| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
Add interrupt checks to Array prototype methods Fixes: https://github.com/quickjs-ng/quickjs/issues/1672 | 1 个月前 | |
Fix unhandled promise rejection tracker, again Delay checking for unhandled rejections so we can make sure to check after other promise jobs have ran. | 1 年前 | |
Allow 'undefined' in let or const declaration (#639) Except at the global scope of a classic script because... who knows, that's just how it is. Fixes: https://github.com/quickjs-ng/quickjs/issues/633 | 1 年前 | |
Don't throw oob exception when setting numeric indexes on TAs Relevant spec section: https://tc39.es/ecma262/multipage/ordinary-and-exotic-objects-behaviours.html#sec-typedarraysetelement It should only throw if Object.defineProperty is used and the TA is detached or OOB if a RAB is used. Fixes: https://github.com/quickjs-ng/quickjs/issues/645 | 1 年前 | |
Prefix stdlib modules with "qjs:" Fixes: https://github.com/quickjs-ng/quickjs/issues/616 | 1 年前 | |
Make Array.fromAsync elements enumerable Array.fromAsync built its result with Object.defineProperty and no `enumerable` flag, so the elements defaulted to non-enumerable. The spec adds them with CreateDataPropertyOrThrow, which creates enumerable own data properties. As a result Object.keys(), spreads and for-in saw an empty array. Add `enumerable: true` to the property definitions and regenerate the precompiled builtin. | 2 个月前 | |
Always call the sort comparator, even for identical values (#1645) * Always call the sort comparator, even for identical values js_array_cmp_generic() skips the comparator when the two JSValues are bitwise identical, on the assumption that a comparator returns 0 for identical objects. SortCompare makes no such allowance: if comparefn is not undefined it is called for every compared pair, and its return value is the only thing that decides the order. The assumption also breaks code that uses the comparator for its side effects. jQuery's uniqueSort() sorts a node list with a comparator that sets a `hasDuplicate` flag whenever it is handed the same node twice, then strips the duplicates afterwards. With the shortcut in place the flag is never set and duplicates survive: const o = {}; let dups = false; [o, o].sort((a, b) => { if (a === b) dups = true; return 0; }); dups // false, V8/JSC/SpiderMonkey: true V8, JavaScriptCore and SpiderMonkey all call the comparator here. Drop the shortcut; the `cmp_same` label goes with it, since the stable-sort tie-break it guarded is the normal fallthrough. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014mv33YvfHz7t9mmkituBnn * Add a test for always calling the sort comparator Covers the behaviour restored by "Always call the sort comparator, even for identical values": SortCompare has no allowance for skipping comparefn when the two values happen to be the same value, and code that uses the comparator for its side effects depends on the call happening. Every block fails without the fix: the jQuery uniqueSort() flag pattern, identical primitives, toSorted(), an exception thrown from the comparator for an identical pair, and an all-identical array large enough to leave the insertion sort cutoff. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KZ4EJPvK2gevMjpx1xdY21 * Extend the sort comparator test past objects The removed shortcut compared the two JSValues bit for bit, so it fired for every type whose value is the payload itself or a shared pointer: identical strings, NaN, bigints, symbols, booleans and null all skipped the comparator as well. Pin each of them, and the array-like path through Array.prototype.sort.call(). Also pin the two things that must not change: undefined values and holes still sort to the end without reaching the comparator, which is SortCompare's own rule, and the separate typed array comparison function keeps calling it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01K6eRbuuuCujKgQkrHgvMrc * Cover the re-entrancy the extra comparator calls open up Every pair now reaches user code, including the pairs the shortcut used to answer without a call, so there are strictly more points at which the comparator can reach back into the array. Added a comparator that shrinks, grows, deletes from, reverses and re-sorts the array under the sort's feet, the coercion of the comparator's return value and of a comparator that is not callable, and a two thousand element run checked for order and stability, once with distinct elements and once where every element is the same object. --------- Co-authored-by: Claude <noreply@anthropic.com> | 1 个月前 | |
DRY assertion functions in tests | 1 年前 | |
Fix reference leak in Atomics.store() on an invalidated buffer | 1 个月前 | |
Fix heap buffer overflow via side-effects in js_typed_array_constructor Fixes: https://github.com/quickjs-ng/quickjs/issues/1296 | 8 个月前 | |
Fix OOB access in TA sort Fixes: https://github.com/quickjs-ng/quickjs/issues/1297 | 8 个月前 | |
Fix OOB access in atomic ops Fixes: https://github.com/quickjs-ng/quickjs/issues/1301 Fixes: https://github.com/quickjs-ng/quickjs/issues/1302 | 8 个月前 | |
Fix OOB access in atomic ops Fixes: https://github.com/quickjs-ng/quickjs/issues/1301 Fixes: https://github.com/quickjs-ng/quickjs/issues/1302 | 8 个月前 | |
Fix heap buffer overflow in js_typed_array_constructor_ta Fixes: https://github.com/quickjs-ng/quickjs/issues/1305 | 8 个月前 | |
Fix heap use-after-free in FinalizationRegistry Fixes: #1318 | 6 个月前 | |
Fix FinalizationRegistry reference counting bug (#1358) Fixes: https://github.com/quickjs-ng/quickjs/issues/1352 | 7 个月前 | |
Fix out of bounds read in regex engine (#1357) Use strncmp instead of memcmp because some implementations of the latter compare more than one byte at a time and will read past end of the input. Fixes: https://github.com/quickjs-ng/quickjs/issues/1354 | 7 个月前 | |
Fix async generator lifecycle bug (#1360) Credit to Yuan (@Reset816) and xia0o0o0o (@KpwnZ) for the report and the test. Fixes: https://github.com/quickjs-ng/quickjs/issues/1355 | 7 个月前 | |
Fix Iterator.concat reentrancy guard | 5 个月前 | |
Fix UAF in fast array delete | 5 个月前 | |
Fix fast array expansion overflow | 4 个月前 | |
test: add test for invalid number literal location | 4 个月前 | |
Fix `set Iterator.prototype.constructor` for non-object values Fixes #1552 | 2 个月前 | |
Fix Iterator Helper close when the source iterator has no `return` (#1558) | 2 个月前 | |
Fix use-after-free from Array `.length` grow + `push` Fixes: #1562 | 2 个月前 | |
Fix use-after-free in DisposableStack disposal Fixees: #1564 | 2 个月前 | |
Fix memory leak in Set.prototype set operations Fixes: #1565 | 2 个月前 | |
Fix type confusion in RegExp.escape with rope strings Fixes #1571 | 2 个月前 | |
Fix reference leak in Iterator.prototype.find Fixes #1572 | 2 个月前 | |
Limit named group scopes to 256 Fixes #1591 | 2 个月前 | |
Fix rejection of escaped reserved punctuators in v-flag \q | 1 个月前 | |
Make BigInt64Array.prototype.with() throw TypeError instead of RangeError when value is invalid. | 1 个月前 | |
Check target extensibility via IsExtensible() in the proxy invariant checks Fixes #1626 | 1 个月前 | |
Propagate exceptions from the get/set descriptor accessors Fixes: #1627 | 1 个月前 | |
Fix Proxy ownKeys trap accepting a primitive result Fixes: #1628 | 1 个月前 | |
Fix UAF in AsyncDisposableStack when using zero-argument reject handler | 1 个月前 | |
Fix UB in String.prototype.normalize() Fix: #1683 | 1 个月前 | |
Throw error when converting BigIntArray to Int8Array | 17 天前 | |
Prevent Object.preventExtensions on TA with RAB (#1695) Fixes: https://github.com/quickjs-ng/quickjs/issues/1691 | 11 天前 | |
Fix Iterator.from GetIteratorDirect handling | 24 天前 | |
Fix underflow with generator in iterable | 6 个月前 | |
Fix TypedArray.prototype.with TOCTOU heap over-read Re-validate the typed array after JS_ToPrimitive (which can trigger user code that resizes or detaches the backing ArrayBuffer). Ref: https://github.com/bellard/quickjs/issues/492 | 6 个月前 | |
Fix memory leak in Iterator.prototype.map Fixes: https://github.com/bellard/quickjs/issues/493 | 6 个月前 | |
Fix crash on cyclic re-export of an imported binding Re-exporting an imported binding (`import { x } from "m"; export { x }`) from a module that participates in an import cycle could dereference a NULL JSVarRef and crash. While a peer in the cycle is still unlinked its import slot is NULL, and both js_build_module_ns() and js_inner_module_linking() used that slot directly. Resolve such a binding by following the import alias to its source module (js_get_local_export_var_ref). When the binding is genuinely unresolvable, e.g. a pure re-export cycle with no concrete binding, throw a SyntaxError instead of crashing. This makes a valid cyclic re-export evaluate correctly, so the test_cyclic_import.js case that previously threw a stopgap SyntaxError now passes. Fixes #567. | 2 个月前 | |
Fix FinalizationRegistry refcounting bug (#656) Introduced in commit 61c8fe6 from last month that moved the callback into the job queue: 1. It leaked `fre->held_val` when no job was enqueued 2. It fumbled the reference count when enqueuing; JS_EnqueueJob already takes care of incrementing and decrementing it Reverts commit 0a70623 from earlier today because that didn't turn out to be a complete fix. Fixes: https://github.com/quickjs-ng/quickjs/issues/648 | 1 年前 | |
Fix exception in WeakRef.prototype.deref (#653) Set the object's opaque to a sentinel value instead of NULL, to stop JS_GetOpaque2 from raising an "illegal class" exception. Fixes: https://github.com/quickjs-ng/quickjs/issues/651 | 1 年前 | |
Fix break statement in presence of labels (#742) In this snippet... for (;;) label: break ...the break statement jumped back to the start of the loop instead of *out* of the loop. Fixes: https://github.com/quickjs-ng/quickjs/issues/741 | 1 年前 | |
Update stack limit in ASan builds (#778) Otherwise recursive calls keep going until they trip ASan checks. Remove the `__ASAN__` and `__UBSAN__` defines; no longer necessary. Remove `globalThis.__running_with_sanitizer__` from qjs; likewise. Fixes: https://github.com/quickjs-ng/quickjs/issues/671 Fixes: https://github.com/quickjs-ng/quickjs/issues/775 Fixes: https://github.com/quickjs-ng/quickjs/issues/776 | 1 年前 | |
Update stack limit in ASan builds (#778) Otherwise recursive calls keep going until they trip ASan checks. Remove the `__ASAN__` and `__UBSAN__` defines; no longer necessary. Remove `globalThis.__running_with_sanitizer__` from qjs; likewise. Fixes: https://github.com/quickjs-ng/quickjs/issues/671 Fixes: https://github.com/quickjs-ng/quickjs/issues/775 Fixes: https://github.com/quickjs-ng/quickjs/issues/776 | 1 年前 | |
Handle unprintable objects better in print() (#834) Before this commit, such objects were printed as `<exception>` because print() and console.log() had no good way to turn them into strings. Instead perform the C equivalent of Object.prototype.toString.call(o) and print the result (which can still error but at least we tried.) Fixes: https://github.com/quickjs-ng/quickjs/issues/832 | 1 年前 | |
Refactor Error.stackTraceLimit - Store the JS value, so the conversion happens when the backtrace is needed - Prevent recursion in build_backtrace - Simplify code for saving / restoring exception in build_backtrace | 1 年前 | |
Fix calling build_backtrace too often (#906) Bug introduced in commit 4c32c53 from late last month. When unwinding the stack, call build_backtrace only when the exception object doesn't already have a .stack property, like how it was before commit 4c32c53. Fixes: https://github.com/quickjs-ng/quickjs/issues/904 | 1 年前 | |
Fix updating DataView length when backing buffer is resized Fixes: https://github.com/quickjs-ng/quickjs/issues/988 Closes: https://github.com/quickjs-ng/quickjs/pull/989 Co-authored-by: Ben Noordhuis <info@bnoordhuis.nl> | 1 年前 | |
Add test for refcount leak in generator function | 1 年前 | |
Implement CallSite.prototype.isConstructor() The Error.prepareStackTrace CallSite objects exposed isNative, getFileName, getFunctionName and the position getters but not isConstructor(), which V8 provides. Track whether each stack frame was entered as a constructor (JS_CALL_FLAG_CONSTRUCTOR) and expose it on the CallSite. | 2 个月前 | |
Return null from CallSite position getters for native frames getLineNumber() and getColumnNumber() returned the internal -1 sentinel for frames without a source position, such as native frames. V8 returns null there, like getFileName() already does for the missing file name. | 2 个月前 | |
Fix missing module exports for array destructuring `export const [a, b] = ...` (and `let`/`var`) did not register the destructured names as module exports, so importing them failed with "Could not find export 'a'". Object destructuring (`export const { a } = ...`) already worked because only the object-property branch of js_parse_destructuring_element() emitted an export entry; the array-element / identifier branch did not. Add the same add_export_entry() call to that branch, guarded by export_flag, mirroring the object case. Extend tests/destructured-export.js to cover array, rest and nested targets. | 2 个月前 | |
Set module internal promise rejection as handled when appropriate (#1554) Before: A module body is run as an async function. js_execute_sync_module calls that function. It finds its result promise already rejected, reads the result, and frees it without attaching a JS handler. The rejection fires a unhandled notification. That notification is never balanced by a is_handled=true notification. The internal promise rejection surfaces as an unhandled rejection in addition to the module's evaluation promise. Additional symptoms: A dynamic import() whose rejection is fully handled by the caller still leaked a unhandled rejection: the internal body promise stayed orphaned. Without the fix a `import('m').then(ok, onerr)` of a throwing module results in a unhandled rejection. Fix: Mark the consumed promise handled, emitting the balancing notification with is_handled=true so the host can handle the rejection correctly. With the fix, a `import('m').then(ok, onerr)` nets zero false positives. | 2 个月前 | |
Handle unprintable objects better in print() (#834) Before this commit, such objects were printed as `<exception>` because print() and console.log() had no good way to turn them into strings. Instead perform the C equivalent of Object.prototype.toString.call(o) and print the result (which can still error but at least we tried.) Fixes: https://github.com/quickjs-ng/quickjs/issues/832 | 1 年前 | |
Addresses an incomplete fix from 1b0b660 | 4 个月前 | |
Fix crash on cyclic re-export of an imported binding Re-exporting an imported binding (`import { x } from "m"; export { x }`) from a module that participates in an import cycle could dereference a NULL JSVarRef and crash. While a peer in the cycle is still unlinked its import slot is NULL, and both js_build_module_ns() and js_inner_module_linking() used that slot directly. Resolve such a binding by following the import alias to its source module (js_get_local_export_var_ref). When the binding is genuinely unresolvable, e.g. a pure re-export cycle with no concrete binding, throw a SyntaxError instead of crashing. This makes a valid cyclic re-export evaluate correctly, so the test_cyclic_import.js case that previously threw a stopgap SyntaxError now passes. Fixes #567. | 2 个月前 | |
Key module identity by specifier and import attributes Module requests with the same specifier but different import attributes must resolve to different modules (ModuleRequestsEqual): the same file can be imported as both a JS module and a text module, notably a module importing its own source with { type: "text" }. quickjs deduplicated module requests by specifier alone, silently dropped the with clause of any repeat import of the same specifier, and cached loaded modules by name alone, so such an import resolved to the JS module itself. Compare the attribute sets when deduplicating module requests and when looking up loaded modules, and remember on each module the attributes it was requested with. In js_module_load(), only apply the .json suffix default when no type attribute was given so that an explicit 'with { type: "text" }' on a .json file is honored. | 1 个月前 | |
test: compare re-export error to direct-import error The module path in the SyntaxError is written into a fixed-size atom buffer (ATOM_GET_STR_BUF_SIZE = 64), so on CI's long absolute build paths the fixture filename is truncated before the distinguishing suffix. The substring assertion on "fixture_reexport_source" therefore failed even though the fix was correct. Assert instead that the re-export error message equals the message from a direct import of the same missing binding. Both name the source module and the same looked-up name, so the messages are identical regardless of path length, which is exactly the behavior the fix guarantees. | 2 个月前 | |
Name the re-exported module when a re-export is missing `export { x } from "./mod.js"` where "./mod.js" has no export `x` reported "Could not find export 'x' in module '<re-exporter>'", naming the module that contains the re-export statement rather than the module that was supposed to provide the binding. A direct `import { x } from "./mod.js"` already reported "./mod.js" correctly. Report the resolved target module and the looked-up name, matching the direct-import diagnostic. | 2 个月前 | |
Name the re-exported module when a re-export is missing `export { x } from "./mod.js"` where "./mod.js" has no export `x` reported "Could not find export 'x' in module '<re-exporter>'", naming the module that contains the re-export statement rather than the module that was supposed to provide the binding. A direct `import { x } from "./mod.js"` already reported "./mod.js" correctly. Report the resolved target module and the looked-up name, matching the direct-import diagnostic. | 2 个月前 | |
Add ES2020 string export/import name support (#1188) Support for ES2020 arbitrary module namespace identifier names, which allows using string literals as export/import names. Examples: ```js export { foo as "string-name" } import { "string-name" as foo } export * as "string-name" from "./mod.js" ``` | 11 个月前 | |
Set module internal promise rejection as handled when appropriate (#1554) Before: A module body is run as an async function. js_execute_sync_module calls that function. It finds its result promise already rejected, reads the result, and frees it without attaching a JS handler. The rejection fires a unhandled notification. That notification is never balanced by a is_handled=true notification. The internal promise rejection surfaces as an unhandled rejection in addition to the module's evaluation promise. Additional symptoms: A dynamic import() whose rejection is fully handled by the caller still leaked a unhandled rejection: the internal body promise stayed orphaned. Without the fix a `import('m').then(ok, onerr)` of a throwing module results in a unhandled rejection. Fix: Mark the consumed promise handled, emitting the balancing notification with is_handled=true so the host can handle the rejection correctly. With the fix, a `import('m').then(ok, onerr)` nets zero false positives. | 2 个月前 | |
Await the async iterator return() when a for-await loop breaks When a `for await` loop was exited via `break`, the async iterator's return() method was called but its result was not awaited. Per spec, AsyncIteratorClose performs Await(Call(return, iterator)), so execution must not continue until that promise settles. Only async generators awaited the close; a plain async function used the synchronous OP_iterator_close path. The break/loop-close emit now routes async iterators through a shared emit_iterator_close() helper that calls return() and awaits it, and skips the call when the iterator has already been closed on normal completion (the slot is undefined), matching the sync for-of behavior. | 2 个月前 | |
Retain function source code in serialized bytecode (#218) Also fix a small memory leak in the output from `qjsc -e`. Fixes: https://github.com/quickjs-ng/quickjs/issues/217 | 2 年前 | |
Report the correct column for an undefined global reference A ReferenceError for an undefined global pointed at column 1 (or the start of the enclosing function) rather than the column of the reference itself, because the OP_get_var_undef opcode was emitted with the surrounding source position. Emit the identifier's own line and column so e.g. `function f(){ return missingGlobal; }` points at `missingGlobal` instead of the function. | 2 个月前 | |
Key module identity by specifier and import attributes Module requests with the same specifier but different import attributes must resolve to different modules (ModuleRequestsEqual): the same file can be imported as both a JS module and a text module, notably a module importing its own source with { type: "text" }. quickjs deduplicated module requests by specifier alone, silently dropped the with clause of any repeat import of the same specifier, and cached loaded modules by name alone, so such an import resolved to the JS module itself. Compare the attribute sets when deduplicating module requests and when looking up loaded modules, and remember on each module the attributes it was requested with. In js_module_load(), only apply the .json suffix default when no type attribute was given so that an explicit 'with { type: "text" }' on a .json file is honored. | 1 个月前 | |
Fix reference leak in `Iterator.prototype.filter` | 2 个月前 | |
Throw from `set Iterator.prototype[@@toStringTag]` on a non-extensible receiver SetterThatIgnoresPrototypeProperties uses CreateDataPropertyOrThrow when the receiver has no own property, which must throw if the property cannot be created (e.g. a non-extensible object). | 2 个月前 | |
Optimize String.prototype.concat (#1295) Optimize the common case where the inputs are strings. Speeds up the string_concat[1-3] benchmarks by 1.1x, 1.8x and 2.1x. Results for string_concat0 are unchanged. It's already so fast there is little to shave off. | 6 个月前 | |
Improve computed property lookup error messages (#1179) QuickJS reported "cannot read property of null" for computed property lookups (`a[k]` where `a === null`), which is markedly less helpful than "cannot read property 'foo' of null". | 11 个月前 | |
perf(parser): Avoid quadratic identifier column lookup | 1 个月前 | |
test: compare re-export error to direct-import error The module path in the SyntaxError is written into a fixed-size atom buffer (ATOM_GET_STR_BUF_SIZE = 64), so on CI's long absolute build paths the fixture filename is truncated before the distinguishing suffix. The substring assertion on "fixture_reexport_source" therefore failed even though the fix was correct. Assert instead that the re-export error message equals the message from a direct import of the same missing binding. Both name the source module and the same looked-up name, so the messages are identical regardless of path length, which is exactly the behavior the fix guarantees. | 2 个月前 | |
Fix TypedArray.prototype.at() to handle resized ArrayBuffer correctly (#1718) | 11 天前 | |
Add string pad leak test | 1 年前 | |
Fix use-after-free of a suspended coroutine reachable only via a closure A suspended coroutine (async function, generator or async generator) keeps its activation frame in a heap-allocated GC object. When a closure captures one of the coroutine's locals it holds an *open* var_ref that points into that frame. Open var_refs were not GC objects and were not traced by their holders, so the edge closure -> var_ref -> coroutine frame was invisible to the cycle collector: a coroutine reachable only through such a closure was collected while still live, and resuming it (or running the closure) then touched freed memory. Make an open var_ref that captures a coroutine local a GC object holding a counted reference to the owning coroutine (JSStackFrame.cur_gc_obj) and mark it from every var_ref holder, so the collector sees the edge and keeps the suspended coroutine (and the frame the var_ref points into) alive. | 1 个月前 | |
Fix use-after-free of a suspended coroutine reachable only via a closure A suspended coroutine (async function, generator or async generator) keeps its activation frame in a heap-allocated GC object. When a closure captures one of the coroutine's locals it holds an *open* var_ref that points into that frame. Open var_refs were not GC objects and were not traced by their holders, so the edge closure -> var_ref -> coroutine frame was invisible to the cycle collector: a coroutine reachable only through such a closure was collected while still live, and resuming it (or running the closure) then touched freed memory. Make an open var_ref that captures a coroutine local a GC object holding a counted reference to the owning coroutine (JSStackFrame.cur_gc_obj) and mark it from every var_ref holder, so the collector sees the edge and keeps the suspended coroutine (and the frame the var_ref points into) alive. | 1 个月前 | |
Fix use-after-free of a suspended coroutine reachable only via a closure A suspended coroutine (async function, generator or async generator) keeps its activation frame in a heap-allocated GC object. When a closure captures one of the coroutine's locals it holds an *open* var_ref that points into that frame. Open var_refs were not GC objects and were not traced by their holders, so the edge closure -> var_ref -> coroutine frame was invisible to the cycle collector: a coroutine reachable only through such a closure was collected while still live, and resuming it (or running the closure) then touched freed memory. Make an open var_ref that captures a coroutine local a GC object holding a counted reference to the owning coroutine (JSStackFrame.cur_gc_obj) and mark it from every var_ref holder, so the collector sees the edge and keeps the suspended coroutine (and the frame the var_ref points into) alive. | 1 个月前 | |
Port js_allocate_fast_array helper for non-mutating array methods Ported from bellard/quickjs: - https://github.com/bellard/quickjs/commit/feefdb1742ed2de8ecd09fd66a848d1695294b3a - https://github.com/bellard/quickjs/commit/4c722cea4e709682003eb0da67b393ea38c56e5e | 5 个月前 | |
add btoa()/atob() builtins - Introduce global btoa() and atob() functions - Standard base64 alphabet (RFC 4648) - Decoder implements forgiving-base64-decode (WHATWG Infra spec) - Tolerant to whitespace, validates padding per spec - JS_AddIntrinsicAToB() ensures DOMException is registered Co-authored-by: Saúl Ibarra Corretgé <s@saghul.net> Co-authored-by: bptato <ninedotnine@gmail.com> | 5 个月前 | |
Fix BigInt.asUintN of negative values covering all limbs js_bigint_asUintN() short-circuited and returned the argument unchanged whenever the requested width was at least as wide as the value's internal representation. That is correct for asIntN, but for asUintN of a negative value the result must be reinterpreted as unsigned, i.e. wrapped modulo 2**bits. As a result BigInt.asUintN(64, -1n) returned -1n instead of 18446744073709551615n (and likewise for any width that is a whole number of internal limbs, e.g. 128, 192). Non-negative values and asIntN are unaffected. Guard the sign-extension path for both the short-BigInt and heap-BigInt representations, extend the result with a leading zero limb so the unsigned value keeps a positive sign, and add an overflow check on the allocation size. Add regression tests in tests/test_bigint.js. | 2 个月前 | |
Use more compact wire format encoding for atoms (#1719) Use a run-length encoding to store keyword-like atoms. Reduces the size of the wire format by about 25-30% when the payload is heavy on such atoms (which, admittedly, is rare.) | 15 天前 | |
Fix integer overflow in the Proxy ownKeys() property enumeration On 32bit hosts. | 1 个月前 | |
DRY assertion functions in tests | 1 年前 | |
Make DOMException a bit more conformant (#1721) | 11 天前 | |
fix: emit source_loc around iterator_close so for/of return() stack traces report correct line Fixes #1266 | 4 个月前 | |
Implement explicit resource management Co-authored-by: Ben Noordhuis <info@bnoordhuis.nl> Closes: https://github.com/quickjs-ng/quickjs/pull/865 | 4 个月前 | |
DRY assertion functions in tests | 1 年前 | |
DRY assertion functions in tests | 1 年前 | |
Improve std file read/write ergonomics (#1365) - make `pos` and `len` arguments optional - accept strings in file.write() | 6 个月前 | |
Add ES2020 string export/import name support (#1188) Support for ES2020 arbitrary module namespace identifier names, which allows using string literals as export/import names. Examples: ```js export { foo as "string-name" } import { "string-name" as foo } export * as "string-name" from "./mod.js" ``` | 11 个月前 | |
Implement os.Worker on Windows (#1003) | 1 年前 | |
Prefix stdlib modules with "qjs:" Fixes: https://github.com/quickjs-ng/quickjs/issues/616 | 1 年前 | |
Continue the TypedArray lastIndexOf scan after a shrink %TypedArray%.prototype.lastIndexOf reads the length before coercing fromIndex (steps 4 and 5). When the coercion shrinks a resizable buffer, the spec scan starts at an index computed from the original length and simply skips the vanished indices, so it reenters the still valid range and can find a match there. quickjs treated any shrink like a detach and returned -1 without scanning. Only bail out when the array is actually out of bounds; for a mere shrink, clamp the start index to the new length and scan. Upward scans (indexOf, includes) keep the old behavior since nothing at or above the clamped range can match. | 1 个月前 | |
Do not coerce the value on a TypedArray out-of-bounds write with a foreign receiver TypedArray [[Set]] (10.4.5.5) only coerces the value, via TypedArraySetElement, when the receiver is the typed array itself (step i). With any other receiver an out-of-bounds or non-canonical integer index is dropped (step ii) and the value is returned without being evaluated. quickjs always evaluated it, so a valueOf/@@toPrimitive on the value ran when it should not have. Only coerce when the receiver object is the typed array (p == p1). | 1 个月前 | |
Copy bytes in increasing order in TypedArray slice %TypedArray%.prototype.slice copies with a byte by byte loop in increasing order when source and target have the same element type (step 14.g). This is observable when the species constructor returns a view over the same buffer that overlaps the source ahead of it: bytes that were already copied are read back as source values. quickjs used memmove, which preserves the original source bytes instead. Use a forward byte copy when the target range overlaps the source ahead of it, and keep memmove otherwise. The overlapping slice case in test_builtin.js encoded the memmove behavior; V8 matches the byte by byte result. | 1 个月前 | |
Fix subarray species constructor arguments %TypedArray%.prototype.subarray reads the [[ByteOffset]] slot (step 13) and passes it to the species constructor unchanged; there is no validation step, so detaching or shrinking the buffer while coercing the begin or end argument must not throw from subarray itself. quickjs read the byteOffset getter, which returns 0 once the buffer is detached, and then threw a RangeError of its own before the constructor was even called. Also, when the source array is length tracking and end is undefined, the argument list is (buffer, beginByteOffset) (step 15), so the result tracks the buffer length too. quickjs always passed a third argument, an undefined length, which a custom species constructor can observe. Read ta->offset directly, drop the extra validation, and call the species constructor with two arguments in the length tracking case. | 1 个月前 | |
Add WASI configurable stack overflow protection (#1700) | 8 天前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 1 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 2 个月前 | ||
| 1 个月前 | ||
| 1 年前 | ||
| 1 个月前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 6 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 5 个月前 | ||
| 5 个月前 | ||
| 4 个月前 | ||
| 4 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 17 天前 | ||
| 11 天前 | ||
| 24 天前 | ||
| 6 个月前 | ||
| 6 个月前 | ||
| 6 个月前 | ||
| 2 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 1 年前 | ||
| 4 个月前 | ||
| 2 个月前 | ||
| 1 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 11 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 2 年前 | ||
| 2 个月前 | ||
| 1 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 6 个月前 | ||
| 11 个月前 | ||
| 1 个月前 | ||
| 2 个月前 | ||
| 11 天前 | ||
| 1 年前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 5 个月前 | ||
| 5 个月前 | ||
| 2 个月前 | ||
| 15 天前 | ||
| 1 个月前 | ||
| 1 年前 | ||
| 11 天前 | ||
| 4 个月前 | ||
| 4 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 6 个月前 | ||
| 11 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 8 天前 |