poe-code 14.0.81 → 14.0.83

package/packages/safe-js/dist/interp/globals/float32array.js

@@ -1,8 +1,19 @@
 import { checkFloat32Allocation, float32Number, float32Storage, isFloat32Array, isFloat32Index } from "../float32.js";
-import { createSandboxClosure } from "../values.js";
+import { createSandboxClosure, isSandboxClosure, measureSandboxData } from "../values.js";
+import { accessorAdapter, readPropertyDescriptor } from "../accessors.js";
+import { float32Prototypes } from "../float32-prototypes.js";
+import { getSandboxDataProperty, getSandboxPropertyDescriptor, getSandboxPrototype, materializeFunctionProperties, registerIntrinsicFunction, registerIntrinsicObject, setSandboxPrototype } from "../object-model.js";
+import { registerBuiltinIdentities, resolveIntrinsicIdentity } from "../intrinsics.js";
+import { invokeBuiltinClosure } from "../builtin-call.js";
+import { retainValues } from "../resources.js";
+import { sandboxNumber, sandboxString } from "../string-coercion.js";
+import { acquireSandboxIterator, readIteratorResult } from "../iteration.js";
+import { createDataCheckpoint } from "../data-checkpoint.js";
+import { createSandboxBox } from "../boxed.js";
 const constructors = new WeakSet();
-export function createFloat32ArrayGlobal(budget) {
+export function createFloat32ArrayGlobal(budget, nativePrototype = false) {
     const constructor = createSandboxClosure({
+        guest: nativePrototype,
         sandbox: true,
         name: "Float32Array",
         length: 3,
@@ -10,33 +21,294 @@ export function createFloat32ArrayGlobal(budget) {
         call: () => {
             throw new TypeError("Constructor Float32Array requires 'new'.");
         },
-        construct: ([source]) => {
-            if (Array.isArray(source) || isFloat32Array(source)) {
-                const length = isFloat32Array(source) ? float32Storage(source).length : source.length;
-                checkFloat32Allocation(length, budget);
-                if (isFloat32Array(source))
-                    return new Float32Array(source);
-                const result = new Float32Array(length);
-                for (let index = 0; index < length; index += 1) {
-                    budget.visitNode();
-                    const descriptor = Object.getOwnPropertyDescriptor(source, index);
-                    if (descriptor !== undefined && !("value" in descriptor))
-                        throw new TypeError("Float32Array input accessors are not supported.");
-                    result[index] = float32Number(descriptor?.value);
+        construct: (args, context) => {
+            if (!nativePrototype)
+                return allocateFloat32Array(args[0], budget);
+            return (async () => {
+                const newTarget = context?.newTarget ?? constructor;
+                const candidate = context?.getProperty === undefined
+                    ? getSandboxDataProperty(newTarget, "prototype", budget)
+                    : await context.getProperty(newTarget, "prototype");
+                const prototype = candidate !== null && typeof candidate === "object" ? candidate : float32Prototypes.get(budget);
+                const release = retainValues(budget, () => [prototype, ...args]);
+                try {
+                    const result = args[0] !== null && typeof args[0] === "object" && !isFloat32Array(args[0])
+                        ? await allocateFloat32Input(args[0], budget, context)
+                        : allocateFloat32Array(args[0], budget);
+                    setSandboxPrototype(result, prototype, budget);
+                    return result;
                 }
-                return result;
-            }
-            const number = float32Number(source);
-            const length = Number.isNaN(number) ? 0 : Math.trunc(number);
-            if (length < 0 || !Number.isSafeInteger(length))
-                throw new RangeError("Invalid typed array length.");
-            checkFloat32Allocation(length, budget);
-            return new Float32Array(length);
+                finally {
+                    release();
+                }
+            })();
         }
     });
     constructors.add(constructor);
     return constructor;
 }
+async function allocateFloat32Input(source, budget, context) {
+    const callerContext = context;
+    const bridge = {
+        ...callerContext, stack: callerContext?.stack ?? [], thisValue: undefined,
+        getProperty: callerContext?.getProperty ?? ((value, key) => {
+            const descriptor = getSandboxPropertyDescriptor(value, key, budget);
+            return descriptor === undefined ? getSandboxDataProperty(value, key, budget)
+                : readPropertyDescriptor(descriptor, value, bridge);
+        }),
+        invokeClosure: callerContext?.invokeClosure ?? ((callee, values, receiver, construct) => invokeBuiltinClosure(callee, values, budget, callerContext, receiver, construct))
+    };
+    const values = [];
+    let iterator;
+    let current;
+    let result;
+    const release = retainValues(budget, () => [source, values, iterator?.retainedValue, current, result]);
+    const checkData = createDataCheckpoint(budget, bridge);
+    try {
+        iterator = await acquireSandboxIterator(source, budget, bridge);
+        let length;
+        if (iterator !== undefined) {
+            while (true) {
+                budget.visitNode();
+                const next = await iterator.next();
+                if (typeof next !== "object" || next === null)
+                    throw new TypeError("Iterator result must be an object.");
+                if ((await readIteratorResult(iterator, next, "done")).value)
+                    break;
+                current = (await readIteratorResult(iterator, next, "value")).value;
+                budget.allocateArrayLength(values.length + 1);
+                values.push(current);
+                checkData(values, 1 + (budget.limits.dataSize === undefined ? 0 : measureSandboxData([current])));
+            }
+            length = values.length;
+        }
+        else {
+            current = await bridge.getProperty(source, "length");
+            const number = await sandboxNumber(current, budget, bridge);
+            length = Number.isNaN(number) || number <= 0 ? 0 : Math.min(Math.trunc(number), Number.MAX_SAFE_INTEGER);
+        }
+        checkFloat32Allocation(length, budget);
+        result = new Float32Array(length);
+        checkData(result, 0, true);
+        for (let index = 0; index < length; index++) {
+            budget.visitNode();
+            current = iterator === undefined ? await bridge.getProperty(source, String(index)) : values[index];
+            result[index] = await sandboxNumber(current, budget, bridge);
+        }
+        return result;
+    }
+    finally {
+        release();
+    }
+}
+function allocateFloat32Array(source, budget) {
+    if (Array.isArray(source) || isFloat32Array(source)) {
+        const length = isFloat32Array(source) ? float32Storage(source).length : source.length;
+        checkFloat32Allocation(length, budget);
+        if (isFloat32Array(source))
+            return new Float32Array(source);
+        const result = new Float32Array(length);
+        for (let index = 0; index < length; index += 1) {
+            budget.visitNode();
+            const descriptor = Object.getOwnPropertyDescriptor(source, index);
+            if (descriptor !== undefined && !("value" in descriptor))
+                throw new TypeError("Float32Array input accessors are not supported.");
+            result[index] = float32Number(descriptor?.value);
+        }
+        return result;
+    }
+    const number = float32Number(source);
+    const length = Number.isNaN(number) ? 0 : Math.trunc(number);
+    if (length < 0 || !Number.isSafeInteger(length))
+        throw new RangeError("Invalid typed array length.");
+    checkFloat32Allocation(length, budget);
+    return new Float32Array(length);
+}
+export function createFloat32ArrayPrototypes(budget, constructor) {
+    const prototype = Object.create(null);
+    const shared = Object.create(null);
+    const abstractCall = () => { throw new TypeError("Abstract TypedArray constructor cannot be called."); };
+    const typedArray = createSandboxClosure({ guest: true, sandbox: true, name: "TypedArray", length: 0,
+        call: abstractCall, construct: abstractCall });
+    Object.defineProperty(materializeFunctionProperties(typedArray), "prototype", { value: shared, writable: false });
+    Object.defineProperty(materializeFunctionProperties(typedArray), "from", {
+        writable: true, configurable: true,
+        value: createSandboxClosure({ guest: true, sandbox: true, name: "from", length: 1,
+            call: async (args, context) => {
+                const target = context?.thisValue;
+                const [source, mapper, receiver] = args;
+                if (!isSandboxClosure(target) || target.construct === undefined)
+                    throw new TypeError("TypedArray.from requires a constructor receiver.");
+                if (mapper !== undefined && !isSandboxClosure(mapper))
+                    throw new TypeError("TypedArray.from mapper must be callable.");
+                if (source === null || source === undefined)
+                    throw new TypeError("TypedArray.from requires a non-null source.");
+                const callerContext = context;
+                context = {
+                    ...callerContext,
+                    stack: callerContext?.stack ?? [],
+                    thisValue: target,
+                    getProperty: callerContext?.getProperty ?? ((value, key) => {
+                        const descriptor = getSandboxPropertyDescriptor(value, key, budget);
+                        return descriptor === undefined ? getSandboxDataProperty(value, key, budget)
+                            : readPropertyDescriptor(descriptor, value, context);
+                    }),
+                    invokeClosure: callerContext?.invokeClosure ?? ((callee, values, thisValue, construct) => invokeBuiltinClosure(callee, values, budget, callerContext, thisValue, construct))
+                };
+                let result;
+                let current;
+                let iterator;
+                const values = [];
+                const release = retainValues(budget, () => [target, result, current, iterator?.retainedValue, values, ...args]);
+                const checkData = createDataCheckpoint(budget, context);
+                const read = (key) => context?.getProperty === undefined
+                    ? getSandboxDataProperty(source, key, budget) : context.getProperty(source, key);
+                try {
+                    iterator = await acquireSandboxIterator(source, budget, context);
+                    let length;
+                    if (iterator !== undefined) {
+                        while (true) {
+                            budget.visitNode();
+                            const next = await iterator.next();
+                            if (typeof next !== "object" || next === null)
+                                throw new TypeError("Iterator result must be an object.");
+                            if ((await readIteratorResult(iterator, next, "done")).value)
+                                break;
+                            current = (await readIteratorResult(iterator, next, "value")).value;
+                            budget.allocateArrayLength(values.length + 1);
+                            values.push(current);
+                            checkData(values, 1 + (budget.limits.dataSize === undefined ? 0 : measureSandboxData([current])));
+                        }
+                        length = values.length;
+                    }
+                    else {
+                        const number = await sandboxNumber(await read("length"), budget, context);
+                        length = Number.isNaN(number) || number <= 0 ? 0 : Math.min(Math.trunc(number), Number.MAX_SAFE_INTEGER);
+                    }
+                    result = await invokeBuiltinClosure(target, [length], budget, context, undefined, true);
+                    if (!isFloat32Array(result) || float32Storage(result).length < length)
+                        throw new TypeError("TypedArray.from constructor must return sufficient typed storage.");
+                    checkData(result, 0, true);
+                    for (let index = 0; index < length; index++) {
+                        budget.visitNode();
+                        current = iterator === undefined ? await read(String(index)) : values[index];
+                        if (mapper !== undefined)
+                            current = await invokeBuiltinClosure(mapper, [current, index], budget, context, receiver);
+                        result[index] = await sandboxNumber(current, budget, context);
+                    }
+                    return result;
+                }
+                finally {
+                    release();
+                }
+            }
+        })
+    });
+    Object.defineProperty(materializeFunctionProperties(typedArray), "of", {
+        writable: true, configurable: true,
+        value: createSandboxClosure({ guest: true, sandbox: true, name: "of", length: 0,
+            call: async (args, context) => {
+                const target = context?.thisValue;
+                if (!isSandboxClosure(target) || target.construct === undefined)
+                    throw new TypeError("TypedArray.of requires a constructor receiver.");
+                let result;
+                const release = retainValues(budget, () => [target, result, ...args]);
+                try {
+                    result = await invokeBuiltinClosure(target, [args.length], budget, context, undefined, true);
+                    if (!isFloat32Array(result) || float32Storage(result).length < args.length)
+                        throw new TypeError("TypedArray.of constructor must return sufficient typed storage.");
+                    for (let index = 0; index < args.length; index++) {
+                        budget.visitNode();
+                        result[index] = await sandboxNumber(args[index], budget, context);
+                    }
+                    return result;
+                }
+                finally {
+                    release();
+                }
+            }
+        })
+    });
+    Object.defineProperties(materializeFunctionProperties(constructor), {
+        prototype: { value: prototype, writable: false },
+        BYTES_PER_ELEMENT: { value: 4, writable: false, enumerable: false, configurable: false }
+    });
+    Object.defineProperties(prototype, {
+        constructor: { value: constructor, writable: true, configurable: true },
+        BYTES_PER_ELEMENT: { value: 4 }
+    });
+    Object.defineProperty(shared, "constructor", { value: typedArray, writable: true, configurable: true });
+    setSandboxPrototype(constructor, typedArray);
+    setSandboxPrototype(prototype, shared);
+    setSandboxPrototype(shared, getSandboxPrototype(Object.create(null), budget));
+    const getters = [];
+    for (const key of ["length", "byteLength", "byteOffset"]) {
+        const getter = createSandboxClosure({ guest: true, sandbox: true, name: `get ${key}`, length: 0,
+            call: (_args, context) => {
+                if (!isFloat32Array(context?.thisValue))
+                    throw new TypeError(`TypedArray ${key} requires a typed array receiver.`);
+                const storage = float32Storage(context.thisValue);
+                return key === "byteLength" ? storage.length * 4 : storage[key];
+            }
+        });
+        getters.push(getter);
+        Object.defineProperty(shared, key, { get: accessorAdapter(getter, "get"), configurable: true });
+    }
+    for (const key of ["set", "slice", "subarray"])
+        Object.defineProperty(shared, key, { value: getFloat32Member(new Float32Array(0), key, budget), writable: true, configurable: true });
+    const arrayPrototype = resolveIntrinsicIdentity(budget, '["Array","prototype"]');
+    Object.defineProperty(shared, "toString", { value: getSandboxDataProperty(arrayPrototype, "toString", budget), writable: true, configurable: true });
+    Object.defineProperty(shared, "join", { writable: true, configurable: true,
+        value: createSandboxClosure({ guest: true, sandbox: true, name: "join", length: 1,
+            call: async (args, context) => {
+                if (!isFloat32Array(context?.thisValue))
+                    throw new TypeError("TypedArray join requires a typed array receiver.");
+                const receiver = context.thisValue;
+                const length = float32Storage(receiver).length;
+                let separator = ",";
+                let text = "";
+                const release = retainValues(budget, () => [receiver, separator, text, ...args]);
+                try {
+                    if (args[0] !== undefined)
+                        separator = await sandboxString(args[0], budget, context);
+                    for (let index = 0; index < length; index++) {
+                        budget.visitNode();
+                        text = budget.allocateString(text + (index === 0 ? "" : separator) + String(receiver[index]));
+                    }
+                    return text;
+                }
+                finally {
+                    release();
+                }
+            }
+        })
+    });
+    const tagGetter = createSandboxClosure({ guest: true, sandbox: true, name: "get [Symbol.toStringTag]", length: 0,
+        call: (_args, context) => isFloat32Array(context?.thisValue) ? "Float32Array" : undefined });
+    getters.push(tagGetter);
+    Object.defineProperty(shared, Symbol.toStringTag, { get: accessorAdapter(tagGetter, "get"), configurable: true });
+    for (const key of ["values", "keys", "entries"]) {
+        const method = getSandboxDataProperty(arrayPrototype, key, budget);
+        const closure = createSandboxClosure({ guest: true, sandbox: true, name: key, length: 0,
+            call: (args, context) => {
+                if (!isFloat32Array(context?.thisValue))
+                    throw new TypeError(`TypedArray ${key} requires a typed array receiver.`);
+                return invokeBuiltinClosure(method, args, budget, context, context.thisValue);
+            }
+        });
+        Object.defineProperty(shared, key, { value: closure, writable: true, configurable: true });
+        if (key === "values")
+            Object.defineProperty(shared, Symbol.iterator, { value: closure, writable: true, configurable: true });
+    }
+    float32Prototypes.set(budget, prototype);
+    registerBuiltinIdentities(budget, { Float32Array: constructor, "%TypedArray%": typedArray });
+    registerIntrinsicFunction(budget, constructor);
+    registerIntrinsicFunction(budget, typedArray);
+    registerIntrinsicObject(budget, prototype);
+    registerIntrinsicObject(budget, shared);
+    for (const getter of getters)
+        registerIntrinsicFunction(budget, getter);
+}
 export function isFloat32ArrayConstructor(value) {
     return typeof value === "object" && value !== null && constructors.has(value);
 }
@@ -48,6 +320,8 @@ export function getFloat32Member(value, property, budget) {
             throw new TypeError("Float32Array accessors are not supported.");
         return descriptor.value;
     }
+    if (float32Prototypes.has(budget))
+        return undefined;
     const storage = float32Storage(value);
     if (key === "length")
         return storage.length;
@@ -60,6 +334,7 @@ export function getFloat32Member(value, property, budget) {
     if (!["set", "slice", "subarray"].includes(key))
         return undefined;
     return createSandboxClosure({
+        guest: true,
         sandbox: true,
         name: key,
         length: key === "set" ? 1 : 2,
@@ -68,63 +343,94 @@ export function getFloat32Member(value, property, budget) {
             if (!isFloat32Array(receiver))
                 throw new TypeError(`Float32Array#${key} requires a Float32Array receiver.`);
             const storage = float32Storage(receiver);
+            const bridge = {
+                ...context, stack: context?.stack ?? [], thisValue: receiver,
+                getProperty: context?.getProperty ?? ((value, property) => {
+                    const descriptor = getSandboxPropertyDescriptor(value, property, budget);
+                    return descriptor === undefined ? getSandboxDataProperty(value, property, budget)
+                        : readPropertyDescriptor(descriptor, value, bridge);
+                }),
+                invokeClosure: context?.invokeClosure ?? ((callee, values, thisValue, construct) => invokeBuiltinClosure(callee, values, budget, context, thisValue, construct))
+            };
             if (key === "set") {
-                const [source, offsetValue = 0] = args;
-                if (!Array.isArray(source) && !isFloat32Array(source))
-                    throw new TypeError("Float32Array#set requires an array or Float32Array.");
-                const number = float32Number(offsetValue);
-                const offset = Number.isNaN(number) ? 0 : Math.trunc(number);
-                const length = isFloat32Array(source) ? float32Storage(source).length : source.length;
-                if (offset < 0 || !Number.isSafeInteger(offset) || offset + length > storage.length)
-                    throw new RangeError("Float32Array#set source is out of bounds.");
-                if (isFloat32Array(source)) {
-                    Float32Array.prototype.set.call(receiver, source, offset);
-                    return undefined;
+                return (async () => {
+                    const [source, offsetValue = 0] = args;
+                    let current;
+                    let sourceObject;
+                    const release = retainValues(budget, () => [receiver, sourceObject, current, ...args]);
+                    try {
+                        const number = await sandboxNumber(offsetValue, budget, bridge);
+                        const offset = Number.isNaN(number) ? 0 : Math.trunc(number);
+                        if (offset < 0)
+                            throw new RangeError("Float32Array#set offset is out of bounds.");
+                        if (source === null || source === undefined)
+                            throw new TypeError("Float32Array#set requires a non-null source.");
+                        let length;
+                        if (isFloat32Array(source))
+                            length = float32Storage(source).length;
+                        else {
+                            sourceObject = typeof source === "object" ? source : createSandboxBox(source);
+                            current = await bridge.getProperty(sourceObject, "length");
+                            const size = await sandboxNumber(current, budget, bridge);
+                            length = Number.isNaN(size) || size <= 0 ? 0 : Math.min(Math.trunc(size), Number.MAX_SAFE_INTEGER);
+                        }
+                        if (offset + length > storage.length)
+                            throw new RangeError("Float32Array#set source is out of bounds.");
+                        if (isFloat32Array(source))
+                            Float32Array.prototype.set.call(receiver, source, offset);
+                        else
+                            for (let index = 0; index < length; index++) {
+                                budget.visitNode();
+                                current = await bridge.getProperty(sourceObject, String(index));
+                                receiver[offset + index] = await sandboxNumber(current, budget, bridge);
+                            }
+                        return undefined;
+                    }
+                    finally {
+                        release();
+                    }
+                })();
+            }
+            return (async () => {
+                const release = retainValues(budget, () => [receiver, ...args]);
+                try {
+                    const start = relativeIndex(await sandboxNumber(args[0], budget, bridge), storage.length);
+                    const end = args[1] === undefined ? storage.length
+                        : relativeIndex(await sandboxNumber(args[1], budget, bridge), storage.length);
+                    const length = Math.max(end - start, 0);
+                    if (key === "subarray")
+                        return new Float32Array(storage.buffer, storage.byteOffset + start * 4, length);
+                    checkFloat32Allocation(length, budget);
+                    const result = new Float32Array(length);
+                    new Uint8Array(result.buffer).set(new Uint8Array(storage.buffer, storage.byteOffset + start * 4, length * 4));
+                    return result;
                 }
-                checkFloat32Allocation(length, budget);
-                const copied = new Float32Array(length);
-                for (let index = 0; index < length; index += 1) {
-                    budget.visitNode();
-                    const entry = Object.getOwnPropertyDescriptor(source, index);
-                    if (entry !== undefined && !("value" in entry))
-                        throw new TypeError("Float32Array input accessors are not supported.");
-                    copied[index] = float32Number(entry?.value);
+                finally {
+                    release();
                 }
-                Float32Array.prototype.set.call(receiver, copied, offset);
-                return undefined;
-            }
-            const start = relativeIndex(args[0], storage.length, 0);
-            const end = relativeIndex(args[1], storage.length, storage.length);
-            const length = Math.max(end - start, 0);
-            if (key === "subarray")
-                return new Float32Array(storage.buffer, storage.byteOffset + start * 4, length);
-            checkFloat32Allocation(length, budget);
-            const result = new Float32Array(length);
-            new Uint8Array(result.buffer).set(new Uint8Array(storage.buffer, storage.byteOffset + start * 4, length * 4));
-            return result;
+            })();
         }
     });
 }
-export function setFloat32Member(value, property, entry) {
-    const key = String(property);
-    if (isFloat32Index(key)) {
+export function setFloat32Member(value, property, entry, budget) {
+    const key = typeof property === "symbol" ? property : String(property);
+    if (typeof key !== "symbol" && isFloat32Index(key)) {
         Reflect.set(value, key, float32Number(entry));
         return;
     }
     const descriptor = Object.getOwnPropertyDescriptor(value, key);
-    if (descriptor === undefined &&
+    const inherited = descriptor ?? (budget === undefined ? undefined : getSandboxPropertyDescriptor(value, key, budget));
+    if (descriptor === undefined && typeof key === "string" &&
+        (budget === undefined || !float32Prototypes.has(budget)) &&
         ["length", "byteLength", "byteOffset", "buffer", "BYTES_PER_ELEMENT"].includes(key))
-        throw new TypeError(`Cannot assign to read only property '${key}'.`);
-    if (descriptor !== undefined && (!("value" in descriptor) || !descriptor.writable))
-        throw new TypeError(`Cannot assign to read only property '${key}'.`);
+        throw new TypeError(`Cannot assign to read only property '${String(key)}'.`);
+    if (inherited !== undefined && (!("value" in inherited) || !inherited.writable))
+        throw new TypeError(`Cannot assign to read only property '${String(key)}'.`);
     Object.defineProperty(value, key, descriptor === undefined
         ? { value: entry, configurable: true, enumerable: true, writable: true }
         : { value: entry });
 }
-function relativeIndex(value, length, fallback) {
-    if (value === undefined)
-        return fallback;
-    const numeric = float32Number(value);
+function relativeIndex(numeric, length) {
     const integer = Number.isNaN(numeric) ? 0 : Math.trunc(numeric);
     return integer < 0 ? Math.max(length + integer, 0) : Math.min(integer, length);
 }

package/packages/safe-js/dist/interp/globals/object-array.js

@@ -12,7 +12,7 @@ import { isSandboxDate } from "../date.js";
 import { createSandboxBox } from "../boxed.js";
 import { createObjectGlobal, hasOwnSandboxProperty } from "./object.js";
 import { isGuestHostObject } from "../host-capabilities.js";
-import { isFloat32Array } from "../float32.js";
+import { float32Number, isFloat32Array, isFloat32Index } from "../float32.js";
 import { deleteSandboxProperty, setSandboxProperty } from "../interpreter.js";
 import { acquireSandboxIterator, closeIterator, getSandboxIterator, readIteratorResult } from "../iteration.js";
 import { sandboxNumber, sandboxString } from "../string-coercion.js";
@@ -681,8 +681,8 @@ async function definePropertiesFromObject(target, descriptors, budget, context)
 }
 export function defineDataProperty(target, key, descriptor, budget) {
     budget.visitNode();
-    if (isFloat32Array(target))
-        throw new TypeError("Typed array property descriptors are not supported.");
+    if (isFloat32Array(target) && typeof key !== "symbol" && isFloat32Index(String(key)) && "value" in descriptor)
+        descriptor = { ...descriptor, value: float32Number(descriptor.value) };
     const properties = objectProperties(target, true);
     if (Array.isArray(properties)) {
         if (key === "length" && "value" in descriptor)

package/packages/safe-js/dist/interp/globals.d.ts

@@ -4,6 +4,8 @@ export declare function createBuiltinBindings(options: Parameters<typeof createC
     random?: () => number;
     clock?: RunClock;
     functionHasInstance?: boolean;
+    errorPrototypes?: boolean;
+    float32Prototypes?: boolean;
 }): {
     RegExp: import("./values.js").SandboxClosure;
     Promise: import("./values.js").SandboxClosure;

package/packages/safe-js/dist/interp/globals.js

@@ -1,7 +1,7 @@
 import { createConsoleJsonGlobals } from "./globals/console-json.js";
 import { createCollectionGlobals } from "./globals/collections.js";
-import { createFloat32ArrayGlobal } from "./globals/float32array.js";
-import { createErrorGlobals } from "./globals/error.js";
+import { createFloat32ArrayGlobal, createFloat32ArrayPrototypes } from "./globals/float32array.js";
+import { createErrorGlobals, createErrorPrototypes } from "./globals/error.js";
 import { createMathGlobals } from "./globals/math.js";
 import { createRegexGlobals } from "./globals/regex.js";
 import { createMiscGlobals } from "./globals/misc.js";
@@ -18,11 +18,11 @@ export function createBuiltinBindings(options) {
     const bindings = {
         ...createConsoleJsonGlobals(options),
         ...createCollectionGlobals(options),
-        Float32Array: createFloat32ArrayGlobal(options.budget),
+        Float32Array: createFloat32ArrayGlobal(options.budget, options.float32Prototypes !== false),
         Date: createDateGlobal(options),
         Symbol: createSymbolGlobal(options.budget),
         BigInt: createBigIntGlobal(options.budget),
-        ...createErrorGlobals(options),
+        ...createErrorGlobals({ ...options, errorPrototypes: options.errorPrototypes !== false }),
         ...createMathGlobals({ random: options.random, budget: options.budget }),
         ...createObjectArrayGlobals(options),
         ...createMiscGlobals(options),
@@ -31,6 +31,10 @@ export function createBuiltinBindings(options) {
         ...createRegexGlobals(options)
     };
     createFunctionPrototype(options.budget, options.functionHasInstance);
+    if (options.float32Prototypes !== false)
+        createFloat32ArrayPrototypes(options.budget, bindings.Float32Array);
+    if (options.errorPrototypes !== false)
+        createErrorPrototypes(options.budget, bindings);
     createGeneratorPrototypes(options.budget);
     registerBuiltinIdentities(options.budget, bindings);
     return bindings;

package/packages/safe-js/dist/interp/host-bridge.js

@@ -408,10 +408,12 @@ function createHostErrorValue(reason, stackFrames, budget, span, state = { seen:
     const error = reason instanceof Error
         ? createSubsetErrorValue(reason.name, reason.message, stackFrames, budget, {
             cause: reason,
-            chargeBudget
+            chargeBudget,
+            transport: true
         })
         : createSubsetErrorValue("Error", describeThrownReason(reason), stackFrames, budget, {
-            chargeBudget: false
+            chargeBudget: false,
+            transport: true
         });
     if (reason instanceof Error) {
         state.seen.set(reason, error);

package/packages/safe-js/dist/interp/instanceof.js

@@ -4,7 +4,7 @@ import { invokeBuiltinClosure } from "./builtin-call.js";
 import { isFloat32Array } from "./float32.js";
 import { isFloat32ArrayConstructor } from "./globals/float32array.js";
 import { isSandboxErrorConstructorInstance } from "./globals/error.js";
-import { getSandboxPropertyDescriptor, getSandboxPrototype, isGuestClosure } from "./object-model.js";
+import { getSandboxPropertyDescriptor, getSandboxPrototype, hasExplicitSandboxPrototype, isGuestClosure } from "./object-model.js";
 import { isSandboxClosure } from "./values.js";
 export async function evaluateInstanceof(value, constructor, budget, context) {
     if (constructor === null || typeof constructor !== "object")
@@ -27,9 +27,10 @@ export async function ordinaryHasInstance(value, constructor, budget, context) {
         return evaluateInstanceof(value, constructor.boundTarget, budget, context);
     }
     // These existing built-ins do not yet have ordinary prototype graphs.
-    if (isFloat32ArrayConstructor(constructor))
+    if (isFloat32ArrayConstructor(constructor) && !isGuestClosure(constructor))
         return isFloat32Array(value);
-    if (isSandboxErrorConstructorInstance(value, constructor))
+    if ((!isGuestClosure(constructor) || (value !== null && typeof value === "object" && !hasExplicitSandboxPrototype(value))) &&
+        isSandboxErrorConstructorInstance(value, constructor))
         return true;
     if (!isGuestClosure(constructor) || typeof value !== "object" || value === null)
         return false;

package/packages/safe-js/dist/interp/interpreter.js

@@ -2380,7 +2380,7 @@ async function evaluateMemberCallExpression(node, context) {
             return evaluateResolvedCallExpression(node, await getPropertyValue(member.object, member.property, context), context, member.object);
         }
         if (isFloat32Array(member.object)) {
-            return evaluateResolvedCallExpression(node, getFloat32Member(member.object, member.property, context.budget), context, member.object);
+            return evaluateResolvedCallExpression(node, await getPropertyValue(member.object, member.property, context), context, member.object);
         }
         if (isSandboxSet(member.object)) {
             return evaluatePrimitiveMemberCall(node, "Set", member.property, getSetMember(member.object, member.property, createSetMethodOptions(context)), context);
@@ -2911,9 +2911,7 @@ export function setSandboxProperty(target, property, value, budget, checkInherit
     if (isSandboxMap(target) || isSandboxSet(target))
         target = getCollectionProperties(target);
     if (isFloat32Array(target)) {
-        if (typeof property === "symbol")
-            throw new TypeError("Typed array symbol properties are not yet supported.");
-        setFloat32Member(target, property, value);
+        setFloat32Member(target, property, value, budget);
         return;
     }
     if (isSandboxRegex(target)) {