poe-code 14.0.80 → 14.0.82

package/packages/safe-js/dist/snapshot/guest-heap-validation.js

@@ -1,9 +1,11 @@
 import { Budget } from "../interp/budget.js";
+import { sandboxErrorNames } from "../error/shape.js";
 import { createRawJson } from "../interp/raw-json.js";
 import { createBuiltinBindings } from "../interp/globals.js";
 import { getIntrinsicIdentity, listIntrinsicIdentities, resolveIntrinsicIdentity } from "../interp/intrinsics.js";
 import { releaseObjectPrototype } from "../interp/object-model.js";
 import { isSandboxClosure } from "../interp/values.js";
+import { assertSnapshotDataDepth } from "../graph-depth.js";
 let intrinsicKinds;
 function intrinsicCatalogue() {
     if (intrinsicKinds !== undefined)
@@ -59,7 +61,7 @@ export function validateGuestHeapNode(raw, heap, maxArrayLength = 0xffffffff) {
         createRawJson(node.text);
         return true;
     }
-    if (!["intrinsic", "guest-function", "guest-class", "guest-generator", "scope-frame", "guest-object", "guest-array", "array-iterator", "map", "set"].includes(String(node.kind)))
+    if (!["intrinsic", "bound-function", "guest-function", "guest-class", "guest-generator", "scope-frame", "guest-object", "guest-array", "array-iterator", "map", "set"].includes(String(node.kind)))
         return false;
     const reference = (value, kinds) => {
         const ref = record(value);
@@ -74,7 +76,7 @@ export function validateGuestHeapNode(raw, heap, maxArrayLength = 0xffffffff) {
     const callable = (value) => {
         if (absent(value))
             return;
-        const target = reference(value, ["intrinsic", "guest-function", "guest-class"]);
+        const target = reference(value, ["intrinsic", "bound-function", "guest-function", "guest-class"]);
         if (target.kind === "intrinsic" && intrinsicCatalogue().get(String(target.id)) !== true)
             throw new TypeError("Guest accessor reference is not callable.");
     };
@@ -145,7 +147,9 @@ export function validateGuestHeapNode(raw, heap, maxArrayLength = 0xffffffff) {
         state(node.state);
     }
     else if (node.kind === "guest-object" || node.kind === "guest-array") {
-        fields(node, ["kind", "state"], node.kind === "guest-array" ? ["templateNodeId", "templateOwner"] : []);
+        fields(node, ["kind", "state"], node.kind === "guest-array" ? ["templateNodeId", "templateOwner"] : ["errorType"]);
+        if (Object.hasOwn(node, "errorType") && !sandboxErrorNames.includes(node.errorType))
+            throw new TypeError("Invalid guest error type.");
         if (Object.hasOwn(node, "templateOwner"))
             reference(node.templateOwner, ["guest-array"]);
         if (Object.hasOwn(node, "templateNodeId") && integer(node.templateNodeId) < 1)
@@ -199,6 +203,27 @@ export function validateGuestHeapNode(raw, heap, maxArrayLength = 0xffffffff) {
             throw new TypeError("Invalid class prototype descriptor.");
         reference(descriptor.value, ["object", "guest-object"]);
     }
+    else if (node.kind === "bound-function") {
+        fields(node, ["kind", "target", "thisValue", "args", "length", "state"], ["name"]);
+        if (Object.hasOwn(node, "name") && typeof node.name !== "string")
+            throw new TypeError("Invalid bound function name.");
+        if (array(node.args).length > maxArrayLength)
+            throw new TypeError("Bound arguments exceed allocation limit.");
+        if (!absent(node.length) && !(typeof node.length === "number" && node.length >= 0) &&
+            !(record(node.length).kind === "number" && record(node.length).value === "Infinity"))
+            throw new TypeError("Invalid bound function length.");
+        const visited = new Set([raw]);
+        let current = node;
+        while (current.kind === "bound-function") {
+            assertSnapshotDataDepth(visited.size, "<bound-target>");
+            callable(current.target);
+            current = reference(current.target);
+            if (visited.has(current))
+                throw new TypeError("Cyclic bound function target.");
+            visited.add(current);
+        }
+        state(node.state);
+    }
     else if (node.kind === "guest-function") {
         fields(node, ["kind", "astNodeId", "scope", "state"], ["name", "environment"]);
         if (integer(node.astNodeId) < 1)

package/packages/safe-js/dist/snapshot/guest-heap.d.ts

@@ -1,3 +1,4 @@
+import { type SandboxErrorName } from "../error/shape.js";
 import { type ScopeFrame } from "../interp/scope.js";
 import { type PropertyDescriptorData } from "./property-descriptors.js";
 import type { CompletionResult } from "../interp/exceptions.js";
@@ -13,6 +14,14 @@ export type GuestObjectState<T> = {
     prototype?: T;
 };
 export type GuestHeapNode<T> = {
+    kind: "bound-function";
+    target: T;
+    thisValue: T;
+    args: T[];
+    name?: string;
+    length: T;
+    state: GuestObjectState<T>;
+} | {
     kind: "array-iterator";
     source: T;
     index: number;
@@ -65,6 +74,7 @@ export type GuestHeapNode<T> = {
 } | {
     kind: "guest-object";
     state: GuestObjectState<T>;
+    errorType?: SandboxErrorName;
 } | {
     kind: "guest-array";
     state: GuestObjectState<T>;

package/packages/safe-js/dist/snapshot/guest-heap.js

@@ -1,4 +1,6 @@
 import { getClosureOrigin, getGeneratorOrigin } from "../interp/closure-origin.js";
+import { boundFunctionStates } from "../interp/bound-function-state.js";
+import { sandboxErrorTypes } from "../error/shape.js";
 import { getGeneratorProperties } from "../interp/generator-properties.js";
 import { getIntrinsicIdentity } from "../interp/intrinsics.js";
 import { getSandboxPrototype, hasExplicitSandboxPrototype, hasGuestObjectState, isGuestClosure, materializeFunctionProperties } from "../interp/object-model.js";
@@ -27,6 +29,12 @@ export function captureGuestHeapNode(value, encode) {
         const state = captureObjectState(value, encode);
         return { kind: "intrinsic", id: intrinsic, ...(state === undefined ? {} : { state }) };
     }
+    const bound = boundFunctionStates.get(value);
+    if (bound !== undefined && isSandboxClosure(value)) {
+        return { kind: "bound-function", target: encode(bound.target), thisValue: encode(bound.thisValue),
+            args: bound.args.map(encode), length: encode(value.length),
+            ...(value.name === undefined ? {} : { name: value.name }), state: captureObjectState(value, encode) };
+    }
     if (isSandboxMap(value))
         return { kind: "map", entries: [...value.entries].map(([key, entry]) => [encode(key), encode(entry)]), ...serializeCollectionProperties(value, encode) };
     if (isSandboxSet(value))
@@ -144,8 +152,11 @@ export function captureGuestHeapNode(value, encode) {
             isSandboxRegExpIterator(value))
             return undefined;
         const prototype = Object.getPrototypeOf(value);
-        if ((prototype === null || prototype === Object.prototype) && hasGuestObjectState(value))
-            return { kind: "guest-object", state: captureObjectState(value, encode) };
+        if ((prototype === null || prototype === Object.prototype) && hasGuestObjectState(value)) {
+            const errorType = sandboxErrorTypes.get(value);
+            return { kind: "guest-object", state: captureObjectState(value, encode),
+                ...(errorType === undefined ? {} : { errorType }) };
+        }
         return undefined;
     }
     if (origin.node.nodeId === undefined)

package/packages/safe-js/dist/snapshot/restore.js

@@ -1,4 +1,6 @@
 import { Budget, SandboxError } from "../interp/budget.js";
+import { createBoundFunction } from "../interp/bound-function.js";
+import { invokeBuiltinClosure } from "../interp/builtin-call.js";
 import { getGeneratorProperties } from "../interp/generator-properties.js";
 import { restoreRegexProperties } from "./regexp-properties.js";
 import { classOrigins, createClassConstructor } from "../interp/classes.js";
@@ -20,7 +22,7 @@ import { restoreDateTime } from "../interp/date.js";
 import { createRawJson } from "../interp/raw-json.js";
 import { createSandboxBox } from "../interp/boxed.js";
 import { restoreBoxedProperties } from "./boxed.js";
-import { sandboxErrorTypes } from "../error/shape.js";
+import { sandboxErrorNames, sandboxErrorTypes } from "../error/shape.js";
 import { SnapshotMismatchError } from "../restore.js";
 import { evaluateNode, Scope, setSandboxProperty } from "../interp/interpreter.js";
 import { getGuestFunctionProperties, getGuestFunctionProperty, getSandboxDataProperty, isGuestClosure, materializeFunctionProperties, registerGuestClosure, setSandboxPrototype } from "../interp/object-model.js";
@@ -376,6 +378,42 @@ function isSerializedRegexValue(value) {
         typeof value.flags === "string" &&
         typeof value.lastIndex === "number");
 }
+function initializeIntrinsicRealm(state) {
+    if (state.intrinsicsInitialized)
+        return;
+    const prototype = Object.values(state.heap).find(node => node.kind === "intrinsic" && node.id === '["%FunctionPrototype%"]');
+    // Older heaps could omit this property or contain a guest-defined hook.
+    // Do not preinstall a nonconfigurable property over their captured state.
+    const functionHasInstance = prototype?.kind !== "intrinsic" || prototype.state === undefined ||
+        prototype.state.properties.properties.some(([key, descriptor]) => {
+            if (key === null || typeof key !== "object" || !("kind" in key) || key.kind !== "ref")
+                return false;
+            const symbol = state.heap[String(key.id)];
+            if (symbol?.kind !== "symbol" || symbol.wellKnown !== "hasInstance" || descriptor.kind !== "data" ||
+                descriptor.writable || descriptor.enumerable || descriptor.configurable)
+                return false;
+            const value = descriptor.value;
+            if (value === null || typeof value !== "object" || !("kind" in value) || value.kind !== "ref")
+                return false;
+            const method = state.heap[String(value.id)];
+            return method?.kind === "intrinsic" && method.id === '["%FunctionPrototype%",{"symbol":"hasInstance"}]';
+        });
+    const errorConstructors = Object.values(state.heap).filter(node => node.kind === "intrinsic" && sandboxErrorNames.some(name => node.id === JSON.stringify([name])));
+    const errorPrototypes = errorConstructors.every(node => node.kind === "intrinsic" &&
+        node.state?.properties.properties.some(([key, descriptor]) => {
+            if (key !== "prototype" || descriptor.kind !== "data" || descriptor.writable ||
+                descriptor.enumerable || descriptor.configurable)
+                return false;
+            const value = descriptor.value;
+            if (value === null || typeof value !== "object" || !("kind" in value) || value.kind !== "ref")
+                return false;
+            const prototype = state.heap[String(value.id)];
+            return prototype?.kind === "intrinsic" &&
+                prototype.id === JSON.stringify([...JSON.parse(node.id), "prototype"]);
+        }));
+    createBuiltinBindings({ budget: state.budget, compileOwner: state.compilation.owner, functionHasInstance, errorPrototypes });
+    state.intrinsicsInitialized = true;
+}
 function restoreHeapValue(id, state) {
     const existing = state.heapValueById.get(id);
     if (existing !== undefined) {
@@ -531,13 +569,27 @@ function restoreHeapValue(id, state) {
             });
         return generator;
     }
-    if (serialized.kind === "intrinsic" || serialized.kind === "guest-function" || serialized.kind === "guest-class" || serialized.kind === "guest-object" || serialized.kind === "guest-array" || serialized.kind === "array-iterator") {
+    if (serialized.kind === "intrinsic" || serialized.kind === "bound-function" || serialized.kind === "guest-function" || serialized.kind === "guest-class" || serialized.kind === "guest-object" || serialized.kind === "guest-array" || serialized.kind === "array-iterator") {
         let value;
-        if (serialized.kind === "intrinsic") {
-            if (!state.intrinsicsInitialized) {
-                createBuiltinBindings({ budget: state.budget, compileOwner: state.compilation.owner });
-                state.intrinsicsInitialized = true;
-            }
+        if (serialized.kind === "bound-function") {
+            initializeIntrinsicRealm(state);
+            const target = deserializeValue(serialized.target, state);
+            if (!isSandboxClosure(target))
+                throw new TypeError("Invalid bound function target.");
+            const boundState = { target, thisValue: undefined, args: [] };
+            const length = deserializeValue(serialized.length, state);
+            if (length !== undefined && typeof length !== "number")
+                throw new TypeError("Invalid bound function length.");
+            value = createBoundFunction(boundState, serialized.name, length, (callee, args, stack, thisValue, construct, newTarget) => invokeBuiltinClosure(callee, args, state.budget, { stack, thisValue, newTarget }, thisValue, construct));
+            // Allocate every bound identity before decoding arguments and receivers:
+            // either may point back to this function, including through another bind.
+            state.initializeIterators.push(() => {
+                boundState.thisValue = deserializeValue(serialized.thisValue, state);
+                boundState.args = serialized.args.map(entry => deserializeValue(entry, state));
+            });
+        }
+        else if (serialized.kind === "intrinsic") {
+            initializeIntrinsicRealm(state);
             value = resolveIntrinsicIdentity(state.budget, serialized.id);
         }
         else if (serialized.kind === "guest-class") {
@@ -578,12 +630,19 @@ function restoreHeapValue(id, state) {
                 homeObject: serialized.environment.homeObject === undefined ? undefined : deserializeValue(serialized.environment.homeObject, state),
                 newTarget: serialized.environment.newTarget === undefined ? undefined : deserializeValue(serialized.environment.newTarget, state)
             };
+            // Current generator functions need their realm before creation, not only
+            // when a later prototype reference is decoded. Earlier heaps can lack the
+            // native nonconfigurable prototype property and retain that legacy shape.
+            const initializeGeneratorPrototype = node.type !== "ArrowFunctionExpression" && node.generator &&
+                serialized.state.properties.properties.some(([key, descriptor]) => key === "prototype" && descriptor.kind === "data" && !descriptor.configurable);
+            if (initializeGeneratorPrototype)
+                initializeIntrinsicRealm(state);
             value = createInterpretedClosure(node, {
                 scope, budget: state.budget, compilation: state.compilation, rootNode: state.rootNode,
                 signal: state.signal, inferredName: serialized.name, functionEnvironment: environment,
                 callStack: [], activeLoopIterations: new Map(), restoredLoopIterations: new Map(),
                 stats: { currentDataSize: 0, nodeVisits: 0, peakDataSize: 0 }
-            }, evaluateNode, environment?.homeObject);
+            }, evaluateNode, environment?.homeObject, initializeGeneratorPrototype);
         }
         else
             value = serialized.kind === "guest-array" ? [] : Object.create(null);
@@ -607,6 +666,8 @@ function restoreHeapValue(id, state) {
                     throw new TypeError(`Missing restored function properties for ${serialized.kind === "intrinsic" ? serialized.id : serialized.kind}.`);
                 if (objectState.prototype !== undefined)
                     setSandboxPrototype(value, deserializeValue(objectState.prototype, state), state.budget);
+                if (serialized.kind === "guest-object" && serialized.errorType !== undefined)
+                    sandboxErrorTypes.set(value, serialized.errorType);
                 restorePropertyDescriptors(target, objectState.properties, entry => deserializeValue(entry, state));
                 if (serialized.kind === "guest-array" && serialized.templateNodeId !== undefined) {
                     const node = state.nodeById.get(serialized.templateNodeId);

package/packages/safe-js/dist/snapshot/validation.js

@@ -706,7 +706,7 @@ function validateArrayHeap(record, path, state) {
 function validateErrorType(record, path) {
     if (!Object.hasOwn(record, "errorType"))
         return;
-    if (record.kind !== "object" ||
+    if ((record.kind !== "object" && record.kind !== "guest-object") ||
         !sandboxErrorNames.includes(record.errorType)) {
         fail("invalidValue", `${path}.errorType`, "invalid error metadata");
     }