Switch to a hash table when the number of variables grows beyond
a threshold.
Speeds up the test case from the linked issue by about 70%.
Fixes: https://github.com/quickjs-ng/quickjs/issues/456
Emit source locations manually for more precise tracking. Don't infer
them from emitted bytecode opcodes because that leads to inaccurate
and sometimes surprising results.
Speeds up code generation (although infinitesimally) as a bonus.
Fixes: https://github.com/quickjs-ng/quickjs/issues/236
Introduced in commit 61c8fe6 from last month that moved the callback
into the job queue:
1. It leaked `fre->held_val` when no job was enqueued
2. It fumbled the reference count when enqueuing; JS_EnqueueJob already
takes care of incrementing and decrementing it
Reverts commit 0a70623 from earlier today because that didn't turn out
to be a complete fix.
Fixes: https://github.com/quickjs-ng/quickjs/issues/648
No test because I can only get it to trigger with qjs, not run-test262,
but the problem is that we need to run FinalizationRegistry finalizers
before asserting no objects remain.
Fixes: https://github.com/quickjs-ng/quickjs/issues/648
This commit implements resizable ArrayBuffers - RABs for short - and
extends typed arrays (TAs) to support fixed-length and length-tracking
modes.
SharedArrayBuffers (SABs) also support the maxByteLength option now but
I cheated and allocate all memory upfront because atomically resizing
memory allocations is hard and this commit is already big and complex.
The lion's share is updating all the TA prototype methods to deal with
RABs resizing underneath them. Method arguments can be arbitrary objects
with arbitrary .valueOf methods and arbitrary side effects, like...
resizing the RAB we're currently operating on.
Fixes: https://github.com/quickjs-ng/quickjs/issues/477
Can be reproduced on the CLI but not from a script:
# should throw "unsupported object class" TypeError
$ qjs --std -e 'bjson.write(function(){})'
/path/to/quickjs.c:6510:15: runtime error: applying zero offset to null pointer
Deserialized bytecode does not have IC state, i.e., `bc->ic == NULL`.
That may or may not be bug (IMO, it is and we should rebuild the
IC state during deserialization) but, either way, don't segfault.
DRY add_ic_slot() and its call sites in a hopefully NFC manner.
Don't raise a "invalid tag 12" exception when encountering bytecode
and JS_READ_OBJ_BYTECODE is not set, because no one knows what "tag 12"
means without looking it up, not even quickjs maintainers.
Don't store the update flag in the IC because that's a) an out-of-band
signalling mechanism, and b) makes JSInlineCache bigger than it needs
to be. One is allocated per function so it adds up.
Another reason for making this change is that it makes visible what
I strongly suspect are bugs in the original implementation.
Otherwise it's too easy to tie up too many resources (cpu, memory) by
crafting inputs with a very large atom count (up to 4 billion.)
This may need some finetuning. If the limit proves too restrictive for
very large snapshots, we can make it relative to the size of the input.
Check inside the deserializer that const atoms are indeed const, don't
trust the input. The serializer only writes type 0 records for const
atoms but the byte stream may have been corrupted or manipulated.
Overlooked during review of c25aad7 ("Add ability to (de)serialize
symbols")
Found with libfuzzer and it found it _really_ fast. Great tool.
Before this commit it segfaulted, now it throws a SyntaxError.
That's still not correct behavior but better than segfaulting.
To be continued.
Includes a small run-test262 fix to handle Windows line endings.
Refs: https://github.com/quickjs-ng/quickjs/issues/567
`JS_NewClassID(rt, &class_id)` where `class_id` is a global variable
is unsafe when called from multiple threads but that is exactly what
quickjs-libc.c did.
Add a new JS_AddRuntimeFinalizer function that lets quickjs-libc
store the class ids in JSRuntimeState and defer freeing the memory
until the runtime is destroyed. Necessary because object finalizers
such as js_std_file_finalizer need to know the class id and run after
js_std_free_handlers runs.
Fixes: https://github.com/quickjs-ng/quickjs/issues/577
