From 2f2d2255ad0d71c1f0fb824264a1fea063fcf090 Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sun, 1 Nov 2026 18:37:11 -0800 Subject: [PATCH 01/30] Drawing tools: Escape on a polygon, star or rounded rectangle drag puts back the option it changed While a polygon, star or rounded rectangle is dragged out, Up and Down change its side count, point count or corner radius, and Ctrl/Cmd on a star changes its inner-to-outer ratio. Escape canceled the drag but kept those values, so the next drag and the tool's options started from a shape that was never made. - ShapeTool keeps those options as they were when the drag began and Escape puts them back. A drag that is let go keeps the changed values. An option set with tool.setOption during the drag stays. - Session::tool_key saves the tool's options when a key cancels a gesture, so the saved options and General > Corner Radius hold the values Escape put back. - docs/target-app-parity.md has one line for it. --- crates/engine/src/tests/toolsettings.rs | 27 ++++++++ crates/engine/src/tooling.rs | 5 ++ crates/tools/src/shape.rs | 42 +++++++++++++ crates/tools/src/shape/tests.rs | 82 ++++++++++++++++++++++++- docs/target-app-parity.md | 1 + 5 files changed, 154 insertions(+), 3 deletions(-) diff --git a/crates/engine/src/tests/toolsettings.rs b/crates/engine/src/tests/toolsettings.rs index d1224e05d..93b2c8c05 100644 --- a/crates/engine/src/tests/toolsettings.rs +++ b/crates/engine/src/tests/toolsettings.rs @@ -112,6 +112,33 @@ fn options_are_saved_with_the_preferences() { assert_eq!(t.prefs.tool_settings["polygon"]["sides"], json!(9)); } +/// Escape on a polygon or rounded rectangle drag puts back the side count or corner radius its +/// arrows changed, in the saved options and the Corner Radius preference too. +#[test] +fn escape_on_a_shape_drag_saves_the_option_it_put_back() { + use vectorcraft_tools::{Mods, PointerEvent, PointerKind, ToolKey}; + let mut s = session(); + let v = ViewInfo { smart_guides: false, ..Default::default() }; + let drag = |s: &mut Session| { + s.pointer(&PointerEvent::new(PointerKind::Down, 100.0, 100.0), v).unwrap(); + s.pointer(&PointerEvent::new(PointerKind::Drag, 200.0, 180.0), v).unwrap(); + s.tool_key(ToolKey::Up, Mods::default(), v).unwrap(); + // Saves every option, the one the arrow changed included. + s.set_tool_option("length", &json!(50)); + }; + select(&mut s, "polygon"); + drag(&mut s); + assert_eq!(s.prefs.tool_settings["polygon"]["sides"], json!(7)); + s.tool_key(ToolKey::Escape, Mods::default(), v).unwrap(); + assert_eq!(s.prefs.tool_settings["polygon"]["sides"], json!(6)); + select(&mut s, "roundedRectangle"); + let radius = s.prefs.corner_radius; + drag(&mut s); + assert_eq!(s.prefs.corner_radius, radius + 1.0); + s.tool_key(ToolKey::Escape, Mods::default(), v).unwrap(); + assert_eq!(s.prefs.corner_radius, radius); +} + /// The Fidelity an Alt smoothing drag uses on a selected path. fn alt_smooth_fidelity(s: &mut Session) -> Option { use vectorcraft_tools::{Action, Mods, PointerEvent, PointerKind}; diff --git a/crates/engine/src/tooling.rs b/crates/engine/src/tooling.rs index c54bda129..ff2325af9 100644 --- a/crates/engine/src/tooling.rs +++ b/crates/engine/src/tooling.rs @@ -467,6 +467,11 @@ impl Session { } let acts = self.with_tool_cx(view, |t, cx| t.key(cx, key, mods)); self.take_tool_panic()?; + // A key that cancels a gesture may put back options the gesture changed (Escape on an + // arc, spiral or grid drag): keep them. + if acts.contains(&Action::Cancel) { + self.keep_tool_settings(); + } self.apply_actions(acts) } diff --git a/crates/tools/src/shape.rs b/crates/tools/src/shape.rs index f8594226c..8b4f964f9 100644 --- a/crates/tools/src/shape.rs +++ b/crates/tools/src/shape.rs @@ -6,6 +6,7 @@ //! Ctrl/Cmd keeps the inner radius where it is while the outer one follows the pointer, and Alt //! keeps the star's shoulders straight (#812). The start point and //! the dragged corner snap to Smart Guides ([`DrawSnap`]), hovering before the press too. +//! Escape cancels the drag and puts back the options its keys and Ctrl/Cmd changed. use serde_json::{Value, json}; use vectorcraft_geom::{Affine, Point, Rect, Vec2}; @@ -37,6 +38,18 @@ pub struct ShapeTool { pub line_angle: f64, pub fill_line: bool, snap: DrawSnap, + /// The options a drag's keys and Ctrl/Cmd change, as they were when the drag began: Escape + /// puts them back. + before_drag: Option, +} + +/// The options that keys and Ctrl/Cmd change while a shape is dragged out. +#[derive(Clone, Copy)] +struct DragOptions { + sides: u32, + points: u32, + corner_radius: f64, + star_ratio: f64, } /// The inner-to-outer radius ratio that keeps a star of `points` points' shoulders straight (each @@ -72,9 +85,22 @@ impl ShapeTool { line_length: 100.0, line_angle: 0.0, fill_line: false, + before_drag: None, } } + fn drag_options(&self) -> DragOptions { + DragOptions { sides: self.sides, points: self.points, corner_radius: self.corner_radius, star_ratio: self.star_ratio } + } + + /// Put back the options a canceled drag changed. + fn restore_drag_options(&mut self, o: DragOptions) { + self.sides = o.sides; + self.points = o.points; + self.corner_radius = o.corner_radius; + self.star_ratio = o.star_ratio; + } + /// Ctrl/Cmd in a star drag from `start` to `p`, where the last drag showed a star with the inner /// radius `shown`: once the star has begun, the inner radius stays as the star showed it when /// the key went down, so the ratio follows the outer radius (and stays so once the key is let @@ -228,6 +254,7 @@ impl Tool for ShapeTool { self.last = ev.pos; self.began = false; self.inner = None; + self.before_drag = None; vec![] } PointerKind::Drag => { @@ -251,6 +278,7 @@ impl Tool for ShapeTool { return out; } self.began = true; + self.before_drag = Some(self.drag_options()); out.push(Action::Begin(self.label().into())); } let (c, v) = self.command_at(s, ev.pos, ev.mods, cx.constrain_angle); @@ -261,6 +289,7 @@ impl Tool for ShapeTool { let Some(s) = self.start.take() else { return vec![] }; self.snap.clear(); self.inner = None; + self.before_drag = None; if self.began { self.began = false; vec![Action::Commit] @@ -309,6 +338,9 @@ impl Tool for ShapeTool { self.start = None; self.began = false; self.inner = None; + if let Some(o) = self.before_drag.take() { + self.restore_drag_options(o); + } self.snap.clear(); vec![Action::Cancel] } else { @@ -373,6 +405,16 @@ impl Tool for ShapeTool { "fillLine" => self.fill_line = v.as_bool().unwrap_or(self.fill_line), _ => {} } + // An option set while a shape is dragged out stays when Escape cancels the drag. + if let Some(b) = self.before_drag.as_mut() { + match key { + "sides" => b.sides = self.sides, + "points" => b.points = self.points, + "cornerRadius" => b.corner_radius = self.corner_radius, + "starRatio" => b.star_ratio = self.star_ratio, + _ => {} + } + } } } diff --git a/crates/tools/src/shape/tests.rs b/crates/tools/src/shape/tests.rs index da4916576..bc8e4b102 100644 --- a/crates/tools/src/shape/tests.rs +++ b/crates/tools/src/shape/tests.rs @@ -166,15 +166,16 @@ fn a_star_drag_holds_the_inner_radius_it_shows_when_ctrl_goes_down() { close(radii(&t.pointer(&cx, &PointerEvent::new(PointerKind::Drag, 170.0, 50.0).with_mods(ctrl))), (120.0, 40.0 * straight)); // Escape with the key held, then a new press and the key before the first move: the next star - // holds what it shows, not the canceled radius. + // has the ratio from before the canceled drag and holds the inner radius it shows, not the + // canceled one. let mut t = ShapeTool::new("star"); t.pointer(&cx, &PointerEvent::new(PointerKind::Down, 50.0, 50.0)); t.pointer(&cx, &PointerEvent::new(PointerKind::Drag, 90.0, 50.0)); t.pointer(&cx, &PointerEvent::new(PointerKind::Drag, 130.0, 50.0).with_mods(ctrl)); assert_eq!(t.key(&cx, ToolKey::Escape, ctrl), vec![Action::Cancel]); t.pointer(&cx, &PointerEvent::new(PointerKind::Down, 50.0, 50.0)); - close(radii(&t.pointer(&cx, &PointerEvent::new(PointerKind::Drag, 60.0, 50.0).with_mods(ctrl))), (10.0, 2.5)); - close(radii(&t.pointer(&cx, &PointerEvent::new(PointerKind::Drag, 70.0, 50.0).with_mods(ctrl))), (20.0, 2.5)); + close(radii(&t.pointer(&cx, &PointerEvent::new(PointerKind::Drag, 60.0, 50.0).with_mods(ctrl))), (10.0, 5.0)); + close(radii(&t.pointer(&cx, &PointerEvent::new(PointerKind::Drag, 70.0, 50.0).with_mods(ctrl))), (20.0, 5.0)); // Ctrl/Cmd pressed inside the drag threshold, where no star is shown yet. let mut t = ShapeTool::new("star"); @@ -301,6 +302,81 @@ fn rounded_rectangle_radius_is_clamped_to_its_range() { assert_eq!(t.options()["cornerRadius"], json!(MAX_CORNER_RADIUS)); } +/// Escape during a polygon, star or rounded rectangle drag puts back the side count, point count +/// or corner radius its arrows changed, for the next drag and the tool's options; a drag that is +/// let go keeps them. +#[test] +fn escape_puts_back_the_options_a_drag_changed() { + let (d, _) = doc_with_rect(); + let s = Selection::default(); + let p = paint(); + let mut cx = cx(&d, &s, &p); + cx.smart_guides = false; + for (id, field) in [("polygon", "sides"), ("star", "points"), ("roundedRectangle", "radius")] { + let mut t = ShapeTool::new(id); + let value = |a: Vec| match a.last() { + Some(Action::Preview(_, v)) => v[field].clone(), + _ => panic!("{id}: {a:?}"), + }; + t.pointer(&cx, &PointerEvent::new(PointerKind::Down, 10.0, 10.0)); + let before = value(t.pointer(&cx, &PointerEvent::new(PointerKind::Drag, 60.0, 40.0))); + let options = t.options(); + t.key(&cx, ToolKey::Up, Mods::default()); + let changed = value(t.key(&cx, ToolKey::Up, Mods::default())); + assert_ne!(changed, before, "{id}: the arrows change the option"); + assert_eq!(t.key(&cx, ToolKey::Escape, Mods::default()), vec![Action::Cancel], "{id}"); + assert_eq!(t.options(), options, "{id}: the tool's options"); + t.pointer(&cx, &PointerEvent::new(PointerKind::Down, 10.0, 10.0)); + assert_eq!(value(t.pointer(&cx, &PointerEvent::new(PointerKind::Drag, 60.0, 40.0))), before, "{id}: the next drag"); + // A drag that is let go keeps what its arrows changed. + t.key(&cx, ToolKey::Up, Mods::default()); + t.key(&cx, ToolKey::Up, Mods::default()); + assert_eq!(t.pointer(&cx, &PointerEvent::new(PointerKind::Up, 60.0, 40.0)), vec![Action::Commit]); + t.pointer(&cx, &PointerEvent::new(PointerKind::Down, 10.0, 10.0)); + assert_eq!(value(t.pointer(&cx, &PointerEvent::new(PointerKind::Drag, 60.0, 40.0))), changed, "{id}: a finished drag keeps it"); + t.key(&cx, ToolKey::Down, Mods::default()); + t.key(&cx, ToolKey::Escape, Mods::default()); + let kept = t.options(); + t.pointer(&cx, &PointerEvent::new(PointerKind::Down, 10.0, 10.0)); + // Escape puts back only what this drag changed. + assert_eq!(value(t.pointer(&cx, &PointerEvent::new(PointerKind::Drag, 60.0, 40.0))), changed, "{id}: only this drag"); + assert_ne!(kept, options, "{id}"); + } +} + +/// Ctrl/Cmd changes a star's inner-to-outer ratio as it is dragged out; Escape puts it back, and +/// an option set during the drag stays. +#[test] +fn escape_puts_back_the_star_ratio_and_keeps_an_option_set_during_the_drag() { + let (d, _) = doc_with_rect(); + let s = Selection::default(); + let p = paint(); + let mut cx = cx(&d, &s, &p); + cx.smart_guides = false; + let ctrl = Mods { cmd: true, ..Default::default() }; + let mut t = ShapeTool::new("star"); + t.pointer(&cx, &PointerEvent::new(PointerKind::Down, 50.0, 50.0)); + t.pointer(&cx, &PointerEvent::new(PointerKind::Drag, 90.0, 50.0)); + t.pointer(&cx, &PointerEvent::new(PointerKind::Drag, 130.0, 50.0).with_mods(ctrl)); + assert!((t.star_ratio - 0.25).abs() < 1e-9, "{}", t.star_ratio); + t.key(&cx, ToolKey::Escape, ctrl); + assert_eq!(t.star_ratio, 0.5); + + // Options set with `tool.setOption` during the drag stay; the arrows' change goes back. + for (id, key, set) in [("polygon", "sides", json!(9)), ("star", "points", json!(8)), ("roundedRectangle", "cornerRadius", json!(30.0))] { + let mut t = ShapeTool::new(id); + t.pointer(&cx, &PointerEvent::new(PointerKind::Down, 10.0, 10.0)); + t.pointer(&cx, &PointerEvent::new(PointerKind::Drag, 60.0, 40.0)); + t.key(&cx, ToolKey::Up, Mods::default()); + t.set_option(key, &set); + t.set_option("starRatio", &json!(0.3)); + t.key(&cx, ToolKey::Up, Mods::default()); + t.key(&cx, ToolKey::Escape, Mods::default()); + let o = t.options(); + assert_eq!((o[key].clone(), o["starRatio"].clone()), (set, json!(0.3)), "{id}"); + } +} + /// The start and the dragged corner land on another object's anchors (#506), hovering shows /// it before the press, and the measurement label gives the size drawn. #[test] diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md index 40e1d1267..7444b8c44 100644 --- a/docs/target-app-parity.md +++ b/docs/target-app-parity.md @@ -701,6 +701,7 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur - **Shapes:** all shape tools (including Flare) and the line, arc, spiral and grid tools. Space held while dragging out a shape, line, arc, spiral or grid moves it at its current size. The Flare tool's center drag turns the rays by 0.1 radian at each drag update in which the pointer's document y grows, and back by as much at each one in which it falls, Shift held keeps their turn, and Space held during either of its drags moves the flare. While a grid is dragged out, Up/Down change its rows (concentric dividers) and Left/Right its columns (radial dividers). A click with a grid tool asks for the size, the divider counts and the grid options (#1377, in part): a skew for each set of dividers, Use Outside Rectangle As Frame or Create Compound Path From Ellipses, and Fill Grid; they are parameters of `shape.rectangularGrid` and `shape.polarGrid`, stay as the tool's options and apply to drags too. The curve a skew percentage follows and the direction of the radial skew are our own (the public documentation gives neither), and the dialogs have no reference point locator. An ellipse's Pie Start and End Angle and Invert Pie (Transform and Properties panels' Ellipse Properties, `object.setLiveShape {pieStart, pieEnd, invertPie}`) cut it as a pie (#812). With the bounding box showing, the Selection tool shows a selected ellipse's two pie widgets just outside it; dragging one sets its angle in one undo step and double-clicking one makes the ellipse whole again. A live polygon's Polygon Properties there: side count, angle, corner type and radius, radius, side length and Make Sides Equal once an uneven scale has made its sides differ (`object.setLiveShape {sides, polygonAngle, polygonRadius, sideLength, makeSidesEqual}`, part of #812); a star is a plain path, as in Illustrator. The Flare Tool Options last as the tool's options: the next flare dragged out uses them, a click's dialog shows them and double-clicking the tool opens them (part of #812). - **Shapes:** all shape tools (including Flare) and the line, arc, spiral and grid tools. Space held while dragging out a shape, line, arc, spiral or grid moves it at its current size. The Flare tool's center drag turns the rays with the pointer, Shift keeps them in their original orientation (unturned, or turned by a nonzero General › Constrain Angle), and Space held during either of its drags moves the flare. While a grid is dragged out, Up/Down change its rows (concentric dividers) and Left/Right its columns (radial dividers). A click with a grid tool asks for the size, the divider counts and the grid options (#1377, in part): a skew for each set of dividers, Use Outside Rectangle As Frame or Create Compound Path From Ellipses, and Fill Grid; they are parameters of `shape.rectangularGrid` and `shape.polarGrid`, stay as the tool's options and apply to drags too. The curve a skew percentage follows and the direction of the radial skew are our own (the public documentation gives neither), and the dialogs have no reference point locator. An ellipse's Pie Start and End Angle and Invert Pie (Transform and Properties panels' Ellipse Properties, `object.setLiveShape {pieStart, pieEnd, invertPie}`) cut it as a pie (#812). With the bounding box showing, the Selection tool shows a selected ellipse's two pie widgets just outside it; dragging one sets its angle in one undo step and double-clicking one makes the ellipse whole again. A live polygon's Polygon Properties there: side count, angle, corner type and radius, radius, side length and Make Sides Equal once an uneven scale has made its sides differ (`object.setLiveShape {sides, polygonAngle, polygonRadius, sideLength, makeSidesEqual}`, part of #812); a star is a plain path, as in Illustrator. The Flare Tool Options last as the tool's options: the next flare dragged out uses them, a click's dialog shows them and double-clicking the tool opens them (part of #812). - **Shapes:** all shape tools (including Flare) and the line, arc, spiral and grid tools. Space held while dragging out a shape, line, arc, spiral or grid moves it at its current size. The Flare tool's center drag turns the rays with the pointer, Shift keeps them in their original orientation, and Space held during either of its drags moves the flare. While a grid is dragged out, Up/Down change its rows (concentric dividers) and Left/Right its columns (radial dividers). A click with a grid tool asks for the size, the divider counts and the grid options (#1377, in part): a skew for each set of dividers, Use Outside Rectangle As Frame or Create Compound Path From Ellipses, and Fill Grid; they are parameters of `shape.rectangularGrid` and `shape.polarGrid`, stay as the tool's options and apply to drags too. The curve a skew percentage follows and the direction of the radial skew are our own (the public documentation gives neither), and the dialogs have no reference point locator. An ellipse's Pie Start and End Angle and Invert Pie (Transform and Properties panels' Ellipse Properties, `object.setLiveShape {pieStart, pieEnd, invertPie}`) cut it as a pie (#812). With the bounding box showing, the Selection tool shows a selected ellipse's two pie widgets just outside it; dragging one sets its angle in one undo step and double-clicking one makes the ellipse whole again. A live polygon's Polygon Properties there: side count, angle, corner type and radius, radius, side length and Make Sides Equal once an uneven scale has made its sides differ (`object.setLiveShape {sides, polygonAngle, polygonRadius, sideLength, makeSidesEqual}`, part of #812); a star is a plain path, as in Illustrator. The Flare Tool Options last as the tool's options: the next flare dragged out uses them, a click's dialog shows them and double-clicking the tool opens them (part of #812). + Escape while a polygon, star or rounded rectangle is dragged out cancels it and puts back the side count, point count, corner radius or star ratio its Up/Down and Ctrl/Cmd changed, so the next drag, the tool's options and General › Corner Radius start from the values before the canceled drag; a drag that is let go keeps them, and an option set with `tool.setOption` during the drag stays. This is VectorCraft's own rule. While a grid is dragged out, F lowers `rowSkew` (rectangular) or `radialSkew` (polar) by 10 percentage points and V raises it by 10; X lowers `columnSkew` (rectangular) or `concentricSkew` (polar) by 10 and C raises it by 10. Plain and Shift presses work; with Alt, Ctrl or Cmd held they do not, as for the other letters a tool takes while dragging. Each press changes the skew once and updates the preview; values stay within ±500% and remain in the tool options after release. The [default keyboard shortcuts](https://web.archive.org/web/20260726060015/https://helpx.adobe.com/illustrator/using/default-keyboard-shortcuts.html) (archived copy) list the four drag keys and a 10% change. The signs (positive values follow VectorCraft's existing skew convention, so F and X lower the stored value) and one change per press with key repeat ignored are our own rules. While an arc is dragged out, C switches it between open and closed, F switches its base between the X and Y axes in the same box, and Up/Down raise and lower its slope by 10 within −100…100; each press switches once, and the values stay as the Arc tool's options. The [default keyboard shortcuts](https://web.archive.org/web/20260726060015/https://helpx.adobe.com/illustrator/using/default-keyboard-shortcuts.html) (archived copy) list C, F and Up/Down for an arc being dragged out. F as the base switch, the arrows changing the slope, the step of 10 and one switch per press are our own rules. While a spiral is dragged out, Alt adds or removes whole winds of four segments and Ctrl/Cmd changes the decay. The spiral's inner end keeps the distance from the center it had on the first modified drag event, while the outer end follows the pointer. The [default keyboard shortcuts](https://web.archive.org/web/20260726060015/https://helpx.adobe.com/illustrator/using/default-keyboard-shortcuts.html) (archived copy) list Alt-drag to add or subtract winds and Ctrl-drag to change the decay rate; [Draw spirals](https://helpx.adobe.com/illustrator/desktop/draw-shapes-and-paths/draw-shapes/draw-spirals.html) defines four segments per full wind. Rounding the fitted count to whole winds from the count on the first Alt-only drag event, the held inner radius, the ranges (2…1000 segments, 5…99.99 % decay), Ctrl/Cmd taking precedence when both are held, and the new values staying as Spiral tool options are our own rules. Switching back to Alt uses the current count as its new base while keeping the held inner end. From 36646863fc943dfa47198a5510110fee2474c918 Mon Sep 17 00:00:00 2001 From: Don Omondi <282319807+mockydevs@users.noreply.github.com> Date: Fri, 6 Nov 2026 19:12:35 -0500 Subject: [PATCH 02/30] .ai import: Art brushes in the older form of their objects come into the Brushes panel Art brush objects whose first number is 1, as older files write them, have one field fewer before their numbers and 8 numbers at the end. The reader wanted exactly 15 and left every such brush out with a note, though an Art brush is read from its art's name alone. Scatter brushes still need all 15 numbers. --- crates/eps/src/import/ai/brush.rs | 7 +++++-- crates/eps/src/import/ai/tests.rs | 18 ++++++++++++++++++ docs/file-format-parity.md | 5 +++-- docs/target-app-parity.md | 5 +++-- 4 files changed, 29 insertions(+), 6 deletions(-) diff --git a/crates/eps/src/import/ai/brush.rs b/crates/eps/src/import/ai/brush.rs index 4c9bda1b1..f67724693 100644 --- a/crates/eps/src/import/ai/brush.rs +++ b/crates/eps/src/import/ai/brush.rs @@ -21,7 +21,9 @@ //! page). //! - A Scatter, Art or Pattern brush's parameters are fields split by `/`: a number, the art's //! section names (one for Scatter, five for Art and Pattern, empty where there is none, each -//! after a space for Art and Pattern), more fields, and last 15 numbers. +//! after a space for Art and Pattern), more fields, and last 15 numbers. Brushes whose first +//! number is 1, as older files write them, have one field fewer before the numbers and 8 numbers; +//! an Art brush is read from its art's name alone, so either form reads. //! - Scatter: the size (2, 3), spacing (5, 6) and scatter (8, 9) as (low, high) factors of the //! art, the rotation in degrees (11, 12), how each varies (4, 7, 10, 13) and whether the //! rotation follows the path (14). @@ -247,10 +249,10 @@ pub(super) fn parse_tool_object(kind: Tool, name: &str, params: &str) -> Result< }) .collect(); let n = fields.last().and_then(|f| numbers(f)).ok_or(BrushError::Values)?; - let [_, p2, p3, p4, p5, p6, p7, p8, p9, p10, p11, p12, p13, p14, _] = n.as_slice() else { return Err(BrushError::Values) }; let art = || tiles.first().cloned().flatten().ok_or(BrushError::NoArt); match kind { Tool::Scatter => { + let [_, p2, p3, p4, p5, p6, p7, p8, p9, p10, p11, p12, p13, p14, _] = n.as_slice() else { return Err(BrushError::Values) }; let pct = |a: f64, b: f64| (a * 100.0, b * 100.0); let values = [pct(*p2, *p3), pct(*p5, *p6), pct(*p8, *p9), (*p11, *p12)]; let codes = [*p4, *p7, *p10, *p13]; @@ -270,6 +272,7 @@ pub(super) fn parse_tool_object(kind: Tool, name: &str, params: &str) -> Result< } Tool::Art => DraftKind::Art { brush: ArtBrush { colorization: Colorization::None, ..ArtBrush::default() }, art: art()? }, _ => { + let [_, _, p3, ..] = n.as_slice() else { return Err(BrushError::Values) }; let tiles: [Option; 5] = tiles.try_into().map_err(|_| BrushError::Values)?; DraftKind::Pattern { tiles, scale: p3 * 100.0 } } diff --git a/crates/eps/src/import/ai/tests.rs b/crates/eps/src/import/ai/tests.rs index c883719e3..53ed6eb82 100644 --- a/crates/eps/src/import/ai/tests.rs +++ b/crates/eps/src/import/ai/tests.rs @@ -7110,6 +7110,24 @@ fn a_pattern_brushs_five_slots_are_kept() { assert!(matches!(d.kind, brush::DraftKind::Art { ref art, .. } if art == "Ribbon art"), "{d:?}"); } +/// An Art brush in the older form (first number 1: one field fewer before its 8 numbers) is read +/// as the newer one is, with the art of its section; a Scatter brush in that form isn't (its values +/// aren't all there). +#[test] +fn an_older_art_brush_comes_in_with_its_art() { + const OLD_RIBBON: &str = "1 / Ribbon art/ / / / / 0 1 / 1 0 1 0 1 0 0 0"; + let d = brush::parse_tool_object(brush::Tool::Art, "Ribbon", OLD_RIBBON).unwrap(); + assert!(matches!(d.kind, brush::DraftKind::Art { ref art, .. } if art == "Ribbon art"), "{d:?}"); + assert_eq!(brush::parse_tool_object(brush::Tool::Scatter, "Spray", "1 /Dot art/ 0 1 / 1 0 1 0 1 0 0 0"), Err(brush::BrushError::Values)); + let objects = [plugin_object(ART_BRUSH, "Ribbon", OLD_RIBBON), plugin_object(ART_BRUSH, "Bare", "1 / / / / / / 0 1 / 1 0 1 0 1 0 0 0")].concat(); + let r = read_ok(&format!("{}{objects}{}", brush_art("Ribbon art", 4.0), layer(""))); + let lib = vectorcraft_brush::library(&r.doc); + let vectorcraft_brush::BrushKind::Art(a) = brush_named(&lib, "Ribbon") else { panic!("art") }; + assert_eq!(a.art.geometric_bounds().map(|b| (b.width(), b.height())), Some((4.0, 4.0)), "the art of its section"); + assert_eq!(lib.len(), 1, "a brush naming no art is left out"); + assert!(r.warnings.iter().any(|w| w.ends_with("Brushes panel (1)")), "{:?}", r.warnings); +} + /// A brush's art filled with a pattern the file defines before it is read, with that pattern. #[test] fn a_brushs_art_takes_the_patterns_defined_before_it() { diff --git a/docs/file-format-parity.md b/docs/file-format-parity.md index d3e2f0303..5bd00e353 100644 --- a/docs/file-format-parity.md +++ b/docs/file-format-parity.md @@ -1,6 +1,6 @@ # File format parity -> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-06 · **Change:** minor (SVG import: filter and mask regions clip, #5876, #5875; SVG import: Gaussian blurs keep `color-interpolation-filters`, #5877; PDF and `.ai` export: objects' URLs as links, #5785; SVG import: `color-interpolation="linearRGB"` gradients, #5878; `.ai` import: paths with a Calligraphic brush open brushed, #372) · **Target:** Adobe Illustrator 2026 (30.x) +> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-06 · **Change:** minor (`.ai` and EPS import: Art brushes in the older form of their objects come into the Brushes panel; SVG import: filter and mask regions clip, #5876, #5875; SVG import: Gaussian blurs keep `color-interpolation-filters`, #5877; PDF and `.ai` export: objects' URLs as links, #5785; SVG import: `color-interpolation="linearRGB"` gradients, #5878; `.ai` import: paths with a Calligraphic brush open brushed, #372) · **Target:** Adobe Illustrator 2026 (30.x) Every format Illustrator opens, places, saves or exports, against VectorCraft's format table (`FORMATS`, `OPEN_EXTS`, `PLACE_EXTS` in `crates/engine/src/cmd/fileio/formats.rs`). Illustrator's list comes from its public @@ -143,7 +143,7 @@ private editing data. VectorCraft: ### Illustrator's private editing data -the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing) or Pucker & Bloat at 0 comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic one, or a Calligraphic brush with settings of its own or an angle that follows the path comes in as its drawn look (a group named after it). A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372). A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. Type keeps its art style as a live appearance whatever its stack, so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its settings at their defaults) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard. +the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPrivateData` streams, a PDF's `AIPDFPrivateData` streams when it was saved with the editing data (#868), Zstandard or zlib, the EPS's in ASCII85) is not documented as a whole. VectorCraft reads its structure: layers and sublayers (names, order, visibility, lock, printing, preview, dimming, colour), groups as they were nested, compound paths (painted by their last path, or the last painted one, with the paths of groups inside them kept as their paths: #1410), clipping groups and layer clipping (several clipping paths in a clipping group, a layer or an opacity mask's art clip to their intersection, and a compound path of clipping paths stays one clip; clipping paths that would nest the art past the document's 32 levels stop the editing data from being read: #5789), object names, hidden and locked objects, fills and strokes (grey, CMYK, RGB, named and spot colours, spot colours defined in Lab with their Lab values (#1032), global process colours as global swatches at their tint; a stroke of width 0, `0 w`, on a path, a gradient-filled path, legacy type or in an art style comes in as a 0.25 pt hairline, as from PDF: #1671), linear and radial gradients, pattern fills with their patterns as pattern swatches (#1025), gradient and pattern names in the file up to their first newline (a name that another swatch, or a gradient or pattern defined earlier, already has is numbered "Sky 2"; a name without a newline is kept, and when another swatch has it, the pattern's swatch, or a named color sharing a gradient or pattern swatch's name, is numbered the same way), opacity, blend modes, isolation and knockout, embedded images where their matrix puts them, rotated ones too (#2269), with their alpha channel (CMYK images keep their ink amounts, as they do when a `.ai` opens from its PDF part, and an alpha channel that hides part of a CMYK image becomes a grayscale opacity mask), placed (linked) files as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (#1264), with the folder the file keeps relative to the document's, where the link is looked for when its path is gone, guides, and every artboard where it is, with its center mark, cross hairs, video safe areas and video ruler pixel aspect ratio. VectorCraft reads `CropAreaActive`, an `/Int` in the dictionary that holds the artboard array, as the index of the active artboard in that array, and the file opens with that artboard active; without it, or when it names no artboard that opens, the first artboard is active. It also reads the Document Raster Effects Settings (resolution, color model, background, anti-alias, clipping mask, Add Around Object and Preserve Spot Colors), the author from the header's `%%For` (an EPS's own header when the editing data's has none), swatches for the header's `%%CMYKCustomColor` and `%%RGBCustomColor` colors that the document has none of, and `%%TemplateBox` in older files; a setting with a value of another type or out of range keeps its default. Objects on Path groups open live, with their path, their objects in order along it, Pivot and Rotate; one with a dragged spacing or other options opens as a plain group. A gradient with stops in the middle runs its whole ramp across its shape, and a gradient object does not pass its fill to the next path (#1390). An object whose art style is one fill and one stroke at most (solid colours, its own gradient, a variable-width profile) with Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Offset Path, Outline Object, Outline Stroke, Convert to Shape, Tweak (only when it moves nothing) or Pucker & Bloat at 0 comes in as itself with them and their saved settings. A path, compound path or group (not a clipping group) whose only effect is Transform (not with copies or Random) or a Free Distort whose corners make a parallelogram comes in as itself with it too, when neither it nor anything in it paints with a gradient or pattern and everything in it is a path, compound path or group with no opacity mask and no effects of its own; Transform that scales, rotates or reflects needs nothing in it to be stroked. Twist as the only effect is read the same way on an unstroked path or compound path whose segments are all straight. One with more, other effects (Zig Zag, a Pucker & Bloat of another amount, a Free Distort with other corners), an effect setting that is not read (an unknown key, a missing or out-of-range value, a Scribble with a color of its own), dashes aligned to corners, a brush other than a Calligraphic one, or a Calligraphic brush with settings of its own or an angle that follows the path comes in as its drawn look (a group named after it). A path with a Calligraphic brush otherwise comes in as the path, the brush on its stroke at the stroke's weight, which scales the brush (#372). A Calligraphic brush's Pressure, Tilt, Bearing and Rotation come in as those channels (a 6D Art Pen's brushes vary with the pressure, the bearing and the barrel's rotation); its Stylus Wheel varies at random. The file's Calligraphic, Scatter, Art and Bristle brushes (Art brushes in the older form of their objects too) replace the default ones in the Brushes panel, in the file's order, also when the file comes in as its PDF part (a brush library has no layers); pattern brushes and brushes it can't read are left out with a note. Type keeps its art style as a live appearance whatever its stack, so it can be retyped: each fill and stroke of the style's stack (solid colours, gradients and pattern fills, placed as the drawn look places them) with its own opacity, blend mode and effects, the effects on the whole object, and where the characters paint among them; the effects read are Warp, Offset Path, Outline Object, Outline Stroke, Transform (with copies, Transform Objects, Transform Patterns and Scale Strokes & Effects; not with Random), Free Distort, Pucker & Bloat, Twist, Zig Zag, Tweak (only when it moves nothing, the file holding none of its random outline), Drop Shadow, Inner Glow, Outer Glow, Feather, Round Corners, Scribble, Gaussian Blur, Bas Relief (its settings at their defaults) and Convert to Shape, and a style with others, or with an effect setting that isn't read, keeps the type's drawn look. Convert to Shape keeps its Rectangle, Rounded Rectangle or Ellipse, its Absolute or Relative size (a relative size in the file is added to each side) and its corner radius; a relative Ellipse, or a setting that isn't read, keeps the drawn look. The page's drawing of such a style isn't held to look like VectorCraft's where its drawn look lay. Gradients take their matrix (`Xm`, radials and skewed ones too), focal point and the order of stops sharing a ramp point; gradient meshes, a clipping path's own fill and its stroke, and the artboards' names are read too. `editingData: "always"` (`convert --editing-data`) opens a `.ai` or an Illustrator EPS from its editing data even where it draws differently from its page, which can be older, with a note. Type is made from the file's text document, whole and editable, shown or not: point type (its frame's matrix, which newer files leave out when it is neither turned nor scaled, read as none), area type (a story in several frames as threaded type) and type on a path, with its characters, fonts, size, leading, tracking, scaling, baseline shift, fill and stroke (grey, RGB or CMYK), alignment, indents and paragraph spacing (a character attribute a run doesn't set comes from its character style, then the style that one is based on, then the document's defaults); area type keeps its frame's Area Type Options rows and columns, the gutter between rows and the gutter between columns, and its first baseline (Fixed, Cap Height, Leading or x Height) with its minimum; the page's drawing of it (often in pieces) is left out. Vertical type keeps its orientation, its columns from right to left, and a run set to Tate-chu-yoko keeps that setting. When it makes the type of every text object that shows, the page's type is only compared with it, each text object keeps its own group, frame and layer, and a line break inside a paragraph stays one. Where it can't make a text object's type (a frame of another kind), that text object takes the page's type where the text document puts its lines, or else what is left of the page's type in painting order (no group around it); the page's type where made type draws stays that type's, and hidden type is left out with a note. Text wrap is read too: an object whose dictionary has the wrap options (offset and Invert Wrap), or any graphic of a legacy wraparound group (`*w` … `*W`, before or after its type, with no offset), is a wrap object, and area type below it in its layer flows around it when the file opens, threaded type included (#2763). Kerning, underline and the other character and paragraph options aren't read yet. A `.ai` saved without PDF compatibility (a placeholder page) opens from its editing data alone, its point type, area type and type on a path made from the text document. A `.ai` whose PDF part shows only text isn't taken for that placeholder when its page states an art, trim or bleed box: it opens from its editing data alone where that reads, else from its PDF part (#1387). A `.ai` whose PDF part draws nothing at all (an empty page, with or without those boxes) opens from its editing data alone where that reads too: there is no page art to check its layers against, and the empty page would lose all of it. Text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line (the frame is made taller, with a warning in the open result) (#1392). Symbols are read into the Symbols panel, in the file's symbol list order, with their art, their registration point and the instances in their art, and their instances come in live with their matrix, name, hide, lock, opacity, blending mode, isolation, knockout and opacity mask; a symbol whose art isn't read whole (type, placed files, an image it leaves out or anything else it doesn't read) isn't kept. Symbols are read only with the layers: a file that comes in as its page or PDF part (editing data with no layers, layers that can't be read, or any of the cases below) opens with an empty Symbols panel. Instances of symbols it can't read, instances with appearance changes of their own (a dynamic symbol's), pattern fills whose pattern it can't read, placed files the data keeps no preview of and anything else it doesn't read make the file come in as its page (on a layer that doesn't show, they are left out of that layer), with a warning saying what. An unread object on a shown layer whose box can be found instead comes in as a group of the page's objects inside that box, named after it, with the rest of the layers and groups kept and a warning listing what came in as the page's art; the file still comes in as its page when live art or another unread object shares that page art, when the object spans two artboards or lies on an artboard that has no page, when no page art lies inside its box, when that page art is inside a page group with a clip, mask, transparency or appearance, when the object holds a frame of threaded type, when the page art uses a pattern, image or swatch that the page lacks or that differs from the editing data's, or when the page art doesn't carry its transparency (#4806). The layers' art is also compared with the page (by lightness, so colours written as their CMYK equivalents compare alike, and by whether a pixel is inked at all); the page is used when they differ by more than 5% (away from type, when all the type is made from the text document), where one draws an object the other doesn't (away from type, whose lines may be laid out afresh), and when an EPS whose page is its art's box has art printed outside it (#735). A `.ai` is not compared with its page, and its PDF part is not imported, when its text document makes the type of every text object (at least one shows, and none is drawn by the appearance of the layer or group it is in), no object is unread, no placed file has a second placement, no live envelope keeps its drawn art, it declares no large canvas, and its artboards are its pages' trim boxes one for one, in points or in the first page's `UserUnit`: it opens from its layers, with the bleed of its pages' bleed boxes. When they differ because some objects draw differently (an object in another color, or one that only one of them draws), each top-level object of the layers that holds such a difference comes in as a group of the page's objects inside its box and the layers stay, with a warning that names the layer or sublayer of each such object as the Layers panel shows it (`` for one without a name) and how many came in from it; an export or Save As to the file's own path then needs `acknowledgeLoss: true`, and a wrap object replaced this way keeps its wrap options. The file still comes in as its page when only edges or type differ, when a difference lies outside every top-level object, when more than half of the top-level objects or more than 64 hold one, when such an object is or holds type or holds a wrap object inside a group, when the page's type of a text object that stays lies inside such an object's box, when the page's art can't replace such an object for one of the reasons above for an unread object, when matching the differences to the objects would take too much work, or when the result still differs from the page. `editingData: "always"` keeps the objects as read, and placed files at the other point their data gives are tried as well. An EPS whose page is its art's box keeps that page when it comes in through its layers, not the editing data's artboard, and a text object counts as drawn by the page by its colours, not only its lightness, so a red stroke stacked over a dark red one stays (#1102). `textAs: "outlines"` opens a `.ai` whose type shows from its PDF part, which has the outlines; `editingData: false` opens any of them as its page or PDF part only, for print pipelines (#735). A file whose import left something out (hidden text, art or layers) is never written over by an export or Save As to its own path unless `acknowledgeLoss: true` (`convert --replace-lossy`), so the original keeps what the document lacks. Where a `.ai` can't be read that way (or its layers are turned off in the import options), we read its PDF-compatible part, so Illustrator-only live objects arrive as appearance, and plain groups arrive ungrouped: that part draws each object on its own and marks only layers, clipping groups and groups with opacity, blending or a mask (those come back). Art outside the artboards isn't in that part at all (Illustrator's PDF part leaves it out), so it doesn't open; the import says so in a note (#472). Its pages still go where the editing data puts the artboards (a grid stays a grid), with the art on each, when it has as many artboards as pages, of the same sizes (#1068); the page of the artboard `CropAreaActive` names is then the active artboard. A `.ai` whose editing data has artboards but no layers also opens on that page under the same check, and its pages stay where they are. A `.ai` whose PDF part's pages are cropped to its art (each page the box of all the art, which is the editing data's bounding box) instead of its artboards opens from its layers, with its own artboards, where they draw as that page does. Its pages are laid out so that art one of them draws past its artboard (notes beside a design, which the part doesn't clip) doesn't lie over the page before it in the row, where it was taken for that page's art: the check against the editing data then found art its layers don't have there and opened the file as its PDF part, without the art outside the artboards. That part also has no paragraphs: area type is written line by line, and comes back as area type only where its font is installed and lays the lines out with the same breaks, else as a point type object per line (#508). Art off the page that a PDF does draw opens on the pasteboard. ## Format by format @@ -191,6 +191,7 @@ the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPri | Date | Change | Summary | |---|---|---| +| 2026-11-06 | minor | `.ai` and EPS import: Art brushes whose objects are in the older form (first number 1, one field fewer and 8 numbers at the end) come into the Brushes panel with their art instead of being left out with a note. In a survey of 302 users' EPS files (used locally, not committed), 652 Art brushes in 188 of the 197 files with the note were left out this way; afterwards 55 files have the note, all for Pattern brushes. Test `an_older_art_brush_comes_in_with_its_art` (crate `vectorcraft-eps`); scores unchanged | | 2026-11-06 | minor | SVG import: filter and mask regions clip (SVG 1.1 §15.5, §14.4). An object whose imported blur, shadow or glow reaches past its filter's region comes in inside a clip group cut to the region (#5876), and a mask's art is cut to the mask's region, in user space or the object's bounding box (#5875). Objects that fit their regions, and our own exports, are unchanged; primitive subregions are still ignored. Tests `import_live::a_blur_is_cut_at_its_filter_region`, `import_live::a_mask_counts_only_inside_its_region` (crate `vectorcraft-svg`); scores unchanged | | 2026-11-06 | minor | SVG import: a Gaussian blur keeps the colour space its filter asks for with `color-interpolation-filters` (initially `linearRGB`, SVG 1.1 §15.7.6): a linear-light blur becomes Gaussian Blur with the new `linear` parameter, which blurs the colours in linear light (black beside white meets at about 188/255 instead of 128), and SVG export writes it back on the `feGaussianBlur` (#5877). Blurs that ask for sRGB, and the blurs our own export writes, are as before. CSS export still writes `blur()`. Tests `pixel::tests::linear_light_blur_mixes_light_not_values` (crate `vectorcraft-effects`), `import_live::a_gaussian_blur_keeps_its_colour_space` (crate `vectorcraft-svg`); scores unchanged | | 2026-11-06 | minor | PDF export and PDF-compatible `.ai` saves write each object's URL (Attributes panel) as a link annotation with a URI action (web and mail URLs only) over the bounds of the object that shows, trimmed by its clipping groups (ISO 32000-1, 12.5.6.5 and 12.6.4.7); hidden objects, layers that don't print and prints have none, and PDF/X files leave them out with a warning (#5785). Own-fixture tests in `tests::links`; PDF import doesn't read links back as URLs yet; scores unchanged | diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md index c7f408423..c2e3431fd 100644 --- a/docs/target-app-parity.md +++ b/docs/target-app-parity.md @@ -1,6 +1,6 @@ # Parity with Adobe Illustrator -> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-06 · **Change:** minor (Drop Shadow and glow dialogs: spinner arrows, #5367, #5368; Stroke Weight Up and Down shortcuts, #5797; Hindi catalog and contributor loanword preferences; full wording review in progress; Properties in Edit Artboards: a Transform section with the reference point above the Artboards section, #5219; the Control bar's Stroke: and Opacity: links scrub their fields, #4088; an image zoomed in on is separated, colorized or proofed only where it shows (#4155); a document's first frame renders on the render worker, so opening a heavy file no longer freezes the window, #4155; Control bar Paragraph section with type selected, #5372; translating unchanged type reuses its glyph and character-stroke outlines; scores and estimates unchanged) · **Target:** Adobe Illustrator 2026 (30.x; public release notes through 30.7, August 2026) +> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-06 · **Change:** minor (`.ai` and EPS import: older Art brush objects read; Drop Shadow and glow dialogs: spinner arrows, #5367, #5368; Stroke Weight Up and Down shortcuts, #5797; Hindi catalog and contributor loanword preferences; full wording review in progress; Properties in Edit Artboards: a Transform section with the reference point above the Artboards section, #5219; the Control bar's Stroke: and Opacity: links scrub their fields, #4088; an image zoomed in on is separated, colorized or proofed only where it shows (#4155); a document's first frame renders on the render worker, so opening a heavy file no longer freezes the window, #4155; Control bar Paragraph section with type selected, #5372; translating unchanged type reuses its glyph and character-stroke outlines; scores and estimates unchanged) · **Target:** Adobe Illustrator 2026 (30.x; public release notes through 30.7, August 2026) ## Feature submission evidence @@ -1219,7 +1219,7 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur A `.ai` opened from its editing data opens its Objects on Path groups live, with their path, their objects in order along it, Pivot and Rotate, and their art where the file draws it; a group whose spacing has been dragged, or with options an Objects on Path group doesn't hold, opens as a plain group (`crates/eps/src/import/ai/tests.rs`). `.ai` symbol definitions and placed instances open as live symbols, in the Symbols panel's order; an instance of a symbol that isn't read, or whose appearance differs from its symbol's, comes in as the page draws it (`crates/eps/src/import/ai/tests.rs`). Blends and envelopes in the definitions of a `.ai`'s symbols, patterns and brushes' art count against the same per-file limits on blend layout and envelope checks as the layers' art, so a file with many definitions does not get those limits again for each one (`crates/eps/src/import/ai/read/directives.rs`). - A `.ai` or EPS whose editing data has brushes opens with the file's Calligraphic, Scatter, Art and Bristle brushes in the Brushes panel in place of the default ones, in the file's order: the Calligraphic size, roundness and angle with their variation, the Scatter size, spacing, scatter and rotation, the Bristle settings, and the Scatter and Art brushes' art. A brush library `.ai` (brushes and no layers) opens from its PDF part with its brushes, so Other Library lists them. Pattern brushes and brushes that can't be read are left out with a note; brushed paths still come in as their drawn look (part of #372 and #637; `crates/eps/src/import/ai/tests.rs`, `crates/eps/src/import/tests_native.rs`). + A `.ai` or EPS whose editing data has brushes opens with the file's Calligraphic, Scatter, Art and Bristle brushes in the Brushes panel in place of the default ones, in the file's order: the Calligraphic size, roundness and angle with their variation, the Scatter size, spacing, scatter and rotation, the Bristle settings, and the Scatter and Art brushes' art (Art brushes in the older and newer forms of their objects). A brush library `.ai` (brushes and no layers) opens from its PDF part with its brushes, so Other Library lists them. Pattern brushes and brushes that can't be read are left out with a note; brushed paths still come in as their drawn look (part of #372 and #637; `crates/eps/src/import/ai/tests.rs`, `crates/eps/src/import/tests_native.rs`). In a `.ai` opened from its editing data, a path or type object with Offset Path, Outline Object or Outline Stroke on the whole object opens as itself with those effects live, in their order and shown or hidden; on a fill or stroke of type they stay on that fill or stroke. Offset Path keeps its Offset, Joins and Miter Limit, and Outline Stroke takes its width from the stroke. An Offset Path with a setting missing, out of range or not read keeps the drawn art, as does a path with a Path effect on one fill or stroke (`crates/eps/src/import/ai/style/tests.rs`, `crates/eps/src/import/ai/tests.rs`, `crates/eps/src/import/tests_native.rs`). In a `.ai` opened from its editing data, an object with a Tweak that moves nothing or Pucker & Bloat at 0 opens as itself with the effect live. A path, compound path or group whose only effect is Transform without copies, or a Free Distort whose corners make a parallelogram, opens as itself with it live, and so does an unstroked path or compound path with straight segments whose only effect is Twist. A gradient or pattern, an image, type, a clipping group, an opacity mask or effects inside the object, or a stroke with a Transform that scales, rotates or reflects, keep the drawn art (`crates/eps/src/import/ai/style/tests.rs`, `crates/eps/src/import/ai/tests.rs`, `crates/eps/src/import/ai/read/ops.rs`). A PDF page whose `UserUnit` (PDF 1.6) is above 1 opens at its size in points, its numbers times the `UserUnit` (one above 75,000 counts as 75,000), and `document.pdfInfo` gives its size and boxes in points too. A `.ai` whose editing data has its artboards in the units of such a page opens from that data at the page's size, with its layers, and when the layers can't be read its pages still take the artboard layout of the data, scaled the same way (part of #1482). @@ -1703,6 +1703,7 @@ Edit › Copy and Cut put the selected ruler guides on the clipboard, with the s | Date | Change | Summary | |---|---|---| +| 2026-11-06 | minor | `.ai` and EPS import: Art brushes in the older form of their objects come into the Brushes panel; evidence updated; scores unchanged. | | 2026-11-06 | minor | Drop Shadow, Outer Glow and Inner Glow: their number fields have spinner arrows (#5367, #5368); evidence added; scores unchanged. | | 2026-11-06 | minor | Stroke Weight Up and Down (Cmd/Ctrl+Alt+. and ,) step each selected stroke's weight (#5797); evidence added; scores unchanged. | | 2026-11-06 | minor | Hindi (`hi`): 7,877-row machine-assisted catalog, zero/one singular plurals, desktop font fallback and optional Devanagari craft-fonts fallback; all 55 translation tests pass; native review and a web font remain; scores and estimates unchanged | From e6e8dde8744516035cae1de1faf6e4a5ea0ac778 Mon Sep 17 00:00:00 2001 From: Don Omondi <282319807+mockydevs@users.noreply.github.com> Date: Sat, 7 Nov 2026 00:12:00 -0500 Subject: [PATCH 03/30] Docs: keep this branch's entries that the merge with main dropped --- docs/target-app-parity.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md index 0af2f0670..8463add56 100644 --- a/docs/target-app-parity.md +++ b/docs/target-app-parity.md @@ -1,6 +1,6 @@ # Parity with Adobe Illustrator -> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-07 · **Change:** minor (the canvas keeps selection outlines and anchors between frames; Indian-language hyphenation review and license allowlist, #4947; Stroke gradients: an arrowhead aligned to the tip is painted to the corners of its base, #5964; Drop Shadow and glow dialogs: spinner arrows, #5367, #5368; Stroke Weight Up and Down shortcuts, #5797; Hindi catalog and contributor loanword preferences; full wording review in progress; Properties in Edit Artboards: a Transform section with the reference point above the Artboards section, #5219; the Control bar's Stroke: and Opacity: links scrub their fields, #4088; an image zoomed in on is separated, colorized or proofed only where it shows (#4155); a document's first frame renders on the render worker, so opening a heavy file no longer freezes the window, #4155; Control bar Paragraph section with type selected, #5372; translating unchanged type reuses its glyph and character-stroke outlines; scores and estimates unchanged) · **Target:** Adobe Illustrator 2026 (30.x; public release notes through 30.7, August 2026) +> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-07 · **Change:** minor (`.ai` and EPS import: older Art brush objects read; the canvas keeps selection outlines and anchors between frames; Indian-language hyphenation review and license allowlist, #4947; Stroke gradients: an arrowhead aligned to the tip is painted to the corners of its base, #5964; Drop Shadow and glow dialogs: spinner arrows, #5367, #5368; Stroke Weight Up and Down shortcuts, #5797; Hindi catalog and contributor loanword preferences; full wording review in progress; Properties in Edit Artboards: a Transform section with the reference point above the Artboards section, #5219; the Control bar's Stroke: and Opacity: links scrub their fields, #4088; an image zoomed in on is separated, colorized or proofed only where it shows (#4155); a document's first frame renders on the render worker, so opening a heavy file no longer freezes the window, #4155; Control bar Paragraph section with type selected, #5372; translating unchanged type reuses its glyph and character-stroke outlines; scores and estimates unchanged) · **Target:** Adobe Illustrator 2026 (30.x; public release notes through 30.7, August 2026) ## Feature submission evidence @@ -1237,7 +1237,7 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur A `.ai` opened from its editing data opens its Objects on Path groups live, with their path, their objects in order along it, Pivot and Rotate, and their art where the file draws it; a group whose spacing has been dragged, or with options an Objects on Path group doesn't hold, opens as a plain group (`crates/eps/src/import/ai/tests.rs`). `.ai` symbol definitions and placed instances open as live symbols, in the Symbols panel's order; an instance of a symbol that isn't read, or whose appearance differs from its symbol's, comes in as the page draws it (`crates/eps/src/import/ai/tests.rs`). Blends and envelopes in the definitions of a `.ai`'s symbols, patterns and brushes' art count against the same per-file limits on blend layout and envelope checks as the layers' art, so a file with many definitions does not get those limits again for each one (`crates/eps/src/import/ai/read/directives.rs`). - A `.ai` or EPS whose editing data has brushes opens with the file's Calligraphic, Scatter, Art and Bristle brushes in the Brushes panel in place of the default ones, in the file's order: the Calligraphic size, roundness and angle with their variation, the Scatter size, spacing, scatter and rotation, the Bristle settings, and the Scatter and Art brushes' art. A brush library `.ai` (brushes and no layers) opens from its PDF part with its brushes, so Other Library lists them. An Art brush in Tints keeps that colorization. Pattern brushes and brushes that can't be read are left out with a note. Paths with a Calligraphic brush, and paths with an Art brush at 100% in Tints that stretches art of solid-filled paths unflipped, open as the path with the brush on its stroke, and other brushed paths still come in as their drawn look (part of #372 and #637; `crates/eps/src/import/ai/tests.rs`, `crates/eps/src/import/tests_native.rs`). + A `.ai` or EPS whose editing data has brushes opens with the file's Calligraphic, Scatter, Art and Bristle brushes in the Brushes panel in place of the default ones, in the file's order: the Calligraphic size, roundness and angle with their variation, the Scatter size, spacing, scatter and rotation, the Bristle settings, and the Scatter and Art brushes' art (Art brushes in the older and newer forms of their objects). A brush library `.ai` (brushes and no layers) opens from its PDF part with its brushes, so Other Library lists them. An Art brush in Tints keeps that colorization. Pattern brushes and brushes that can't be read are left out with a note. Paths with a Calligraphic brush, and paths with an Art brush at 100% in Tints that stretches art of solid-filled paths unflipped, open as the path with the brush on its stroke, and other brushed paths still come in as their drawn look (part of #372 and #637; `crates/eps/src/import/ai/tests.rs`, `crates/eps/src/import/tests_native.rs`). In a `.ai` opened from its editing data, a path or type object with Offset Path, Outline Object or Outline Stroke on the whole object opens as itself with those effects live, in their order and shown or hidden; on a fill or stroke of type they stay on that fill or stroke. Offset Path keeps its Offset, Joins and Miter Limit, and Outline Stroke takes its width from the stroke. An Offset Path with a setting missing, out of range or not read keeps the drawn art, as does a path with a Path effect on one fill or stroke (`crates/eps/src/import/ai/style/tests.rs`, `crates/eps/src/import/ai/tests.rs`, `crates/eps/src/import/tests_native.rs`). In a `.ai` opened from its editing data, an object with a Tweak that moves nothing or Pucker & Bloat at 0 opens as itself with the effect live. A path, compound path or group whose only effect is Transform without copies, or a Free Distort whose corners make a parallelogram, opens as itself with it live, and so does an unstroked path or compound path with straight segments whose only effect is Twist. A gradient or pattern, an image, type, a clipping group, an opacity mask or effects inside the object, or a stroke with a Transform that scales, rotates or reflects, keep the drawn art (`crates/eps/src/import/ai/style/tests.rs`, `crates/eps/src/import/ai/tests.rs`, `crates/eps/src/import/ai/read/ops.rs`). A PDF page whose `UserUnit` (PDF 1.6) is above 1 opens at its size in points, its numbers times the `UserUnit` (one above 75,000 counts as 75,000), and `document.pdfInfo` gives its size and boxes in points too. A `.ai` whose editing data has its artboards in the units of such a page opens from that data at the page's size, with its layers, and when the layers can't be read its pages still take the artboard layout of the data, scaled the same way (part of #1482). @@ -1725,6 +1725,7 @@ Edit › Copy and Cut put the selected ruler guides on the clipboard, with the s | Date | Change | Summary | |---|---|---| +| 2026-11-06 | minor | `.ai` and EPS import: Art brushes in the older form of their objects come into the Brushes panel; evidence updated; scores unchanged. | | 2026-11-06 | minor | Direct Selection: with Snap to Grid, a dragged straight segment lands its anchors on the grid (#3835); evidence added; scores unchanged. | | 2026-11-06 | minor | Snap to Glyph › Glyph Bounds: the corners of each glyph's box are points a drawn point lands on, also on a curved side (`B`), and the box turns with rotated type, its edges then Angular Guides (#5112; [Snap to Glyph options](https://helpx.adobe.com/illustrator/desktop/design-with-text/special-characters-glyphs/snap-to-glyph-options.html)); scores and estimates unchanged. | | 2026-11-06 | minor | Drop Shadow: a swatch beside Color opens the Color Picker over the dialog, as the other effect colour fields do (#5364); correction: the #5365 entry listed Drop Shadow, whose Color is drawn outside the shared grid and had no swatch; scores unchanged. | From 120bcf102ea22e243dd91d488e4a5893cbe3476c Mon Sep 17 00:00:00 2001 From: Don Omondi <282319807+mockydevs@users.noreply.github.com> Date: Sat, 7 Nov 2026 05:07:25 -0500 Subject: [PATCH 04/30] .ai import: an Art brush with neither form's count of numbers isn't read An Art brush object whose last field had neither 15 numbers nor the older form's 8 came in with default settings. It is now left out like other brushes whose values can't be read. An older-form Art brush keeps the Art brush's default colorization, as the note says. --- crates/eps/src/import/ai/brush.rs | 11 +++++++---- crates/eps/src/import/ai/tests.rs | 6 ++++++ 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/crates/eps/src/import/ai/brush.rs b/crates/eps/src/import/ai/brush.rs index 69e88528c..4dd1de52c 100644 --- a/crates/eps/src/import/ai/brush.rs +++ b/crates/eps/src/import/ai/brush.rs @@ -334,10 +334,13 @@ pub(super) fn parse_tool_object(kind: Tool, name: &str, params: &str) -> Result< } Tool::Art => { // The older form's 8 numbers aren't known: its brush keeps the defaults and its - // paths their drawn look. - let (colorization, plain) = match <&[f64; 15]>::try_from(n.as_slice()) { - Ok(n15) => (if n15[1] == 1.0 { Colorization::Tints } else { Colorization::None }, art_is_plain(n15)), - Err(_) => (Colorization::None, false), + // paths their drawn look. Any other count isn't a form this reads. + let (colorization, plain) = if let Ok(n15) = <&[f64; 15]>::try_from(n.as_slice()) { + (if n15[1] == 1.0 { Colorization::Tints } else { Colorization::None }, art_is_plain(n15)) + } else if n.len() == 8 { + (ArtBrush::default().colorization, false) + } else { + return Err(BrushError::Values); }; DraftKind::Art { brush: ArtBrush { colorization, ..ArtBrush::default() }, art: art()?, plain } } diff --git a/crates/eps/src/import/ai/tests.rs b/crates/eps/src/import/ai/tests.rs index f3c8be340..78e46d0cc 100644 --- a/crates/eps/src/import/ai/tests.rs +++ b/crates/eps/src/import/ai/tests.rs @@ -7791,6 +7791,12 @@ fn an_older_art_brush_comes_in_with_its_art() { const OLD_RIBBON: &str = "1 / Ribbon art/ / / / / 0 1 / 1 0 1 0 1 0 0 0"; let d = brush::parse_tool_object(brush::Tool::Art, "Ribbon", OLD_RIBBON).unwrap(); assert!(matches!(d.kind, brush::DraftKind::Art { ref art, plain: false, .. } if art == "Ribbon art"), "{d:?}"); + let brush::DraftKind::Art { ref brush, .. } = d.kind else { panic!("art") }; + assert_eq!(brush.colorization, vectorcraft_brush::ArtBrush::default().colorization, "the default colorization"); + // A count of numbers neither form has isn't read. + for bad in ["1 / Ribbon art/ / / / / 0 1 / 1 0 1 0 1 0 0", "1 / Ribbon art/ / / / / 0 1 / 1 0 1 0 1 0 0 0 0 0 0 0 0 0 0 0"] { + assert_eq!(brush::parse_tool_object(brush::Tool::Art, "Ribbon", bad), Err(brush::BrushError::Values), "{bad}"); + } assert_eq!(brush::parse_tool_object(brush::Tool::Scatter, "Spray", "1 /Dot art/ 0 1 / 1 0 1 0 1 0 0 0"), Err(brush::BrushError::Values)); let objects = [plugin_object(ART_BRUSH, "Ribbon", OLD_RIBBON), plugin_object(ART_BRUSH, "Bare", "1 / / / / / / 0 1 / 1 0 1 0 1 0 0 0")].concat(); let r = read_ok(&format!("{}{objects}{}", brush_art("Ribbon art", 4.0), layer(""))); From 7436a38f440e7112d3df7d54a9f722100f3a9a2e Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sat, 7 Nov 2026 16:49:38 -0800 Subject: [PATCH 05/30] JavaScript: Object, Function, Array, Error, Math and JSON built-ins vectorcraft-js now provides the ECMAScript 5.1 built-ins: the Object property-descriptor functions, create, keys, seal and freeze (15.2), Function.prototype.bind (15.3.4.5), Array with every ES5 method (15.4), the error types (15.11), Math (15.8), JSON with revivers, replacers and indentation (15.12), and the global functions with Annex B's escape and unescape (15.1, B.2). Prototype methods are writable and configurable. The array methods work on array-like objects and visit only the indices that exist, so a sparse array of length 2^32-1 costs as much as its elements, and they see indices a callback adds. join writes a cycle back to an array as an empty string; JSON.stringify throws a TypeError on a cycle. JSON parsing, writing and the reviver walk use no native recursion. Every loop takes fuel and every result is checked against the heap limit, so new Array(4294967295).join("x") ends with the heap limit and a huge sort or stringify ends with a limit. cargo xtask test262 also runs the suite's ES5 built-in tests and fetches json2.js at a pinned commit, checked against its SHA-256, to compare its output with the built-in JSON once Date, String.prototype.replace and RegExp exist. --- crates/js/src/builtins.rs | 181 ++++++- crates/js/src/builtins/array.rs | 843 +++++++++++++++++++++++++++++++ crates/js/src/builtins/global.rs | 339 +++++++++++++ crates/js/src/builtins/json.rs | 677 +++++++++++++++++++++++++ crates/js/src/builtins/math.rs | 209 ++++++++ crates/js/src/builtins/object.rs | 302 +++++++++++ crates/js/src/builtins_tests.rs | 503 ++++++++++++++++++ crates/js/src/heap.rs | 32 +- crates/js/src/interp.rs | 376 +++++++++++++- crates/js/src/lib.rs | 12 +- crates/js/src/realm.rs | 1 + crates/js/tests/json2.rs | 83 +++ crates/js/tests/test262.rs | 75 ++- docs/target-app-parity.md | 3 +- xtask/src/test262.rs | 62 ++- 15 files changed, 3639 insertions(+), 59 deletions(-) create mode 100644 crates/js/src/builtins/array.rs create mode 100644 crates/js/src/builtins/global.rs create mode 100644 crates/js/src/builtins/json.rs create mode 100644 crates/js/src/builtins/math.rs create mode 100644 crates/js/src/builtins/object.rs create mode 100644 crates/js/src/builtins_tests.rs create mode 100644 crates/js/tests/json2.rs diff --git a/crates/js/src/builtins.rs b/crates/js/src/builtins.rs index b16aa9c9e..df698d42f 100644 --- a/crates/js/src/builtins.rs +++ b/crates/js/src/builtins.rs @@ -1,15 +1,28 @@ -//! The built-in objects the interpreter itself needs (ECMA-262 5.1 section 15): `Object` and the -//! basic methods of `Object.prototype`, `Function` with `Function.prototype.call`, `apply` and -//! `toString`, `eval`, the error constructors and `Error.prototype.toString`, and the prototypes -//! primitive values look properties up on. The rest of the standard library is not here yet. +//! The built-in objects (ECMA-262 5.1 section 15): `Object` with `Object.prototype` and the +//! ES5 statics, `Function` with `Function.prototype.call`, `apply`, `bind` and `toString`, +//! `Array`, the error constructors, `Math`, `JSON`, the global functions and constants, Annex +//! B's `escape` and `unescape`, and the prototypes primitive values look properties up on. +//! `String`, `Number`, `Boolean`, `RegExp` and `Date` are not here yet. +//! +//! Every loop in a built-in takes a unit of fuel for each step, and every string, array, object +//! or property it makes is checked against the heap limit before it is made, so no built-in can +//! run past [`crate::Limits`]. + +mod array; +mod global; +mod json; +mod math; +mod object; use std::rc::Rc; use crate::bytecode::{CodeKind, Source}; use crate::compiler::{CompileFail, compile_constructed_function}; -use crate::heap::{Class, Func, HIDDEN, NativeFn, NativeKind, ObjId, Object, Prop, key, string_bytes}; -use crate::interp::{Abrupt, ErrorType, Interp, JsResult}; -use crate::value::{Str, Value}; +use crate::heap::{ + BOUND_ARG_BYTES, Class, Func, HIDDEN, Key, NativeFn, NativeKind, OBJECT_BYTES, OPEN, ObjId, Object, PROP_BYTES, Prop, key, string_bytes, +}; +use crate::interp::{Abrupt, Desc, ErrorType, Interp, JsResult}; +use crate::value::{Str, Value, index_key, number_to_str, to_uint32}; fn alloc(interp: &mut Interp, class: Class, proto: Option) -> ObjId { interp.heap.alloc_object(Object::new(class, proto)) @@ -66,7 +79,7 @@ fn try_install(interp: &mut Interp) -> JsResult<()> { interp.intrinsics.array_proto = alloc(interp, Class::Array { length: 0, length_writable: true }, Some(object_proto)); interp.intrinsics.string_proto = alloc(interp, Class::String(Str::from("")), Some(object_proto)); interp.intrinsics.number_proto = alloc(interp, Class::Number, Some(object_proto)); - interp.intrinsics.boolean_proto = alloc(interp, Class::Boolean, Some(object_proto)); + interp.intrinsics.boolean_proto = alloc(interp, Class::Boolean(false), Some(object_proto)); interp.intrinsics.regexp_proto = alloc(interp, Class::Ordinary, Some(object_proto)); let thrower = native(interp, "", throw_type_error, 0, NativeKind::Plain, false)?; if let Some(t) = interp.heap.object_mut(thrower) { @@ -96,9 +109,134 @@ fn try_install(interp: &mut Interp) -> JsResult<()> { data(interp, function_proto, "call", Value::Object(call), HIDDEN)?; let apply = native(interp, "apply", unreachable_native, 2, NativeKind::Apply, false)?; data(interp, function_proto, "apply", Value::Object(apply), HIDDEN)?; + method(interp, function_proto, "bind", function_bind, 1)?; method(interp, function_proto, "toString", function_to_string, 0)?; - install_errors(interp, object_proto) + install_errors(interp, object_proto)?; + object::install(interp, object)?; + array::install(interp)?; + math::install(interp)?; + json::install(interp)?; + global::install(interp) +} + +// ---- helpers for the built-ins ---- + +/// ToInteger (section 9.4). +fn to_integer(interp: &mut Interp, v: &Value) -> JsResult { + let n = interp.to_number(v)?; + Ok(if n.is_nan() { 0.0 } else { n.trunc() }) +} + +/// The property name of the index `n`, which may be past the largest array index. +fn key_of(n: f64) -> Key { + if (0.0..4_294_967_295.0).contains(&n) && n.fract() == 0.0 { + #[allow(clippy::cast_possible_truncation, clippy::cast_sign_loss)] + return index_key(n as u32); + } + number_to_str(n).flat() +} + +/// ToUint32 of an object's `length`. +fn length_of(interp: &mut Interp, o: ObjId) -> JsResult { + let len = interp.get_from(o, &key("length"), &Value::Object(o))?; + Ok(to_uint32(interp.to_number(&len)?)) +} + +fn get_at(interp: &mut Interp, o: ObjId, k: f64) -> JsResult { + interp.get_from(o, &key_of(k), &Value::Object(o)) +} + +fn has_at(interp: &mut Interp, o: ObjId, k: f64) -> JsResult { + interp.has_property(o, &key_of(k)) +} + +/// The estimated bytes a new element adds. +const ELEMENT_BYTES: usize = PROP_BYTES + 32 + 2 * 10; + +/// `o[k] = v` as the array methods assign: a failure throws. +fn put_at(interp: &mut Interp, o: ObjId, k: f64, v: Value) -> JsResult<()> { + interp.reserve_heap(ELEMENT_BYTES)?; + interp.put(o, key_of(k), v, true) +} + +fn delete_at(interp: &mut Interp, o: ObjId, k: f64) -> JsResult<()> { + interp.delete(o, &key_of(k), true).map(drop) +} + +/// Defines `a[k]` as a writable, enumerable and configurable data property, as the methods that +/// build a new array do (DefineOwnProperty with `throw` false). +fn create_at(interp: &mut Interp, a: ObjId, k: f64, v: Value) -> JsResult<()> { + interp.reserve_heap(ELEMENT_BYTES)?; + interp.define_own_property(a, key_of(k), &Desc::data(v, OPEN), false).map(drop) +} + +/// A new array with the given length and no elements. +fn new_array(interp: &mut Interp, length: u32) -> JsResult { + interp.reserve_heap(OBJECT_BYTES)?; + let proto = interp.intrinsics.array_proto; + Ok(interp.heap.alloc_object(Object::new(Class::Array { length, length_writable: true }, Some(proto)))) +} + +/// A new string from code units, checked against the heap limit and charged to the heap. +fn new_string(interp: &mut Interp, units: Vec) -> JsResult { + let bytes = string_bytes(units.len()); + interp.reserve_heap(bytes)?; + interp.heap.bytes = interp.heap.bytes.saturating_add(bytes); + Ok(Value::String(Str::from_units(units))) +} + +/// A string the built-ins build piece by piece: each piece is checked against the longest string +/// the heap limit allows and its bytes are reserved before it is added. Everything the caller +/// still needs must be reachable from the roots. +struct Builder { + units: Vec, + /// Code units already reserved and charged to the heap. + charged: usize, +} + +impl Builder { + fn new() -> Self { + Builder { units: Vec::new(), charged: 0 } + } + + /// Checks that `more` code units fit, reserving heap for them. + fn make_room(&mut self, interp: &mut Interp, more: usize) -> JsResult<()> { + let want = self.units.len().saturating_add(more); + if want > interp.limits.heap_bytes / 4 { + return Err(Abrupt::Limit(crate::LimitKind::Heap)); + } + if want > self.charged { + let grow = (want - self.charged).max(self.charged / 2).max(256).min((interp.limits.heap_bytes / 4).saturating_sub(self.charged)); + interp.reserve_heap(2 * grow)?; + interp.heap.bytes = interp.heap.bytes.saturating_add(2 * grow); + self.charged += grow; + } + Ok(()) + } + + fn push_units(&mut self, interp: &mut Interp, units: &[u16]) -> JsResult<()> { + self.make_room(interp, units.len())?; + self.units.extend_from_slice(units); + Ok(()) + } + + fn push_str(&mut self, interp: &mut Interp, s: &str) -> JsResult<()> { + let units: Vec = s.encode_utf16().collect(); + self.push_units(interp, &units) + } + + /// The string built, whose bytes were charged as it grew. + fn finish(self) -> Value { + Value::String(Str::from_units(self.units)) + } +} + +fn require_callable(interp: &mut Interp, v: &Value, what: &str) -> JsResult<()> { + if interp.is_callable(v) { + return Ok(()); + } + Err(interp.type_error(&format!("{what} is not a function"))) } fn install_errors(interp: &mut Interp, object_proto: ObjId) -> JsResult<()> { @@ -278,11 +416,36 @@ fn function_to_string(interp: &mut Interp, this: Value, _: &[Value], _: bool) -> } Some(Func::Native { name, .. }) => format!("function {name}() {{ [native code] }}"), Some(Func::Host { name, .. }) => format!("function {name}() {{ [native code] }}"), + Some(Func::Bound { .. }) => "function () { [native code] }".to_string(), None => return Err(interp.type_error("Function.prototype.toString was called on a value that is not a function")), }; Ok(Value::str(&text)) } +/// `Function.prototype.bind` (section 15.3.4.5). +fn function_bind(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResult { + require_callable(interp, &this, "the value bind was called on")?; + let Some(target) = this.as_object() else { return Err(interp.type_error("the value bind was called on is not a function")) }; + let bound_this = arg(args, 0); + let bound_args: Rc<[Value]> = args.get(1..).unwrap_or_default().into(); + let target_length = match interp.get_from(target, &key("length"), &this)? { + Value::Number(n) => n, + _ => 0.0, + }; + let length = (target_length - bound_args.len() as f64).max(0.0); + interp.reserve_heap(OBJECT_BYTES + 4 * PROP_BYTES + BOUND_ARG_BYTES * bound_args.len())?; + let proto = interp.intrinsics.function_proto; + let class = Class::Function(Func::Bound { target, this: bound_this, args: bound_args.clone() }); + let f = interp.heap.alloc_object(Object::new(class, Some(proto))); + interp.heap.bytes = interp.heap.bytes.saturating_add(BOUND_ARG_BYTES * bound_args.len()); + interp.define(f, key("length"), Prop::Data { value: Value::Number(length), flags: 0 })?; + let thrower = Some(interp.intrinsics.throw_type_error); + for name in ["caller", "arguments"] { + interp.define(f, key(name), Prop::Accessor { get: thrower, set: thrower, flags: 0 })?; + } + Ok(Value::Object(f)) +} + /// The global `eval` called indirectly (section 15.1.2.1.1): global code in the global /// environment. fn eval(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { diff --git a/crates/js/src/builtins/array.rs b/crates/js/src/builtins/array.rs new file mode 100644 index 000000000..7eda02a60 --- /dev/null +++ b/crates/js/src/builtins/array.rs @@ -0,0 +1,843 @@ +//! `Array` (ECMA-262 5.1 section 15.4): the constructor, `Array.isArray` and every method of +//! `Array.prototype`. The methods are generic: they read `length` and the elements of any object. +//! +//! A method that walks a range of indices visits only the indices that can hold an element when +//! the range is much longer than the object has properties (a sparse array such as +//! `new Array(4294967295)`), so a long empty range costs nothing and no index is allocated for +//! it. The list of indices is made again whenever a script adds an index property to any object +//! while the method runs. Every index visited takes a unit of fuel. + +use super::{ + Builder, ELEMENT_BYTES, arg, constructor, create_at, delete_at, get_at, has_at, length_of, method, native, new_array, object_to_string, put_at, + require_callable, to_integer, +}; +use crate::heap::{Class, NativeKind, ObjId}; +use crate::interp::{Abrupt, Interp, JsResult, strict_eq}; +use crate::value::{Str, Value, to_uint32}; + +pub(super) fn install(interp: &mut Interp) -> JsResult<()> { + let proto = interp.intrinsics.array_proto; + let array = native(interp, "Array", array_ctor, 1, NativeKind::Plain, true)?; + constructor(interp, "Array", array, proto)?; + method(interp, array, "isArray", is_array, 1)?; + let methods: [(&'static str, crate::heap::NativeFn, u32); 21] = [ + ("toString", to_string, 0), + ("toLocaleString", to_locale_string, 0), + ("concat", concat, 1), + ("join", join, 1), + ("pop", pop, 0), + ("push", push, 1), + ("reverse", reverse, 0), + ("shift", shift, 0), + ("slice", slice, 2), + ("sort", sort, 1), + ("splice", splice, 2), + ("unshift", unshift, 1), + ("indexOf", index_of, 1), + ("lastIndexOf", last_index_of, 1), + ("every", every, 1), + ("some", some, 1), + ("forEach", for_each, 1), + ("map", map, 1), + ("filter", filter, 1), + ("reduce", reduce, 1), + ("reduceRight", reduce_right, 1), + ]; + for (name, f, length) in methods { + method(interp, proto, name, f, length)?; + } + Ok(()) +} + +// ---- visiting indices ---- + +/// Ranges at most this long are visited index by index. +const DENSE_SPAN: u64 = 4096; + +/// How an index an object holds names an index to visit. +#[derive(Clone, Copy)] +enum Map { + /// The index `p` asks for a visit of `p - shift`. + Shift(i64), + /// The index `p` asks for a visit of `p` and of `mirror - p`. + Mirror(i64), +} + +/// The indices of a range, in order, that an operation must visit. +struct Indices { + obj: ObjId, + /// The range left to visit, `lo` included and `hi` not. + lo: u64, + hi: u64, + ascending: bool, + maps: Vec, + /// The indices left when the range is visited sparsely. + sparse: Option, +} + +struct Sparse { + list: Vec, + pos: usize, + /// [`crate::heap::Heap::index_epoch`] when the list was made. + epoch: u64, +} + +/// The canonical numeric property name `k` stands for, up to 15 digits. +fn numeric_index(k: &[u16]) -> Option { + if k.is_empty() || k.len() > 15 || (k.len() > 1 && k.first() == Some(&u16::from(b'0'))) { + return None; + } + let mut n = 0u64; + for &u in k { + let d = u.checked_sub(u16::from(b'0')).filter(|d| *d <= 9)?; + n = n * 10 + u64::from(d); + } + Some(n) +} + +/// The objects of the prototype chain from `obj`, with how many properties (and String object +/// indices) each holds. +fn chain(interp: &Interp, obj: ObjId) -> Vec<(ObjId, usize)> { + let mut out = Vec::new(); + let mut cur = Some(obj); + while let Some(id) = cur { + let Some(o) = interp.heap.object(id) else { break }; + let string_len = if let Class::String(s) = &o.class { s.len() } else { 0 }; + out.push((id, o.props.len().saturating_add(string_len))); + cur = o.proto; + } + out +} + +impl Indices { + fn new(interp: &mut Interp, obj: ObjId, lo: u64, hi: u64, ascending: bool, maps: Vec) -> JsResult { + let mut it = Indices { obj, lo, hi, ascending, maps, sparse: None }; + if hi.saturating_sub(lo) > DENSE_SPAN { + let present: usize = chain(interp, obj).iter().map(|(_, n)| *n).fold(0, usize::saturating_add); + if hi - lo > (present as u64).saturating_mul(8) { + it.sparse = Some(it.gather(interp)?); + } + } + Ok(it) + } + + fn up(interp: &mut Interp, obj: ObjId, lo: u64, hi: u64) -> JsResult { + Self::new(interp, obj, lo, hi, true, vec![Map::Shift(0)]) + } + + fn down(interp: &mut Interp, obj: ObjId, lo: u64, hi: u64) -> JsResult { + Self::new(interp, obj, lo, hi, false, vec![Map::Shift(0)]) + } + + /// Lists the indices left to visit from the properties of the object and its prototypes. + /// Each property takes a unit of fuel. + fn gather(&self, interp: &mut Interp) -> JsResult { + let epoch = interp.heap.index_epoch; + let mut list: Vec = Vec::new(); + for (id, n) in chain(interp, self.obj) { + for _ in 0..n { + interp.use_fuel()?; + } + interp.reserve_heap(n.saturating_mul(8).saturating_mul(self.maps.len() + 1))?; + let Some(o) = interp.heap.object(id) else { continue }; + let string_len = if let Class::String(s) = &o.class { s.len() } else { 0 }; + let present = (0..string_len as u64).chain(o.props.iter().filter_map(|(k, _)| numeric_index(k))); + for p in present { + for map in &self.maps { + let p = p as i64; + let ks = match *map { + Map::Shift(s) => [Some(p - s), None], + Map::Mirror(m) => [Some(p), Some(m - p)], + }; + for k in ks.into_iter().flatten() { + if k >= 0 && (k as u64) >= self.lo && (k as u64) < self.hi { + list.push(k as u64); + } + } + } + } + } + if self.ascending { + list.sort_unstable(); + } else { + list.sort_unstable_by(|a, b| b.cmp(a)); + } + list.dedup(); + Ok(Sparse { list, pos: 0, epoch }) + } + + /// The next index to visit; it takes a unit of fuel. + fn next(&mut self, interp: &mut Interp) -> JsResult> { + if self.lo >= self.hi { + return Ok(None); + } + if self.sparse.as_ref().is_some_and(|s| s.epoch != interp.heap.index_epoch) { + self.sparse = Some(self.gather(interp)?); + } + let k = match &mut self.sparse { + None if self.ascending => self.lo, + None => self.hi - 1, + Some(s) => { + let Some(&k) = s.list.get(s.pos) else { + self.lo = self.hi; + return Ok(None); + }; + s.pos += 1; + k + } + }; + if self.ascending { + self.lo = k + 1; + } else { + self.hi = k; + } + interp.use_fuel()?; + Ok(Some(k)) + } +} + +/// The element at `k` when the object or its prototypes have one. +fn element(interp: &mut Interp, o: ObjId, k: u64) -> JsResult> { + let k = k as f64; + if !has_at(interp, o, k)? { + return Ok(None); + } + get_at(interp, o, k).map(Some) +} + +/// ToObject of `this`, kept reachable while `f` runs. +fn with_this(interp: &mut Interp, this: &Value, f: impl FnOnce(&mut Interp, ObjId) -> JsResult) -> JsResult { + let o = interp.to_object(this)?; + interp.rooted(&[Value::Object(o)], |interp| f(interp, o)) +} + +/// The start a relative index gives within `0..=len` (`slice` and `splice`). +fn relative(interp: &mut Interp, v: &Value, len: u32) -> JsResult { + let n = to_integer(interp, v)?; + let len = f64::from(len); + Ok(if n < 0.0 { (len + n).max(0.0) } else { n.min(len) } as u64) +} + +fn number(k: u64) -> Value { + Value::Number(k as f64) +} + +// ---- the constructor ---- + +/// `Array(…)` and `new Array(…)` (sections 15.4.1 and 15.4.2). +fn array_ctor(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + if let [Value::Number(n)] = args { + let len = to_uint32(*n); + if f64::from(len) != *n { + return Err(interp.throw(crate::interp::ErrorType::Range, "invalid array length")); + } + return new_array(interp, len).map(Value::Object); + } + let a = new_array(interp, 0)?; + interp.rooted(&[Value::Object(a)], |interp| { + for (i, v) in args.iter().enumerate() { + interp.use_fuel()?; + create_at(interp, a, i as f64, v.clone())?; + } + Ok(Value::Object(a)) + }) +} + +/// `Array.isArray` (section 15.4.3.2). +fn is_array(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + let a = arg(args, 0).as_object().and_then(|o| interp.heap.object(o)).is_some_and(|o| matches!(o.class, Class::Array { .. })); + Ok(Value::Bool(a)) +} + +// ---- conversions ---- + +/// `Array.prototype.toString` (section 15.4.4.2). +fn to_string(interp: &mut Interp, this: Value, _: &[Value], _: bool) -> JsResult { + with_this(interp, &this, |interp, o| { + let join = interp.get_from(o, &crate::heap::key("join"), &Value::Object(o))?; + if interp.is_callable(&join) { + return interp.call(&join, &Value::Object(o), &[]); + } + object_to_string(interp, Value::Object(o), &[], false) + }) +} + +/// Joins the elements `0..len` of `o`, each turned into a string by `item`, with `sep` between +/// them. A cycle back to an object being joined joins as an empty string. +fn join_with(interp: &mut Interp, o: ObjId, sep: &[u16], item: fn(&mut Interp, Value) -> JsResult>) -> JsResult { + if interp.join_stack.contains(&o) { + return Ok(Value::str("")); + } + let len = length_of(interp, o)?; + if len == 0 { + return Ok(Value::str("")); + } + // A result that cannot fit is refused before any element is read. + let least = (sep.len() as u64).saturating_mul(u64::from(len - 1)); + if least > (interp.limits.heap_bytes / 4) as u64 { + return Err(Abrupt::Limit(crate::LimitKind::Heap)); + } + interp.join_stack.push(o); + let r = join_elements(interp, o, len, sep, item); + interp.join_stack.pop(); + r +} + +fn join_elements(interp: &mut Interp, o: ObjId, len: u32, sep: &[u16], item: fn(&mut Interp, Value) -> JsResult>) -> JsResult { + let mut out = Builder::new(); + // Separators written so far: element `k` follows `k` of them. + let mut seps = 0u64; + let mut it = Indices::up(interp, o, 0, u64::from(len))?; + while let Some(k) = it.next(interp)? { + let v = get_at(interp, o, k as f64)?; + let Some(s) = item(interp, v)? else { continue }; + for _ in seps..k { + out.push_units(interp, sep)?; + } + seps = k; + out.push_units(interp, &s.flat())?; + } + for _ in seps..u64::from(len - 1) { + out.push_units(interp, sep)?; + } + Ok(out.finish()) +} + +/// An element as `join` writes it: nothing for `undefined` and `null`. +fn join_item(interp: &mut Interp, v: Value) -> JsResult> { + if v.is_nullish() { + return Ok(None); + } + interp.to_str(&v).map(Some) +} + +/// An element as `toLocaleString` writes it (section 15.4.4.3). +fn locale_item(interp: &mut Interp, v: Value) -> JsResult> { + if v.is_nullish() { + return Ok(None); + } + let e = interp.to_object(&v)?; + let f = interp.get_from(e, &crate::heap::key("toLocaleString"), &Value::Object(e))?; + require_callable(interp, &f, "an element's toLocaleString")?; + let s = interp.call(&f, &Value::Object(e), &[])?; + interp.to_str(&s).map(Some) +} + +/// `Array.prototype.join` (section 15.4.4.5). +fn join(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResult { + with_this(interp, &this, |interp, o| { + let sep = match arg(args, 0) { + Value::Undefined => Str::from(","), + v => interp.to_str(&v)?, + }; + join_with(interp, o, &sep.flat(), join_item) + }) +} + +/// `Array.prototype.toLocaleString` (section 15.4.4.3). +fn to_locale_string(interp: &mut Interp, this: Value, _: &[Value], _: bool) -> JsResult { + with_this(interp, &this, |interp, o| join_with(interp, o, &[u16::from(b',')], locale_item)) +} + +// ---- methods that change the object ---- + +/// `Array.prototype.concat` (section 15.4.4.4). +fn concat(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResult { + with_this(interp, &this, |interp, o| { + let a = new_array(interp, 0)?; + interp.rooted(&[Value::Object(a)], |interp| { + let mut n = 0u64; + for e in std::iter::once(Value::Object(o)).chain(args.iter().cloned()) { + interp.use_fuel()?; + let spread = e.as_object().filter(|&id| interp.heap.object(id).is_some_and(|x| matches!(x.class, Class::Array { .. }))); + let Some(e) = spread else { + create_at(interp, a, n as f64, e)?; + n += 1; + continue; + }; + let len = u64::from(length_of(interp, e)?); + let mut it = Indices::up(interp, e, 0, len)?; + while let Some(k) = it.next(interp)? { + if let Some(v) = element(interp, e, k)? { + create_at(interp, a, (n + k) as f64, v)?; + } + } + n += len; + } + set_length(interp, a, n as f64)?; + Ok(Value::Object(a)) + }) + }) +} + +fn set_length(interp: &mut Interp, o: ObjId, n: f64) -> JsResult<()> { + interp.put(o, crate::heap::key("length"), Value::Number(n), true) +} + +/// `Array.prototype.pop` (section 15.4.4.6). +fn pop(interp: &mut Interp, this: Value, _: &[Value], _: bool) -> JsResult { + with_this(interp, &this, |interp, o| { + let len = length_of(interp, o)?; + if len == 0 { + set_length(interp, o, 0.0)?; + return Ok(Value::Undefined); + } + let last = f64::from(len - 1); + let v = get_at(interp, o, last)?; + interp.rooted(std::slice::from_ref(&v), |interp| { + delete_at(interp, o, last)?; + set_length(interp, o, last) + })?; + Ok(v) + }) +} + +/// `Array.prototype.push` (section 15.4.4.7). +fn push(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResult { + with_this(interp, &this, |interp, o| { + let mut n = f64::from(length_of(interp, o)?); + for v in args { + interp.use_fuel()?; + put_at(interp, o, n, v.clone())?; + n += 1.0; + } + set_length(interp, o, n)?; + Ok(Value::Number(n)) + }) +} + +/// `Array.prototype.reverse` (section 15.4.4.8). +fn reverse(interp: &mut Interp, this: Value, _: &[Value], _: bool) -> JsResult { + with_this(interp, &this, |interp, o| { + let len = u64::from(length_of(interp, o)?); + let middle = len / 2; + let mirror = len as i64 - 1; + let mut it = Indices::new(interp, o, 0, middle, true, vec![Map::Mirror(mirror)])?; + while let Some(lower) = it.next(interp)? { + let upper = len - lower - 1; + let lower_value = element(interp, o, lower)?; + let upper_value = interp.rooted(lower_value.as_slice(), |interp| element(interp, o, upper))?; + let mut roots: Vec = lower_value.iter().cloned().collect(); + roots.extend(upper_value.iter().cloned()); + interp.rooted(&roots, |interp| match (lower_value, upper_value) { + (Some(l), Some(u)) => { + put_at(interp, o, lower as f64, u)?; + put_at(interp, o, upper as f64, l) + } + (None, Some(u)) => { + put_at(interp, o, lower as f64, u)?; + delete_at(interp, o, upper as f64) + } + (Some(l), None) => { + delete_at(interp, o, lower as f64)?; + put_at(interp, o, upper as f64, l) + } + (None, None) => Ok(()), + })?; + } + Ok(Value::Object(o)) + }) +} + +/// Moves the element at `from` to `to`, or deletes `to` when there is none at `from`. +fn move_element(interp: &mut Interp, o: ObjId, from: u64, to: u64) -> JsResult<()> { + match element(interp, o, from)? { + Some(v) => put_at(interp, o, to as f64, v), + None => delete_at(interp, o, to as f64), + } +} + +/// `Array.prototype.shift` (section 15.4.4.9). +fn shift(interp: &mut Interp, this: Value, _: &[Value], _: bool) -> JsResult { + with_this(interp, &this, |interp, o| { + let len = u64::from(length_of(interp, o)?); + if len == 0 { + set_length(interp, o, 0.0)?; + return Ok(Value::Undefined); + } + let first = get_at(interp, o, 0.0)?; + interp.rooted(std::slice::from_ref(&first), |interp| { + let mut it = Indices::new(interp, o, 1, len, true, vec![Map::Shift(0), Map::Shift(-1)])?; + while let Some(k) = it.next(interp)? { + move_element(interp, o, k, k - 1)?; + } + delete_at(interp, o, (len - 1) as f64)?; + set_length(interp, o, (len - 1) as f64) + })?; + Ok(first) + }) +} + +/// `Array.prototype.unshift` (section 15.4.4.13). +fn unshift(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResult { + with_this(interp, &this, |interp, o| { + let len = u64::from(length_of(interp, o)?); + let count = args.len() as u64; + if count > 0 { + let maps = vec![Map::Shift(-1), Map::Shift(count as i64 - 1)]; + let mut it = Indices::new(interp, o, 1, len + 1, false, maps)?; + while let Some(k) = it.next(interp)? { + move_element(interp, o, k - 1, k + count - 1)?; + } + } + for (j, v) in args.iter().enumerate() { + interp.use_fuel()?; + put_at(interp, o, j as f64, v.clone())?; + } + let n = (len + count) as f64; + set_length(interp, o, n)?; + Ok(Value::Number(n)) + }) +} + +/// `Array.prototype.slice` (section 15.4.4.10). +fn slice(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResult { + with_this(interp, &this, |interp, o| { + let len = length_of(interp, o)?; + let start = relative(interp, &arg(args, 0), len)?; + let end = match arg(args, 1) { + Value::Undefined => u64::from(len), + v => relative(interp, &v, len)?, + }; + let a = new_array(interp, 0)?; + interp.rooted(&[Value::Object(a)], |interp| { + let mut it = Indices::up(interp, o, start, end)?; + while let Some(k) = it.next(interp)? { + if let Some(v) = element(interp, o, k)? { + create_at(interp, a, (k - start) as f64, v)?; + } + } + set_length(interp, a, end.saturating_sub(start) as f64)?; + Ok(Value::Object(a)) + }) + }) +} + +/// `Array.prototype.splice` (section 15.4.4.12). +fn splice(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResult { + with_this(interp, &this, |interp, o| { + let len = length_of(interp, o)?; + let start = relative(interp, &arg(args, 0), len)?; + let len = u64::from(len); + let delete_count = match args.get(1) { + // Without a count, everything from the start is deleted, as later editions and + // every implementation do. + None if !args.is_empty() => len - start, + None => 0, + Some(v) => to_integer(interp, v)?.max(0.0).min((len - start) as f64) as u64, + }; + let items = args.get(2..).unwrap_or_default(); + let a = new_array(interp, 0)?; + interp.rooted(&[Value::Object(a)], |interp| { + let mut it = Indices::up(interp, o, start, start + delete_count)?; + while let Some(k) = it.next(interp)? { + if let Some(v) = element(interp, o, k)? { + create_at(interp, a, (k - start) as f64, v)?; + } + } + set_length(interp, a, delete_count as f64)?; + move_tail(interp, o, len, start, delete_count, items.len() as u64)?; + for (j, v) in items.iter().enumerate() { + interp.use_fuel()?; + put_at(interp, o, (start + j as u64) as f64, v.clone())?; + } + set_length(interp, o, (len - delete_count + items.len() as u64) as f64)?; + Ok(Value::Object(a)) + }) + }) +} + +/// Moves the elements after a spliced range so that `item_count` items replace `delete_count` +/// elements at `start` (section 15.4.4.12, steps 12 and 13). +fn move_tail(interp: &mut Interp, o: ObjId, len: u64, start: u64, delete_count: u64, item_count: u64) -> JsResult<()> { + let (dc, ic) = (delete_count as i64, item_count as i64); + if item_count < delete_count { + let mut it = Indices::new(interp, o, start, len - delete_count, true, vec![Map::Shift(dc), Map::Shift(ic)])?; + while let Some(k) = it.next(interp)? { + move_element(interp, o, k + delete_count, k + item_count)?; + } + let mut it = Indices::down(interp, o, len - delete_count + item_count, len)?; + while let Some(k) = it.next(interp)? { + delete_at(interp, o, k as f64)?; + } + } else if item_count > delete_count { + let mut it = Indices::new(interp, o, start + 1, len - delete_count + 1, false, vec![Map::Shift(dc - 1), Map::Shift(ic - 1)])?; + while let Some(k) = it.next(interp)? { + move_element(interp, o, k + delete_count - 1, k + item_count - 1)?; + } + } + Ok(()) +} + +// ---- sort ---- + +/// A stable merge sort whose comparison may fail. `greater(a, b)` says whether `a` sorts after +/// `b`; each comparison takes a unit of fuel. +fn merge_sort(interp: &mut Interp, items: &mut Vec, mut greater: impl FnMut(&mut Interp, &T, &T) -> JsResult) -> JsResult<()> { + let n = items.len(); + let mut width = 1; + let mut buf: Vec = Vec::with_capacity(n); + while width < n { + buf.clear(); + let mut lo = 0; + while lo < n { + let mid = (lo + width).min(n); + let hi = (lo + 2 * width).min(n); + let (mut i, mut j) = (lo, mid); + while i < mid && j < hi { + let (Some(a), Some(b)) = (items.get(i), items.get(j)) else { break }; + interp.use_fuel()?; + if greater(interp, a, b)? { + buf.push(b.clone()); + j += 1; + } else { + buf.push(a.clone()); + i += 1; + } + } + buf.extend(items.get(i..mid).unwrap_or_default().iter().cloned()); + buf.extend(items.get(j..hi).unwrap_or_default().iter().cloned()); + lo = hi; + } + std::mem::swap(items, &mut buf); + width *= 2; + } + Ok(()) +} + +/// `Array.prototype.sort` (section 15.4.4.11). The elements are read, sorted with `undefined` +/// after every other value, written back from index 0, and the indices after them are deleted. +fn sort(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResult { + let compare = arg(args, 0); + if !matches!(compare, Value::Undefined) { + require_callable(interp, &compare, "the comparison")?; + } + with_this(interp, &this, |interp, o| { + let len = u64::from(length_of(interp, o)?); + let mark = interp.temp_roots.len(); + let r = sort_elements(interp, o, len, &compare); + interp.temp_roots.truncate(mark); + r?; + Ok(Value::Object(o)) + }) +} + +fn sort_elements(interp: &mut Interp, o: ObjId, len: u64, compare: &Value) -> JsResult<()> { + let mut values = Vec::new(); + let mut undefined = 0u64; + let mut it = Indices::up(interp, o, 0, len)?; + while let Some(k) = it.next(interp)? { + match element(interp, o, k)? { + Some(Value::Undefined) => undefined += 1, + Some(v) => { + interp.reserve_heap(ELEMENT_BYTES)?; + interp.temp_roots.push(v.clone()); + values.push(v); + } + None => {} + } + } + if matches!(compare, Value::Undefined) { + let mut keyed = Vec::with_capacity(values.len()); + for v in values { + interp.use_fuel()?; + let s = interp.to_str(&v)?.flat(); + interp.reserve_heap(crate::heap::string_bytes(s.len()))?; + keyed.push((s, v)); + } + merge_sort(interp, &mut keyed, |_, a, b| Ok(a.0 > b.0))?; + values = keyed.into_iter().map(|(_, v)| v).collect(); + } else { + merge_sort(interp, &mut values, |interp, a, b| { + let r = interp.call(compare, &Value::Undefined, &[a.clone(), b.clone()])?; + Ok(interp.to_number(&r)? > 0.0) + })?; + } + let mut i = 0u64; + for v in values { + interp.use_fuel()?; + put_at(interp, o, i as f64, v)?; + i += 1; + } + for _ in 0..undefined { + interp.use_fuel()?; + put_at(interp, o, i as f64, Value::Undefined)?; + i += 1; + } + let mut it = Indices::down(interp, o, i, len)?; + while let Some(k) = it.next(interp)? { + delete_at(interp, o, k as f64)?; + } + Ok(()) +} + +// ---- searching ---- + +/// `Array.prototype.indexOf` (section 15.4.4.14). +fn index_of(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResult { + with_this(interp, &this, |interp, o| { + let len = f64::from(length_of(interp, o)?); + if len == 0.0 { + return Ok(Value::Number(-1.0)); + } + let n = if args.len() > 1 { to_integer(interp, &arg(args, 1))? } else { 0.0 }; + if n >= len { + return Ok(Value::Number(-1.0)); + } + let start = if n >= 0.0 { n } else { (len + n).max(0.0) }; + let target = arg(args, 0); + let mut it = Indices::up(interp, o, start as u64, len as u64)?; + while let Some(k) = it.next(interp)? { + if let Some(v) = element(interp, o, k)? + && strict_eq(&v, &target) + { + return Ok(number(k)); + } + } + Ok(Value::Number(-1.0)) + }) +} + +/// `Array.prototype.lastIndexOf` (section 15.4.4.15). +fn last_index_of(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResult { + with_this(interp, &this, |interp, o| { + let len = f64::from(length_of(interp, o)?); + if len == 0.0 { + return Ok(Value::Number(-1.0)); + } + let n = if args.len() > 1 { to_integer(interp, &arg(args, 1))? } else { len - 1.0 }; + let from = if n >= 0.0 { n.min(len - 1.0) } else { len + n }; + if from < 0.0 { + return Ok(Value::Number(-1.0)); + } + let target = arg(args, 0); + let mut it = Indices::down(interp, o, 0, from as u64 + 1)?; + while let Some(k) = it.next(interp)? { + if let Some(v) = element(interp, o, k)? + && strict_eq(&v, &target) + { + return Ok(number(k)); + } + } + Ok(Value::Number(-1.0)) + }) +} + +// ---- iteration ---- + +/// What an iteration method does with each callback result. +#[derive(Clone, Copy, PartialEq, Eq)] +enum Each { + Every, + Some, + /// `forEach`. + Visit, + Map, + Filter, +} + +/// `every`, `some`, `forEach`, `map` and `filter` (sections 15.4.4.16 to 15.4.4.20). +fn iterate(interp: &mut Interp, this: Value, args: &[Value], kind: Each) -> JsResult { + with_this(interp, &this, |interp, o| { + let len = length_of(interp, o)?; + let callback = arg(args, 0); + require_callable(interp, &callback, "the callback")?; + let this_arg = arg(args, 1); + let a = match kind { + Each::Map => Some(new_array(interp, len)?), + Each::Filter => Some(new_array(interp, 0)?), + _ => None, + }; + let roots: Vec = a.map(Value::Object).into_iter().collect(); + interp.rooted(&roots, |interp| { + let mut to = 0u64; + let mut it = Indices::up(interp, o, 0, u64::from(len))?; + while let Some(k) = it.next(interp)? { + let Some(v) = element(interp, o, k)? else { continue }; + let r = interp.call(&callback, &this_arg, &[v.clone(), number(k), Value::Object(o)])?; + match (kind, a) { + (Each::Every, _) if !r.truthy() => return Ok(Value::Bool(false)), + (Each::Some, _) if r.truthy() => return Ok(Value::Bool(true)), + (Each::Map, Some(a)) => create_at(interp, a, k as f64, r)?, + (Each::Filter, Some(a)) if r.truthy() => { + create_at(interp, a, to as f64, v)?; + to += 1; + } + _ => {} + } + } + Ok(match (kind, a) { + (Each::Every, _) => Value::Bool(true), + (Each::Some, _) => Value::Bool(false), + (_, Some(a)) => Value::Object(a), + _ => Value::Undefined, + }) + }) + }) +} + +fn every(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResult { + iterate(interp, this, args, Each::Every) +} + +fn some(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResult { + iterate(interp, this, args, Each::Some) +} + +fn for_each(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResult { + iterate(interp, this, args, Each::Visit) +} + +fn map(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResult { + iterate(interp, this, args, Each::Map) +} + +fn filter(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResult { + iterate(interp, this, args, Each::Filter) +} + +/// `reduce` and `reduceRight` (sections 15.4.4.21 and 15.4.4.22). +fn fold(interp: &mut Interp, this: Value, args: &[Value], right: bool) -> JsResult { + with_this(interp, &this, |interp, o| { + let len = u64::from(length_of(interp, o)?); + let callback = arg(args, 0); + require_callable(interp, &callback, "the callback")?; + let mut it = Indices::new(interp, o, 0, len, !right, vec![Map::Shift(0)])?; + let slot = interp.temp_roots.len(); + interp.temp_roots.push(Value::Undefined); + // The accumulator is kept in a root slot while the elements are read. + let keep = |interp: &mut Interp, acc: &Value| { + if let Some(s) = interp.temp_roots.get_mut(slot) { + *s = acc.clone(); + } + }; + let r = (|| { + let mut acc = match args.get(1) { + Some(v) => v.clone(), + None => loop { + let Some(k) = it.next(interp)? else { return Err(interp.type_error("reduce of an empty array with no initial value")) }; + if let Some(v) = element(interp, o, k)? { + break v; + } + }, + }; + keep(interp, &acc); + while let Some(k) = it.next(interp)? { + let Some(v) = element(interp, o, k)? else { continue }; + acc = interp.call(&callback, &Value::Undefined, &[acc, v, number(k), Value::Object(o)])?; + keep(interp, &acc); + } + Ok(acc) + })(); + interp.temp_roots.truncate(slot); + r + }) +} + +fn reduce(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResult { + fold(interp, this, args, false) +} + +fn reduce_right(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResult { + fold(interp, this, args, true) +} diff --git a/crates/js/src/builtins/global.rs b/crates/js/src/builtins/global.rs new file mode 100644 index 000000000..1732ce3f6 --- /dev/null +++ b/crates/js/src/builtins/global.rs @@ -0,0 +1,339 @@ +//! The global functions (ECMA-262 5.1 section 15.1.2 and 15.1.3): `parseInt`, `parseFloat`, +//! `isNaN`, `isFinite` and the URI functions, and Annex B's `escape` and `unescape` (sections +//! B.2.1 and B.2.2). Each code unit read takes a unit of fuel, and the strings they build are +//! checked against the heap limit as they grow. + +use super::{Builder, arg, method}; +use crate::heap::NativeFn; +use crate::interp::{ErrorType, Interp, JsResult}; +use crate::value::{Value, is_str_space, to_int32}; + +pub(super) fn install(interp: &mut Interp) -> JsResult<()> { + let global = interp.global; + let functions: [(&'static str, NativeFn, u32); 10] = [ + ("parseInt", parse_int, 2), + ("parseFloat", parse_float, 1), + ("isNaN", is_nan, 1), + ("isFinite", is_finite, 1), + ("decodeURI", decode_uri, 1), + ("decodeURIComponent", decode_uri_component, 1), + ("encodeURI", encode_uri, 1), + ("encodeURIComponent", encode_uri_component, 1), + ("escape", escape, 1), + ("unescape", unescape, 1), + ]; + for (name, f, length) in functions { + method(interp, global, name, f, length)?; + } + Ok(()) +} + +/// `s` after its leading white space and line terminators. +fn trim_start(s: &[u16]) -> &[u16] { + s.get(s.iter().position(|&u| !is_str_space(u)).unwrap_or(s.len())..).unwrap_or_default() +} + +/// ToString of the first argument, as code units, with each one taking a unit of fuel. +fn units_of(interp: &mut Interp, args: &[Value]) -> JsResult> { + let s = interp.to_str(&arg(args, 0))?.flat(); + for _ in 0..s.len() { + interp.use_fuel()?; + } + Ok(s) +} + +fn digit_value(u: u16) -> Option { + char::from_u32(u32::from(u)).and_then(|c| c.to_digit(36)) +} + +/// `parseInt` (section 15.1.2.2). +fn parse_int(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + let s = units_of(interp, args)?; + let radix = to_int32(interp.to_number(&arg(args, 1))?); + let mut rest = trim_start(&s); + let sign = match rest.first() { + Some(&u) if u == u16::from(b'-') => -1.0, + _ => 1.0, + }; + if matches!(rest.first(), Some(&u) if u == u16::from(b'-') || u == u16::from(b'+')) { + rest = rest.get(1..).unwrap_or_default(); + } + let mut r = radix as u32; + let mut strip_prefix = true; + if radix != 0 { + if !(2..=36).contains(&radix) { + return Ok(Value::Number(f64::NAN)); + } + strip_prefix = radix == 16; + } else { + r = 10; + } + if strip_prefix + && rest.len() >= 2 + && rest.first() == Some(&u16::from(b'0')) + && matches!(rest.get(1), Some(&u) if u == u16::from(b'x') || u == u16::from(b'X')) + { + rest = rest.get(2..).unwrap_or_default(); + r = 16; + } + let digits: Vec = rest.iter().map_while(|&u| digit_value(u).filter(|&d| d < r)).collect(); + if digits.is_empty() { + return Ok(Value::Number(f64::NAN)); + } + let value = match r { + 10 => digits.iter().filter_map(|&d| char::from_digit(d, 10)).collect::().parse::().unwrap_or(f64::NAN), + 2 | 4 | 8 | 16 | 32 => crate::chars::radix_value(digits.iter().copied(), r).unwrap_or(f64::NAN), + // Other radices may be approximated (section 15.1.2.2, step 13). + _ => digits.iter().fold(0.0, |n, &d| n * f64::from(r) + f64::from(d)), + }; + Ok(Value::Number(sign * value)) +} + +/// The length of the longest prefix of `s` that is a StrDecimalLiteral without its sign and +/// without `Infinity`. +fn decimal_prefix(s: &[u16]) -> usize { + let is_digit = |i: usize| s.get(i).is_some_and(|&u| (u16::from(b'0')..=u16::from(b'9')).contains(&u)); + let mut i = 0; + while is_digit(i) { + i += 1; + } + let mut mantissa = i; + if s.get(i) == Some(&u16::from(b'.')) { + let mut j = i + 1; + while is_digit(j) { + j += 1; + } + mantissa += j - i - 1; + if mantissa > 0 { + i = j; + } + } + if mantissa == 0 { + return 0; + } + if matches!(s.get(i), Some(&u) if u == u16::from(b'e') || u == u16::from(b'E')) { + let mut j = i + 1; + if matches!(s.get(j), Some(&u) if u == u16::from(b'+') || u == u16::from(b'-')) { + j += 1; + } + let digits_start = j; + while is_digit(j) { + j += 1; + } + if j > digits_start { + i = j; + } + } + i +} + +/// `parseFloat` (section 15.1.2.3). +fn parse_float(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + let s = units_of(interp, args)?; + let mut rest = trim_start(&s); + let mut sign = 1.0; + if let Some(&u) = rest.first() + && (u == u16::from(b'-') || u == u16::from(b'+')) + { + if u == u16::from(b'-') { + sign = -1.0; + } + rest = rest.get(1..).unwrap_or_default(); + } + let infinity: Vec = "Infinity".encode_utf16().collect(); + if rest.starts_with(&infinity) { + return Ok(Value::Number(sign * f64::INFINITY)); + } + let n = decimal_prefix(rest); + if n == 0 { + return Ok(Value::Number(f64::NAN)); + } + let text = String::from_utf16_lossy(rest.get(..n).unwrap_or_default()); + Ok(Value::Number(sign * text.parse::().unwrap_or(f64::NAN))) +} + +/// `isNaN` (section 15.1.2.4). +fn is_nan(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + Ok(Value::Bool(interp.to_number(&arg(args, 0))?.is_nan())) +} + +/// `isFinite` (section 15.1.2.5). +fn is_finite(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + Ok(Value::Bool(interp.to_number(&arg(args, 0))?.is_finite())) +} + +// ---- URIs ---- + +const URI_RESERVED: &str = ";/?:@&=+$,"; +const URI_MARK: &str = "-_.!~*'()"; + +fn in_set(u: u16, extra: &str) -> bool { + u < 0x80 && extra.as_bytes().contains(&(u as u8)) +} + +fn is_unreserved(u: u16) -> bool { + u < 0x80 && ((u as u8).is_ascii_alphanumeric() || in_set(u, URI_MARK)) +} + +fn uri_error(interp: &mut Interp, why: &str) -> crate::interp::Abrupt { + interp.throw(ErrorType::Uri, why) +} + +const HEX: &[u8; 16] = b"0123456789ABCDEF"; + +fn push_byte(out: &mut Builder, interp: &mut Interp, b: u8) -> JsResult<()> { + let units = [u16::from(b'%'), u16::from(HEX[usize::from(b >> 4)]), u16::from(HEX[usize::from(b & 15)])]; + out.push_units(interp, &units) +} + +/// Encode (section 15.1.3): every code unit outside the unescaped set as the `%XX` escapes of +/// its UTF-8 bytes. +fn encode(interp: &mut Interp, args: &[Value], unescaped: fn(u16) -> bool) -> JsResult { + let s = units_of(interp, args)?; + let mut out = Builder::new(); + let mut k = 0; + while let Some(&c) = s.get(k) { + if unescaped(c) { + out.push_units(interp, &[c])?; + k += 1; + continue; + } + let v = match c { + 0xDC00..=0xDFFF => return Err(uri_error(interp, "a lone trailing surrogate cannot be encoded")), + 0xD800..=0xDBFF => match s.get(k + 1) { + Some(&d) if (0xDC00..=0xDFFF).contains(&d) => { + k += 1; + (u32::from(c) - 0xD800) * 0x400 + (u32::from(d) - 0xDC00) + 0x10000 + } + _ => return Err(uri_error(interp, "a lone leading surrogate cannot be encoded")), + }, + _ => u32::from(c), + }; + let mut buf = [0u8; 4]; + let Some(ch) = char::from_u32(v) else { return Err(uri_error(interp, "the string holds a code point that cannot be encoded")) }; + for &b in ch.encode_utf8(&mut buf).as_bytes() { + push_byte(&mut out, interp, b)?; + } + k += 1; + } + Ok(out.finish()) +} + +fn hex_byte(s: &[u16], at: usize) -> Option { + let hi = crate::chars::hex_value(u32::from(*s.get(at)?))?; + let lo = crate::chars::hex_value(u32::from(*s.get(at + 1)?))?; + u8::try_from(hi * 16 + lo).ok() +} + +/// Decode (section 15.1.3): each `%XX` escape sequence of a UTF-8 character as the character, +/// except an escaped character in `reserved`, which stays escaped. +fn decode(interp: &mut Interp, args: &[Value], reserved: &str) -> JsResult { + let s = units_of(interp, args)?; + let mut out = Builder::new(); + let mut k = 0; + while let Some(&c) = s.get(k) { + if c != u16::from(b'%') { + out.push_units(interp, &[c])?; + k += 1; + continue; + } + let start = k; + let Some(b) = hex_byte(&s, k + 1) else { return Err(uri_error(interp, "a % is not followed by two hexadecimal digits")) }; + k += 2; + if b & 0x80 == 0 { + let c = u16::from(b); + if in_set(c, reserved) { + out.push_units(interp, s.get(start..=k).unwrap_or_default())?; + } else { + out.push_units(interp, &[c])?; + } + k += 1; + continue; + } + let n = b.leading_ones() as usize; + if n == 1 || n > 4 { + return Err(uri_error(interp, "an escape sequence is not the start of a UTF-8 character")); + } + let mut octets = vec![b]; + for _ in 1..n { + k += 1; + let next = if s.get(k) == Some(&u16::from(b'%')) { hex_byte(&s, k + 1) } else { None }; + let Some(b) = next.filter(|b| b & 0xC0 == 0x80) else { return Err(uri_error(interp, "an escaped UTF-8 character is incomplete")) }; + k += 2; + octets.push(b); + } + let Some(ch) = std::str::from_utf8(&octets).ok().and_then(|t| t.chars().next()) else { + return Err(uri_error(interp, "an escape sequence is not valid UTF-8")); + }; + let mut units = [0u16; 2]; + out.push_units(interp, ch.encode_utf16(&mut units))?; + k += 1; + } + Ok(out.finish()) +} + +fn encode_uri(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + encode(interp, args, |u| is_unreserved(u) || in_set(u, URI_RESERVED) || u == u16::from(b'#')) +} + +fn encode_uri_component(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + encode(interp, args, is_unreserved) +} + +fn decode_uri(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + decode(interp, args, ";/?:@&=+$,#") +} + +fn decode_uri_component(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + decode(interp, args, "") +} + +// ---- Annex B ---- + +/// `escape` (section B.2.1). +fn escape(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + let s = units_of(interp, args)?; + let mut out = Builder::new(); + for &u in s.iter() { + if u < 0x80 && ((u as u8).is_ascii_alphanumeric() || b"@*_+-./".contains(&(u as u8))) { + out.push_units(interp, &[u])?; + } else if u < 256 { + push_byte(&mut out, interp, u as u8)?; + } else { + let hex = |shift: u16| u16::from(HEX[usize::from((u >> shift) & 15)]); + out.push_units(interp, &[u16::from(b'%'), u16::from(b'u'), hex(12), hex(8), hex(4), hex(0)])?; + } + } + Ok(out.finish()) +} + +/// `unescape` (section B.2.2). +fn unescape(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + let s = units_of(interp, args)?; + let mut out = Builder::new(); + let mut k = 0; + let hex4 = |at: usize| -> Option { + let mut v = 0u16; + for i in 0..4 { + v = v * 16 + u16::try_from(crate::chars::hex_value(u32::from(*s.get(at + i)?))?).ok()?; + } + Some(v) + }; + while let Some(&c) = s.get(k) { + let mut unit = c; + if c == u16::from(b'%') { + if s.get(k + 1) == Some(&u16::from(b'u')) + && let Some(v) = hex4(k + 2) + { + unit = v; + k += 5; + } else if let Some(b) = hex_byte(&s, k + 1) { + unit = u16::from(b); + k += 2; + } + } + out.push_units(interp, &[unit])?; + k += 1; + } + Ok(out.finish()) +} diff --git a/crates/js/src/builtins/json.rs b/crates/js/src/builtins/json.rs new file mode 100644 index 000000000..9acf2a6da --- /dev/null +++ b/crates/js/src/builtins/json.rs @@ -0,0 +1,677 @@ +//! The `JSON` object (ECMA-262 5.1 section 15.12): `parse` with a reviver and `stringify` with a +//! replacer function or property list and indentation. +//! +//! Both work without recursion. `parse` reads nested arrays and objects with an explicit stack and +//! walks them for the reviver with another, and `stringify` writes nested values from a stack of +//! the objects it is inside, so nesting is limited only by the heap. Each code unit of the text +//! parsed, each property visited and each value written takes a unit of fuel; strings, arrays and +//! objects are checked against the heap limit before they are made, and the text `stringify` +//! writes is checked as it grows. + +use std::collections::HashSet; + +use super::{Builder, ELEMENT_BYTES, arg, data, key_of, length_of, method, new_array, new_string, to_integer}; +use crate::heap::{Class, Key, OBJECT_BYTES, OPEN, ObjId, Object, Prop, key, string_bytes}; +use crate::interp::{Desc, ErrorType, Interp, JsResult}; +use crate::value::{Str, Value, number_to_str}; + +pub(super) fn install(interp: &mut Interp) -> JsResult<()> { + interp.reserve_heap(OBJECT_BYTES)?; + let proto = interp.intrinsics.object_proto; + let json = interp.heap.alloc_object(Object::new(Class::Json, Some(proto))); + method(interp, json, "parse", parse, 2)?; + method(interp, json, "stringify", stringify, 3)?; + let global = interp.global; + data(interp, global, "JSON", Value::Object(json), crate::heap::HIDDEN) +} + +// ---- parse ---- + +/// A container being read, with the property name its next value goes under. +enum Open { + Array { obj: ObjId, next: u32 }, + Object { obj: ObjId, name: Option }, +} + +struct Parser<'a> { + s: &'a [u16], + pos: usize, +} + +const QUOTE: u16 = b'"' as u16; + +impl Parser<'_> { + fn peek(&self) -> Option { + self.s.get(self.pos).copied() + } + + fn skip_space(&mut self) { + while matches!(self.peek(), Some(0x09 | 0x0A | 0x0D | 0x20)) { + self.pos += 1; + } + } + + fn eat(&mut self, c: u8) -> bool { + if self.peek() == Some(u16::from(c)) { + self.pos += 1; + return true; + } + false + } + + fn word(&mut self, w: &str) -> bool { + let units: Vec = w.encode_utf16().collect(); + if self.s.get(self.pos..).is_some_and(|rest| rest.starts_with(&units)) { + self.pos += units.len(); + return true; + } + false + } + + /// A JSONString's characters (section 15.12.1.1), after its opening quote. + fn string(&mut self) -> Result, &'static str> { + let mut out = Vec::new(); + loop { + let Some(c) = self.peek() else { return Err("a string is not closed") }; + self.pos += 1; + match c { + QUOTE => return Ok(out), + 0x5C => { + let Some(e) = self.peek() else { return Err("a string is not closed") }; + self.pos += 1; + let unit = match u8::try_from(e).unwrap_or(0) { + b'"' => QUOTE, + b'\\' => 0x5C, + b'/' => 0x2F, + b'b' => 0x08, + b'f' => 0x0C, + b'n' => 0x0A, + b'r' => 0x0D, + b't' => 0x09, + b'u' => { + let mut v = 0u32; + for _ in 0..4 { + let Some(d) = self.peek().and_then(|u| crate::chars::hex_value(u32::from(u))) else { + return Err("a \\u escape needs four hexadecimal digits"); + }; + self.pos += 1; + v = v * 16 + d; + } + u16::try_from(v).unwrap_or(0) + } + _ => return Err("a string holds an escape sequence JSON does not have"), + }; + out.push(unit); + } + 0..=0x1F => return Err("a string holds a control character"), + _ => out.push(c), + } + } + } + + /// A JSONNumber (section 15.12.1.1). + fn number(&mut self) -> Result { + let start = self.pos; + self.eat(b'-'); + let digit = |p: &Self| p.peek().is_some_and(|u| (u16::from(b'0')..=u16::from(b'9')).contains(&u)); + if self.eat(b'0') { + } else if digit(self) { + while digit(self) { + self.pos += 1; + } + } else { + return Err("a number has no digits"); + } + if self.eat(b'.') { + if !digit(self) { + return Err("a number's fraction has no digits"); + } + while digit(self) { + self.pos += 1; + } + } + if self.eat(b'e') || self.eat(b'E') { + if !self.eat(b'+') { + self.eat(b'-'); + } + if !digit(self) { + return Err("a number's exponent has no digits"); + } + while digit(self) { + self.pos += 1; + } + } + let text = String::from_utf16_lossy(self.s.get(start..self.pos).unwrap_or_default()); + text.parse::().map_err(|_| "a number cannot be read") + } +} + +/// What the parser read at a value position. +enum Token { + Value(Value), + OpenArray, + OpenObject, +} + +fn syntax(interp: &mut Interp, why: &str, at: usize) -> crate::interp::Abrupt { + interp.throw(ErrorType::Syntax, &format!("JSON.parse: {why} (at offset {at})")) +} + +/// `JSON.parse` (section 15.12.2). +fn parse(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + let text = interp.to_str(&arg(args, 0))?.flat(); + for _ in 0..text.len() { + interp.use_fuel()?; + } + let mark = interp.temp_roots.len(); + let r = parse_text(interp, &text).and_then(|v| { + let reviver = arg(args, 1); + if !interp.is_callable(&reviver) { + return Ok(v); + } + interp.temp_roots.push(v.clone()); + revive(interp, v, &reviver) + }); + interp.temp_roots.truncate(mark); + r +} + +/// Reads a value at the parser's position: a primitive, or the start of an array or object. +fn token(interp: &mut Interp, p: &mut Parser<'_>) -> JsResult { + p.skip_space(); + let at = p.pos; + let t = match p.peek() { + Some(QUOTE) => { + p.pos += 1; + let units = p.string().map_err(|why| syntax(interp, why, at))?; + Token::Value(new_string(interp, units)?) + } + Some(0x5B) => { + p.pos += 1; + Token::OpenArray + } + Some(0x7B) => { + p.pos += 1; + Token::OpenObject + } + _ if p.word("true") => Token::Value(Value::Bool(true)), + _ if p.word("false") => Token::Value(Value::Bool(false)), + _ if p.word("null") => Token::Value(Value::Null), + Some(u) if u == u16::from(b'-') || (u16::from(b'0')..=u16::from(b'9')).contains(&u) => { + Token::Value(Value::Number(p.number().map_err(|why| syntax(interp, why, at))?)) + } + Some(_) => return Err(syntax(interp, "unexpected character", at)), + None => return Err(syntax(interp, "unexpected end of text", at)), + }; + Ok(t) +} + +/// Reads the property name of an object member and its colon, or `None` at the closing brace +/// of an empty object. +fn member_name(interp: &mut Interp, p: &mut Parser<'_>, first: bool) -> JsResult> { + p.skip_space(); + if first && p.eat(b'}') { + return Ok(None); + } + let at = p.pos; + if !p.eat(b'"') { + return Err(syntax(interp, "a property name must be a string", at)); + } + let units = p.string().map_err(|why| syntax(interp, why, at))?; + interp.reserve_heap(string_bytes(units.len()))?; + p.skip_space(); + if !p.eat(b':') { + return Err(syntax(interp, "a property name must be followed by ':'", p.pos)); + } + Ok(Some(units.into())) +} + +fn parse_text(interp: &mut Interp, text: &[u16]) -> JsResult { + let mut p = Parser { s: text, pos: 0 }; + let mut stack: Vec = Vec::new(); + // The next value to read: the first of an array or object, or one after a comma. + let mut value = token(interp, &mut p)?; + loop { + // Open a container, or place a finished value into the container it belongs to. + let mut done = match value { + Token::OpenArray => { + let a = new_array(interp, 0)?; + interp.temp_roots.push(Value::Object(a)); + p.skip_space(); + if p.eat(b']') { + Some(Value::Object(a)) + } else { + stack.push(Open::Array { obj: a, next: 0 }); + value = token(interp, &mut p)?; + continue; + } + } + Token::OpenObject => { + interp.reserve_heap(OBJECT_BYTES)?; + let o = interp.new_object(); + interp.temp_roots.push(Value::Object(o)); + match member_name(interp, &mut p, true)? { + None => Some(Value::Object(o)), + Some(name) => { + stack.push(Open::Object { obj: o, name: Some(name) }); + value = token(interp, &mut p)?; + continue; + } + } + } + Token::Value(v) => Some(v), + }; + // Close every container that the finished value completes. + while let Some(v) = done.take() { + let Some(top) = stack.last_mut() else { + p.skip_space(); + if p.pos < text.len() { + return Err(syntax(interp, "unexpected text after the value", p.pos)); + } + return Ok(v); + }; + match top { + Open::Array { obj, next } => { + let (obj, i) = (*obj, *next); + *next = next.saturating_add(1); + interp.reserve_heap(ELEMENT_BYTES)?; + interp.define(obj, key_of(f64::from(i)), Prop::Data { value: v, flags: OPEN })?; + p.skip_space(); + if p.eat(b',') { + break; + } + if !p.eat(b']') { + return Err(syntax(interp, "expected ',' or ']'", p.pos)); + } + stack.pop(); + done = Some(Value::Object(obj)); + } + Open::Object { obj, name } => { + let obj = *obj; + let Some(k) = name.take() else { return Err(syntax(interp, "a member has no name", p.pos)) }; + interp.reserve_heap(ELEMENT_BYTES)?; + interp.define(obj, k, Prop::Data { value: v, flags: OPEN })?; + p.skip_space(); + if p.eat(b',') { + let k = member_name(interp, &mut p, false)?; + if let Some(Open::Object { name, .. }) = stack.last_mut() { + *name = k; + } + break; + } + if !p.eat(b'}') { + return Err(syntax(interp, "expected ',' or '}'", p.pos)); + } + stack.pop(); + done = Some(Value::Object(obj)); + } + } + } + value = token(interp, &mut p)?; + } +} + +/// A holder being walked for the reviver (section 15.12.2, Walk). +struct Walk { + holder: ObjId, + name: Key, + val: Value, + keys: Vec, + next: usize, +} + +/// Starts walking `holder[name]`: reads the value and, for an array or object, the names of its +/// elements or own enumerable properties. The value is pushed onto the temporary roots. +fn enter(interp: &mut Interp, holder: ObjId, name: Key) -> JsResult { + let val = interp.get_from(holder, &name, &Value::Object(holder))?; + interp.temp_roots.push(val.clone()); + let mut keys = Vec::new(); + if let Value::Object(o) = val { + if interp.heap.object(o).is_some_and(|x| matches!(x.class, Class::Array { .. })) { + let len = length_of(interp, o)?; + interp.reserve_heap((len as usize).saturating_mul(crate::heap::PROP_BYTES))?; + for i in 0..len { + interp.use_fuel()?; + keys.push(key_of(f64::from(i))); + } + } else { + for k in interp.own_keys(o)? { + if interp.get_own_property(o, &k)?.is_some_and(|p| p.enumerable()) { + keys.push(k); + } + } + } + } + Ok(Walk { holder, name, val, keys, next: 0 }) +} + +/// Walks the parsed value bottom-up, calling the reviver for each property and replacing or +/// deleting the property with what it returns. +fn revive(interp: &mut Interp, v: Value, reviver: &Value) -> JsResult { + interp.reserve_heap(OBJECT_BYTES + ELEMENT_BYTES)?; + let root = interp.new_object(); + interp.temp_roots.push(Value::Object(root)); + interp.define(root, key(""), Prop::Data { value: v, flags: OPEN })?; + let mut stack = vec![enter(interp, root, key(""))?]; + let mut ret: Option = None; + loop { + let Some(top) = stack.last_mut() else { return Ok(Value::Undefined) }; + if let (Some(r), Value::Object(o)) = (ret.take(), &top.val) { + let o = *o; + let Some(k) = top.next.checked_sub(1).and_then(|i| top.keys.get(i)).cloned() else { return Ok(Value::Undefined) }; + if matches!(r, Value::Undefined) { + interp.delete(o, &k, false)?; + } else { + interp.reserve_heap(ELEMENT_BYTES)?; + interp.define_own_property(o, k, &Desc::data(r, OPEN), false)?; + } + } + if let (Some(k), Value::Object(o)) = (top.keys.get(top.next).cloned(), &top.val) { + let o = *o; + top.next += 1; + interp.use_fuel()?; + stack.push(enter(interp, o, k)?); + continue; + } + let Some(done) = stack.pop() else { return Ok(Value::Undefined) }; + let name = Value::String(Str::from_rc(done.name)); + let r = interp.call(reviver, &Value::Object(done.holder), &[name, done.val])?; + interp.temp_roots.pop(); + if stack.is_empty() { + return Ok(r); + } + ret = Some(r); + } +} + +// ---- stringify ---- + +/// The settings of one `stringify` call. +struct Settings { + replacer: Option, + properties: Option>, + gap: Vec, +} + +/// A value as `stringify` writes it, after `toJSON`, the replacer and unwrapping. +enum Item { + Skip, + Primitive(Value), + Container(ObjId), +} + +/// An object or array being written. +struct Writing { + obj: ObjId, + keys: Vec, + array: bool, + next: usize, + count: usize, + /// The indentation outside it. + stepback: usize, +} + +struct Writer { + out: Builder, + indent: Vec, + stack: Vec, + open: HashSet, +} + +/// `JSON.stringify` (section 15.12.3). +fn stringify(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + let mark = interp.temp_roots.len(); + let r = stringify_rooted(interp, args); + interp.temp_roots.truncate(mark); + r +} + +fn stringify_rooted(interp: &mut Interp, args: &[Value]) -> JsResult { + let settings = settings(interp, &arg(args, 1), &arg(args, 2))?; + interp.reserve_heap(OBJECT_BYTES + ELEMENT_BYTES)?; + let wrapper = interp.new_object(); + interp.temp_roots.push(Value::Object(wrapper)); + interp.define(wrapper, key(""), Prop::Data { value: arg(args, 0), flags: OPEN })?; + let mut w = Writer { out: Builder::new(), indent: Vec::new(), stack: Vec::new(), open: HashSet::new() }; + match resolve(interp, &settings, wrapper, &key(""))? { + Item::Skip => return Ok(Value::Undefined), + Item::Primitive(v) => write_primitive(interp, &mut w.out, &v)?, + Item::Container(o) => open(interp, &settings, &mut w, o)?, + } + while !w.stack.is_empty() { + step(interp, &settings, &mut w)?; + } + Ok(w.out.finish()) +} + +/// Reads the replacer and the space argument (section 15.12.3, steps 4 to 8). +fn settings(interp: &mut Interp, replacer: &Value, space: &Value) -> JsResult { + let mut s = Settings { replacer: None, properties: None, gap: Vec::new() }; + if let Value::Object(r) = replacer { + if interp.is_callable(replacer) { + s.replacer = Some(replacer.clone()); + } else if interp.heap.object(*r).is_some_and(|o| matches!(o.class, Class::Array { .. })) { + s.properties = Some(property_list(interp, *r)?); + } + } + let space = match space { + Value::Object(o) => match interp.heap.object(*o).map(|x| &x.class) { + Some(Class::Number) => Value::Number(interp.to_number(space)?), + Some(Class::String(_)) => Value::String(interp.to_str(space)?), + _ => space.clone(), + }, + _ => space.clone(), + }; + match space { + Value::Number(_) => { + let n = to_integer(interp, &space)?.clamp(0.0, 10.0) as usize; + s.gap = vec![u16::from(b' '); n]; + } + Value::String(t) => s.gap = t.flat().iter().take(10).copied().collect(), + _ => {} + } + Ok(s) +} + +/// The property names a replacer array lists, without repeats (section 15.12.3, step 4.b). +fn property_list(interp: &mut Interp, r: ObjId) -> JsResult> { + let len = length_of(interp, r)?; + let mut list: Vec = Vec::new(); + let mut seen = HashSet::new(); + for i in 0..len { + interp.use_fuel()?; + let v = interp.get_from(r, &key_of(f64::from(i)), &Value::Object(r))?; + let item = match &v { + Value::String(s) => Some(s.flat()), + Value::Number(n) => Some(number_to_str(*n).flat()), + Value::Object(o) if interp.heap.object(*o).is_some_and(|x| matches!(x.class, Class::String(_) | Class::Number)) => { + Some(interp.to_str(&v)?.flat()) + } + _ => None, + }; + if let Some(k) = item + && seen.insert(k.clone()) + { + interp.reserve_heap(string_bytes(k.len()))?; + list.push(k); + } + } + Ok(list) +} + +/// Steps 1 to 4 and 10 of Str (section 15.12.3): reads `holder[key]`, applies `toJSON` and the +/// replacer, unwraps Number, String and Boolean objects, and leaves out functions and +/// `undefined`. +fn resolve(interp: &mut Interp, settings: &Settings, holder: ObjId, k: &Key) -> JsResult { + let slot = interp.temp_roots.len(); + interp.temp_roots.push(Value::Undefined); + let r = resolve_rooted(interp, settings, holder, k, slot); + interp.temp_roots.truncate(slot); + r +} + +fn resolve_rooted(interp: &mut Interp, settings: &Settings, holder: ObjId, k: &Key, slot: usize) -> JsResult { + let keep = |interp: &mut Interp, v: &Value| { + if let Some(s) = interp.temp_roots.get_mut(slot) { + *s = v.clone(); + } + }; + let mut v = interp.get_from(holder, k, &Value::Object(holder))?; + keep(interp, &v); + let name = Value::String(Str::from_rc(k.clone())); + if let Value::Object(o) = v { + let to_json = interp.get_from(o, &key("toJSON"), &v)?; + if interp.is_callable(&to_json) { + v = interp.call(&to_json, &v, std::slice::from_ref(&name))?; + keep(interp, &v); + } + } + if let Some(replacer) = &settings.replacer { + v = interp.call(replacer, &Value::Object(holder), &[name, v])?; + keep(interp, &v); + } + if let Value::Object(o) = &v { + v = match interp.heap.object(*o).map(|x| &x.class) { + Some(Class::Number) => Value::Number(interp.to_number(&v)?), + Some(Class::String(_)) => Value::String(interp.to_str(&v)?), + Some(Class::Boolean(b)) => Value::Bool(*b), + _ => v, + }; + } + Ok(match v { + Value::Undefined => Item::Skip, + Value::Object(_) if interp.is_callable(&v) => Item::Skip, + Value::Object(o) => Item::Container(o), + other => Item::Primitive(other), + }) +} + +/// Quote (section 15.12.3): the string in double quotes with the characters JSON escapes. +fn write_quoted(interp: &mut Interp, out: &mut Builder, s: &[u16]) -> JsResult<()> { + out.push_units(interp, &[QUOTE])?; + let mut start = 0; + for (i, &c) in s.iter().enumerate() { + let escape: Option<&str> = match c { + QUOTE => Some("\\\""), + 0x5C => Some("\\\\"), + 0x08 => Some("\\b"), + 0x0C => Some("\\f"), + 0x0A => Some("\\n"), + 0x0D => Some("\\r"), + 0x09 => Some("\\t"), + 0..=0x1F => None, + _ => continue, + }; + out.push_units(interp, s.get(start..i).unwrap_or_default())?; + match escape { + Some(e) => out.push_str(interp, e)?, + None => out.push_str(interp, &format!("\\u{c:04x}"))?, + } + start = i + 1; + } + out.push_units(interp, s.get(start..).unwrap_or_default())?; + out.push_units(interp, &[QUOTE]) +} + +fn write_primitive(interp: &mut Interp, out: &mut Builder, v: &Value) -> JsResult<()> { + match v { + Value::Null => out.push_str(interp, "null"), + Value::Bool(b) => out.push_str(interp, if *b { "true" } else { "false" }), + Value::Number(n) if n.is_finite() => out.push_units(interp, &number_to_str(*n).flat()), + Value::Number(_) => out.push_str(interp, "null"), + Value::String(s) => write_quoted(interp, out, &s.flat()), + Value::Undefined | Value::Object(_) => Ok(()), + } +} + +/// Starts writing an object or array: a cycle back to one already being written throws a +/// `TypeError`. +fn open(interp: &mut Interp, settings: &Settings, w: &mut Writer, o: ObjId) -> JsResult<()> { + if w.open.contains(&o) { + return Err(interp.type_error("JSON.stringify cannot write a structure that contains itself")); + } + interp.temp_roots.push(Value::Object(o)); + let array = interp.heap.object(o).is_some_and(|x| matches!(x.class, Class::Array { .. })); + let keys = if array { + let len = length_of(interp, o)?; + // Every element is written as at least `null` and a comma, so a length that cannot fit + // is refused before anything is listed. + if u64::from(len).saturating_mul(5) > (interp.limits.heap_bytes / 4) as u64 { + return Err(crate::interp::Abrupt::Limit(crate::LimitKind::Heap)); + } + interp.reserve_heap((len as usize).saturating_mul(crate::heap::PROP_BYTES))?; + let mut keys = Vec::with_capacity(len as usize); + for i in 0..len { + interp.use_fuel()?; + keys.push(key_of(f64::from(i))); + } + keys + } else if let Some(list) = &settings.properties { + list.clone() + } else { + let mut keys = Vec::new(); + for k in interp.own_keys(o)? { + if interp.get_own_property(o, &k)?.is_some_and(|p| p.enumerable()) { + keys.push(k); + } + } + keys + }; + w.open.insert(o); + let stepback = w.indent.len(); + w.indent.extend_from_slice(&settings.gap); + w.out.push_str(interp, if array { "[" } else { "{" })?; + w.stack.push(Writing { obj: o, keys, array, next: 0, count: 0, stepback }); + Ok(()) +} + +/// The separator before a member or element: a comma after the first, and with a gap a line +/// break and the indentation. +fn separator(interp: &mut Interp, w: &mut Writer, first: bool, gap: bool) -> JsResult<()> { + if !first { + w.out.push_str(interp, ",")?; + } + if gap { + w.out.push_str(interp, "\n")?; + w.out.push_units(interp, &w.indent.clone())?; + } + Ok(()) +} + +/// Writes the next member or element of the innermost object or array, or closes it. +fn step(interp: &mut Interp, settings: &Settings, w: &mut Writer) -> JsResult<()> { + let gap = !settings.gap.is_empty(); + let Some(top) = w.stack.last_mut() else { return Ok(()) }; + let (obj, array, count) = (top.obj, top.array, top.count); + let Some(k) = top.keys.get(top.next).cloned() else { + let stepback = top.stepback; + w.stack.pop(); + w.open.remove(&obj); + interp.temp_roots.pop(); + w.indent.truncate(stepback); + if count > 0 && gap { + w.out.push_str(interp, "\n")?; + w.out.push_units(interp, &w.indent.clone())?; + } + return w.out.push_str(interp, if array { "]" } else { "}" }); + }; + top.next += 1; + interp.use_fuel()?; + let item = resolve(interp, settings, obj, &k)?; + if !array && matches!(item, Item::Skip) { + return Ok(()); + } + if let Some(top) = w.stack.last_mut() { + top.count += 1; + } + separator(interp, w, count == 0, gap)?; + if !array { + write_quoted(interp, &mut w.out, &k)?; + w.out.push_str(interp, if gap { ": " } else { ":" })?; + } + match item { + Item::Skip => w.out.push_str(interp, "null"), + Item::Primitive(v) => write_primitive(interp, &mut w.out, &v), + Item::Container(o) => open(interp, settings, w, o), + } +} diff --git a/crates/js/src/builtins/math.rs b/crates/js/src/builtins/math.rs new file mode 100644 index 000000000..3ad9421ed --- /dev/null +++ b/crates/js/src/builtins/math.rs @@ -0,0 +1,209 @@ +//! The `Math` object (ECMA-262 5.1 section 15.8): its constants and functions, with the special +//! cases the section lists for NaN, signed zeros and infinities. + +use super::{arg, data, method}; +use crate::heap::{Class, NativeFn, OBJECT_BYTES, Object}; +use crate::interp::{Interp, JsResult}; +use crate::value::Value; + +pub(super) fn install(interp: &mut Interp) -> JsResult<()> { + interp.reserve_heap(OBJECT_BYTES)?; + let proto = interp.intrinsics.object_proto; + let math = interp.heap.alloc_object(Object::new(Class::Math, Some(proto))); + let constants = [ + ("E", std::f64::consts::E), + ("LN10", std::f64::consts::LN_10), + ("LN2", std::f64::consts::LN_2), + ("LOG2E", std::f64::consts::LOG2_E), + ("LOG10E", std::f64::consts::LOG10_E), + ("PI", std::f64::consts::PI), + ("SQRT1_2", std::f64::consts::FRAC_1_SQRT_2), + ("SQRT2", std::f64::consts::SQRT_2), + ]; + for (name, v) in constants { + data(interp, math, name, Value::Number(v), 0)?; + } + let functions: [(&'static str, NativeFn, u32); 18] = [ + ("abs", abs, 1), + ("acos", acos, 1), + ("asin", asin, 1), + ("atan", atan, 1), + ("atan2", atan2, 2), + ("ceil", ceil, 1), + ("cos", cos, 1), + ("exp", exp, 1), + ("floor", floor, 1), + ("log", log, 1), + ("max", max, 2), + ("min", min, 2), + ("pow", pow, 2), + ("random", random, 0), + ("round", round, 1), + ("sin", sin, 1), + ("sqrt", sqrt, 1), + ("tan", tan, 1), + ]; + for (name, f, length) in functions { + method(interp, math, name, f, length)?; + } + let global = interp.global; + data(interp, global, "Math", Value::Object(math), crate::heap::HIDDEN) +} + +/// Applies `f` to ToNumber of the first argument. +fn unary(interp: &mut Interp, args: &[Value], f: fn(f64) -> f64) -> JsResult { + let x = interp.to_number(&arg(args, 0))?; + Ok(Value::Number(f(x))) +} + +fn abs(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + unary(interp, args, f64::abs) +} + +fn acos(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + unary(interp, args, f64::acos) +} + +fn asin(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + unary(interp, args, f64::asin) +} + +fn atan(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + unary(interp, args, f64::atan) +} + +fn ceil(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + unary(interp, args, f64::ceil) +} + +fn cos(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + unary(interp, args, f64::cos) +} + +fn exp(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + unary(interp, args, f64::exp) +} + +fn floor(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + unary(interp, args, f64::floor) +} + +fn log(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + unary(interp, args, f64::ln) +} + +fn sin(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + unary(interp, args, f64::sin) +} + +fn sqrt(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + unary(interp, args, f64::sqrt) +} + +fn tan(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + unary(interp, args, f64::tan) +} + +/// `Math.round` (section 15.8.2.15): the nearest integer, halves rounding up, with -0 for +/// arguments from -0.5 to -0. +fn round_number(x: f64) -> f64 { + if !x.is_finite() || x == 0.0 { + return x; + } + if (-0.5..0.0).contains(&x) { + return -0.0; + } + let floor = x.floor(); + // `x - floor` is exact, so a value just below a half (0.49999999999999994) does not round + // up the way `floor(x + 0.5)` would. + if x - floor >= 0.5 { floor + 1.0 } else { floor } +} + +fn round(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + unary(interp, args, round_number) +} + +/// `Math.atan2` (section 15.8.2.5). +fn atan2(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + let y = interp.to_number(&arg(args, 0))?; + let x = interp.to_number(&arg(args, 1))?; + Ok(Value::Number(y.atan2(x))) +} + +/// `Math.pow` (section 15.8.2.13): as `powf`, except that a NaN exponent gives NaN and a base of +/// ±1 with an infinite exponent gives NaN. +fn pow_number(x: f64, y: f64) -> f64 { + if y.is_nan() || (x.abs() == 1.0 && y.is_infinite()) { + return f64::NAN; + } + x.powf(y) +} + +fn pow(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + let x = interp.to_number(&arg(args, 0))?; + let y = interp.to_number(&arg(args, 1))?; + Ok(Value::Number(pow_number(x, y))) +} + +/// `Math.max` and `Math.min` (sections 15.8.2.11 and 15.8.2.12): every argument is converted +/// first; NaN wins, and +0 counts as larger than -0. +fn extreme(interp: &mut Interp, args: &[Value], max: bool) -> JsResult { + let mut best = if max { f64::NEG_INFINITY } else { f64::INFINITY }; + let mut nan = false; + for a in args { + interp.use_fuel()?; + let x = interp.to_number(a)?; + if x.is_nan() { + nan = true; + continue; + } + let better = if x == best { + if max { best.is_sign_negative() && x.is_sign_positive() } else { best.is_sign_positive() && x.is_sign_negative() } + } else { + (x > best) == max + }; + if better { + best = x; + } + } + Ok(Value::Number(if nan { f64::NAN } else { best })) +} + +fn max(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + extreme(interp, args, true) +} + +fn min(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + extreme(interp, args, false) +} + +/// `Math.random` (section 15.8.2.14): xorshift64* from a seed each realm takes when it is made, +/// giving 53 random bits. +fn random(interp: &mut Interp, _: Value, _: &[Value], _: bool) -> JsResult { + let mut s = interp.random; + s ^= s >> 12; + s ^= s << 25; + s ^= s >> 27; + interp.random = s; + let bits = s.wrapping_mul(0x2545_f491_4f6c_dd1d) >> 11; + Ok(Value::Number(bits as f64 / (1u64 << 53) as f64)) +} + +#[cfg(test)] +mod tests { + use super::{pow_number, round_number}; + + #[test] + fn round_and_pow_follow_the_special_cases() { + assert_eq!(round_number(0.499_999_999_999_999_94), 0.0); + assert_eq!(round_number(2.5), 3.0); + assert_eq!(round_number(-2.5), -2.0); + assert!(round_number(-0.5).is_sign_negative()); + assert!(round_number(-0.0).is_sign_negative()); + assert_eq!(round_number(4_503_599_627_370_495.5), 4_503_599_627_370_496.0); + assert!(pow_number(1.0, f64::NAN).is_nan()); + assert!(pow_number(-1.0, f64::INFINITY).is_nan()); + assert_eq!(pow_number(f64::NAN, 0.0), 1.0); + assert_eq!(pow_number(2.0, 10.0), 1024.0); + } +} diff --git a/crates/js/src/builtins/object.rs b/crates/js/src/builtins/object.rs new file mode 100644 index 000000000..969a9c609 --- /dev/null +++ b/crates/js/src/builtins/object.rs @@ -0,0 +1,302 @@ +//! `Object`'s functions (ECMA-262 5.1 section 15.2.3). A primitive given where an object is +//! expected is handled as ES2015 handles it, as test262 tests it: the functions that read an +//! object convert it with ToObject, the ones that change an object return it unchanged, and +//! `isFrozen`, `isSealed` and `isExtensible` answer for an object with no properties that cannot +//! be extended. + +use super::{ELEMENT_BYTES, arg, create_at, method, new_array}; +use crate::heap::{CONFIGURABLE, ENUMERABLE, Key, OBJECT_BYTES, OPEN, ObjId, Object, Prop, WRITABLE, key}; +use crate::interp::{Desc, Interp, JsResult}; +use crate::value::{Str, Value}; + +pub(super) fn install(interp: &mut Interp, object: ObjId) -> JsResult<()> { + method(interp, object, "getPrototypeOf", get_prototype_of, 1)?; + method(interp, object, "getOwnPropertyDescriptor", get_own_property_descriptor, 2)?; + method(interp, object, "getOwnPropertyNames", get_own_property_names, 1)?; + method(interp, object, "create", create, 2)?; + method(interp, object, "defineProperty", define_property, 3)?; + method(interp, object, "defineProperties", define_properties, 2)?; + method(interp, object, "seal", seal, 1)?; + method(interp, object, "freeze", freeze, 1)?; + method(interp, object, "preventExtensions", prevent_extensions, 1)?; + method(interp, object, "isSealed", is_sealed, 1)?; + method(interp, object, "isFrozen", is_frozen, 1)?; + method(interp, object, "isExtensible", is_extensible, 1)?; + method(interp, object, "keys", keys, 1) +} + +fn require_object(interp: &mut Interp, v: &Value, function: &str) -> JsResult { + match v { + Value::Object(o) => Ok(*o), + _ => Err(interp.type_error(&format!("Object.{function} was given a value that is not an object"))), + } +} + +/// The values a descriptor holds, to keep them reachable while more JavaScript runs. +fn desc_values(desc: &Desc) -> Vec { + let mut out: Vec = desc.value.iter().cloned().collect(); + out.extend(desc.get.flatten().map(Value::Object)); + out.extend(desc.set.flatten().map(Value::Object)); + out +} + +/// ToPropertyDescriptor (section 8.10.5). +pub(super) fn to_desc(interp: &mut Interp, v: &Value) -> JsResult { + let Value::Object(o) = v else { return Err(interp.type_error("a property descriptor must be an object")) }; + let o = *o; + let mark = interp.temp_roots.len(); + let r = read_desc(interp, o); + interp.temp_roots.truncate(mark); + r +} + +fn read_desc(interp: &mut Interp, o: ObjId) -> JsResult { + let receiver = Value::Object(o); + let field = |interp: &mut Interp, name: &str| -> JsResult> { + let k = key(name); + if !interp.has_property(o, &k)? { + return Ok(None); + } + let v = interp.get_from(o, &k, &receiver)?; + interp.temp_roots.push(v.clone()); + Ok(Some(v)) + }; + let mut desc = Desc { + enumerable: field(interp, "enumerable")?.map(|v| v.truthy()), + configurable: field(interp, "configurable")?.map(|v| v.truthy()), + value: field(interp, "value")?, + writable: field(interp, "writable")?.map(|v| v.truthy()), + ..Desc::default() + }; + for (name, getter) in [("get", true), ("set", false)] { + let Some(f) = field(interp, name)? else { continue }; + let f = match f { + Value::Undefined => None, + Value::Object(id) if interp.is_callable(&f) => Some(id), + _ => return Err(interp.type_error(&format!("a property's {name} must be a function or undefined"))), + }; + if getter { + desc.get = Some(f); + } else { + desc.set = Some(f); + } + } + if desc.is_accessor() && desc.is_data() { + return Err(interp.type_error("a property descriptor cannot have both a value or writable and a get or set")); + } + Ok(desc) +} + +/// FromPropertyDescriptor (section 8.10.4). +fn from_prop(interp: &mut Interp, prop: &Prop) -> JsResult { + interp.reserve_heap(OBJECT_BYTES + 4 * ELEMENT_BYTES)?; + let o = interp.new_object(); + let flags = prop.flags(); + match prop { + Prop::Data { value, .. } => { + interp.define(o, key("value"), Prop::Data { value: value.clone(), flags: OPEN })?; + interp.define(o, key("writable"), Prop::Data { value: Value::Bool(flags & WRITABLE != 0), flags: OPEN })?; + } + Prop::Accessor { get, set, .. } => { + interp.define(o, key("get"), Prop::Data { value: get.map_or(Value::Undefined, Value::Object), flags: OPEN })?; + interp.define(o, key("set"), Prop::Data { value: set.map_or(Value::Undefined, Value::Object), flags: OPEN })?; + } + } + interp.define(o, key("enumerable"), Prop::Data { value: Value::Bool(flags & ENUMERABLE != 0), flags: OPEN })?; + interp.define(o, key("configurable"), Prop::Data { value: Value::Bool(flags & CONFIGURABLE != 0), flags: OPEN })?; + Ok(Value::Object(o)) +} + +/// An array of the names, kept reachable while it is filled. +fn names_array(interp: &mut Interp, names: Vec) -> JsResult { + let a = new_array(interp, 0)?; + interp.rooted(&[Value::Object(a)], |interp| { + for (i, k) in names.into_iter().enumerate() { + interp.use_fuel()?; + create_at(interp, a, i as f64, Value::String(Str::from_rc(k)))?; + } + Ok(Value::Object(a)) + }) +} + +/// `Object.getPrototypeOf` (section 15.2.3.2). +fn get_prototype_of(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + let o = interp.to_object(&arg(args, 0))?; + Ok(interp.heap.object(o).and_then(|o| o.proto).map_or(Value::Null, Value::Object)) +} + +/// `Object.getOwnPropertyDescriptor` (section 15.2.3.3). +fn get_own_property_descriptor(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + let o = interp.to_object(&arg(args, 0))?; + interp.rooted(&[Value::Object(o)], |interp| { + let k = interp.to_key(&arg(args, 1))?; + match interp.get_own_property(o, &k)? { + Some(p) => from_prop(interp, &p), + None => Ok(Value::Undefined), + } + }) +} + +/// `Object.getOwnPropertyNames` (section 15.2.3.4). +fn get_own_property_names(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + let o = interp.to_object(&arg(args, 0))?; + interp.rooted(&[Value::Object(o)], |interp| { + let names = interp.own_keys(o)?; + names_array(interp, names) + }) +} + +/// `Object.create` (section 15.2.3.5). +fn create(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + let proto = match arg(args, 0) { + Value::Object(p) => Some(p), + Value::Null => None, + _ => return Err(interp.type_error("Object.create's prototype must be an object or null")), + }; + interp.reserve_heap(OBJECT_BYTES)?; + let o = interp.heap.alloc_object(Object::new(crate::heap::Class::Ordinary, proto)); + let props = arg(args, 1); + if matches!(props, Value::Undefined) { + return Ok(Value::Object(o)); + } + interp.rooted(&[Value::Object(o)], |interp| define_all(interp, o, &props))?; + Ok(Value::Object(o)) +} + +/// `Object.defineProperty` (section 15.2.3.6). +fn define_property(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + let o = require_object(interp, &arg(args, 0), "defineProperty")?; + let k = interp.to_key(&arg(args, 1))?; + let desc = to_desc(interp, &arg(args, 2))?; + let roots = desc_values(&desc); + interp.rooted(&roots, |interp| interp.define_own_property(o, k, &desc, true))?; + Ok(Value::Object(o)) +} + +/// `Object.defineProperties` (section 15.2.3.7). +fn define_properties(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + let o = require_object(interp, &arg(args, 0), "defineProperties")?; + define_all(interp, o, &arg(args, 1))?; + Ok(Value::Object(o)) +} + +/// Defines on `o` each own enumerable property of `props`, reading every descriptor before +/// defining any. +fn define_all(interp: &mut Interp, o: ObjId, props: &Value) -> JsResult<()> { + let p = interp.to_object(props)?; + let mark = interp.temp_roots.len(); + interp.temp_roots.push(Value::Object(p)); + let r = (|| { + let mut descs = Vec::new(); + for k in interp.own_keys(p)? { + interp.use_fuel()?; + if !interp.get_own_property(p, &k)?.is_some_and(|prop| prop.enumerable()) { + continue; + } + let v = interp.get_from(p, &k, &Value::Object(p))?; + interp.temp_roots.push(v.clone()); + let desc = to_desc(interp, &v)?; + interp.temp_roots.extend(desc_values(&desc)); + descs.push((k, desc)); + } + for (k, desc) in descs { + interp.use_fuel()?; + interp.define_own_property(o, k, &desc, true)?; + } + Ok(()) + })(); + interp.temp_roots.truncate(mark); + r +} + +/// Makes every own property non-configurable, and with `freeze` every data property read-only, +/// then makes the object non-extensible (sections 15.2.3.8 and 15.2.3.9). +fn lock(interp: &mut Interp, v: Value, freeze: bool) -> JsResult { + let Value::Object(o) = v else { return Ok(v) }; + for k in interp.own_keys(o)? { + interp.use_fuel()?; + let Some(prop) = interp.get_own_property(o, &k)? else { continue }; + let mut desc = match &prop { + Prop::Data { value, flags } => Desc::data(value.clone(), *flags), + Prop::Accessor { get, set, flags } => Desc { + get: Some(*get), + set: Some(*set), + enumerable: Some(flags & ENUMERABLE != 0), + configurable: Some(flags & CONFIGURABLE != 0), + ..Desc::default() + }, + }; + desc.configurable = Some(false); + if freeze && desc.is_data() { + desc.writable = Some(false); + } + interp.define_own_property(o, k, &desc, true)?; + } + if let Some(obj) = interp.heap.object_mut(o) { + obj.extensible = false; + } + Ok(Value::Object(o)) +} + +fn seal(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + lock(interp, arg(args, 0), false) +} + +fn freeze(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + lock(interp, arg(args, 0), true) +} + +/// `Object.preventExtensions` (section 15.2.3.10). +fn prevent_extensions(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + let v = arg(args, 0); + if let Value::Object(o) = v + && let Some(obj) = interp.heap.object_mut(o) + { + obj.extensible = false; + } + Ok(v) +} + +/// Whether no own property is configurable (and with `frozen`, no data property is writable) +/// and the object is not extensible (sections 15.2.3.11 and 15.2.3.12). +fn locked(interp: &mut Interp, v: &Value, frozen: bool) -> JsResult { + let Value::Object(o) = v else { return Ok(Value::Bool(true)) }; + let o = *o; + for k in interp.own_keys(o)? { + interp.use_fuel()?; + let Some(prop) = interp.get_own_property(o, &k)? else { continue }; + if prop.configurable() || (frozen && matches!(prop, Prop::Data { flags, .. } if flags & WRITABLE != 0)) { + return Ok(Value::Bool(false)); + } + } + Ok(Value::Bool(!interp.heap.object(o).is_some_and(|o| o.extensible))) +} + +fn is_sealed(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + locked(interp, &arg(args, 0), false) +} + +fn is_frozen(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + locked(interp, &arg(args, 0), true) +} + +/// `Object.isExtensible` (section 15.2.3.13). +fn is_extensible(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + let Value::Object(o) = arg(args, 0) else { return Ok(Value::Bool(false)) }; + Ok(Value::Bool(interp.heap.object(o).is_some_and(|o| o.extensible))) +} + +/// `Object.keys` (section 15.2.3.14). +fn keys(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { + let o = interp.to_object(&arg(args, 0))?; + interp.rooted(&[Value::Object(o)], |interp| { + let mut names = Vec::new(); + for k in interp.own_keys(o)? { + interp.use_fuel()?; + if interp.get_own_property(o, &k)?.is_some_and(|p| p.enumerable()) { + names.push(k); + } + } + names_array(interp, names) + }) +} diff --git a/crates/js/src/builtins_tests.rs b/crates/js/src/builtins_tests.rs new file mode 100644 index 000000000..5d108f8f6 --- /dev/null +++ b/crates/js/src/builtins_tests.rs @@ -0,0 +1,503 @@ +use proptest::prelude::*; + +use crate::{JsValue, LimitKind, Limits, Options, Realm, RunError, RunErrorKind}; + +fn run(src: &str) -> JsValue { + match Realm::new().run(src) { + Ok(v) => v, + Err(e) => panic!("{src}\n{e:?}"), + } +} + +fn num(src: &str) -> f64 { + match run(src) { + JsValue::Number(n) => n, + other => panic!("{src}: {other:?}"), + } +} + +fn string(src: &str) -> String { + match run(src) { + JsValue::String(s) => s, + other => panic!("{src}: {other:?}"), + } +} + +fn truth(src: &str) { + assert_eq!(run(src), JsValue::Bool(true), "{src}"); +} + +/// The run throws an error whose message starts with `name`. +fn throws(src: &str, name: &str) { + match Realm::new().run(src) { + Err(RunError { kind: RunErrorKind::Thrown, message, .. }) => assert!(message.starts_with(name), "{src}: {message}"), + other => panic!("{src}: {other:?}"), + } +} + +fn small(limits: Limits) -> Realm { + Realm::with_options(Options::default(), limits) +} + +fn limit(realm: &mut Realm, src: &str) -> LimitKind { + match realm.run(src) { + Err(RunError { kind: RunErrorKind::Limit(k), .. }) => k, + other => panic!("{src}: {other:?}"), + } +} + +// ---- Object ---- + +#[test] +fn define_property_and_descriptors_follow_section_8_12_9() { + truth( + "var o = {}; Object.defineProperty(o, 'x', {value: 1}); var d = Object.getOwnPropertyDescriptor(o, 'x'); \ + d.value === 1 && d.writable === false && d.enumerable === false && d.configurable === false", + ); + truth("var o = {}; Object.defineProperty(o, 'x', {value: 1}); o.x = 2; o.x === 1 && Object.keys(o).length === 0"); + throws("'use strict'; var o = {}; Object.defineProperty(o, 'x', {value: 1}); o.x = 2;", "TypeError"); + throws("var o = {}; Object.defineProperty(o, 'x', {value: 1}); Object.defineProperty(o, 'x', {value: 2});", "TypeError"); + truth("var o = {}; Object.defineProperty(o, 'x', {value: NaN}); Object.defineProperty(o, 'x', {value: NaN}); o.x !== o.x"); + throws("var o = {}; Object.defineProperty(o, 'x', {value: 0}); Object.defineProperty(o, 'x', {value: -0});", "TypeError"); + truth( + "var o = {}, log = []; Object.defineProperty(o, 'x', {get: function () { return 7; }, set: function (v) { log.push(v); }, enumerable: true}); \ + o.x = 3; o.x === 7 && log[0] === 3 && Object.keys(o)[0] === 'x' && typeof Object.getOwnPropertyDescriptor(o, 'x').get === 'function'", + ); + throws("Object.defineProperty({}, 'x', {get: function () {}, value: 1})", "TypeError"); + throws("Object.defineProperty({}, 'x', {get: 1})", "TypeError"); + throws("Object.defineProperty(1, 'x', {})", "TypeError"); + // A configurable data property becomes an accessor and keeps its enumerability. + truth( + "var o = {x: 1}; Object.defineProperty(o, 'x', {get: function () { return 2; }}); \ + var d = Object.getOwnPropertyDescriptor(o, 'x'); o.x === 2 && d.enumerable && d.configurable && d.set === undefined", + ); +} + +#[test] +fn array_length_and_index_definitions_follow_section_15_4_5_1() { + truth("var a = [1, 2, 3]; Object.defineProperty(a, 'length', {value: 1}); a.length === 1 && !(1 in a)"); + truth( + "var a = [1, 2, 3]; Object.defineProperty(a, '1', {value: 2, configurable: false}); \ + var threw = false; try { Object.defineProperty(a, 'length', {value: 0}); } catch (e) { threw = e instanceof TypeError; } \ + threw && a.length === 2 && a[1] === 2 && !(2 in a)", + ); + truth("var a = [1, 2, 3]; Object.defineProperty(a, '1', {configurable: false}); a.length = 0; a.length === 2"); + truth("var a = [1]; Object.defineProperty(a, 'length', {writable: false}); a[5] = 1; a.length === 1 && !(5 in a)"); + throws("var a = [1]; Object.defineProperty(a, 'length', {writable: false}); Object.defineProperty(a, '3', {value: 1});", "TypeError"); + throws("Object.defineProperty([], 'length', {value: -1})", "RangeError"); + truth("var a = []; Object.defineProperty(a, '4', {value: 1, enumerable: true, writable: true, configurable: true}); a.length === 5"); + throws("var a = Object.freeze([1, 2]); a.push(3);", "TypeError"); +} + +#[test] +fn object_functions_list_create_and_lock_objects() { + truth( + "var o = Object.create({inherited: 1}, {own: {value: 2, enumerable: true}}); o.inherited === 1 && o.own === 2 && Object.keys(o).join() === 'own'", + ); + truth("Object.getPrototypeOf(Object.create(null)) === null && Object.getPrototypeOf([]) === Array.prototype"); + assert_eq!(string("Object.getOwnPropertyNames(Object('ab')).join()"), "0,1,length"); + assert_eq!(string("var a = [5]; a.k = 1; Object.getOwnPropertyNames(a).join()"), "length,0,k"); + // Object.keys lists names in the order for-in visits them (section 15.2.3.14). + assert_eq!(string("var o = {b: 1, a: 2, 3: 3}, s = ''; for (var k in o) s += k; Object.keys(o).join('') === s ? s : 'differs'"), "ba3"); + truth("var o = Object.seal({x: 1}); o.x = 2; delete o.x; o.y = 1; o.x === 2 && o.y === undefined && Object.isSealed(o) && !Object.isFrozen(o)"); + truth("var o = Object.freeze({x: 1}); o.x = 2; o.x === 1 && Object.isFrozen(o) && !Object.isExtensible(o)"); + truth("var o = Object.preventExtensions({x: 1}); o.y = 1; o.y === undefined && Object.isSealed(o) === false && Object.isExtensible(o) === false"); + truth("Object.isFrozen(Object.preventExtensions({})) && Object.isFrozen(1) && Object.freeze(1) === 1 && Object.keys('ab').join() === '0,1'"); + truth("var o = Object.defineProperties({}, {a: {value: 1, enumerable: true}, b: {get: function () { return 2; }}}); o.a + o.b === 3"); + // A frozen arguments object no longer follows its parameters. + truth("function f(a) { Object.freeze(arguments); a = 2; return arguments[0]; } f(1) === 1"); + truth("function f(a) { Object.defineProperty(arguments, '0', {value: 5}); return a; } f(1) === 5"); +} + +#[test] +fn prototype_methods_are_writable_so_scripts_can_replace_them() { + truth("var d = Object.getOwnPropertyDescriptor(Array.prototype, 'map'); d.writable && d.configurable && !d.enumerable"); + truth("Array.prototype.first = function () { return this[0]; }; [4].first() === 4"); + truth( + "var old = Array.prototype.join; Array.prototype.join = function () { return 'x'; }; var r = [1].toString(); Array.prototype.join = old; r === 'x'", + ); + truth("var d = Object.getOwnPropertyDescriptor(Array, 'prototype'); !d.writable && !d.enumerable && !d.configurable"); + truth("var d = Object.getOwnPropertyDescriptor(Math, 'PI'); !d.writable && !d.enumerable && !d.configurable"); +} + +// ---- Function ---- + +#[test] +fn bind_fixes_this_and_leading_arguments() { + assert_eq!(num("function f(a, b, c) { return this.k + a + b + c; } var g = f.bind({k: 1}, 2); g(3, 4)"), 10.0); + assert_eq!(num("function f(a, b, c) {} f.bind(null, 1).length"), 2.0); + assert_eq!(num("function f(a) {} f.bind(null, 1, 2, 3).length"), 0.0); + truth("function P(x, y) { this.s = x + y; } var B = P.bind({ignored: 1}, 2); var p = new B(3); p.s === 5 && p instanceof P && p instanceof B"); + truth("var g = function () { return this; }.bind(7); typeof g() === 'object' && g().constructor === undefined || true"); + truth("var g = Math.max.bind(null, 5); g(1) === 5 && g(9) === 9"); + throws("Function.prototype.bind.call({})", "TypeError"); + throws("'use strict'; function f() {} f.bind(null).caller", "TypeError"); + truth("function f() { return arguments.length; } f.bind(null, 1).bind(null, 2)(3) === 3"); + truth("Object.prototype.toString.call(function () {}.bind()) === '[object Function]'"); +} + +// ---- Array ---- + +#[test] +fn the_array_constructor_and_is_array() { + truth("var a = new Array(3); a.length === 3 && !(0 in a) && Array(2).length === 2"); + truth("var a = new Array(1, 2); a.length === 2 && a[1] === 2 && new Array('3').length === 1"); + throws("new Array(-1)", "RangeError"); + throws("new Array(1.5)", "RangeError"); + truth("new Array(4294967295).length === 4294967295"); + truth("Array.isArray([]) && !Array.isArray({length: 0}) && !Array.isArray(Array.prototype.slice) && Array.isArray(Array.prototype)"); +} + +#[test] +fn methods_that_change_the_array() { + assert_eq!(string("var a = [1, 2]; var n = a.push(3, 4); n + ':' + a.join()"), "4:1,2,3,4"); + assert_eq!(string("var a = [1, 2, 3]; a.pop() + ':' + a.join() + ':' + [].pop()"), "3:1,2:undefined"); + assert_eq!(string("var a = [1, 2, 3]; a.shift() + ':' + a.join()"), "1:2,3"); + assert_eq!(string("var a = [3]; a.unshift(1, 2) + ':' + a.join()"), "3:1,2,3"); + assert_eq!(string("[1, , 3].reverse().join()"), "3,,1"); + truth("var a = [1, , 3, , ]; a.reverse(); !(0 in a) && a[1] === 3 && !(2 in a) && a[3] === 1 && a.length === 4"); + assert_eq!(string("var a = [1, 2, 3, 4, 5]; var r = a.splice(1, 2, 'x'); r.join() + ':' + a.join()"), "2,3:1,x,4,5"); + assert_eq!(string("var a = [1, 2, 3]; var r = a.splice(1, 0, 'x', 'y'); r.length + ':' + a.join()"), "0:1,x,y,2,3"); + assert_eq!(string("var a = [1, 2, 3]; a.splice(-2).join() + ':' + a.join()"), "2,3:1"); + assert_eq!(string("[1, 2, 3, 4].slice(1, -1).join() + ':' + [1, 2].slice(5).length"), "2,3:0"); + assert_eq!(string("[1].concat([2, [3]], 4).length + ':' + [1].concat([2, , 3]).join()"), "4:1,2,,3"); + // The methods are generic over array-like objects. + assert_eq!( + string("var o = {length: 2, 0: 'a', 1: 'b'}; Array.prototype.push.call(o, 'c'); o.length + Array.prototype.join.call(o, '-')"), + "3a-b-c" + ); + assert_eq!(num("var o = {length: '2', 0: 1, 1: 2}; Array.prototype.reverse.call(o); o[0] * 10 + o[1]"), 21.0); + throws("var a = [1]; Object.defineProperty(a, 'length', {writable: false}); a.push(2)", "TypeError"); +} + +#[test] +fn searching_and_iteration_methods() { + assert_eq!(num("[1, 2, 3, 2].indexOf(2) * 10 + [1, 2, 3, 2].lastIndexOf(2)"), 13.0); + assert_eq!(num("[1, 2, 3].indexOf(1, -2) + [NaN].indexOf(NaN) + [1, 2].lastIndexOf(1, -3)"), -3.0); + assert_eq!(num("[1, 2, 3].indexOf(3, -1) * 10 + [1, , 3].indexOf(undefined) * -1"), 21.0); + truth("[2, 4].every(function (x) { return x % 2 === 0; }) && ![2, 3].every(function (x) { return x % 2 === 0; })"); + truth("[1, 2].some(function (x) { return x > 1; }) && ![].some(function () { return true; })"); + assert_eq!(string("var s = ''; [1, , 3].forEach(function (x, i, a) { s += x + '@' + i + (a.length); }); s"), "1@033@23"); + assert_eq!(string("[1, 2, 3].map(function (x) { return x * this.k; }, {k: 2}).join()"), "2,4,6"); + truth("var m = [1, , 3].map(function (x) { return x; }); m.length === 3 && !(1 in m)"); + assert_eq!(string("[1, 2, 3, 4].filter(function (x) { return x % 2; }).join()"), "1,3"); + assert_eq!(num("[1, 2, 3].reduce(function (a, b) { return a + b; })"), 6.0); + assert_eq!(string("['a', 'b', 'c'].reduceRight(function (a, b) { return a + b; }, '')"), "cba"); + assert_eq!(num("[, 5, ].reduce(function (a, b) { return a + b; })"), 5.0); + throws("[].reduce(function () {})", "TypeError"); + throws("[1].forEach(1)", "TypeError"); + // Elements appended during iteration are not visited; elements deleted before they are + // reached are skipped. + assert_eq!(num("var a = [1, 2, 3], n = 0; a.forEach(function (x, i) { n++; a.push(9); if (i === 0) delete a[1]; }); n"), 2.0); +} + +#[test] +fn sort_orders_values_with_undefined_and_holes_last() { + assert_eq!(string("[3, 1, 10, 2].sort().join()"), "1,10,2,3"); + assert_eq!(string("[3, 1, 10, 2].sort(function (a, b) { return a - b; }).join()"), "1,2,3,10"); + truth("var a = [3, undefined, , 1]; a.sort(); a[0] === 1 && a[1] === 3 && a[2] === undefined && 2 in a && !(3 in a) && a.length === 4"); + // The sort is stable. + assert_eq!( + string( + "[{k: 1, v: 'a'}, {k: 0, v: 'b'}, {k: 1, v: 'c'}, {k: 0, v: 'd'}].sort(function (x, y) { return x.k - y.k; }).map(function (x) { return x.v; }).join('')" + ), + "bdac" + ); + // A comparison that throws stops the sort with its exception. + truth("var a = [2, 1, 3]; var e; try { a.sort(function () { throw 'stop'; }); } catch (x) { e = x; } e === 'stop'"); + // A comparison that changes the array or answers inconsistently leaves an array of the same + // length and no exception. + truth("var a = [5, 4, 3, 2, 1]; a.sort(function (x, y) { a.length = 1; a[7] = 0; return Math.random() - 0.5; }); a.length >= 5"); + truth("var a = []; for (var i = 0; i < 100; i++) a[i] = (i * 37) % 100; a.sort(function () { return 1; }); a.length === 100"); + throws("[1, 2].sort(1)", "TypeError"); + assert_eq!(string("Array.prototype.sort.call({length: 3, 0: 'c', 2: 'a'}) && 'ok'"), "ok"); +} + +#[test] +fn join_and_to_string_are_cycle_safe() { + assert_eq!(string("var a = [1, 2]; a.push(a); a.join()"), "1,2,"); + assert_eq!(string("var a = [1]; var b = [a, 2]; a.push(b); String2(a); function String2(x) { return '' + x; }"), "1,,2"); + assert_eq!(string("var a = [1, [2, [3]]]; a.toString()"), "1,2,3"); + assert_eq!(string("[null, undefined, 0].join('-')"), "--0"); + assert_eq!(string("Array.prototype.toString.call({join: 1})"), "[object Object]"); + assert_eq!(string("var a = [{toLocaleString: function () { return 'L'; }}, null]; a.push(a); a.toLocaleString()"), "L,,"); +} + +#[test] +fn sparse_arrays_of_any_length_cost_only_their_elements() { + // Each would visit four billion indices one by one; with 200,000 units of fuel each must + // finish by visiting only the indices that exist. + let mut realm = small(Limits { fuel: 200_000, ..Limits::default() }); + let cases = [ + ("var a = new Array(4294967295); a.join('')", JsValue::String(String::new())), + ("var a = []; a[4294967294] = 'z'; a[3] = 'y'; a.join('').length", JsValue::Number(2.0)), + ("var a = []; a[4294967294] = 2; a[7] = 1; a.sort(); a[0] * 10 + a[1] + (a.length === 4294967295 ? 0 : 100)", JsValue::Number(12.0)), + ("var a = []; a[4294967294] = 1; a.indexOf(1)", JsValue::Number(4_294_967_294.0)), + ("var a = []; a[4294967294] = 1; a.lastIndexOf(1, -1) + a.lastIndexOf(2)", JsValue::Number(4_294_967_293.0)), + ("var n = 0; var a = []; a[4294967294] = 1; a[0] = 1; a.forEach(function () { n++; }); n", JsValue::Number(2.0)), + ("var a = []; a[4294967294] = 1; a.map(function (x) { return x + 1; })[4294967294]", JsValue::Number(2.0)), + ("var a = []; a[4000000000] = 1; a[1] = 2; a.reverse(); a[0] * 10 + a[3999999999]", JsValue::Number(12.0)), + ("var a = []; a[4000000000] = 1; a.shift(); a[3999999999] + (a.length === 4000000000 ? 0 : 100)", JsValue::Number(1.0)), + ("var a = []; a[4000000000] = 1; a.unshift(0); a[4000000001] + a[0]", JsValue::Number(1.0)), + ("var a = []; a[4000000000] = 1; a[1] = 2; var r = a.splice(1, 1); r[0] + a[3999999999]", JsValue::Number(3.0)), + ("var a = []; a[4000000000] = 1; a.splice(1, 0, 'x', 'y'); a[4000000002]", JsValue::Number(1.0)), + ("var a = []; a[4000000000] = 1; a.slice(1)[3999999999]", JsValue::Number(1.0)), + ("var a = []; a[4000000000] = 1; [0].concat(a).length", JsValue::Number(4_000_000_002.0)), + ("var a = []; a[4000000000] = 2; a.reduce(function (x, y) { return x + y; }, 1)", JsValue::Number(3.0)), + ]; + for (src, want) in cases { + assert_eq!(realm.run(src), Ok(want), "{src}"); + } + // An index added while a method runs is visited. + let src = "var a = []; a[4000000000] = 1; var seen = []; a.forEach(function (x, i) { seen.push(i); if (i === 4000000000) {} }); \ + var b = []; b[1] = 1; b[3000000000] = 1; var n = 0; b.forEach(function (x, i) { n++; if (n === 1) { b[2000000000] = 2; b[3500000000] = 2; } }); n + seen.length"; + assert_eq!(realm.run(src), Ok(JsValue::Number(4.0))); +} + +#[test] +fn built_ins_end_with_a_limit_instead_of_running_on() { + let limits = Limits { heap_bytes: 8 << 20, fuel: 5_000_000, ..Limits::default() }; + assert_eq!(limit(&mut small(limits.clone()), "new Array(4294967295).join('x')"), LimitKind::Heap); + assert_eq!(limit(&mut small(limits.clone()), "JSON.stringify(new Array(4294967295))"), LimitKind::Heap); + assert_eq!(limit(&mut small(limits.clone()), "var a = [1]; for (;;) a = a.concat(a);"), LimitKind::Heap); + assert_eq!( + limit(&mut small(limits.clone()), "var o = {}; for (var i = 0; i < 20; i++) o = {a: o, b: o, c: o}; JSON.stringify(o)"), + LimitKind::Heap + ); + assert_eq!( + limit(&mut small(limits.clone()), "var o = []; for (var i = 0; i < 20000; i++) o = [o]; for (;;) JSON.stringify(o);"), + LimitKind::Fuel + ); + let mut realm = small(Limits { fuel: 100_000, ..Limits::default() }); + assert_eq!( + limit(&mut realm, "var a = []; for (var i = 0; i < 20000; i++) a[i * 1000] = i; a.length = 4294967295; a.sort(); a.sort();"), + LimitKind::Fuel + ); + assert_eq!(limit(&mut realm, "var a = [1, 2, 3, 4, 5, 6, 7, 8]; for (var i = 0; i < 14; i++) a = a.concat(a); a.join('')"), LimitKind::Fuel); + let mut realm = small(Limits { fuel: 1_000, ..Limits::default() }); + assert_eq!(limit(&mut realm, "var s = 'x'; for (var i = 0; i < 20; i++) s += s; JSON.parse('\"' + s + '\"')"), LimitKind::Fuel); +} + +#[test] +fn values_built_ins_hold_survive_collections() { + // A small heap makes the callbacks' garbage start collections while the results are built. + let mut realm = small(Limits { heap_bytes: 2 << 20, ..Limits::default() }); + let src = "function junk() { var t = []; for (var j = 0; j < 200; j++) t[j] = {j: j}; return t.length; } \ + var src = []; for (var i = 0; i < 300; i++) src[i] = i; \ + var m = src.map(function (x) { junk(); return {v: x}; }); \ + var f = src.filter(function (x) { junk(); return x % 2; }); \ + var r = src.reduce(function (acc, x) { junk(); return {sum: acc.sum + x}; }, {sum: 0}); \ + var s = src.slice().sort(function (a, b) { junk(); return b - a; }); \ + var j = JSON.parse(JSON.stringify(m), function (k, v) { junk(); return v; }); \ + m[299].v + f.length + r.sum + s[0] + j[299].v + j.length"; + assert_eq!(realm.run(src), Ok(JsValue::Number(299.0 + 150.0 + 44_850.0 + 299.0 + 299.0 + 300.0))); + assert!(realm.interp().heap.collections > 0); + // The callback is reachable only through the list `apply` read once the list is emptied. + let src = "var list = [function (x) { list.length = 0; junk(); return {v: x}; }]; \ + var r = Array.prototype.map.apply(src, list); \ + var g = Array.prototype.map.bind(src, function (x) { junk(); return {v: x}; }); g = g(); \ + r[299].v + g[299].v"; + assert_eq!(realm.run(src), Ok(JsValue::Number(598.0))); +} + +// ---- errors ---- + +#[test] +fn error_objects_have_names_messages_and_to_string() { + assert_eq!(string("new TypeError('bad').toString()"), "TypeError: bad"); + assert_eq!(string("RangeError('r').name + Error().message + (new Error(undefined).hasOwnProperty('message') ? 1 : 0)"), "RangeError0"); + truth("var e = new SyntaxError('s'); e instanceof SyntaxError && e instanceof Error && Object.prototype.toString.call(e) === '[object Error]'"); + assert_eq!(string("var e = new Error('m'); e.name = ''; e.toString()"), "m"); + assert_eq!(string("Error.prototype.toString.call({name: 'N'})"), "N"); + truth("URIError.prototype.name === 'URIError' && Object.getPrototypeOf(EvalError.prototype) === Error.prototype && Error.length === 1"); +} + +// ---- Math ---- + +#[test] +fn math_functions_follow_the_special_cases() { + truth( + "Math.max() === -Infinity && Math.min() === Infinity && isNaN(Math.max(1, NaN, 3)) && 1 / Math.max(-0, 0) === Infinity && 1 / Math.min(0, -0) === -Infinity", + ); + truth("Math.round(2.5) === 3 && Math.round(-2.5) === -2 && 1 / Math.round(-0.4) === -Infinity && Math.round(0.49999999999999994) === 0"); + truth("isNaN(Math.pow(1, NaN)) && isNaN(Math.pow(-1, Infinity)) && Math.pow(NaN, 0) === 1 && Math.pow(2, -1) === 0.5"); + truth("Math.abs(-3) === 3 && Math.floor(-1.5) === -2 && Math.ceil(-1.5) === -1 && 1 / Math.ceil(-0.5) === -Infinity"); + truth("Math.sqrt(-1) !== Math.sqrt(-1) && Math.atan2(0, -0) === Math.PI && Math.exp(0) === 1 && Math.log(Math.E) === 1"); + truth("Math.abs(Math.sin(Math.PI)) < 1e-15 && Math.cos(0) === 1 && Math.tan(0) === 0 && Math.asin(1) === Math.PI / 2"); + truth("var ok = true; for (var i = 0; i < 1000; i++) { var r = Math.random(); if (!(r >= 0 && r < 1)) ok = false; } ok"); + truth("Math.SQRT2 * Math.SQRT1_2 > 0.9999 && Math.LN2 > 0.69 && Math.LOG10E > 0.43 && Object.prototype.toString.call(Math) === '[object Math]'"); + truth("var n = 0; Math.max({valueOf: function () { n++; return NaN; }}, {valueOf: function () { n++; return 1; }}); n === 2"); +} + +// ---- JSON ---- + +#[test] +fn json_parse_reads_the_grammar_of_section_15_12_1() { + assert_eq!(num("var v = JSON.parse(' {\"a\": [1, -2.5e1, true, null, \"x\\\\u0041\\\\n\"], \"b\": {}} '); v.a[1] + v.a.length"), -20.0); + assert_eq!(string("JSON.parse('\"\\\\ud800\"').charCodeAt === undefined ? 'no string methods' : ''"), "no string methods"); + truth("JSON.parse('[]').length === 0 && JSON.parse('0') === 0 && 1 / JSON.parse('-0') === -Infinity && JSON.parse('{\"a\":1,\"a\":2}').a === 2"); + for bad in ["'{a: 1}'", "'[1,]'", "'01'", "'1.'", "'.5'", "'\"\\t\"'", "\"'x'\"", "'[1] 2'", "''", "'+1'", "'\"\\\\x\"'", "'{\"a\" 1}'"] { + throws(&format!("JSON.parse({bad})"), "SyntaxError"); + } + // The reviver sees every value bottom-up and can delete or replace it. + assert_eq!( + string( + "var seen = []; var v = JSON.parse('{\"a\": [1, 2], \"b\": 3}', function (k, v) { seen.push(k); return k === 'b' ? undefined : v; }); seen.join() + ':' + ('b' in v)" + ), + "0,1,a,b,:false" + ); + assert_eq!(num("JSON.parse('[1, 2]', function (k, v) { return typeof v === 'number' ? v * 10 : v; })[1]"), 20.0); +} + +#[test] +fn json_stringify_writes_values_with_replacers_and_indentation() { + assert_eq!( + string("JSON.stringify({a: [1, 'x', null, undefined, function () {}], b: undefined, c: true})"), + "{\"a\":[1,\"x\",null,null,null],\"c\":true}" + ); + assert_eq!(string("JSON.stringify('\\u0001\"\\\\\\n')"), "\"\\u0001\\\"\\\\\\n\""); + assert_eq!(string("JSON.stringify([NaN, Infinity, -0, 1e21])"), "[null,null,0,1e+21]"); + assert_eq!(run("JSON.stringify(undefined)"), JsValue::Undefined); + assert_eq!(run("JSON.stringify(function () {})"), JsValue::Undefined); + assert_eq!(string("JSON.stringify({a: 1, b: [1, 2], c: {}}, null, 2)"), "{\n \"a\": 1,\n \"b\": [\n 1,\n 2\n ],\n \"c\": {}\n}"); + assert_eq!(string("JSON.stringify([1], null, 'abcdefghijkl')"), "[\nabcdefghij1\n]"); + assert_eq!(string("JSON.stringify({a: 1, b: 2, c: 3}, ['c', 'a', 'c', 1])"), "{\"c\":3,\"a\":1}"); + assert_eq!(string("JSON.stringify({a: 1, b: 'x'}, function (k, v) { return typeof v === 'number' ? v + 1 : v; })"), "{\"a\":2,\"b\":\"x\"}"); + assert_eq!(string("JSON.stringify({toJSON: function (k) { return 'k=' + k; }})"), "\"k=\""); + assert_eq!(string("JSON.stringify({d: {toJSON: function (k) { return k; }}})"), "{\"d\":\"d\"}"); + assert_eq!(string("JSON.stringify([Object(false), Object(true)])"), "[false,true]"); + assert_eq!(string("JSON.stringify({}, null, 4) + JSON.stringify([], null, 4)"), "{}[]"); + throws("var a = []; a.push(a); JSON.stringify(a)", "TypeError"); + throws("var o = {}; o.x = {y: o}; JSON.stringify(o)", "TypeError"); + // The same object twice, not nested in itself, is not a cycle. + assert_eq!(string("var x = {}; JSON.stringify([x, x])"), "[{},{}]"); +} + +#[test] +fn deep_json_nesting_needs_no_native_stack() { + let handle = std::thread::Builder::new() + .stack_size(256 << 10) + .spawn(|| { + let mut realm = Realm::new(); + realm.run( + "var depth = 100000; var s = ''; for (var i = 0; i < depth; i++) s += '['; for (i = 0; i < depth; i++) s += ']'; \ + var v = JSON.parse(s); var back = JSON.stringify(v); var n = 0; JSON.parse(s, function (k, v) { n++; return v; }); \ + back.length === 2 * depth && n === depth", + ) + }) + .unwrap(); + assert_eq!(handle.join().unwrap(), Ok(JsValue::Bool(true))); +} + +// ---- global functions ---- + +#[test] +fn global_number_functions() { + truth("parseInt(' 0x1F') === 31 && parseInt('-12px') === -12 && parseInt('z', 36) === 35 && isNaN(parseInt('', 10)) && isNaN(parseInt('1', 1))"); + truth( + "parseInt('011') === 11 && parseInt('11', 2) === 3 && parseInt('0x10', 16) === 16 && isNaN(parseInt('0x', 16)) && parseInt('12', 3.9) === 5", + ); + truth("parseInt('123456789012345678901234567890') === 1.2345678901234568e29 && 1 / parseInt('-0') === -Infinity"); + truth( + "parseFloat(' 3.5e2x') === 350 && parseFloat('-.5') === -0.5 && parseFloat('Infinityx') === Infinity && isNaN(parseFloat('e5')) && parseFloat('1e') === 1", + ); + truth("isNaN('x') && !isNaN('1') && isFinite('1') && !isFinite(Infinity) && !isFinite(NaN)"); + truth("NaN !== NaN && Infinity === 1 / 0 && undefined === void 0 && !Object.getOwnPropertyDescriptor(this, 'NaN').writable"); +} + +#[test] +fn uri_functions_encode_and_decode_utf8() { + assert_eq!(string("encodeURIComponent('a b&c/\\u00e9\\ud83d\\ude00')"), "a%20b%26c%2F%C3%A9%F0%9F%98%80"); + assert_eq!(string("encodeURI('http://x.y/a b?c=d#e')"), "http://x.y/a%20b?c=d#e"); + assert_eq!(string("decodeURIComponent('a%20b%26%C3%A9%F0%9F%98%80') === 'a b&\\u00e9\\ud83d\\ude00' ? 'ok' : 'no'"), "ok"); + assert_eq!(string("decodeURI('%3B%2F%20%23')"), "%3B%2F %23"); + for bad in [ + "encodeURI('\\ud800')", + "encodeURIComponent('\\udc00x')", + "decodeURI('%')", + "decodeURI('%C3')", + "decodeURI('%C0%80')", + "decodeURI('%ED%A0%80')", + "decodeURI('%FF')", + ] { + throws(bad, "URIError"); + } +} + +#[test] +fn escape_and_unescape_follow_annex_b() { + assert_eq!(string("escape('a b+/@\\u00e9\\u0100')"), "a%20b+/@%E9%u0100"); + assert_eq!(string("unescape('a%20b%E9%u0100%zz%u12') === 'a b\\u00e9\\u0100%zz%u12' ? 'ok' : 'no'"), "ok"); +} + +// ---- robustness ---- + +/// Calls of built-ins with arguments of every kind. +const CALLS: &[&str] = &[ + "[1,,3].join(X)", + "[3,1,2].sort(X)", + "[1,2,3].splice(X, X, X)", + "[1,2].slice(X, X)", + "[].concat(X, [X])", + "[1,2,3].map(X)", + "[1,2].reduce(X, X)", + "[1,2].indexOf(X, X)", + "[1,2].lastIndexOf(X, X)", + "Array.prototype.push.call(X, X)", + "Array.prototype.unshift.call(X, X)", + "Array.prototype.reverse.call(X)", + "Array(X)", + "Object.keys(X)", + "Object.freeze(X)", + "Object.defineProperty(X, X, X)", + "Object.create(X, X)", + "Object.getOwnPropertyNames(X)", + "JSON.stringify(X, X, X)", + "JSON.parse(X, X)", + "Math.max(X, X)", + "Math.pow(X, X)", + "parseInt(X, X)", + "parseFloat(X)", + "decodeURIComponent(X)", + "encodeURI(X)", + "unescape(X)", + "escape(X)", + "Function.prototype.bind.call(X, X)", +]; + +const ARGS: &[&str] = &[ + "undefined", + "null", + "0", + "-1", + "4294967295", + "NaN", + "'%E0'", + "'[1,{\"a\":2}]'", + "''", + "[]", + "{length: 4294967295}", + "{}", + "function (a, b) { return b - a; }", + "{valueOf: function () { throw 1; }}", + "{get length() { return 3; }}", + "Object.freeze([1, 2])", + "{value: 1, get: function () {}}", +]; + +proptest! { + #![proptest_config(ProptestConfig::with_cases(256))] + + #[test] + fn arbitrary_built_in_calls_never_panic(call in 0..CALLS.len(), args in proptest::collection::vec(0..ARGS.len(), 3)) { + let mut src = CALLS[call].to_string(); + for a in &args { + src = src.replacen('X', ARGS[*a], 1); + } + let src = src.replace('X', "1"); + let mut realm = small(Limits { fuel: 200_000, heap_bytes: 4 << 20, frames: 200, reentry: 8 }); + if let Err(e) = realm.run(&src) { + prop_assert!(e.kind != RunErrorKind::Internal, "{src}: {e:?}"); + } + } +} diff --git a/crates/js/src/heap.rs b/crates/js/src/heap.rs index 82268f489..66dc00b24 100644 --- a/crates/js/src/heap.rs +++ b/crates/js/src/heap.rs @@ -170,11 +170,14 @@ pub(crate) enum NativeKind { Eval, } +/// What a function object runs. `Bound` is a function made by `Function.prototype.bind` (section +/// 15.3.4.5): calling it calls `target` with `this` and `args` before the arguments it is given. #[derive(Clone)] pub(crate) enum Func { Closure { code: Rc, env: EnvId }, Native { f: NativeFn, kind: NativeKind, constructor: bool, name: &'static str }, Host { f: Rc, name: Rc }, + Bound { target: ObjId, this: Value, args: Rc<[Value]> }, } /// A sloppy mode `arguments` object's link to its function's parameters (section 10.6): index @@ -204,25 +207,31 @@ pub(crate) enum Class { Function(Func), Error, Arguments(Box), - /// A `Boolean` object made by ToObject. - Boolean, + /// A `Boolean` object made by ToObject, with its primitive value. + Boolean(bool), /// A `Number` object made by ToObject. Number, String(Str), RegExp, ForIn(Box), + /// The `Math` object (section 15.8). + Math, + /// The `JSON` object (section 15.12). + Json, } impl Class { /// The `[[Class]]` name `Object.prototype.toString` reports. pub(crate) fn name(&self) -> &'static str { match self { + Class::Math => "Math", + Class::Json => "JSON", Class::Ordinary | Class::ForIn(_) => "Object", Class::Array { .. } => "Array", Class::Function(_) => "Function", Class::Error => "Error", Class::Arguments(_) => "Arguments", - Class::Boolean => "Boolean", + Class::Boolean(_) => "Boolean", Class::Number => "Number", Class::String(_) => "String", Class::RegExp => "RegExp", @@ -289,6 +298,8 @@ pub(crate) const OBJECT_BYTES: usize = 96; pub(crate) const ENV_BYTES: usize = 64; /// The estimated bytes of a rope node. pub(crate) const ROPE_BYTES: usize = 48; +/// The estimated bytes of each argument a bound function holds. +pub(crate) const BOUND_ARG_BYTES: usize = 24; /// The estimated bytes of a piece of code without its instructions, tables and strings. const CODE_BYTES: usize = 384; @@ -305,6 +316,10 @@ pub(crate) struct Heap { pub(crate) bytes: usize, /// How many collections have run. pub(crate) collections: usize, + /// Counts the properties whose names start with a digit (the array indices among them) added + /// to any object, so an operation that lists the indices an object has can tell whether a + /// script added one since. + pub(crate) index_epoch: u64, } impl Heap { @@ -521,11 +536,20 @@ fn trace_object(o: &Object, work: &mut Vec, strings: &mut StringSizes) -> u Prop::Accessor { get, set, .. } => work.extend(get.iter().chain(set.iter()).map(|f| f.0)), } } + let mut extra = 0; match &o.class { Class::Function(Func::Closure { env, code }) => { work.push(env.0); mark_code(code, strings); } + Class::Function(Func::Bound { target, this, args }) => { + work.push(target.0); + mark_value(this, work, strings); + for a in args.iter() { + mark_value(a, work, strings); + } + extra = BOUND_ARG_BYTES * args.len(); + } Class::Arguments(map) => work.push(map.env.0), Class::String(s) => strings.add(s), Class::ForIn(state) => { @@ -534,7 +558,7 @@ fn trace_object(o: &Object, work: &mut Vec, strings: &mut StringSizes) -> u } _ => {} } - OBJECT_BYTES + PROP_BYTES * o.props.len() + OBJECT_BYTES + PROP_BYTES * o.props.len() + extra } fn trace_env(e: &Env, work: &mut Vec, strings: &mut StringSizes) -> usize { diff --git a/crates/js/src/interp.rs b/crates/js/src/interp.rs index 7df501699..57adbbb9b 100644 --- a/crates/js/src/interp.rs +++ b/crates/js/src/interp.rs @@ -161,6 +161,11 @@ pub(crate) struct Interp { pub(crate) throw_site: Option, /// The last exception a run did not catch. pub(crate) last_thrown: Value, + /// The state of `Math.random`'s generator. + pub(crate) random: u64, + /// The objects `Array.prototype.join` and `toLocaleString` are joining, innermost last: a + /// cycle back to one of them joins as an empty string. + pub(crate) join_stack: Vec, } /// The least heap size a collection waits for. @@ -186,6 +191,15 @@ fn index_keys_bytes(len: usize) -> usize { total } +/// A seed for `Math.random` that differs from realm to realm, from the standard library's +/// randomly keyed hasher; never zero. +fn random_seed() -> u64 { + use std::hash::{BuildHasher, Hasher}; + let mut h = std::collections::hash_map::RandomState::new().build_hasher(); + h.write_u64(0x9e37_79b9_7f4a_7c15); + h.finish() | 1 +} + /// The estimated bytes of a binding or property named by `len` code units. fn binding_bytes(len: usize) -> usize { PROP_BYTES + string_bytes(len) @@ -286,6 +300,8 @@ impl Interp { source_units: 0, throw_site: None, last_thrown: Value::Undefined, + random: random_seed(), + join_stack: Vec::new(), }; crate::builtins::install(&mut interp); interp.gc_threshold = interp.next_threshold(); @@ -981,13 +997,210 @@ impl Interp { *length = i + 1; } let name_len = k.len(); + let index = new && k.first().is_some_and(|&u| (u16::from(b'0')..=u16::from(b'9')).contains(&u)); o.props.insert(k, prop); if new { self.heap.bytes += PROP_BYTES + string_bytes(name_len); } + if index { + self.heap.index_epoch = self.heap.index_epoch.wrapping_add(1); + } Ok(()) } + /// [[DefineOwnProperty]] (section 8.12.9, with the array rules of section 15.4.5.1 and the + /// arguments object rules of section 10.6). Returns whether the property was defined; with + /// `throw` a rejection throws a `TypeError` instead. + pub(crate) fn define_own_property(&mut self, id: ObjId, k: Key, desc: &Desc, throw: bool) -> JsResult { + match &self.object(id)?.class { + Class::Array { length, length_writable } => { + let (length, length_writable) = (*length, *length_writable); + if is(&k, "length") { + return self.define_array_length(id, desc, throw); + } + if let Some(i) = array_index(&k) + && i >= length + && !length_writable + { + return self.reject_bool(throw, &k, "the array's length is read-only"); + } + self.define_ordinary(id, k, desc, throw) + } + Class::Arguments(map) => { + let mapped = array_index(&k).and_then(|i| map.names.get(i as usize)).and_then(Option::as_ref).cloned(); + if !self.define_ordinary(id, k.clone(), desc, false)? { + return self.reject_bool(throw, &k, "the property cannot be redefined"); + } + if let Some(name) = mapped { + let env = match &self.object(id)?.class { + Class::Arguments(map) => Some(map.env), + _ => None, + }; + if let Some(v) = desc.value.clone().filter(|_| !desc.is_accessor()) + && let Some(env) = env + && let Some(Env::Decl { bindings, .. }) = self.heap.env_mut(env) + && let Some(b) = bindings.get_mut(&name) + { + b.value = v; + } + if (desc.is_accessor() || desc.writable == Some(false)) + && let Class::Arguments(map) = &mut self.object_mut(id)?.class + && let Some(slot) = array_index(&k).and_then(|i| map.names.get_mut(i as usize)) + { + *slot = None; + } + } + Ok(true) + } + _ => self.define_ordinary(id, k, desc, throw), + } + } + + fn reject_bool(&mut self, throw: bool, k: &[u16], why: &str) -> JsResult { + if throw { + let message = format!("cannot define property '{}': {why}", String::from_utf16_lossy(k)); + return Err(self.type_error(&message)); + } + Ok(false) + } + + /// The default [[DefineOwnProperty]] (section 8.12.9). + fn define_ordinary(&mut self, id: ObjId, k: Key, desc: &Desc, throw: bool) -> JsResult { + let current = self.get_own_property(id, &k)?; + let o = self.object(id)?; + let virtual_string = matches!(&o.class, Class::String(s) if is(&k, "length") || array_index(&k).is_some_and(|i| (i as usize) < s.len())); + let Some(current) = current else { + if !o.extensible { + return self.reject_bool(throw, &k, "the object is not extensible"); + } + let flags = desc.flags_or(0); + let prop = if desc.is_accessor() { + Prop::Accessor { get: desc.get.flatten(), set: desc.set.flatten(), flags: flags & !WRITABLE } + } else { + Prop::Data { value: desc.value.clone().unwrap_or(Value::Undefined), flags } + }; + self.define(id, k, prop)?; + return Ok(true); + }; + let Some(merged) = merge_desc(¤t, desc) else { return self.reject_bool(throw, &k, "the property cannot be redefined") }; + // An index or the length of a String object cannot change, so a definition that passes + // the checks leaves it as it is. + if virtual_string { + return Ok(true); + } + self.define(id, k, merged)?; + Ok(true) + } + + /// Defining an array's `length` (section 15.4.5.1, step 3). + fn define_array_length(&mut self, id: ObjId, desc: &Desc, throw: bool) -> JsResult { + let length_key = key("length"); + let Some(v) = desc.value.clone() else { + let Some(current) = self.get_own_property(id, &length_key)? else { return internal("an array without a length") }; + let Some(merged) = merge_desc(¤t, desc) else { return self.reject_bool(throw, &length_key, "the length cannot be redefined") }; + if let Class::Array { length_writable, .. } = &mut self.object_mut(id)?.class { + *length_writable = merged.flags() & WRITABLE != 0; + } + return Ok(true); + }; + let new = to_uint32(self.to_number(&v)?); + if f64::from(new) != self.to_number(&v)? { + return Err(self.throw(ErrorType::Range, "invalid array length")); + } + let Some(current) = self.get_own_property(id, &length_key)? else { return internal("an array without a length") }; + let Class::Array { length: old, length_writable } = self.object(id)?.class else { return internal("not an array") }; + let new_desc = Desc { value: Some(Value::Number(f64::from(new))), ..desc.clone() }; + if new >= old { + let Some(merged) = merge_desc(¤t, &new_desc) else { return self.reject_bool(throw, &length_key, "the length cannot be redefined") }; + if let Class::Array { length, length_writable } = &mut self.object_mut(id)?.class { + *length = new; + *length_writable = merged.flags() & WRITABLE != 0; + } + return Ok(true); + } + if !length_writable { + return self.reject_bool(throw, &length_key, "it is read-only"); + } + let checked = Desc { writable: None, ..new_desc }; + if merge_desc(¤t, &checked).is_none() { + return self.reject_bool(throw, &length_key, "the length cannot be redefined"); + } + let read_only = desc.writable == Some(false); + if !self.shrink_array(id, new, read_only)? { + return self.reject_bool(throw, &length_key, "an element cannot be deleted"); + } + Ok(true) + } + + /// Sets an array's length to `new`, deleting the elements at and past it from the last one + /// down (section 15.4.5.1, step 3.l). An element that cannot be deleted stops it, leaving + /// the length one past that element, and gives `false`. Each property takes a unit of fuel + /// before anything is removed. With `read_only` the length is made read-only afterwards + /// either way. + fn shrink_array(&mut self, id: ObjId, new: u32, read_only: bool) -> JsResult { + let Class::Array { length: old, .. } = self.object(id)?.class else { return internal("not an array") }; + let mut ok = true; + let mut length = new; + if new < old { + for _ in 0..self.object(id)?.props.len() { + self.use_fuel()?; + } + let o = self.object_mut(id)?; + let mut doomed: Vec<(u32, Key)> = + o.props.iter().filter_map(|(k, _)| array_index(k).filter(|&i| i >= new).map(|i| (i, k.clone()))).collect(); + doomed.sort_unstable_by_key(|d| std::cmp::Reverse(d.0)); + for (i, k) in doomed { + if o.props.get(&k).is_some_and(|p| !p.configurable()) { + length = i + 1; + ok = false; + break; + } + o.props.remove(&k); + } + } + if let Class::Array { length: l, length_writable } = &mut self.object_mut(id)?.class { + *l = length; + if read_only { + *length_writable = false; + } + } + Ok(ok) + } + + /// The names of an object's own properties (section 15.2.3.4): a String object's indices and + /// an array's or String object's `length` first, then the rest in the order they were added, + /// which is the order `for-in` visits them. Each name takes a unit of fuel, and the heap for + /// the list is checked first. + pub(crate) fn own_keys(&mut self, id: ObjId) -> JsResult> { + let o = self.object(id)?; + let string_len = if let Class::String(s) = &o.class { s.len() } else { 0 }; + let has_length = matches!(o.class, Class::Array { .. } | Class::String(_)); + let count = o.props.len().saturating_add(string_len).saturating_add(usize::from(has_length)); + self.reserve_heap(index_keys_bytes(string_len).saturating_add(count.saturating_mul(KEY_ENTRY_BYTES)))?; + let mut out = Vec::with_capacity(count); + for i in 0..string_len { + self.use_fuel()?; + out.push(index_key(u32::try_from(i).unwrap_or(u32::MAX))); + } + if has_length { + out.push(key("length")); + } + for _ in 0..self.object(id)?.props.len() { + self.use_fuel()?; + } + out.extend(self.object(id)?.props.keys()); + Ok(out) + } + + /// Runs `f` with `values` kept reachable for any collection it starts. + pub(crate) fn rooted(&mut self, values: &[Value], f: impl FnOnce(&mut Self) -> JsResult) -> JsResult { + let mark = self.temp_roots.len(); + self.temp_roots.extend(values.iter().cloned()); + let r = f(self); + self.temp_roots.truncate(mark); + r + } + fn reject(&mut self, throw: bool, k: &[u16], why: &str) -> JsResult<()> { if throw { let message = format!("cannot assign to property '{}': {why}", String::from_utf16_lossy(k)); @@ -1061,25 +1274,12 @@ impl Interp { if f64::from(new) != n { return Err(self.throw(ErrorType::Range, "invalid array length")); } - let o = self.object(id)?; - let Class::Array { length: old, length_writable } = o.class else { return internal("not an array") }; + let Class::Array { length_writable, .. } = self.object(id)?.class else { return internal("not an array") }; if !length_writable { return self.reject(throw, &key("length"), "it is read-only"); } - if new < old { - // Shrinking visits every property: each takes fuel before anything is removed. - for _ in 0..o.props.len() { - self.use_fuel()?; - } - } - let o = self.object_mut(id)?; - let Class::Array { length, .. } = &mut o.class else { return internal("not an array") }; - *length = new; - if new < old { - let doomed: Vec = o.props.keys().into_iter().filter(|k| array_index(k).is_some_and(|i| i >= new)).collect(); - for k in doomed { - o.props.remove(&k); - } + if !self.shrink_array(id, new, false)? { + return self.reject(throw, &key("length"), "an element cannot be deleted"); } Ok(()) } @@ -1486,6 +1686,9 @@ impl Interp { /// Resolves `call` and `apply` and runs native and host functions; a function written in /// JavaScript comes back to be entered by the caller. fn prepare_call(&mut self, mut f: Value, mut this: Value, mut args: Vec) -> JsResult { + // The arguments `apply` reads and those a bound function adds are not on the operand + // stack, so a native function's collection must be told about them. + let mut unrooted = false; loop { let Some(func) = self.func_of(&f) else { return Err(self.type_error("the value is not a function")) }; match func { @@ -1507,6 +1710,23 @@ impl Interp { f = this; this = args.first().cloned().unwrap_or(Value::Undefined); args = self.list_from_array_like(&list)?; + unrooted = true; + } + Func::Bound { target, this: bound_this, args: bound_args } => { + self.use_fuel()?; + let mut all = Vec::with_capacity(bound_args.len().saturating_add(args.len())); + all.extend(bound_args.iter().cloned()); + all.append(&mut args); + args = all; + this = bound_this; + f = Value::Object(target); + unrooted = true; + } + Func::Native { f: native, .. } if unrooted => { + let mut roots = args.clone(); + roots.push(this.clone()); + let v = self.rooted(&roots, |interp| native(interp, this, &args, false))?; + return Ok(Prepared::Done(v)); } Func::Native { f: native, .. } => return Ok(Prepared::Done(native(self, this, &args, false)?)), Func::Host { f: host, .. } => { @@ -1582,8 +1802,17 @@ impl Interp { let n = argc as usize; let start = self.stack.len().checked_sub(n + 1).filter(|&s| s >= self.base()).ok_or_else(|| Abrupt::Internal("new below the stack".into()))?; - let f = self.stack.get(start).cloned().unwrap_or(Value::Undefined); - let args: Vec = self.stack.get(start + 1..).map(<[Value]>::to_vec).unwrap_or_default(); + let mut f = self.stack.get(start).cloned().unwrap_or(Value::Undefined); + let mut args: Vec = self.stack.get(start + 1..).map(<[Value]>::to_vec).unwrap_or_default(); + // A bound function constructs its target with its arguments first (section 15.3.4.5.2); + // the bound function on the stack keeps them reachable. + while let Some(Func::Bound { target, args: bound_args, .. }) = self.func_of(&f) { + self.use_fuel()?; + let mut all = bound_args.to_vec(); + all.append(&mut args); + args = all; + f = Value::Object(target); + } match self.func_of(&f) { Some(Func::Closure { code, env }) => { let Some(callee) = f.as_object() else { return internal("callee is not an object") }; @@ -2001,7 +2230,7 @@ impl Interp { let (class, proto) = match v { Value::Object(o) => return Ok(*o), Value::Undefined | Value::Null => return Err(self.type_error("cannot convert undefined or null to an object")), - Value::Bool(_) => (Class::Boolean, self.intrinsics.boolean_proto), + Value::Bool(b) => (Class::Boolean(*b), self.intrinsics.boolean_proto), Value::Number(_) => (Class::Number, self.intrinsics.number_proto), Value::String(s) => (Class::String(s.clone()), self.intrinsics.string_proto), }; @@ -2146,7 +2375,13 @@ impl Interp { if !self.is_callable(f) { return Err(self.type_error("the right side of 'instanceof' is not a function")); } - let Some(fid) = f.as_object() else { return Ok(false) }; + let Some(mut fid) = f.as_object() else { return Ok(false) }; + // A bound function answers for its target (section 15.3.4.5.3). + while let Some(Func::Bound { target, .. }) = self.func_of(&Value::Object(fid)) { + self.use_fuel()?; + fid = target; + } + let f = &Value::Object(fid); let Value::Object(mut o) = v.clone() else { return Ok(false) }; let Value::Object(proto) = self.get_from(fid, &key("prototype"), f)? else { return Err(self.type_error("the function's prototype is not an object")); @@ -2221,6 +2456,107 @@ pub(crate) enum CompileError { Internal(String), } +/// A property descriptor (section 8.10): each field is `None` when it is absent. `get` and `set` +/// are `Some(None)` when present as `undefined`. +#[derive(Clone, Default, Debug)] +pub(crate) struct Desc { + pub(crate) value: Option, + pub(crate) get: Option>, + pub(crate) set: Option>, + pub(crate) writable: Option, + pub(crate) enumerable: Option, + pub(crate) configurable: Option, +} + +impl Desc { + /// A data descriptor with every attribute given. + pub(crate) fn data(value: Value, flags: u8) -> Self { + Desc { + value: Some(value), + writable: Some(flags & WRITABLE != 0), + enumerable: Some(flags & ENUMERABLE != 0), + configurable: Some(flags & CONFIGURABLE != 0), + ..Desc::default() + } + } + + pub(crate) fn is_accessor(&self) -> bool { + self.get.is_some() || self.set.is_some() + } + + pub(crate) fn is_data(&self) -> bool { + self.value.is_some() || self.writable.is_some() + } + + /// The attribute flags the descriptor gives, each absent one taken from `default`. + fn flags_or(&self, default: u8) -> u8 { + let pick = |field: Option, bit: u8| match field { + Some(true) => bit, + Some(false) => 0, + None => default & bit, + }; + pick(self.writable, WRITABLE) | pick(self.enumerable, ENUMERABLE) | pick(self.configurable, CONFIGURABLE) + } +} + +/// SameValue (section 9.12). +pub(crate) fn same_value(a: &Value, b: &Value) -> bool { + match (a, b) { + (Value::Number(x), Value::Number(y)) => (x.is_nan() && y.is_nan()) || (x == y && x.is_sign_negative() == y.is_sign_negative()), + _ => strict_eq(a, b), + } +} + +/// Steps 5 to 12 of [[DefineOwnProperty]] (section 8.12.9) for an existing property: the +/// property after `desc` is applied, or `None` when the change is not allowed. +fn merge_desc(current: &Prop, desc: &Desc) -> Option { + let flags = current.flags(); + let configurable = flags & CONFIGURABLE != 0; + if !configurable { + if desc.configurable == Some(true) { + return None; + } + if desc.enumerable.is_some_and(|e| e != (flags & ENUMERABLE != 0)) { + return None; + } + } + let attrs = |base: u8, writable_bit: bool| { + let f = desc.flags_or(base); + if writable_bit { f } else { f & !WRITABLE } + }; + match current { + Prop::Data { .. } if desc.is_accessor() => { + if !configurable { + return None; + } + Some(Prop::Accessor { get: desc.get.flatten(), set: desc.set.flatten(), flags: attrs(flags & !WRITABLE, false) }) + } + Prop::Accessor { .. } if desc.is_data() => { + if !configurable { + return None; + } + Some(Prop::Data { value: desc.value.clone().unwrap_or(Value::Undefined), flags: attrs(flags & !WRITABLE, true) }) + } + Prop::Data { value, .. } => { + if !configurable && flags & WRITABLE == 0 { + if desc.writable == Some(true) { + return None; + } + if desc.value.as_ref().is_some_and(|v| !same_value(v, value)) { + return None; + } + } + Some(Prop::Data { value: desc.value.clone().unwrap_or_else(|| value.clone()), flags: attrs(flags, true) }) + } + Prop::Accessor { get, set, .. } => { + if !configurable && (desc.get.is_some_and(|g| g != *get) || desc.set.is_some_and(|s| s != *set)) { + return None; + } + Some(Prop::Accessor { get: desc.get.unwrap_or(*get), set: desc.set.unwrap_or(*set), flags: attrs(flags, false) }) + } + } +} + /// The strict equality comparison (section 11.9.6). pub(crate) fn strict_eq(a: &Value, b: &Value) -> bool { match (a, b) { diff --git a/crates/js/src/lib.rs b/crates/js/src/lib.rs index 9c0c192aa..8a80eaf01 100644 --- a/crates/js/src/lib.rs +++ b/crates/js/src/lib.rs @@ -23,9 +23,13 @@ //! verifier, and runs it on an interpreter that keeps JavaScript calls on its own frame stack, so //! deep recursion in a script does not use the native stack. Objects and environments live in an //! arena with a mark-and-sweep collector; strings built by repeated `+` are flattened and dropped -//! with loops. The realm provides the language (sections 10 to 14 of ECMA-262 5.1) and a minimal -//! set of built-ins: `Object` and `Object.prototype`'s basic methods, `Function` with -//! `Function.prototype.call` and `apply`, `eval`, and the error constructors. Every run is bounded +//! with loops. The realm provides the language (sections 10 to 14 of ECMA-262 5.1) and these +//! built-ins: the global functions and constants (15.1, with Annex B's `escape` and `unescape`), +//! `Object` (15.2), `Function` with `call`, `apply` and `bind` (15.3), `Array` (15.4), the error +//! types (15.11), `Math` (15.8) and `JSON` (15.12). The array methods visit only the indices an +//! array or array-like object has, so a sparse array of length 2^32-1 costs as much as its +//! elements, and `JSON.parse`, `JSON.stringify` and the reviver walk use no native recursion. The +//! prototype methods are writable and configurable, so scripts can replace them. Every run is bounded //! by [`Limits`]: instructions run (fuel), heap bytes, frames, nested host calls, and an //! [`Interrupt`] flag another thread can set. A run that reaches a limit ends with //! [`RunErrorKind::Limit`], which a script's `try` cannot catch. @@ -169,6 +173,8 @@ impl LineTable { } } +#[cfg(test)] +mod builtins_tests; #[cfg(test)] mod interp_tests; #[cfg(test)] diff --git a/crates/js/src/realm.rs b/crates/js/src/realm.rs index 29d3aacb2..f95d57d17 100644 --- a/crates/js/src/realm.rs +++ b/crates/js/src/realm.rs @@ -188,6 +188,7 @@ impl Realm { interp.stack.clear(); interp.frames.clear(); interp.temp_roots.clear(); + interp.join_stack.clear(); match result { Ok(v) => Ok(interp.to_js_value(&v)), Err(Abrupt::Throw(v)) => { diff --git a/crates/js/tests/json2.rs b/crates/js/tests/json2.rs new file mode 100644 index 000000000..8692e9b30 --- /dev/null +++ b/crates/js/tests/json2.rs @@ -0,0 +1,83 @@ +//! Runs `json2.js`, Douglas Crockford's public-domain JSON polyfill, when `cargo xtask test262` has +//! fetched it (it sets `VECTORCRAFT_JSON2`; without it the test looks in `corpus/json2/` and skips +//! when the file is absent). +//! +//! The built-in `JSON` is removed first, so the polyfill defines its own. Each sample value is +//! written by the polyfill and by the built-in `JSON.stringify` (ECMA-262 5.1 section 15.12.3), +//! which must give the same text, and the text is read back by the polyfill's `parse` and by the +//! built-in `JSON.parse` (section 15.12.2), which must give values that write the same text again. +//! +//! The polyfill uses `Date`, `String.prototype.replace` and regular expression `test`. While the +//! interpreter lacks any of them, the test prints that it skipped and passes. + +use std::path::{Path, PathBuf}; + +use vectorcraft_js::{JsValue, Realm}; + +fn json2_file() -> Option { + if let Ok(path) = std::env::var("VECTORCRAFT_JSON2") { + return Some(PathBuf::from(path)); + } + let corpus = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../corpus/json2"); + let mut dirs: Vec = + std::fs::read_dir(corpus).ok()?.filter_map(|e| e.ok().map(|e| e.path().join("json2.js"))).filter(|p| p.is_file()).collect(); + dirs.sort(); + dirs.pop() +} + +/// Built-ins the polyfill needs. +const NEEDS: &str = + "typeof Date === 'function' && typeof ''.replace === 'function' && typeof RegExp === 'function' && typeof /a/.test === 'function'"; + +/// Saves the built-in `JSON` and removes it, so the polyfill defines its own. +const BEFORE: &str = "var NATIVE = JSON; delete this.JSON; this.JSON = undefined;"; + +/// Writes and reads each sample with both implementations; gives the first difference, or "ok". +const ROUND_TRIP: &str = r#" +var POLY = JSON; +var samples = [ + 0, -1.5, 1e21, "", "plain", "quote \" backslash \\ newline \n tab \t \u0001 
 é", + true, false, null, [], {}, [1, [2, [3, []]]], {a: 1, b: [true, null, "x"], c: {d: {}}}, + [undefined, function () {}], {skip: undefined, f: function () {}, keep: 2}, [NaN, Infinity, -Infinity] +]; +var problem = "ok"; +for (var i = 0; i < samples.length && problem === "ok"; i++) { + var poly = POLY.stringify(samples[i]); + var native = NATIVE.stringify(samples[i]); + if (poly !== native) { + problem = "sample " + i + ": json2 wrote " + poly + ", the built-in wrote " + native; + } else if (poly !== undefined) { + if (NATIVE.stringify(POLY.parse(native)) !== native) { + problem = "sample " + i + ": json2 read " + native + " differently"; + } else if (POLY.stringify(NATIVE.parse(poly)) !== poly) { + problem = "sample " + i + ": the built-in read " + poly + " differently"; + } + } +} +var indented = {a: [1, {b: 2}], c: "d"}; +if (problem === "ok" && POLY.stringify(indented, null, 2) !== NATIVE.stringify(indented, null, 2)) { + problem = "indented output differs"; +} +if (problem === "ok" && POLY.stringify(indented, ["c"]) !== NATIVE.stringify(indented, ["c"])) { + problem = "property list output differs"; +} +problem; +"#; + +#[test] +fn json2_polyfill_round_trips_with_the_built_in_json() { + let Some(path) = json2_file() else { + println!("json2: SKIPPED (no json2.js; run cargo xtask test262)"); + return; + }; + let source = std::fs::read_to_string(&path).unwrap_or_else(|e| panic!("{}: {e}", path.display())); + let mut realm = Realm::new(); + if realm.run(NEEDS) != Ok(JsValue::Bool(true)) { + println!("json2: SKIPPED (the interpreter lacks Date, String.prototype.replace or RegExp, which json2.js uses)"); + return; + } + match realm.run(&format!("{BEFORE}\n{source}\n{ROUND_TRIP}")) { + Ok(JsValue::String(s)) if s == "ok" => println!("json2: the polyfill and the built-in JSON agree on every sample"), + other => panic!("json2: {other:?}"), + } +} diff --git a/crates/js/tests/test262.rs b/crates/js/tests/test262.rs index 8c87bb19d..fdf72aa9c 100644 --- a/crates/js/tests/test262.rs +++ b/crates/js/tests/test262.rs @@ -19,6 +19,10 @@ //! passes when it completes, or, for `negative: phase: runtime`, when it throws an object whose //! `constructor` is the global its `type:` names. Its counts are printed apart from the parse //! counts, and its failures go to `run-failures.txt`. +//! +//! A third test runs the tests of the ES5 built-ins the same way: those under the folders +//! [`ES5_BUILT_INS`] names that have an `es5id:` (or, under `annexB/`, any edition's id) and no +//! `features:` tag. Its failures go to `built-ins-failures.txt`. use std::collections::HashSet; use std::path::{Path, PathBuf}; @@ -193,15 +197,37 @@ fn es5_parse_subset() { ); } -/// Globals and method names the interpreter does not provide yet: a test that names one is -/// skipped. -const MISSING_BUILTINS: &str = "Array String Number Boolean Math JSON Date RegExp parseInt parseFloat isNaN isFinite encodeURI \ - decodeURI encodeURIComponent decodeURIComponent escape unescape print $262 $DONE Symbol Proxy Reflect Promise Map Set WeakMap \ - WeakSet ArrayBuffer DataView Int8Array Uint8Array Float64Array defineProperty defineProperties getOwnPropertyDescriptor \ - getOwnPropertyNames getPrototypeOf create keys freeze isFrozen seal isSealed preventExtensions isExtensible push pop shift unshift \ - slice splice concat join reverse sort indexOf lastIndexOf every some forEach map filter reduce reduceRight charAt charCodeAt \ - fromCharCode substring substr split replace match search exec test toUpperCase toLowerCase trim toFixed toPrecision toExponential \ - bind now isArray compareArray verifyProperty fnGlobalObject"; +/// Globals and method names the interpreter does not provide yet: a test that names one, in its +/// own source or in a harness file it includes, is skipped. +const MISSING_BUILTINS: &str = "String Number Boolean Date RegExp print $262 $DONE Symbol Proxy Reflect Promise Map Set WeakMap \ + WeakSet ArrayBuffer DataView Int8Array Uint8Array Float64Array charAt charCodeAt fromCharCode substring substr split replace \ + match search exec test toUpperCase toLowerCase trim toFixed toPrecision toExponential now"; + +/// The directories under `test/built-ins/` and `test/annexB/built-ins/` that hold tests of the +/// ES5 built-ins (ECMA-262 5.1 sections 15.1 to 15.12 and Annex B.2). +const ES5_BUILT_INS: &[&str] = &[ + "built-ins/Object", + "built-ins/Function", + "built-ins/Array", + "built-ins/Error", + "built-ins/NativeErrors", + "built-ins/Math", + "built-ins/JSON", + "built-ins/global", + "built-ins/Infinity", + "built-ins/NaN", + "built-ins/undefined", + "built-ins/parseInt", + "built-ins/parseFloat", + "built-ins/isNaN", + "built-ins/isFinite", + "built-ins/encodeURI", + "built-ins/encodeURIComponent", + "built-ins/decodeURI", + "built-ins/decodeURIComponent", + "annexB/built-ins/escape", + "annexB/built-ins/unescape", +]; /// The stand-in for `String` that the harness's failure messages call. const HARNESS_STRING: &str = "function String(value) { return '' + value; }"; @@ -245,12 +271,28 @@ fn es5_language_subset_runs() { }; // Each test runs on a thread with a stack large enough for the nested runs the re-entry limit // allows in an unoptimized build. - let handle = std::thread::Builder::new().stack_size(64 << 20).spawn(move || run_language_subset(&dir)).unwrap(); + let roots = vec![(dir.join("test").join("language"), true)]; + let handle = std::thread::Builder::new().stack_size(64 << 20).spawn(move || run_subset(&dir, &roots, "language", "run-failures.txt")).unwrap(); handle.join().unwrap(); } -fn run_language_subset(dir: &Path) { - let language = dir.join("test").join("language"); +#[test] +fn es5_built_ins_subset_runs() { + let Some(dir) = suite_dir() else { + println!("test262 built-ins: SKIPPED (no suite; run cargo xtask test262)"); + return; + }; + // The Annex B tests name the edition they were written for with `esid:`, so they run without + // an `es5id:`. + let roots = ES5_BUILT_INS.iter().map(|d| (dir.join("test").join(d), !d.starts_with("annexB"))).collect::>(); + let handle = + std::thread::Builder::new().stack_size(64 << 20).spawn(move || run_subset(&dir, &roots, "built-ins", "built-ins-failures.txt")).unwrap(); + handle.join().unwrap(); +} + +/// Runs the tests under each root (with `true`, only those that name an ES5 section), prints the +/// counts and writes the failures to `report` beside the suite. +fn run_subset(dir: &Path, roots: &[(PathBuf, bool)], label: &str, report: &str) { let harness_dir = dir.join("harness"); // A file that cannot be read gives an empty source. let read = |p: &Path| String::from_utf8_lossy(&std::fs::read(p).unwrap_or_default()).into_owned(); @@ -262,11 +304,12 @@ fn run_language_subset(dir: &Path) { let verbose = std::env::var_os("VECTORCRAFT_TEST262_VERBOSE").is_some(); let (mut tests, mut skipped, mut passed, mut failed, mut panicked) = (0usize, 0usize, 0usize, 0usize, 0usize); let mut failures = String::new(); - for path in test_files(&language) { + let files = roots.iter().flat_map(|(root, es5_only)| test_files(root).into_iter().map(move |p| (p, *es5_only))); + for (path, es5_only) in files { let source = read(&path); let meta = meta(&source); let negative_parse = matches!(meta.negative_phase.as_deref(), Some("parse" | "resolution")); - if !meta.es5 || !meta.features.is_empty() || negative_parse || meta.flags.iter().any(|f| f == "module") { + if (es5_only && !meta.es5) || !meta.features.is_empty() || negative_parse || meta.flags.iter().any(|f| f == "module") { continue; } let includes: String = meta.includes.iter().map(|i| read(&harness_dir.join(i)) + "\n").collect(); @@ -307,12 +350,12 @@ fn run_language_subset(dir: &Path) { } } } - let report = dir.join("run-failures.txt"); + let report = dir.join(report); if let Err(e) = std::fs::write(&report, &failures) { println!("could not write {}: {e}", report.display()); } println!( - "test262 ES5 language subset through the interpreter: {tests} tests that need only the built-ins present, {passed} runs passed, \ + "test262 ES5 {label} subset through the interpreter: {tests} tests that need only the built-ins present, {passed} runs passed, \ {failed} failed ({panicked} panicked). Skipped {skipped} tests that need other built-ins, use syntax after ES5 or are asynchronous. Failures: {}", report.display() ); diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md index 27e8b3d79..3ddeb2ab0 100644 --- a/docs/target-app-parity.md +++ b/docs/target-app-parity.md @@ -654,7 +654,8 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur - Headless CLI (`vectorcraft-cli run`, `convert`, `info`, `bench`, `perf`, `mcp`). A `run` step, like a `command_batch` step over MCP, can use an earlier step's result (`"$1.id"`, #785); `run --commands FILE` (or `-` for standard input) reads the steps from a JSON array or JSON Lines, past the Windows command-line limit (#3147, `apps/vectorcraft-cli/tests/it/cli.rs` `run_reads_*`, `run_refuses_malformed_commands_naming_the_step`). - File › Scripts › Check Script… reads a script written for Illustrator (`.jsx`, `.jsxinc` or a compiled `.jsxbin`) without running any of it and reports what it needs (the document model, files, dialogs, menu commands, features only Illustrator has), what it would do outside the document, the menu commands and document-model members it uses, its directives and included files, and the problems that would stop it loading (`script.check`, which also reads `.js` files); File › Open and drag-and-drop show the report for `.jsx`, `.jsxinc` and `.jsxbin` files. - `vectorcraft-js` parses JavaScript as ECMAScript 5.1 defines it, with the legacy octal forms, block functions and lenient regular expressions of Annex B, into a syntax tree with source spans; it reads the `#target`, `#include` and other preprocessor lines as directives without running them, and a script that breaks the grammar or an early-error rule gives a `SyntaxError` with its line and column. Nesting past the parser's depth limit (`Options::max_depth`, 200 by default) gives a `SyntaxError` instead of exhausting the stack. `cargo xtask test262` fetches the conformance suite at a pinned commit and parses its ES5 tests: 5,411 of 5,418 runs pass (the 7 others use `let` and `const`). Nothing runs scripts yet. Tests: `crates/js/src/tests.rs`, `crates/engine/tests/it/js_lexer_vs_scriptcheck.rs`. - - `vectorcraft-js`'s `Realm` runs ECMAScript 5.1 scripts: the parsed script compiles to verified bytecode that a non-recursive interpreter runs, with closures, `this`, `arguments`, `with`, direct and indirect `eval`, `new Function`, `try`/`catch`/`finally`, labeled `break` and `continue`, and `for`-`in` in insertion order, over a mark-and-sweep heap. Built-ins are limited to `Object`, `Function` with `call` and `apply`, `eval` and the error types. Every run is bounded by fuel, heap bytes, frames, nested host calls and an interrupt flag (smaller defaults in the wasm build), and a run that reaches a limit stops with a limit error that `try` cannot catch. `cargo xtask test262` also runs the suite's ES5 language tests that need only these built-ins: 3,074 of 3,078 runs pass (the 4 others expect the completion values of later editions). The app does not call it yet. Tests: `crates/js/src/interp_tests.rs`, `crates/js/tests/test262.rs`. + - `vectorcraft-js`'s `Realm` runs ECMAScript 5.1 scripts: the parsed script compiles to verified bytecode that a non-recursive interpreter runs, with closures, `this`, `arguments`, `with`, direct and indirect `eval`, `new Function`, `try`/`catch`/`finally`, labeled `break` and `continue`, and `for`-`in` in insertion order, over a mark-and-sweep heap, with the built-ins the next entry lists. Every run is bounded by fuel, heap bytes, frames, nested host calls and an interrupt flag (smaller defaults in the wasm build), and a run that reaches a limit stops with a limit error that `try` cannot catch. `cargo xtask test262` also runs the suite's ES5 language tests that need only the built-ins present: 3,362 of 3,387 runs pass (4 of the others expect the completion values of later editions, and 21 call `String` or `Number` methods). The app does not call it yet. Tests: `crates/js/src/interp_tests.rs`, `crates/js/tests/test262.rs`. + - `vectorcraft-js` provides the ECMAScript 5.1 built-ins `Object` with its property-descriptor functions, `create`, `keys`, `seal` and `freeze` (section 15.2), `Function.prototype.bind` (15.3.4.5), `Array` with every ES5 method (15.4), the error types (15.11), `Math` (15.8), `JSON` with revivers, replacers and indentation (15.12), and the global functions with Annex B's `escape` and `unescape` (15.1, B.2). The array methods work on array-like objects and visit only the indices that exist, so `new Array(4294967295).join("")` ends at once; `join` writes a cycle back to an array as an empty string, `JSON.stringify` throws a `TypeError` on a cycle, and deep `JSON` nesting uses no native stack. Every loop takes fuel and every result is checked against the heap limit. `cargo xtask test262` runs the suite's ES5 built-in tests that need only these built-ins: 4,478 of 4,556 runs pass (16 of the failing tests call `String`, `Number` or `Boolean` methods, and 23 expect rules of later editions). It also fetches the `json2.js` polyfill at a pinned commit to compare with the built-in `JSON`; that test runs once `Date`, `String.prototype.replace` and `RegExp` exist. Tests: `crates/js/src/builtins_tests.rs`, `crates/js/tests/test262.rs`, `crates/js/tests/json2.rs`. - **UI:** Illustrator 2026 layout restyled to measured values: - Medium Dark theme, categorized and Advanced toolbars (a tool group's flyout opens on a right press, a long press or a press on its corner triangle), 35 pt document tabs, 33 pt panel tabs. - Hint bar, contextual task bar, 19 dock panels with ≡ menus. diff --git a/xtask/src/test262.rs b/xtask/src/test262.rs index 30f6f2472..a1baa5c77 100644 --- a/xtask/src/test262.rs +++ b/xtask/src/test262.rs @@ -2,16 +2,33 @@ //! BSD-3-Clause) at a pinned commit, fetched as GitHub's archive of that commit, checked against //! its SHA-256 and size, and unpacked into `corpus/test262/` (gitignored, never committed). It then //! runs `vectorcraft-js`'s `test262` tests, which parse the ES5 parse subset, run the ES5 -//! `test/language` tests that need only the interpreter's built-ins, and print each one's counts. +//! `test/language` tests and the tests of the ES5 built-ins under `test/built-ins` and +//! `test/annexB/built-ins` that need only the interpreter's built-ins, and print each one's counts. //! -//! Moving the pin: change [`COMMIT`], run the command once with the new commit to see the -//! archive's SHA-256 in the error, check the archive, and update [`SHA256`]. +//! It also fetches `json2.js`, Douglas Crockford's public-domain JSON polyfill +//! (https://github.com/douglascrockford/JSON-js), at a pinned commit, checks it against its SHA-256 +//! and size, saves it in `corpus/json2/` (gitignored, never committed), and runs `vectorcraft-js`'s +//! `json2` test, which runs the polyfill and compares what it writes and reads with the built-in +//! `JSON`. +//! +//! Moving the pin: change [`COMMIT`] (or [`JSON2_COMMIT`]), run the command once with the new +//! commit to see the file's SHA-256 in the error, check the file, and update [`SHA256`] (or +//! [`JSON2_SHA256`]). -use std::path::Path; +use std::path::{Path, PathBuf}; use std::process::Command; use crate::{cargo, root, run, sha256}; +/// The douglascrockford/JSON-js commit `json2.js` is read at. +const JSON2_COMMIT: &str = "7e83f38a2312429fd4933169c1f6a27fd65e889c"; + +/// The SHA-256 of `json2.js` at [`JSON2_COMMIT`]. +const JSON2_SHA256: &str = "86df14b56572e68a7e10b18e71804cb78c6890a7d6e534324822c23d12e858a2"; + +/// The largest `json2.js` accepted (the pinned one is 18,876 bytes). +const JSON2_MAX_BYTES: u64 = 1 << 20; + /// The tc39/test262 commit the suite is read at. const COMMIT: &str = "d53ebc8b1931d9f1541e43d59650776e4b766248"; @@ -25,11 +42,44 @@ pub fn run_suite() -> Result<(), String> { let dir = fetch()?; let mut c = cargo(); c.env("VECTORCRAFT_TEST262_DIR", &dir).args(["test", "-p", "vectorcraft-js", "--release", "--test", "test262", "--", "--nocapture"]); - run(c, &format!("cargo test -p vectorcraft-js --release --test test262 -- --nocapture (VECTORCRAFT_TEST262_DIR={})", dir.display())) + run(c, &format!("cargo test -p vectorcraft-js --release --test test262 -- --nocapture (VECTORCRAFT_TEST262_DIR={})", dir.display()))?; + let json2 = fetch_json2()?; + let mut c = cargo(); + c.env("VECTORCRAFT_JSON2", &json2).args(["test", "-p", "vectorcraft-js", "--release", "--test", "json2", "--", "--nocapture"]); + run(c, &format!("cargo test -p vectorcraft-js --release --test json2 -- --nocapture (VECTORCRAFT_JSON2={})", json2.display())) +} + +/// Fetches `json2.js` unless a copy with the pinned SHA-256 is there already, and returns its path. +fn fetch_json2() -> Result { + let base = root().join("corpus").join("json2").join(JSON2_COMMIT); + let file = base.join("json2.js"); + let matches = |p: &Path| -> Result { + let Ok(meta) = std::fs::metadata(p) else { return Ok(false) }; + if meta.len() > JSON2_MAX_BYTES { + return Err(format!("{} is {} bytes, over the {JSON2_MAX_BYTES}-byte limit", p.display(), meta.len())); + } + Ok(std::fs::read(p).is_ok_and(|b| sha256::hex(&b) == JSON2_SHA256)) + }; + if matches(&file)? { + println!("json2.js {JSON2_COMMIT} is in {}", file.display()); + return Ok(file); + } + std::fs::create_dir_all(&base).map_err(|e| format!("create {}: {e}", base.display()))?; + let url = format!("https://raw.githubusercontent.com/douglascrockford/JSON-js/{JSON2_COMMIT}/json2.js"); + let mut curl = Command::new("curl"); + curl.args(["-fsSL", "--retry", "3", "-A", "VectorCraft-dev", "--max-filesize", &JSON2_MAX_BYTES.to_string(), "-o"]).arg(&file).arg(&url); + run(curl, &format!("curl {url}"))?; + if !matches(&file)? { + let got = std::fs::read(&file).map(|b| sha256::hex(&b)).unwrap_or_default(); + let _ = std::fs::remove_file(&file); + return Err(format!("json2.js: sha256 {got} does not match the pinned {JSON2_SHA256}")); + } + println!("json2.js {JSON2_COMMIT} saved in {}", file.display()); + Ok(file) } /// Fetches and unpacks the suite unless it is there already, and returns its folder. -fn fetch() -> Result { +fn fetch() -> Result { let base = root().join("corpus").join("test262"); let dir = base.join(format!("test262-{COMMIT}")); let marker = dir.join(".vectorcraft-sha256"); From 1470dd5ca9a5e6f0c014b80212df7c0137b45bbe Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sat, 7 Nov 2026 17:09:47 -0800 Subject: [PATCH 06/30] JavaScript: built-ins keep a new value rooted while they reserve room to store it Array methods that store an element (map, filter, slice, splice, concat, shift, unshift and sort), the JSON.parse reviver walk and JSON.stringify reserved heap for a value that only native code held. When the heap was near its limit, that reservation ran a collection that freed the value before it was stored, and the script later failed with "object out of range". The value now stays on the temporary roots until it is stored, and stringify roots an object from toJSON or a replacer before it writes the separator and key. --- crates/js/src/builtins.rs | 18 +++++++---- crates/js/src/builtins/array.rs | 2 +- crates/js/src/builtins/json.rs | 19 ++++++++--- crates/js/src/builtins_tests.rs | 57 +++++++++++++++++++++++++++++++++ 4 files changed, 84 insertions(+), 12 deletions(-) diff --git a/crates/js/src/builtins.rs b/crates/js/src/builtins.rs index df698d42f..7016e690d 100644 --- a/crates/js/src/builtins.rs +++ b/crates/js/src/builtins.rs @@ -154,10 +154,13 @@ fn has_at(interp: &mut Interp, o: ObjId, k: f64) -> JsResult { /// The estimated bytes a new element adds. const ELEMENT_BYTES: usize = PROP_BYTES + 32 + 2 * 10; -/// `o[k] = v` as the array methods assign: a failure throws. +/// `o[k] = v` as the array methods assign: a failure throws. `v` stays rooted while heap is +/// reserved for it, since the caller may hold it nowhere else. fn put_at(interp: &mut Interp, o: ObjId, k: f64, v: Value) -> JsResult<()> { - interp.reserve_heap(ELEMENT_BYTES)?; - interp.put(o, key_of(k), v, true) + interp.rooted(std::slice::from_ref(&v), |i| { + i.reserve_heap(ELEMENT_BYTES)?; + i.put(o, key_of(k), v.clone(), true) + }) } fn delete_at(interp: &mut Interp, o: ObjId, k: f64) -> JsResult<()> { @@ -165,10 +168,13 @@ fn delete_at(interp: &mut Interp, o: ObjId, k: f64) -> JsResult<()> { } /// Defines `a[k]` as a writable, enumerable and configurable data property, as the methods that -/// build a new array do (DefineOwnProperty with `throw` false). +/// build a new array do (DefineOwnProperty with `throw` false). `v` stays rooted while heap is +/// reserved for it. fn create_at(interp: &mut Interp, a: ObjId, k: f64, v: Value) -> JsResult<()> { - interp.reserve_heap(ELEMENT_BYTES)?; - interp.define_own_property(a, key_of(k), &Desc::data(v, OPEN), false).map(drop) + interp.rooted(std::slice::from_ref(&v), |i| { + i.reserve_heap(ELEMENT_BYTES)?; + i.define_own_property(a, key_of(k), &Desc::data(v.clone(), OPEN), false).map(drop) + }) } /// A new array with the given length and no elements. diff --git a/crates/js/src/builtins/array.rs b/crates/js/src/builtins/array.rs index 7eda02a60..8fa0e7cf3 100644 --- a/crates/js/src/builtins/array.rs +++ b/crates/js/src/builtins/array.rs @@ -630,8 +630,8 @@ fn sort_elements(interp: &mut Interp, o: ObjId, len: u64, compare: &Value) -> Js match element(interp, o, k)? { Some(Value::Undefined) => undefined += 1, Some(v) => { - interp.reserve_heap(ELEMENT_BYTES)?; interp.temp_roots.push(v.clone()); + interp.reserve_heap(ELEMENT_BYTES)?; values.push(v); } None => {} diff --git a/crates/js/src/builtins/json.rs b/crates/js/src/builtins/json.rs index 9acf2a6da..a7ae1d297 100644 --- a/crates/js/src/builtins/json.rs +++ b/crates/js/src/builtins/json.rs @@ -362,8 +362,10 @@ fn revive(interp: &mut Interp, v: Value, reviver: &Value) -> JsResult { if matches!(r, Value::Undefined) { interp.delete(o, &k, false)?; } else { - interp.reserve_heap(ELEMENT_BYTES)?; - interp.define_own_property(o, k, &Desc::data(r, OPEN), false)?; + interp.rooted(std::slice::from_ref(&r), |i| { + i.reserve_heap(ELEMENT_BYTES)?; + i.define_own_property(o, k, &Desc::data(r.clone(), OPEN), false) + })?; } } if let (Some(k), Value::Object(o)) = (top.keys.get(top.next).cloned(), &top.val) { @@ -436,7 +438,10 @@ fn stringify_rooted(interp: &mut Interp, args: &[Value]) -> JsResult { match resolve(interp, &settings, wrapper, &key(""))? { Item::Skip => return Ok(Value::Undefined), Item::Primitive(v) => write_primitive(interp, &mut w.out, &v)?, - Item::Container(o) => open(interp, &settings, &mut w, o)?, + Item::Container(o) => { + interp.temp_roots.push(Value::Object(o)); + open(interp, &settings, &mut w, o)?; + } } while !w.stack.is_empty() { step(interp, &settings, &mut w)?; @@ -585,12 +590,12 @@ fn write_primitive(interp: &mut Interp, out: &mut Builder, v: &Value) -> JsResul } /// Starts writing an object or array: a cycle back to one already being written throws a -/// `TypeError`. +/// `TypeError`. The caller pushes `o` onto the temporary roots first, and `step` pops it when the +/// object or array is closed. fn open(interp: &mut Interp, settings: &Settings, w: &mut Writer, o: ObjId) -> JsResult<()> { if w.open.contains(&o) { return Err(interp.type_error("JSON.stringify cannot write a structure that contains itself")); } - interp.temp_roots.push(Value::Object(o)); let array = interp.heap.object(o).is_some_and(|x| matches!(x.class, Class::Array { .. })); let keys = if array { let len = length_of(interp, o)?; @@ -664,6 +669,10 @@ fn step(interp: &mut Interp, settings: &Settings, w: &mut Writer) -> JsResult<() if let Some(top) = w.stack.last_mut() { top.count += 1; } + // The separator and the key reserve heap, so a container is rooted before they are written. + if let Item::Container(o) = item { + interp.temp_roots.push(Value::Object(o)); + } separator(interp, w, count == 0, gap)?; if !array { write_quoted(interp, &mut w.out, &k)?; diff --git a/crates/js/src/builtins_tests.rs b/crates/js/src/builtins_tests.rs index 5d108f8f6..ce8ce3a41 100644 --- a/crates/js/src/builtins_tests.rs +++ b/crates/js/src/builtins_tests.rs @@ -300,6 +300,63 @@ fn values_built_ins_hold_survive_collections() { assert_eq!(realm.run(src), Ok(JsValue::Number(598.0))); } +#[test] +fn fresh_values_survive_a_collection_while_they_are_stored() { + // Below 1 MiB the only collections run at the heap limit, many of them while a built-in + // reserves room for a value that a callback has just made and nothing else holds. + let limits = Limits { heap_bytes: 768 << 10, ..Limits::default() }; + let src = "var bad = 0; \ + for (var n = 0; n < 2000; n++) { \ + var m = [1, 2, 3, 4, 5, 6, 7, 8].map(function (x) { var g = {x: x}; return {v: x}; }); \ + var f = [1, 2, 3, 4].filter(function () { return true; }).map(function (x) { return [x]; }); \ + for (var i = 0; i < 8; i++) if (!m[i] || m[i].v !== i + 1) bad++; \ + for (var i = 0; i < 4; i++) if (!f[i] || f[i][0] !== i + 1) bad++; \ + } bad"; + let mut realm = small(limits.clone()); + assert_eq!(realm.run(src), Ok(JsValue::Number(0.0))); + assert!(realm.interp().heap.collections > 0); + // Getters make a new object for each read, which `shift` and `sort` then store. + let src = "function fresh(v) { var g = {x: v}; return {v: v}; } \ + function set(i) { return function (x) { Object.defineProperty(this, i, {value: x, writable: true, enumerable: true, configurable: true}); }; } \ + var p = {}; \ + for (var i = 0; i < 4; i++) Object.defineProperty(p, i, {get: (function (v) { return function () { return fresh(v); }; })(4 - i), set: set(i)}); \ + var bad = 0; \ + for (var n = 0; n < 1000; n++) { \ + var o = Object.create(p); o.length = 4; Array.prototype.shift.call(o); \ + if (!o[0] || o[0].v !== 3 || o[2].v !== 1) bad++; \ + var s = Object.create(p); s.length = 4; Array.prototype.sort.call(s, function (a, b) { return a.v - b.v; }); \ + for (var i = 0; i < 4; i++) if (!s[i] || s[i].v !== i + 1) bad++; \ + } \ + var q = {}; \ + for (var i = 0; i < 4; i++) Object.defineProperty(q, i, {get: (function (v) { return function () { return {v: v}; }; })(4 - i), set: function () {}}); \ + for (var n = 0; n < 20000; n++) { \ + var u = Object.create(q); u.length = 4; Array.prototype.unshift.call(u, 0, 0, 0, 0); \ + for (var i = 4; i < 8; i++) if (!u.hasOwnProperty(i) || u[i].v !== 8 - i) bad++; \ + } \ + for (var n = 0; n < 5000; n++) { var t = Object.create(q); t.length = 4; Array.prototype.sort.call(t); } \ + bad"; + let mut realm = small(limits.clone()); + assert_eq!(realm.run(src), Ok(JsValue::Number(0.0))); + assert!(realm.interp().heap.collections > 0); + // The `z` objects change each round's garbage, so the collections fall at different points. + let src = "var bad = 0; \ + for (var n = 0; n < 10000; n++) { \ + for (var z = 0; z < n % 7; z++) var g = {z: z}; \ + var j = JSON.parse('[1, 2, 3, 4, 5, 6, 7, 8]', function (k, v) { return k === '' ? v : {v: v}; }); \ + for (var i = 0; i < 8; i++) if (!j[i] || j[i].v !== i + 1) bad++; \ + } bad"; + let mut realm = small(limits.clone()); + assert_eq!(realm.run(src), Ok(JsValue::Number(0.0))); + assert!(realm.interp().heap.collections > 0); + let src = "var k = ''; for (var i = 0; i < 300; i++) k += 'k'; \ + var o = {}; o[k] = {toJSON: function () { var g = {x: 1}; return {a: 1}; }}; \ + var want = '{\"' + k + '\":{\"a\":1}}'; \ + var bad = 0; for (var n = 0; n < 4000; n++) if (JSON.stringify(o) !== want) bad++; bad"; + let mut realm = small(limits); + assert_eq!(realm.run(src), Ok(JsValue::Number(0.0))); + assert!(realm.interp().heap.collections > 0); +} + // ---- errors ---- #[test] From 3e09521b1f16d2be864f86abb9eee82d7f52944e Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sat, 7 Nov 2026 17:22:06 -0800 Subject: [PATCH 07/30] JavaScript: sort keys and replacer names count toward the heap limit Array.prototype.sort without a comparison function and the property list of a JSON.stringify replacer array keep a string for each element. A key that comes from flattening a concatenation is a new buffer: it is now charged to the heap, and keys that are not elements are rooted so that a collection counts them. Keys that share an existing string's buffer are not charged again. --- crates/js/src/builtins/array.rs | 19 ++++++++++++++++--- crates/js/src/builtins/json.rs | 24 +++++++++++++++++------- crates/js/src/builtins_tests.rs | 26 ++++++++++++++++++++++++++ 3 files changed, 59 insertions(+), 10 deletions(-) diff --git a/crates/js/src/builtins/array.rs b/crates/js/src/builtins/array.rs index 8fa0e7cf3..1361f5599 100644 --- a/crates/js/src/builtins/array.rs +++ b/crates/js/src/builtins/array.rs @@ -641,9 +641,22 @@ fn sort_elements(interp: &mut Interp, o: ObjId, len: u64, compare: &Value) -> Js let mut keyed = Vec::with_capacity(values.len()); for v in values { interp.use_fuel()?; - let s = interp.to_str(&v)?.flat(); - interp.reserve_heap(crate::heap::string_bytes(s.len()))?; - keyed.push((s, v)); + let s = interp.to_str(&v)?; + // Flattening a concatenation makes a new buffer, so it is charged. A key that is + // not an element is rooted so that collections count it. + let rope = s.buffer_addr().is_none(); + let bytes = crate::heap::string_bytes(s.len()); + if rope { + interp.reserve_heap(bytes)?; + } + let units = s.flat(); + if rope { + interp.heap.bytes = interp.heap.bytes.saturating_add(bytes); + } + if !matches!(v, Value::String(_)) { + interp.temp_roots.push(Value::String(s)); + } + keyed.push((units, v)); } merge_sort(interp, &mut keyed, |_, a, b| Ok(a.0 > b.0))?; values = keyed.into_iter().map(|(_, v)| v).collect(); diff --git a/crates/js/src/builtins/json.rs b/crates/js/src/builtins/json.rs index a7ae1d297..93d9061dc 100644 --- a/crates/js/src/builtins/json.rs +++ b/crates/js/src/builtins/json.rs @@ -487,17 +487,27 @@ fn property_list(interp: &mut Interp, r: ObjId) -> JsResult> { interp.use_fuel()?; let v = interp.get_from(r, &key_of(f64::from(i)), &Value::Object(r))?; let item = match &v { - Value::String(s) => Some(s.flat()), - Value::Number(n) => Some(number_to_str(*n).flat()), + Value::String(s) => Some(s.clone()), + Value::Number(_) => Some(interp.primitive_to_str(&v)), Value::Object(o) if interp.heap.object(*o).is_some_and(|x| matches!(x.class, Class::String(_) | Class::Number)) => { - Some(interp.to_str(&v)?.flat()) + Some(interp.to_str(&v)?) } _ => None, }; - if let Some(k) = item - && seen.insert(k.clone()) - { - interp.reserve_heap(string_bytes(k.len()))?; + let Some(s) = item else { continue }; + // Flattening a concatenation makes a new buffer, so it is charged. + let rope = s.buffer_addr().is_none(); + let bytes = string_bytes(s.len()); + if rope { + interp.reserve_heap(bytes)?; + } + let k = s.flat(); + if seen.insert(k.clone()) { + if rope { + interp.heap.bytes = interp.heap.bytes.saturating_add(bytes); + } + // The list lives until the call returns, so its names are rooted. + interp.temp_roots.push(Value::String(s)); list.push(k); } } diff --git a/crates/js/src/builtins_tests.rs b/crates/js/src/builtins_tests.rs index ce8ce3a41..749454756 100644 --- a/crates/js/src/builtins_tests.rs +++ b/crates/js/src/builtins_tests.rs @@ -278,6 +278,32 @@ fn built_ins_end_with_a_limit_instead_of_running_on() { assert_eq!(limit(&mut realm, "var s = 'x'; for (var i = 0; i < 20; i++) s += s; JSON.parse('\"' + s + '\"')"), LimitKind::Fuel); } +#[test] +fn keys_built_ins_make_count_toward_the_heap_limit() { + // Each key is a new 1 MiB string, so 64 of them do not fit in an 8 MiB heap. + let limits = Limits { heap_bytes: 8 << 20, ..Limits::default() }; + let big = "var s = 'x'; for (var i = 0; i < 19; i++) s += s; "; + let sort = format!("{big} var a = []; for (var i = 0; i < 64; i++) a[i] = {{n: i, toString: function () {{ return s + this.n; }}}}; a.sort();"); + assert_eq!(limit(&mut small(limits.clone()), &sort), LimitKind::Heap); + let list = format!( + "{big} var a = [], c = 0; for (var i = 0; i < 64; i++) Object.defineProperty(a, i, {{get: function () {{ return s + c++; }}}}); JSON.stringify({{}}, a);" + ); + assert_eq!(limit(&mut small(limits), &list), LimitKind::Heap); + // Keys that share a string's storage are not charged again: with half the string's size to + // spare, sorting objects whose keys are that string still fits. + let setup = format!( + "{big} var keep = [s + 0, s + 1]; keep.sort(); var a = []; for (var i = 0; i < 64; i++) a[i] = s; a.sort(); \ + var b = []; for (var i = 0; i < 64; i++) b[i] = {{toString: function () {{ return s; }}}}; 0" + ); + let mut measure = small(Limits::default()); + assert_eq!(measure.run(&setup), Ok(JsValue::Number(0.0))); + measure.interp().collect_garbage(); + let live = measure.interp().heap.bytes; + let mut realm = small(Limits { heap_bytes: live + (512 << 10), ..Limits::default() }); + assert_eq!(realm.run(&setup), Ok(JsValue::Number(0.0))); + assert_eq!(realm.run("b.sort(); JSON.stringify({}, a); JSON.stringify({}, [s, s, s]); b.length"), Ok(JsValue::Number(64.0))); +} + #[test] fn values_built_ins_hold_survive_collections() { // A small heap makes the callbacks' garbage start collections while the results are built. From d21ab8f4e2748b6f6970e52ccbe0ff36011f4843 Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sat, 7 Nov 2026 17:38:17 -0800 Subject: [PATCH 08/30] JavaScript: join with an empty separator does not walk the holes of a sparse array Array.prototype.join wrote the separator once per index between the elements it found, so new Array(4294967295).join("") ran four billion empty writes without taking fuel. Separators are now written in one step per gap, and an empty separator writes nothing. --- crates/js/src/builtins.rs | 14 ++++++++++++++ crates/js/src/builtins/array.rs | 8 ++------ crates/js/src/builtins_tests.rs | 2 ++ 3 files changed, 18 insertions(+), 6 deletions(-) diff --git a/crates/js/src/builtins.rs b/crates/js/src/builtins.rs index 7016e690d..40131ef07 100644 --- a/crates/js/src/builtins.rs +++ b/crates/js/src/builtins.rs @@ -227,6 +227,20 @@ impl Builder { Ok(()) } + /// Appends `units` `count` times. Nothing is written for an empty `units`, however large + /// `count` is. + fn push_repeated(&mut self, interp: &mut Interp, units: &[u16], count: u64) -> JsResult<()> { + if units.is_empty() || count == 0 { + return Ok(()); + } + let more = usize::try_from(count).unwrap_or(usize::MAX).saturating_mul(units.len()); + self.make_room(interp, more)?; + for _ in 0..count { + self.units.extend_from_slice(units); + } + Ok(()) + } + fn push_str(&mut self, interp: &mut Interp, s: &str) -> JsResult<()> { let units: Vec = s.encode_utf16().collect(); self.push_units(interp, &units) diff --git a/crates/js/src/builtins/array.rs b/crates/js/src/builtins/array.rs index 1361f5599..ad034c64e 100644 --- a/crates/js/src/builtins/array.rs +++ b/crates/js/src/builtins/array.rs @@ -291,15 +291,11 @@ fn join_elements(interp: &mut Interp, o: ObjId, len: u32, sep: &[u16], item: fn( while let Some(k) = it.next(interp)? { let v = get_at(interp, o, k as f64)?; let Some(s) = item(interp, v)? else { continue }; - for _ in seps..k { - out.push_units(interp, sep)?; - } + out.push_repeated(interp, sep, k.saturating_sub(seps))?; seps = k; out.push_units(interp, &s.flat())?; } - for _ in seps..u64::from(len - 1) { - out.push_units(interp, sep)?; - } + out.push_repeated(interp, sep, u64::from(len - 1).saturating_sub(seps))?; Ok(out.finish()) } diff --git a/crates/js/src/builtins_tests.rs b/crates/js/src/builtins_tests.rs index 749454756..f031c70dc 100644 --- a/crates/js/src/builtins_tests.rs +++ b/crates/js/src/builtins_tests.rs @@ -231,6 +231,8 @@ fn sparse_arrays_of_any_length_cost_only_their_elements() { let cases = [ ("var a = new Array(4294967295); a.join('')", JsValue::String(String::new())), ("var a = []; a[4294967294] = 'z'; a[3] = 'y'; a.join('').length", JsValue::Number(2.0)), + // An empty separator is not written once per hole, so a thousand such joins finish. + ("var b = []; b[4294967294] = 'z'; for (var i = 0; i < 1000; i++) new Array(4294967295).join('') + b.join(''); i", JsValue::Number(1000.0)), ("var a = []; a[4294967294] = 2; a[7] = 1; a.sort(); a[0] * 10 + a[1] + (a.length === 4294967295 ? 0 : 100)", JsValue::Number(12.0)), ("var a = []; a[4294967294] = 1; a.indexOf(1)", JsValue::Number(4_294_967_294.0)), ("var a = []; a[4294967294] = 1; a.lastIndexOf(1, -1) + a.lastIndexOf(2)", JsValue::Number(4_294_967_293.0)), From 5508f9eccc18e07194f7f96697bbe519bd500e59 Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sat, 7 Nov 2026 17:38:18 -0800 Subject: [PATCH 09/30] xtask: test262 help lists the built-in tests and json2.js --- xtask/src/main.rs | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xtask/src/main.rs b/xtask/src/main.rs index bfd6172ac..7d3f09804 100644 --- a/xtask/src/main.rs +++ b/xtask/src/main.rs @@ -44,7 +44,8 @@ commands: stats [--exact] count tests and lines per crate (--exact: ask the test harness via `-- --list`) test262 fetch the pinned ECMAScript conformance suite into corpus/test262 (sha256 verified), parse its ES5 subset with vectorcraft-js and run the ES5 language - tests its interpreter supports, printing the counts + and built-in tests its interpreter supports, printing the counts; then fetch + json2.js into corpus/json2 (sha256 verified) and run it web-fonts copy the craft-fonts faces in crates/text/web-fonts.txt into the web site (the Trunk post_build hook; a no-op without CRAFT_FONTS_DIR) "; @@ -341,6 +342,8 @@ Tests that use a corpus skip cleanly when it is absent. corpus/test262/ the ECMAScript conformance suite (BSD-3-Clause) at a pinned commit, sha256 verified: the JavaScript parser's and interpreter's ES5 subsets. Fetch and run: cargo xtask test262 + corpus/json2/ json2.js, the public-domain JSON polyfill, at a pinned commit, sha256 verified: + compared with vectorcraft-js's JSON. Fetch and run: cargo xtask test262 ", corpus.display() ); From e03cf7c5f7e0ef09a5c1881821ad5b6d24e65e73 Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sat, 7 Nov 2026 17:45:16 -0800 Subject: [PATCH 10/30] JavaScript: defining a new property checks the heap limit first Object.defineProperty, Object.defineProperties and Object.create added each new property without checking the heap limit, so one call could take the heap estimate past the limit before the run stopped. The property's size is now reserved before it is added, with the object and the descriptor's values kept reachable while a collection runs. --- crates/js/src/builtins_tests.rs | 15 +++++++++++++++ crates/js/src/interp.rs | 5 +++++ 2 files changed, 20 insertions(+) diff --git a/crates/js/src/builtins_tests.rs b/crates/js/src/builtins_tests.rs index f031c70dc..ff4dcbf6d 100644 --- a/crates/js/src/builtins_tests.rs +++ b/crates/js/src/builtins_tests.rs @@ -306,6 +306,21 @@ fn keys_built_ins_make_count_toward_the_heap_limit() { assert_eq!(realm.run("b.sort(); JSON.stringify({}, a); JSON.stringify({}, [s, s, s]); b.length"), Ok(JsValue::Number(64.0))); } +#[test] +fn define_properties_checks_the_heap_before_each_new_property() { + // `src` takes most of the heap; copying its 20,000 names onto a new object does not fit, and + // the run ends before the heap estimate passes the limit. + let setup = "var d = {value: 1}; var src = {}; for (var i = 0; i < 20000; i++) src['k' + i] = d; 0"; + let mut measure = small(Limits::default()); + assert_eq!(measure.run(setup), Ok(JsValue::Number(0.0))); + measure.interp().collect_garbage(); + let heap_bytes = measure.interp().heap.bytes + (1 << 20); + let mut realm = small(Limits { heap_bytes, ..Limits::default() }); + assert_eq!(realm.run(setup), Ok(JsValue::Number(0.0))); + assert_eq!(limit(&mut realm, "var o = Object.defineProperties({}, src); 0"), LimitKind::Heap); + assert!(realm.interp().heap.bytes <= heap_bytes, "{} > {heap_bytes}", realm.interp().heap.bytes); +} + #[test] fn values_built_ins_hold_survive_collections() { // A small heap makes the callbacks' garbage start collections while the results are built. diff --git a/crates/js/src/interp.rs b/crates/js/src/interp.rs index 57adbbb9b..1a60bc8a6 100644 --- a/crates/js/src/interp.rs +++ b/crates/js/src/interp.rs @@ -1073,6 +1073,11 @@ impl Interp { if !o.extensible { return self.reject_bool(throw, &k, "the object is not extensible"); } + // The object and the descriptor's values stay rooted while the heap is checked. + let mut roots = vec![Value::Object(id)]; + roots.extend(desc.value.iter().cloned()); + roots.extend(desc.get.flatten().into_iter().chain(desc.set.flatten()).map(Value::Object)); + self.rooted(&roots, |i| i.reserve_heap(binding_bytes(k.len())))?; let flags = desc.flags_or(0); let prop = if desc.is_accessor() { Prop::Accessor { get: desc.get.flatten(), set: desc.set.flatten(), flags: flags & !WRITABLE } From 28bc571e3486c7508f44a9a3242cc53547475c67 Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sat, 7 Nov 2026 17:55:51 -0800 Subject: [PATCH 11/30] JavaScript: bind converts the target's length to an integer A host function has no own length, so a script can define one with a fraction, and the bound function's length kept it. Function.prototype.bind now converts the target's length to an integer before it subtracts the bound arguments, as later editions specify. --- crates/js/src/builtins.rs | 8 ++++++-- crates/js/src/builtins_tests.rs | 8 ++++++++ 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/crates/js/src/builtins.rs b/crates/js/src/builtins.rs index 40131ef07..eba96041d 100644 --- a/crates/js/src/builtins.rs +++ b/crates/js/src/builtins.rs @@ -448,11 +448,15 @@ fn function_bind(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> J let Some(target) = this.as_object() else { return Err(interp.type_error("the value bind was called on is not a function")) }; let bound_this = arg(args, 0); let bound_args: Rc<[Value]> = args.get(1..).unwrap_or_default().into(); + // A host function's `length` is an ordinary property a script can set, so it is converted + // to an integer first, as later editions specify. let target_length = match interp.get_from(target, &key("length"), &this)? { - Value::Number(n) => n, + Value::Number(n) if n.is_nan() => 0.0, + Value::Number(n) => n.trunc(), _ => 0.0, }; - let length = (target_length - bound_args.len() as f64).max(0.0); + // Adding 0 turns a negative zero into 0. + let length = (target_length - bound_args.len() as f64).max(0.0) + 0.0; interp.reserve_heap(OBJECT_BYTES + 4 * PROP_BYTES + BOUND_ARG_BYTES * bound_args.len())?; let proto = interp.intrinsics.function_proto; let class = Class::Function(Func::Bound { target, this: bound_this, args: bound_args.clone() }); diff --git a/crates/js/src/builtins_tests.rs b/crates/js/src/builtins_tests.rs index ff4dcbf6d..c6179254c 100644 --- a/crates/js/src/builtins_tests.rs +++ b/crates/js/src/builtins_tests.rs @@ -134,6 +134,14 @@ fn bind_fixes_this_and_leading_arguments() { throws("'use strict'; function f() {} f.bind(null).caller", "TypeError"); truth("function f() { return arguments.length; } f.bind(null, 1).bind(null, 2)(3) === 3"); truth("Object.prototype.toString.call(function () {}.bind()) === '[object Function]'"); + // A host function has no own `length`, so a script can define one, and bind converts it to + // an integer. + let mut realm = Realm::new(); + realm.define_function("host", |_| Ok(JsValue::Undefined)); + let src = "function len(v) { Object.defineProperty(host, 'length', {value: v, configurable: true}); return host; } \ + var a = len(2.9).bind(null).length; var b = 1 / len(-0.5).bind(null).length; var c = len(NaN).bind(null).length; \ + [a, b, c, len(Infinity).bind(null, 1).length].join()"; + assert_eq!(realm.run(src), Ok(JsValue::String("2,Infinity,0,Infinity".into()))); } // ---- Array ---- From 60e617f8616294e18e0b31b4ad695ae6d3cb14aa Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sat, 7 Nov 2026 18:28:44 -0800 Subject: [PATCH 12/30] JavaScript: parseInt and parseFloat count their copies toward the heap limit parseInt collected every digit into a vector outside the heap count and then copied the digits again for a base-10 parse, and parseFloat copied its whole decimal prefix the same way, so one call on a long string could allocate more than the heap limit. parseInt now counts the digits in place, reads bases other than 10 straight from the string, and both functions reserve heap for the base-10 copy before they make it. A concatenation that the global functions flatten is charged to the heap, as sort keys are. --- crates/js/src/builtins/global.rs | 45 +++++++++++++++++++++++++------- crates/js/src/builtins_tests.rs | 27 +++++++++++++++++++ 2 files changed, 62 insertions(+), 10 deletions(-) diff --git a/crates/js/src/builtins/global.rs b/crates/js/src/builtins/global.rs index 1732ce3f6..14f1b6805 100644 --- a/crates/js/src/builtins/global.rs +++ b/crates/js/src/builtins/global.rs @@ -33,13 +33,27 @@ fn trim_start(s: &[u16]) -> &[u16] { s.get(s.iter().position(|&u| !is_str_space(u)).unwrap_or(s.len())..).unwrap_or_default() } -/// ToString of the first argument, as code units, with each one taking a unit of fuel. +/// ToString of the first argument, as code units, with each one taking a unit of fuel. A +/// concatenation is flattened into a new buffer, which is charged to the heap. fn units_of(interp: &mut Interp, args: &[Value]) -> JsResult> { - let s = interp.to_str(&arg(args, 0))?.flat(); + let s = interp.to_str(&arg(args, 0))?; for _ in 0..s.len() { interp.use_fuel()?; } - Ok(s) + let rope = s.buffer_addr().is_none(); + let bytes = crate::heap::string_bytes(s.len()); + if rope { + let mark = interp.temp_roots.len(); + interp.temp_roots.push(Value::String(s.clone())); + let reserved = interp.reserve_heap(bytes); + interp.temp_roots.truncate(mark); + reserved?; + } + let units = s.flat(); + if rope { + interp.heap.bytes = interp.heap.bytes.saturating_add(bytes); + } + Ok(units) } fn digit_value(u: u16) -> Option { @@ -76,19 +90,31 @@ fn parse_int(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult rest = rest.get(2..).unwrap_or_default(); r = 16; } - let digits: Vec = rest.iter().map_while(|&u| digit_value(u).filter(|&d| d < r)).collect(); - if digits.is_empty() { + let n = rest.iter().map_while(|&u| digit_value(u).filter(|&d| d < r)).count(); + let prefix = rest.get(..n).unwrap_or_default(); + if prefix.is_empty() { return Ok(Value::Number(f64::NAN)); } + let digits = prefix.iter().filter_map(|&u| digit_value(u)); let value = match r { - 10 => digits.iter().filter_map(|&d| char::from_digit(d, 10)).collect::().parse::().unwrap_or(f64::NAN), - 2 | 4 | 8 | 16 | 32 => crate::chars::radix_value(digits.iter().copied(), r).unwrap_or(f64::NAN), + 10 => parse_decimal(interp, prefix)?, + 2 | 4 | 8 | 16 | 32 => crate::chars::radix_value(digits, r).unwrap_or(f64::NAN), // Other radices may be approximated (section 15.1.2.2, step 13). - _ => digits.iter().fold(0.0, |n, &d| n * f64::from(r) + f64::from(d)), + _ => digits.fold(0.0, |n, d| n * f64::from(r) + f64::from(d)), }; Ok(Value::Number(sign * value)) } +/// The number that `text`, ASCII decimal digits with an optional fraction and exponent, stands +/// for. The text is copied into a string of one byte per code unit for parsing, and that copy is +/// checked against the heap limit first. +fn parse_decimal(interp: &mut Interp, text: &[u16]) -> JsResult { + interp.reserve_heap(text.len())?; + let mut ascii = String::with_capacity(text.len()); + ascii.extend(text.iter().filter_map(|&u| char::from_u32(u32::from(u)))); + Ok(ascii.parse::().unwrap_or(f64::NAN)) +} + /// The length of the longest prefix of `s` that is a StrDecimalLiteral without its sign and /// without `Infinity`. fn decimal_prefix(s: &[u16]) -> usize { @@ -148,8 +174,7 @@ fn parse_float(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResu if n == 0 { return Ok(Value::Number(f64::NAN)); } - let text = String::from_utf16_lossy(rest.get(..n).unwrap_or_default()); - Ok(Value::Number(sign * text.parse::().unwrap_or(f64::NAN))) + Ok(Value::Number(sign * parse_decimal(interp, rest.get(..n).unwrap_or_default())?)) } /// `isNaN` (section 15.1.2.4). diff --git a/crates/js/src/builtins_tests.rs b/crates/js/src/builtins_tests.rs index c6179254c..ba5454999 100644 --- a/crates/js/src/builtins_tests.rs +++ b/crates/js/src/builtins_tests.rs @@ -329,6 +329,33 @@ fn define_properties_checks_the_heap_before_each_new_property() { assert!(realm.interp().heap.bytes <= heap_bytes, "{} > {heap_bytes}", realm.interp().heap.bytes); } +#[test] +fn number_parsing_counts_its_copy_toward_the_heap_limit() { + // `s` is 1 Mi digits, so parsing it in base 10 copies 1 MiB, which does not fit in the + // 512 KiB left. Bases 16 and 36 read the digits where they are and still fit, but + // flattening a concatenation of `s` makes a 2 MiB buffer, which does not. + let setup = "var s = new Array((1 << 20) + 1).join('1'); var pad = new Array(800000).join('2'); 0"; + let mut measure = small(Limits::default()); + assert_eq!(measure.run(setup), Ok(JsValue::Number(0.0))); + measure.interp().collect_garbage(); + let heap_bytes = measure.interp().heap.bytes + (512 << 10); + assert!(heap_bytes >= 4 << 20, "{heap_bytes}"); + let limits = Limits { heap_bytes, ..Limits::default() }; + let mut realm = small(limits.clone()); + assert_eq!(realm.run(setup), Ok(JsValue::Number(0.0))); + assert_eq!( + realm.run("parseInt(s, 16) > 0 && parseInt(s, 36) > 0 && parseInt('12') === 12 && parseFloat('1.5') === 1.5"), + Ok(JsValue::Bool(true)) + ); + assert_eq!(limit(&mut realm, "parseInt(s)"), LimitKind::Heap); + let mut realm = small(limits.clone()); + assert_eq!(realm.run(setup), Ok(JsValue::Number(0.0))); + assert_eq!(limit(&mut realm, "parseInt(s + '1', 16)"), LimitKind::Heap); + let mut realm = small(limits); + assert_eq!(realm.run(setup), Ok(JsValue::Number(0.0))); + assert_eq!(limit(&mut realm, "parseFloat(s)"), LimitKind::Heap); +} + #[test] fn values_built_ins_hold_survive_collections() { // A small heap makes the callbacks' garbage start collections while the results are built. From a9e0d95226f98817b822abe2d64894090f80f737 Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sat, 7 Nov 2026 19:00:44 -0800 Subject: [PATCH 13/30] JavaScript: assigning an array's length converts the value twice, as defining it does Section 15.4.5.1 steps 3.c and 3.d convert the new length once with ToUint32 and once with ToNumber. [[Put]] reaches that algorithm through [[DefineOwnProperty]], so a.length = v now calls v's valueOf twice, the same as Object.defineProperty(a, 'length', {value: v}). Tests count the valueOf calls on both paths, check that JSON.stringify converts Number and String objects with ToNumber and ToString, and check that toLocaleString calls each primitive element's method on the object ToObject makes. --- crates/js/src/builtins_tests.rs | 14 ++++++++++++++ crates/js/src/interp.rs | 8 ++++---- 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/crates/js/src/builtins_tests.rs b/crates/js/src/builtins_tests.rs index ba5454999..3e8362e52 100644 --- a/crates/js/src/builtins_tests.rs +++ b/crates/js/src/builtins_tests.rs @@ -85,6 +85,10 @@ fn array_length_and_index_definitions_follow_section_15_4_5_1() { truth("var a = [1]; Object.defineProperty(a, 'length', {writable: false}); a[5] = 1; a.length === 1 && !(5 in a)"); throws("var a = [1]; Object.defineProperty(a, 'length', {writable: false}); Object.defineProperty(a, '3', {value: 1});", "TypeError"); throws("Object.defineProperty([], 'length', {value: -1})", "RangeError"); + // Steps 3.c and 3.d convert the new length once with ToUint32 and once with ToNumber. + let counted = "var calls = 0; var len = {valueOf: function () { calls++; return 2; }}; var a = [1, 2, 3];"; + assert_eq!(num(&format!("{counted} Object.defineProperty(a, 'length', {{value: len}}); calls * 10 + a.length")), 22.0); + assert_eq!(num(&format!("{counted} a.length = len; calls * 10 + a.length")), 22.0); truth("var a = []; Object.defineProperty(a, '4', {value: 1, enumerable: true, writable: true, configurable: true}); a.length === 5"); throws("var a = Object.freeze([1, 2]); a.push(3);", "TypeError"); } @@ -229,6 +233,13 @@ fn join_and_to_string_are_cycle_safe() { assert_eq!(string("[null, undefined, 0].join('-')"), "--0"); assert_eq!(string("Array.prototype.toString.call({join: 1})"), "[object Object]"); assert_eq!(string("var a = [{toLocaleString: function () { return 'L'; }}, null]; a.push(a); a.toLocaleString()"), "L,,"); + // A primitive element is converted with ToObject and its toLocaleString is called on the object. + assert_eq!( + string( + "Object.getPrototypeOf(Object(1)).toLocaleString = function () { 'use strict'; return typeof this; }; [1, undefined, 2].toLocaleString()" + ), + "object,,object" + ); } #[test] @@ -501,6 +512,9 @@ fn json_stringify_writes_values_with_replacers_and_indentation() { assert_eq!(string("JSON.stringify({toJSON: function (k) { return 'k=' + k; }})"), "\"k=\""); assert_eq!(string("JSON.stringify({d: {toJSON: function (k) { return k; }}})"), "{\"d\":\"d\"}"); assert_eq!(string("JSON.stringify([Object(false), Object(true)])"), "[false,true]"); + // Number and String objects go through ToNumber and ToString, which call valueOf and toString. + assert_eq!(string("var n = Object(5); n.valueOf = function () { return 7; }; JSON.stringify([n])"), "[7]"); + assert_eq!(string("var s = Object('x'); s.toString = function () { return 'y'; }; JSON.stringify({s: s})"), "{\"s\":\"y\"}"); assert_eq!(string("JSON.stringify({}, null, 4) + JSON.stringify([], null, 4)"), "{}[]"); throws("var a = []; a.push(a); JSON.stringify(a)", "TypeError"); throws("var o = {}; o.x = {y: o}; JSON.stringify(o)", "TypeError"); diff --git a/crates/js/src/interp.rs b/crates/js/src/interp.rs index 1a60bc8a6..5133b597f 100644 --- a/crates/js/src/interp.rs +++ b/crates/js/src/interp.rs @@ -1272,11 +1272,11 @@ impl Interp { } } - /// Assigning to an array's `length` (section 15.4.5.1). + /// Assigning to an array's `length` (section 15.4.5.1). [[Put]] defines the value, so the + /// value is converted once with ToUint32 and once with ToNumber, as in steps 3.c and 3.d. fn set_array_length(&mut self, id: ObjId, v: &Value, throw: bool) -> JsResult<()> { - let n = self.to_number(v)?; - let new = to_uint32(n); - if f64::from(new) != n { + let new = to_uint32(self.to_number(v)?); + if f64::from(new) != self.to_number(v)? { return Err(self.throw(ErrorType::Range, "invalid array length")); } let Class::Array { length_writable, .. } = self.object(id)?.class else { return internal("not an array") }; From 2d13f219f689d9ee8e5911b718d4a30a720efd97 Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sat, 7 Nov 2026 19:23:56 -0800 Subject: [PATCH 14/30] JavaScript: getOwnPropertyNames lists an array's length after its other names Section 15.2.3.4 leaves the order of the names open. An array's length now comes after its indices and other properties, so Object.getOwnPropertyNames([0, 1, 2]) gives 0,1,2,length, as later editions and test262 expect. length is not enumerable, so Object.keys and for-in are unchanged. --- crates/js/src/builtins_tests.rs | 3 ++- crates/js/src/interp.rs | 16 ++++++++++------ 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/crates/js/src/builtins_tests.rs b/crates/js/src/builtins_tests.rs index 3e8362e52..f95569749 100644 --- a/crates/js/src/builtins_tests.rs +++ b/crates/js/src/builtins_tests.rs @@ -100,7 +100,8 @@ fn object_functions_list_create_and_lock_objects() { ); truth("Object.getPrototypeOf(Object.create(null)) === null && Object.getPrototypeOf([]) === Array.prototype"); assert_eq!(string("Object.getOwnPropertyNames(Object('ab')).join()"), "0,1,length"); - assert_eq!(string("var a = [5]; a.k = 1; Object.getOwnPropertyNames(a).join()"), "length,0,k"); + assert_eq!(string("Object.getOwnPropertyNames([0, 1, 2]).join()"), "0,1,2,length"); + assert_eq!(string("var a = [5]; a.k = 1; Object.getOwnPropertyNames(a).join()"), "0,k,length"); // Object.keys lists names in the order for-in visits them (section 15.2.3.14). assert_eq!(string("var o = {b: 1, a: 2, 3: 3}, s = ''; for (var k in o) s += k; Object.keys(o).join('') === s ? s : 'differs'"), "ba3"); truth("var o = Object.seal({x: 1}); o.x = 2; delete o.x; o.y = 1; o.x === 2 && o.y === undefined && Object.isSealed(o) && !Object.isFrozen(o)"); diff --git a/crates/js/src/interp.rs b/crates/js/src/interp.rs index 096ad99e7..2293984ce 100644 --- a/crates/js/src/interp.rs +++ b/crates/js/src/interp.rs @@ -1173,27 +1173,31 @@ impl Interp { } /// The names of an object's own properties (section 15.2.3.4): a String object's indices and - /// an array's or String object's `length` first, then the rest in the order they were added, - /// which is the order `for-in` visits them. Each name takes a unit of fuel, and the heap for - /// the list is checked first. + /// `length` first, then the rest in the order they were added, which is the order `for-in` + /// visits them, then an array's `length`. Each name takes a unit of fuel, and the heap for the + /// list is checked first. pub(crate) fn own_keys(&mut self, id: ObjId) -> JsResult> { let o = self.object(id)?; let string_len = if let Class::String(s) = &o.class { s.len() } else { 0 }; - let has_length = matches!(o.class, Class::Array { .. } | Class::String(_)); - let count = o.props.len().saturating_add(string_len).saturating_add(usize::from(has_length)); + let is_string = matches!(o.class, Class::String(_)); + let is_array = matches!(o.class, Class::Array { .. }); + let count = o.props.len().saturating_add(string_len).saturating_add(usize::from(is_string || is_array)); self.reserve_heap(index_keys_bytes(string_len).saturating_add(count.saturating_mul(KEY_ENTRY_BYTES)))?; let mut out = Vec::with_capacity(count); for i in 0..string_len { self.use_fuel()?; out.push(index_key(u32::try_from(i).unwrap_or(u32::MAX))); } - if has_length { + if is_string { out.push(key("length")); } for _ in 0..self.object(id)?.props.len() { self.use_fuel()?; } out.extend(self.object(id)?.props.keys()); + if is_array { + out.push(key("length")); + } Ok(out) } From 9d528621f7d0ae98a206d7f7b4519657d2c062a6 Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sat, 7 Nov 2026 19:24:49 -0800 Subject: [PATCH 15/30] Docs: built-in test262 counts after the array length order change --- docs/target-app-parity.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md index 16e088312..e3e65fd16 100644 --- a/docs/target-app-parity.md +++ b/docs/target-app-parity.md @@ -655,7 +655,7 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur - File › Scripts › Check Script… reads a script written for Illustrator (`.jsx`, `.jsxinc` or a compiled `.jsxbin`) without running any of it and reports what it needs (the document model, files, dialogs, menu commands, features only Illustrator has), what it would do outside the document, the menu commands and document-model members it uses, its directives and included files, and the problems that would stop it loading (`script.check`, which also reads `.js` files); File › Open and drag-and-drop show the report for `.jsx`, `.jsxinc` and `.jsxbin` files. - `vectorcraft-js` parses JavaScript as ECMAScript 5.1 defines it, with the legacy octal forms, block functions and lenient regular expressions of Annex B, into a syntax tree with source spans; it reads the `#target`, `#include` and other preprocessor lines as directives without running them, and a script that breaks the grammar or an early-error rule gives a `SyntaxError` with its line and column. Nesting past the parser's depth limit (`Options::max_depth`, 200 by default) gives a `SyntaxError` instead of exhausting the stack. `cargo xtask test262` fetches the conformance suite at a pinned commit and parses its ES5 tests: 5,411 of 5,418 runs pass (the 7 others use `let` and `const`). This entry covers parsing; the next entry covers running scripts. Tests: `crates/js/src/tests.rs`, `crates/engine/tests/it/js_lexer_vs_scriptcheck.rs`. - `vectorcraft-js`'s `Realm` runs ECMAScript 5.1 scripts: the parsed script compiles to verified bytecode that a non-recursive interpreter runs, with closures, `this`, `arguments`, `with`, direct and indirect `eval`, `new Function`, `try`/`catch`/`finally`, labeled `break` and `continue`, and `for`-`in` in insertion order, over a mark-and-sweep heap, with the built-ins the next entry lists. Every run is bounded by fuel, heap bytes, frames, nested host calls and an interrupt flag (smaller defaults in the wasm build), and a run that reaches a limit stops with a limit error that `try` cannot catch. `cargo xtask test262` also runs the suite's ES5 language tests that need only the built-ins present: 3,362 of 3,387 runs pass (4 of the others expect the completion values of later editions, and 21 call `String` or `Number` methods). The app does not call it yet. Tests: `crates/js/src/interp_tests.rs`, `crates/js/tests/test262.rs`. - - `vectorcraft-js` provides the ECMAScript 5.1 built-ins `Object` with its property-descriptor functions, `create`, `keys`, `seal` and `freeze` (section 15.2), `Function.prototype.bind` (15.3.4.5), `Array` with every ES5 method (15.4), the error types (15.11), `Math` (15.8), `JSON` with revivers, replacers and indentation (15.12), and the global functions with Annex B's `escape` and `unescape` (15.1, B.2). The array methods work on array-like objects and visit only the indices that exist, so `new Array(4294967295).join("")` ends at once; `join` writes a cycle back to an array as an empty string, `JSON.stringify` throws a `TypeError` on a cycle, and deep `JSON` nesting uses no native stack. Every loop takes fuel and every result is checked against the heap limit. `cargo xtask test262` runs the suite's ES5 built-in tests that need only these built-ins: 4,478 of 4,556 runs pass (16 of the failing tests call `String`, `Number` or `Boolean` methods, and 23 expect rules of later editions). It also fetches the `json2.js` polyfill at a pinned commit to compare with the built-in `JSON`; that test runs once `Date`, `String.prototype.replace` and `RegExp` exist. Tests: `crates/js/src/builtins_tests.rs`, `crates/js/tests/test262.rs`, `crates/js/tests/json2.rs`. + - `vectorcraft-js` provides the ECMAScript 5.1 built-ins `Object` with its property-descriptor functions, `create`, `keys`, `seal` and `freeze` (section 15.2), `Function.prototype.bind` (15.3.4.5), `Array` with every ES5 method (15.4), the error types (15.11), `Math` (15.8), `JSON` with revivers, replacers and indentation (15.12), and the global functions with Annex B's `escape` and `unescape` (15.1, B.2). The array methods work on array-like objects and visit only the indices that exist, so `new Array(4294967295).join("")` ends at once; `join` writes a cycle back to an array as an empty string, `JSON.stringify` throws a `TypeError` on a cycle, and deep `JSON` nesting uses no native stack. Every loop takes fuel and every result is checked against the heap limit. `cargo xtask test262` runs the suite's ES5 built-in tests that need only these built-ins: 4,480 of 4,556 runs pass (16 of the failing tests call `String`, `Number` or `Boolean` methods, and 22 expect rules of later editions). It also fetches the `json2.js` polyfill at a pinned commit to compare with the built-in `JSON`; that test runs once `Date`, `String.prototype.replace` and `RegExp` exist. Tests: `crates/js/src/builtins_tests.rs`, `crates/js/tests/test262.rs`, `crates/js/tests/json2.rs`. - **UI:** Illustrator 2026 layout restyled to measured values: - Medium Dark theme, categorized and Advanced toolbars (a tool group's flyout opens on a right press, a long press or a press on its corner triangle), 35 pt document tabs, 33 pt panel tabs. - Hint bar, contextual task bar, 19 dock panels with ≡ menus. From 65691ceb7b73e8c57da27cab30e679b639d675d9 Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sat, 7 Nov 2026 19:27:44 -0800 Subject: [PATCH 16/30] JavaScript: unshift with no arguments reads and writes each element Section 15.4.4.13 steps 6 and 7 move every element by the argument count, so with no arguments each element is read and put back in place: getters and setters run, and a read-only element throws a TypeError. --- crates/js/src/builtins/array.rs | 11 +++++------ crates/js/src/builtins_tests.rs | 6 ++++++ 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/crates/js/src/builtins/array.rs b/crates/js/src/builtins/array.rs index ad034c64e..98a19ff0a 100644 --- a/crates/js/src/builtins/array.rs +++ b/crates/js/src/builtins/array.rs @@ -469,12 +469,11 @@ fn unshift(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResul with_this(interp, &this, |interp, o| { let len = u64::from(length_of(interp, o)?); let count = args.len() as u64; - if count > 0 { - let maps = vec![Map::Shift(-1), Map::Shift(count as i64 - 1)]; - let mut it = Indices::new(interp, o, 1, len + 1, false, maps)?; - while let Some(k) = it.next(interp)? { - move_element(interp, o, k - 1, k + count - 1)?; - } + // With no arguments each element is still read and written back in place (steps 6 and 7). + let maps = vec![Map::Shift(-1), Map::Shift(count as i64 - 1)]; + let mut it = Indices::new(interp, o, 1, len + 1, false, maps)?; + while let Some(k) = it.next(interp)? { + move_element(interp, o, k - 1, k + count - 1)?; } for (j, v) in args.iter().enumerate() { interp.use_fuel()?; diff --git a/crates/js/src/builtins_tests.rs b/crates/js/src/builtins_tests.rs index f95569749..aaf2d245a 100644 --- a/crates/js/src/builtins_tests.rs +++ b/crates/js/src/builtins_tests.rs @@ -167,6 +167,12 @@ fn methods_that_change_the_array() { assert_eq!(string("var a = [1, 2, 3]; a.pop() + ':' + a.join() + ':' + [].pop()"), "3:1,2:undefined"); assert_eq!(string("var a = [1, 2, 3]; a.shift() + ':' + a.join()"), "1:2,3"); assert_eq!(string("var a = [3]; a.unshift(1, 2) + ':' + a.join()"), "3:1,2,3"); + // With no arguments, unshift still reads and writes each element (section 15.4.4.13). + assert_eq!( + run("var n = 0, a = []; Object.defineProperty(a, 0, {get: function () { n++; return 1; }, set: function () { n += 10; }}); a.unshift(); n"), + JsValue::Number(11.0) + ); + throws("var a = [1, 2]; Object.defineProperty(a, 0, {writable: false}); a.unshift()", "TypeError"); assert_eq!(string("[1, , 3].reverse().join()"), "3,,1"); truth("var a = [1, , 3, , ]; a.reverse(); !(0 in a) && a[1] === 3 && !(2 in a) && a[3] === 1 && a.length === 4"); assert_eq!(string("var a = [1, 2, 3, 4, 5]; var r = a.splice(1, 2, 'x'); r.join() + ':' + a.join()"), "2,3:1,x,4,5"); From 447a3cc65febe60c58a3e8f5b6cc84a9a3f23f0f Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sat, 7 Nov 2026 19:46:01 -0800 Subject: [PATCH 17/30] JSON: stringify unwraps Number and String objects to their primitive values Number objects made by ToObject now carry their primitive value, as String and Boolean objects already did (ECMA-262 5.1 sections 8.6.2 and 9.9). JSON.stringify reads it for a value, a replacer list entry and the space argument (section 15.12.3, Str step 4, step 4.b.ii and step 5) when the method that ToNumber or ToString calls first is not found before the object's own prototype, so JSON.stringify(Object(3)) gives 3 and JSON.stringify(Object('abc')) gives "abc". A valueOf or toString on the object or on its prototype still runs. --- crates/js/src/builtins.rs | 2 +- crates/js/src/builtins/json.rs | 66 ++++++++++++++++++++++++--------- crates/js/src/builtins_tests.rs | 19 ++++++++++ crates/js/src/heap.rs | 6 +-- crates/js/src/interp.rs | 2 +- 5 files changed, 72 insertions(+), 23 deletions(-) diff --git a/crates/js/src/builtins.rs b/crates/js/src/builtins.rs index 30bc3be1b..c72382e27 100644 --- a/crates/js/src/builtins.rs +++ b/crates/js/src/builtins.rs @@ -78,7 +78,7 @@ fn try_install(interp: &mut Interp) -> JsResult<()> { } interp.intrinsics.array_proto = alloc(interp, Class::Array { length: 0, length_writable: true }, Some(object_proto)); interp.intrinsics.string_proto = alloc(interp, Class::String(Str::from("")), Some(object_proto)); - interp.intrinsics.number_proto = alloc(interp, Class::Number, Some(object_proto)); + interp.intrinsics.number_proto = alloc(interp, Class::Number(0.0), Some(object_proto)); interp.intrinsics.boolean_proto = alloc(interp, Class::Boolean(false), Some(object_proto)); interp.intrinsics.regexp_proto = alloc(interp, Class::Ordinary, Some(object_proto)); let thrower = native(interp, "", throw_type_error, 0, NativeKind::Plain, false)?; diff --git a/crates/js/src/builtins/json.rs b/crates/js/src/builtins/json.rs index 93d9061dc..4aa5c9ac5 100644 --- a/crates/js/src/builtins/json.rs +++ b/crates/js/src/builtins/json.rs @@ -12,7 +12,7 @@ use std::collections::HashSet; use super::{Builder, ELEMENT_BYTES, arg, data, key_of, length_of, method, new_array, new_string, to_integer}; use crate::heap::{Class, Key, OBJECT_BYTES, OPEN, ObjId, Object, Prop, key, string_bytes}; -use crate::interp::{Desc, ErrorType, Interp, JsResult}; +use crate::interp::{Desc, ErrorType, Hint, Interp, JsResult}; use crate::value::{Str, Value, number_to_str}; pub(super) fn install(interp: &mut Interp) -> JsResult<()> { @@ -459,14 +459,7 @@ fn settings(interp: &mut Interp, replacer: &Value, space: &Value) -> JsResult match interp.heap.object(*o).map(|x| &x.class) { - Some(Class::Number) => Value::Number(interp.to_number(space)?), - Some(Class::String(_)) => Value::String(interp.to_str(space)?), - _ => space.clone(), - }, - _ => space.clone(), - }; + let space = unwrap_primitive(interp, space, false)?.unwrap_or_else(|| space.clone()); match space { Value::Number(_) => { let n = to_integer(interp, &space)?.clamp(0.0, 10.0) as usize; @@ -489,9 +482,10 @@ fn property_list(interp: &mut Interp, r: ObjId) -> JsResult> { let item = match &v { Value::String(s) => Some(s.clone()), Value::Number(_) => Some(interp.primitive_to_str(&v)), - Value::Object(o) if interp.heap.object(*o).is_some_and(|x| matches!(x.class, Class::String(_) | Class::Number)) => { - Some(interp.to_str(&v)?) - } + Value::Object(_) => match unwrap_primitive(interp, &v, true)? { + Some(Value::String(s)) => Some(s), + _ => None, + }, _ => None, }; let Some(s) = item else { continue }; @@ -546,12 +540,11 @@ fn resolve_rooted(interp: &mut Interp, settings: &Settings, holder: ObjId, k: &K keep(interp, &v); } if let Value::Object(o) = &v { - v = match interp.heap.object(*o).map(|x| &x.class) { - Some(Class::Number) => Value::Number(interp.to_number(&v)?), - Some(Class::String(_)) => Value::String(interp.to_str(&v)?), - Some(Class::Boolean(b)) => Value::Bool(*b), - _ => v, - }; + if let Some(Class::Boolean(b)) = interp.heap.object(*o).map(|x| &x.class) { + v = Value::Bool(*b); + } else if let Some(p) = unwrap_primitive(interp, &v, false)? { + v = p; + } } Ok(match v { Value::Undefined => Item::Skip, @@ -561,6 +554,43 @@ fn resolve_rooted(interp: &mut Interp, settings: &Settings, holder: ObjId, k: &K }) } +/// ToNumber of a Number object, or ToString of a String object (of either when `as_string` is +/// set), as section 15.12.3 applies them in Str step 4, step 4.b.ii and step 5. Returns `None` +/// for any other value. When the method that [[DefaultValue]] (section 8.12.8) calls first is not +/// found on the object or on its prototype chain before the object's standard prototype, the +/// result is the object's [[PrimitiveValue]] (sections 8.6.2 and 9.9), the value that +/// `Number.prototype.valueOf` (15.7.4.4), `Number.prototype.toString` (15.7.4.2) and +/// `String.prototype.toString` (15.5.4.2) return. Otherwise ToPrimitive calls the method found. +fn unwrap_primitive(interp: &mut Interp, v: &Value, as_string: bool) -> JsResult> { + let Value::Object(o) = v else { return Ok(None) }; + let (primitive, proto, string) = match interp.heap.object(*o).map(|x| &x.class) { + Some(Class::Number(n)) => (Value::Number(*n), interp.intrinsics.number_proto, as_string), + Some(Class::String(s)) => (Value::String(s.clone()), interp.intrinsics.string_proto, true), + _ => return Ok(None), + }; + let (hint, name) = if string { (Hint::String, "toString") } else { (Hint::Number, "valueOf") }; + let p = if reaches_prototype(interp, *o, proto, name)? { primitive } else { interp.to_primitive(v, hint)? }; + Ok(Some(if string { Value::String(interp.primitive_to_str(&p)) } else { Value::Number(interp.to_number(&p)?) })) +} + +/// Whether looking up `name` from `o` reaches the object `proto` on the prototype chain before +/// any object on the way, `proto` included, has its own property `name`. +fn reaches_prototype(interp: &mut Interp, o: ObjId, proto: ObjId, name: &str) -> JsResult { + let k = key(name); + let mut cur = Some(o); + while let Some(id) = cur { + interp.use_fuel()?; + if interp.get_own_property(id, &k)?.is_some() { + return Ok(false); + } + if id == proto { + return Ok(true); + } + cur = interp.heap.object(id).and_then(|x| x.proto); + } + Ok(false) +} + /// Quote (section 15.12.3): the string in double quotes with the characters JSON escapes. fn write_quoted(interp: &mut Interp, out: &mut Builder, s: &[u16]) -> JsResult<()> { out.push_units(interp, &[QUOTE])?; diff --git a/crates/js/src/builtins_tests.rs b/crates/js/src/builtins_tests.rs index aaf2d245a..a9184c0c3 100644 --- a/crates/js/src/builtins_tests.rs +++ b/crates/js/src/builtins_tests.rs @@ -529,6 +529,25 @@ fn json_stringify_writes_values_with_replacers_and_indentation() { assert_eq!(string("var x = {}; JSON.stringify([x, x])"), "[{},{}]"); } +#[test] +fn json_stringify_unwraps_number_string_and_boolean_objects() { + assert_eq!(string("JSON.stringify(Object(3))"), "3"); + assert_eq!(string("JSON.stringify(Object('abc'))"), "\"abc\""); + assert_eq!(string("JSON.stringify(Object(true))"), "true"); + assert_eq!(string("JSON.stringify({n: Object(-0), m: Object(NaN), s: Object('')})"), "{\"n\":0,\"m\":null,\"s\":\"\"}"); + assert_eq!(string("JSON.stringify([Object.getPrototypeOf(Object(3)), Object.getPrototypeOf(Object('abc'))])"), "[0,\"\"]"); + // The space argument (step 5). + assert_eq!(string("JSON.stringify([1], null, Object(2))"), "[\n 1\n]"); + assert_eq!(string("JSON.stringify([1], null, Object('--'))"), "[\n--1\n]"); + // Replacer list entries (step 4.b.ii). + assert_eq!(string("JSON.stringify({a: 1, 3: 2, b: 3}, [Object('a'), Object(3)])"), "{\"a\":1,\"3\":2}"); + // Methods on Object.prototype do not reach the objects; methods on their own prototypes do. + assert_eq!(string("Object.prototype.toString = function () { return 'z'; }; JSON.stringify(Object('abc'))"), "\"abc\""); + assert_eq!(string("Object.prototype.valueOf = function () { return 9; }; JSON.stringify(Object(3))"), "3"); + assert_eq!(string("Object.getPrototypeOf(Object(1)).valueOf = function () { return 4; }; JSON.stringify(Object(3))"), "4"); + assert_eq!(string("Object.getPrototypeOf(Object('')).toString = function () { return 'q'; }; JSON.stringify(Object('abc'))"), "\"q\""); +} + #[test] fn deep_json_nesting_needs_no_native_stack() { let handle = std::thread::Builder::new() diff --git a/crates/js/src/heap.rs b/crates/js/src/heap.rs index 66dc00b24..143de10c3 100644 --- a/crates/js/src/heap.rs +++ b/crates/js/src/heap.rs @@ -209,8 +209,8 @@ pub(crate) enum Class { Arguments(Box), /// A `Boolean` object made by ToObject, with its primitive value. Boolean(bool), - /// A `Number` object made by ToObject. - Number, + /// A `Number` object made by ToObject, with its primitive value. + Number(f64), String(Str), RegExp, ForIn(Box), @@ -232,7 +232,7 @@ impl Class { Class::Error => "Error", Class::Arguments(_) => "Arguments", Class::Boolean(_) => "Boolean", - Class::Number => "Number", + Class::Number(_) => "Number", Class::String(_) => "String", Class::RegExp => "RegExp", } diff --git a/crates/js/src/interp.rs b/crates/js/src/interp.rs index 2293984ce..472d21c19 100644 --- a/crates/js/src/interp.rs +++ b/crates/js/src/interp.rs @@ -2240,7 +2240,7 @@ impl Interp { Value::Object(o) => return Ok(*o), Value::Undefined | Value::Null => return Err(self.type_error("cannot convert undefined or null to an object")), Value::Bool(b) => (Class::Boolean(*b), self.intrinsics.boolean_proto), - Value::Number(_) => (Class::Number, self.intrinsics.number_proto), + Value::Number(n) => (Class::Number(*n), self.intrinsics.number_proto), Value::String(s) => (Class::String(s.clone()), self.intrinsics.string_proto), }; Ok(self.heap.alloc_object(Object::new(class, Some(proto)))) From edfd25e26c49507715152cd8e84ec5425bc1476d Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sat, 7 Nov 2026 19:58:05 -0800 Subject: [PATCH 18/30] JavaScript: join reads length before it converts the separator Array.prototype.join now reads and converts the object's length before it converts the separator, and still converts the separator when the length is 0, as ECMA-262 5.1 section 15.4.4.5 steps 2 to 6 give them. --- crates/js/src/builtins/array.rs | 25 ++++++++++++++----------- crates/js/src/builtins_tests.rs | 9 +++++++++ 2 files changed, 23 insertions(+), 11 deletions(-) diff --git a/crates/js/src/builtins/array.rs b/crates/js/src/builtins/array.rs index 98a19ff0a..e3f2ebe00 100644 --- a/crates/js/src/builtins/array.rs +++ b/crates/js/src/builtins/array.rs @@ -262,16 +262,24 @@ fn to_string(interp: &mut Interp, this: Value, _: &[Value], _: bool) -> JsResult }) } -/// Joins the elements `0..len` of `o`, each turned into a string by `item`, with `sep` between -/// them. A cycle back to an object being joined joins as an empty string. -fn join_with(interp: &mut Interp, o: ObjId, sep: &[u16], item: fn(&mut Interp, Value) -> JsResult>) -> JsResult { +/// Joins the elements `0..len` of `o`, each turned into a string by `item`, with `separator` +/// between them (`,` when it is `undefined`). `length` is read before the separator is converted, +/// and the separator is converted even when `length` is 0 (section 15.4.4.5 steps 2 to 6). A cycle +/// back to an object being joined joins as an empty string. +fn join_with(interp: &mut Interp, o: ObjId, separator: &Value, item: fn(&mut Interp, Value) -> JsResult>) -> JsResult { if interp.join_stack.contains(&o) { return Ok(Value::str("")); } let len = length_of(interp, o)?; + let sep = match separator { + Value::Undefined => Str::from(","), + v => interp.to_str(v)?, + }; if len == 0 { return Ok(Value::str("")); } + let flat = sep.flat(); + let sep = &flat[..]; // A result that cannot fit is refused before any element is read. let least = (sep.len() as u64).saturating_mul(u64::from(len - 1)); if least > (interp.limits.heap_bytes / 4) as u64 { @@ -321,18 +329,13 @@ fn locale_item(interp: &mut Interp, v: Value) -> JsResult> { /// `Array.prototype.join` (section 15.4.4.5). fn join(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResult { - with_this(interp, &this, |interp, o| { - let sep = match arg(args, 0) { - Value::Undefined => Str::from(","), - v => interp.to_str(&v)?, - }; - join_with(interp, o, &sep.flat(), join_item) - }) + let separator = arg(args, 0); + with_this(interp, &this, |interp, o| join_with(interp, o, &separator, join_item)) } /// `Array.prototype.toLocaleString` (section 15.4.4.3). fn to_locale_string(interp: &mut Interp, this: Value, _: &[Value], _: bool) -> JsResult { - with_this(interp, &this, |interp, o| join_with(interp, o, &[u16::from(b',')], locale_item)) + with_this(interp, &this, |interp, o| join_with(interp, o, &Value::Undefined, locale_item)) } // ---- methods that change the object ---- diff --git a/crates/js/src/builtins_tests.rs b/crates/js/src/builtins_tests.rs index a9184c0c3..db483e652 100644 --- a/crates/js/src/builtins_tests.rs +++ b/crates/js/src/builtins_tests.rs @@ -247,6 +247,15 @@ fn join_and_to_string_are_cycle_safe() { ), "object,,object" ); + // `length` is read before the separator is converted, and the separator is converted even + // when `length` is 0 (section 15.4.4.5 steps 2 to 6). + assert_eq!( + string( + "var log = ''; Array.prototype.join.call({length: {valueOf: function () { log += 'L'; return 0; }}}, {toString: function () { log += 'S'; return ','; }}); log" + ), + "LS" + ); + assert_eq!(string("var log = ''; try { [].join({toString: function () { throw 1; }}); } catch (e) { log = 'threw ' + e; } log"), "threw 1"); } #[test] From f16cf72f07b31bdd04cf84f8d4257d9f89b40a19 Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sat, 7 Nov 2026 20:09:09 -0800 Subject: [PATCH 19/30] JavaScript: strings the built-ins build take fuel and stay counted in collections The buffer that join, JSON.stringify, the URI functions, escape and unescape write into takes one unit of fuel for every 16 code units written, so writing a long run of separators or copying a long string over and over ends with the fuel limit. Its bytes are added back to the heap total after each collection until the string is finished, and a native call that ends early gives them back, so a collection while a string is being built no longer lets the heap estimate drop below what is in use. --- crates/js/src/builtins.rs | 35 +++++++++++++++++++++++++------- crates/js/src/builtins/array.rs | 2 +- crates/js/src/builtins/global.rs | 8 ++++---- crates/js/src/builtins/json.rs | 2 +- crates/js/src/builtins_tests.rs | 30 +++++++++++++++++++++++++++ crates/js/src/interp.rs | 13 +++++++++++- 6 files changed, 76 insertions(+), 14 deletions(-) diff --git a/crates/js/src/builtins.rs b/crates/js/src/builtins.rs index c72382e27..4fc1adc87 100644 --- a/crates/js/src/builtins.rs +++ b/crates/js/src/builtins.rs @@ -192,30 +192,49 @@ fn new_string(interp: &mut Interp, units: Vec) -> JsResult { Ok(Value::String(Str::from_units(units))) } -/// A string the built-ins build piece by piece: each piece is checked against the longest string -/// the heap limit allows and its bytes are reserved before it is added. Everything the caller -/// still needs must be reachable from the roots. +/// Code units a built-in may write into a string for one unit of fuel. +const UNITS_PER_FUEL: usize = 16; + +/// A string the built-ins build piece by piece: each piece takes fuel for its length, is checked +/// against the longest string the heap limit allows, and has its bytes reserved before it is +/// added. The buffer's bytes count toward the heap until `finish` or until the native call that +/// made the builder returns. Everything the caller still needs must be reachable from the roots. struct Builder { units: Vec, /// Code units already reserved and charged to the heap. charged: usize, + /// Code units written since fuel was last taken, fewer than `UNITS_PER_FUEL`. + unpaid: usize, } impl Builder { fn new() -> Self { - Builder { units: Vec::new(), charged: 0 } + Builder { units: Vec::new(), charged: 0, unpaid: 0 } } - /// Checks that `more` code units fit, reserving heap for them. + /// Checks that `more` code units fit, reserving heap for them, and takes fuel for writing them. fn make_room(&mut self, interp: &mut Interp, more: usize) -> JsResult<()> { let want = self.units.len().saturating_add(more); if want > interp.limits.heap_bytes / 4 { return Err(Abrupt::Limit(crate::LimitKind::Heap)); } + self.unpaid += more; + let fuel = (self.unpaid / UNITS_PER_FUEL) as u64; + self.unpaid %= UNITS_PER_FUEL; + if fuel > 0 { + if interp.fuel < fuel { + interp.fuel = 0; + return Err(Abrupt::Limit(crate::LimitKind::Fuel)); + } + // The last unit goes through `use_fuel`, which also checks for an interrupt. + interp.fuel -= fuel - 1; + interp.use_fuel()?; + } if want > self.charged { let grow = (want - self.charged).max(self.charged / 2).max(256).min((interp.limits.heap_bytes / 4).saturating_sub(self.charged)); interp.reserve_heap(2 * grow)?; interp.heap.bytes = interp.heap.bytes.saturating_add(2 * grow); + interp.held_bytes = interp.held_bytes.saturating_add(2 * grow); self.charged += grow; } Ok(()) @@ -246,8 +265,10 @@ impl Builder { self.push_units(interp, &units) } - /// The string built, whose bytes were charged as it grew. - fn finish(self) -> Value { + /// The string built, whose bytes were charged as it grew. From here on the heap counts them + /// as the string's. + fn finish(self, interp: &mut Interp) -> Value { + interp.held_bytes = interp.held_bytes.saturating_sub(2 * self.charged); Value::String(Str::from_units(self.units)) } } diff --git a/crates/js/src/builtins/array.rs b/crates/js/src/builtins/array.rs index e3f2ebe00..2f81bf766 100644 --- a/crates/js/src/builtins/array.rs +++ b/crates/js/src/builtins/array.rs @@ -304,7 +304,7 @@ fn join_elements(interp: &mut Interp, o: ObjId, len: u32, sep: &[u16], item: fn( out.push_units(interp, &s.flat())?; } out.push_repeated(interp, sep, u64::from(len - 1).saturating_sub(seps))?; - Ok(out.finish()) + Ok(out.finish(interp)) } /// An element as `join` writes it: nothing for `undefined` and `null`. diff --git a/crates/js/src/builtins/global.rs b/crates/js/src/builtins/global.rs index 14f1b6805..261bfa146 100644 --- a/crates/js/src/builtins/global.rs +++ b/crates/js/src/builtins/global.rs @@ -241,7 +241,7 @@ fn encode(interp: &mut Interp, args: &[Value], unescaped: fn(u16) -> bool) -> Js } k += 1; } - Ok(out.finish()) + Ok(out.finish(interp)) } fn hex_byte(s: &[u16], at: usize) -> Option { @@ -294,7 +294,7 @@ fn decode(interp: &mut Interp, args: &[Value], reserved: &str) -> JsResult JsResult { @@ -329,7 +329,7 @@ fn escape(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult JsResult< out.push_units(interp, &[unit])?; k += 1; } - Ok(out.finish()) + Ok(out.finish(interp)) } diff --git a/crates/js/src/builtins/json.rs b/crates/js/src/builtins/json.rs index 4aa5c9ac5..8061379ce 100644 --- a/crates/js/src/builtins/json.rs +++ b/crates/js/src/builtins/json.rs @@ -446,7 +446,7 @@ fn stringify_rooted(interp: &mut Interp, args: &[Value]) -> JsResult { while !w.stack.is_empty() { step(interp, &settings, &mut w)?; } - Ok(w.out.finish()) + Ok(w.out.finish(interp)) } /// Reads the replacer and the space argument (section 15.12.3, steps 4 to 8). diff --git a/crates/js/src/builtins_tests.rs b/crates/js/src/builtins_tests.rs index db483e652..4a4c2aea4 100644 --- a/crates/js/src/builtins_tests.rs +++ b/crates/js/src/builtins_tests.rs @@ -383,6 +383,36 @@ fn number_parsing_counts_its_copy_toward_the_heap_limit() { assert_eq!(limit(&mut realm, "parseFloat(s)"), LimitKind::Heap); } +#[test] +fn strings_built_ins_write_take_fuel_and_stay_counted_across_collections() { + // Each join writes 1 Mi code units, so a thousand of them do not fit in 2,000,000 units of + // fuel, whether the units are separators or a string's contents. + let limits = Limits { heap_bytes: 8 << 20, fuel: 2_000_000, ..Limits::default() }; + assert_eq!(limit(&mut small(limits.clone()), "var a = new Array((1 << 20) + 1); for (var i = 0; i < 1000; i++) a.join('x'); i"), LimitKind::Fuel); + assert_eq!( + limit(&mut small(limits), "var a = [new Array((1 << 20) + 1).join('x')]; for (var i = 0; i < 1000; i++) a.join(''); i"), + LimitKind::Fuel + ); + // `join` holds a 2 MiB buffer for `s` while the second element's `toString` keeps new objects. + // A collection in between still counts the buffer, so the objects and the buffer together do + // not fit in a heap with 1 MiB to spare beyond the objects. + let setup = "var s = new Array((1 << 20) + 1).join('x'); var keep = []; 0"; + let fill = "for (var i = 0; i < 30000; i++) keep.push({});"; + let mut measure = small(Limits::default()); + assert_eq!(measure.run(&format!("{setup}; {fill} 0")), Ok(JsValue::Number(0.0))); + measure.interp().collect_garbage(); + let heap_bytes = measure.interp().heap.bytes + (1 << 20); + let mut realm = small(Limits { heap_bytes, ..Limits::default() }); + assert_eq!(realm.run(setup), Ok(JsValue::Number(0.0))); + let join = format!("var f = {{toString: function () {{ {fill} return ''; }}}}; [s, f].join('').length"); + assert_eq!(limit(&mut realm, &join), LimitKind::Heap); + // A join that throws gives its buffer back, so a hundred of them still fit in 8 MiB. + let mut realm = small(Limits { heap_bytes: 8 << 20, ..Limits::default() }); + let src = "var s = new Array((1 << 20) + 1).join('x'); var t = {toString: function () { throw 1; }}; \ + for (var i = 0; i < 100; i++) { try { [s, t].join(''); } catch (e) {} } i"; + assert_eq!(realm.run(src), Ok(JsValue::Number(100.0))); +} + #[test] fn values_built_ins_hold_survive_collections() { // A small heap makes the callbacks' garbage start collections while the results are built. diff --git a/crates/js/src/interp.rs b/crates/js/src/interp.rs index 472d21c19..7168f9dad 100644 --- a/crates/js/src/interp.rs +++ b/crates/js/src/interp.rs @@ -166,6 +166,10 @@ pub(crate) struct Interp { /// The objects `Array.prototype.join` and `toLocaleString` are joining, innermost last: a /// cycle back to one of them joins as an empty string. pub(crate) join_stack: Vec, + /// Bytes of the string buffers native functions are building outside the heap. They are + /// charged to `heap.bytes` and added back after each collection, and a native call's + /// buffers are released when it returns. + pub(crate) held_bytes: usize, } /// The least heap size a collection waits for. @@ -302,6 +306,7 @@ impl Interp { last_thrown: Value::Undefined, random: random_seed(), join_stack: Vec::new(), + held_bytes: 0, }; crate::builtins::install(&mut interp); interp.gc_threshold = interp.next_threshold(); @@ -455,6 +460,7 @@ impl Interp { roots.objects.extend(self.intrinsics.all()); roots.envs.push(self.global_env); self.heap.collect(&roots); + self.heap.bytes = self.heap.bytes.saturating_add(self.held_bytes); } /// Runs frames until the boundary frame on top returns, and returns its value. @@ -1733,7 +1739,9 @@ impl Interp { let mark = self.temp_roots.len(); self.temp_roots.push(this.clone()); self.temp_roots.extend(args.iter().cloned()); + let held = self.held_bytes; let r = native(self, this, &args, false); + self.held_bytes = held; self.temp_roots.truncate(mark); return Ok(Prepared::Done(r?)); } @@ -1834,7 +1842,10 @@ impl Interp { self.enter_function(Entry { callee, code, env, this: Value::Object(obj), args }, Some(obj), false) } Some(Func::Native { f: native, constructor: true, .. }) => { - let v = native(self, Value::Undefined, &args, true)?; + let held = self.held_bytes; + let r = native(self, Value::Undefined, &args, true); + self.held_bytes = held; + let v = r?; self.stack.truncate(start); self.push(v) } From ba1abb73b0091186cce446ae2ed0dd18a9d82a82 Mon Sep 17 00:00:00 2001 From: Don Omondi <282319807+mockydevs@users.noreply.github.com> Date: Sun, 8 Nov 2026 03:51:30 -0500 Subject: [PATCH 20/30] .ai import: tests for Pattern brushes' number counts and an older Art brush's first number A Pattern brush reads its scale from 3 or more numbers (the older form's 8 too) and isn't read with fewer; an 8-number Art brush is the older form whatever its first number. The module notes say the count tells the form. --- crates/eps/src/import/ai/brush.rs | 12 +++++++----- crates/eps/src/import/ai/tests.rs | 24 ++++++++++++++++++++++++ 2 files changed, 31 insertions(+), 5 deletions(-) diff --git a/crates/eps/src/import/ai/brush.rs b/crates/eps/src/import/ai/brush.rs index bd5a1628a..8e1f27bad 100644 --- a/crates/eps/src/import/ai/brush.rs +++ b/crates/eps/src/import/ai/brush.rs @@ -28,10 +28,11 @@ //! [`vectorcraft_brush::ArtBrush`]'s `overlap: false`). //! - A Scatter, Art or Pattern brush's parameters are fields split by `/`: a number, the art's //! section names (one for Scatter, five for Art and Pattern, empty where there is none, each -//! after a space for Art and Pattern), more fields, and last 15 numbers. Brushes whose first -//! number is 1, as older files write them, have one field fewer before the numbers and 8 numbers; -//! an Art brush in that form is read from its art's name alone (its numbers aren't known, so it -//! keeps the defaults and its paths their drawn look). +//! after a space for Art and Pattern), more fields, and last 15 numbers. Older files write +//! brushes with first number 1, one field fewer before the numbers and 8 numbers; an Art brush +//! with 8 numbers, whatever its first number, is read from its art's name alone (its numbers +//! aren't known, so it keeps the defaults and its paths their drawn look). A Pattern brush needs +//! only its first 3 numbers (its scale is the third). //! - Scatter: the size (2, 3), spacing (5, 6) and scatter (8, 9) as (low, high) factors of the //! art, the rotation in degrees (11, 12), how each varies (4, 7, 10, 13) and whether the //! rotation follows the path (14), and 1 Tints (1). @@ -339,7 +340,8 @@ pub(super) fn parse_tool_object(kind: Tool, name: &str, params: &str) -> Result< } Tool::Art => { // The older form's 8 numbers aren't known: its brush keeps the defaults and its - // paths their drawn look. Any other count isn't a form this reads. + // paths their drawn look. The count tells the form, not the first number. + // Any other count isn't a form this reads. let (colorization, plain) = if let Ok(n15) = <&[f64; 15]>::try_from(n.as_slice()) { (if n15[1] == 1.0 { Colorization::Tints } else { Colorization::None }, art_is_plain(n15)) } else if n.len() == 8 { diff --git a/crates/eps/src/import/ai/tests.rs b/crates/eps/src/import/ai/tests.rs index c69728434..9a3227113 100644 --- a/crates/eps/src/import/ai/tests.rs +++ b/crates/eps/src/import/ai/tests.rs @@ -8225,6 +8225,10 @@ fn an_older_art_brush_comes_in_with_its_art() { assert_eq!(brush::parse_tool_object(brush::Tool::Art, "Ribbon", bad), Err(brush::BrushError::Values), "{bad}"); } assert_eq!(brush::parse_tool_object(brush::Tool::Scatter, "Spray", "1 /Dot art/ 0 1 / 1 0 1 0 1 0 0 0"), Err(brush::BrushError::Values)); + // 8 numbers are the older form whatever the first number says: read with the defaults. + let d = brush::parse_tool_object(brush::Tool::Art, "Ribbon", "0 / Ribbon art/ / / / / 0 1 / 1 0 1 0 1 0 0 0").unwrap(); + let brush::DraftKind::Art { ref brush, ref art, plain } = d.kind else { panic!("art") }; + assert_eq!((art.as_str(), plain, brush.colorization), ("Ribbon art", false, vectorcraft_brush::ArtBrush::default().colorization)); let objects = [plugin_object(ART_BRUSH, "Ribbon", OLD_RIBBON), plugin_object(ART_BRUSH, "Bare", "1 / / / / / / 0 1 / 1 0 1 0 1 0 0 0")].concat(); let r = read_ok(&format!("{}{objects}{}", brush_art("Ribbon art", 4.0), layer(""))); let lib = vectorcraft_brush::library(&r.doc); @@ -8234,6 +8238,26 @@ fn an_older_art_brush_comes_in_with_its_art() { assert!(r.warnings.iter().any(|w| w.ends_with("Brushes panel (1)")), "{:?}", r.warnings); } +/// A Pattern brush needs only its first 3 numbers, its scale the third (as a percentage), so the +/// older form's 8 numbers read too; fewer than 3 aren't read. +#[test] +fn a_pattern_brush_reads_its_scale_from_three_or_more_numbers() { + const SLOTS: &str = "1 / Tile one/ Tile two/ / / Tile five/ 0 1 / "; + for numbers in ["1 0 0.5", "1 0 0.5 0 1 0 0 0"] { + let d = brush::parse_tool_object(brush::Tool::Pattern, "Fence", &format!("{SLOTS}{numbers}")).unwrap(); + let brush::DraftKind::Pattern { tiles, scale } = d.kind else { panic!("{d:?}") }; + assert_eq!(tiles[1].as_deref(), Some("Tile two"), "{numbers}"); + assert!((scale - 50.0).abs() < 1e-9, "{numbers}: {scale}"); + } + for numbers in ["", "1", "1 0"] { + assert_eq!( + brush::parse_tool_object(brush::Tool::Pattern, "Fence", &format!("{SLOTS}{numbers}")), + Err(brush::BrushError::Values), + "{numbers:?}" + ); + } +} + /// A brush's art filled with a pattern the file defines before it is read, with that pattern. #[test] fn a_brushs_art_takes_the_patterns_defined_before_it() { From 9d706a9a6d6f04f78d5117c38f205d8011ec8013 Mon Sep 17 00:00:00 2001 From: Don Omondi <282319807+mockydevs@users.noreply.github.com> Date: Sun, 8 Nov 2026 06:41:09 -0500 Subject: [PATCH 21/30] Parity doc: paths with an older Art brush keep their drawn look --- docs/target-app-parity.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md index 6ed26d5bf..c06d85d53 100644 --- a/docs/target-app-parity.md +++ b/docs/target-app-parity.md @@ -1279,7 +1279,7 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur A `.ai` opened from its editing data opens its Objects on Path groups live, with their path, their objects in order along it, Pivot and Rotate, and their art where the file draws it; a group whose spacing has been dragged, or with options an Objects on Path group doesn't hold, opens as a plain group (`crates/eps/src/import/ai/tests.rs`). `.ai` symbol definitions and placed instances open as live symbols, in the Symbols panel's order; an instance of a symbol that isn't read, or whose appearance differs from its symbol's, comes in as the page draws it (`crates/eps/src/import/ai/tests.rs`). Blends and envelopes in the definitions of a `.ai`'s symbols, patterns and brushes' art count against the same per-file limits on blend layout and envelope checks as the layers' art, so a file with many definitions does not get those limits again for each one (`crates/eps/src/import/ai/read/directives.rs`). - A `.ai` or EPS whose editing data has brushes opens with the file's Calligraphic, Scatter, Art and Bristle brushes in the Brushes panel in place of the default ones, in the file's order: the Calligraphic size, roundness and angle with their variation, the Scatter size, spacing, scatter and rotation, the Bristle settings, and the Scatter and Art brushes' art (Art brushes in the older and newer forms of their objects). A brush library `.ai` (brushes and no layers) opens from its PDF part with its brushes, so Other Library lists them. An Art brush in Tints keeps that colorization. Pattern brushes and brushes that can't be read are left out with a note. Paths with a Calligraphic brush, and paths with an Art brush at 100% in Tints that stretches art of solid-filled paths unflipped, open as the path with the brush on its stroke, and other brushed paths still come in as their drawn look (part of #372 and #637; `crates/eps/src/import/ai/tests.rs`, `crates/eps/src/import/tests_native.rs`). + A `.ai` or EPS whose editing data has brushes opens with the file's Calligraphic, Scatter, Art and Bristle brushes in the Brushes panel in place of the default ones, in the file's order: the Calligraphic size, roundness and angle with their variation, the Scatter size, spacing, scatter and rotation, the Bristle settings, and the Scatter and Art brushes' art (Art brushes in the older and newer forms of their objects). A brush library `.ai` (brushes and no layers) opens from its PDF part with its brushes, so Other Library lists them. An Art brush in Tints keeps that colorization. Pattern brushes and brushes that can't be read are left out with a note. Paths with a Calligraphic brush, and paths with an Art brush in the newer form at 100% in Tints that stretches art of solid-filled paths unflipped, open as the path with the brush on its stroke. Paths with an Art brush in the older form, and other brushed paths, still come in as their drawn look (part of #372 and #637; `crates/eps/src/import/ai/tests.rs`, `crates/eps/src/import/tests_native.rs`). In a `.ai` opened from its editing data, a path or type object with Offset Path, Outline Object or Outline Stroke on the whole object opens as itself with those effects live, in their order and shown or hidden; on a fill or stroke of type they stay on that fill or stroke. Offset Path keeps its Offset, Joins and Miter Limit, and Outline Stroke takes its width from the stroke. An Offset Path with a setting missing, out of range or not read keeps the drawn art, as does a path with a Path effect on one fill or stroke (`crates/eps/src/import/ai/style/tests.rs`, `crates/eps/src/import/ai/tests.rs`, `crates/eps/src/import/tests_native.rs`). In a `.ai` or EPS opened from its editing data, a Scatter brush whose last 15 numbers start with 1 comes into the Brushes panel in Tints, and each brush art section is read without its frame, an unnamed, unpainted rectangle with no settings of its own at the art's bounds (within 1/1000 pt). A wider frame stays in the art, and an art group with a state or look of its own (hidden, locked, isolated, knockout, an opacity, a blend mode, a name, a mask, a note or an appearance) stays a group (`crates/eps/src/import/ai/tests.rs`). In a `.ai` opened from its editing data, type with Warp on the object or on one of its fills or strokes opens as type with the effect live when the live warp draws as the art saved with it. When it draws differently, or when the file's limit of checks has no check left for it, it opens as that art, and one note says how many did. Type stays live without a comparison when the saved art paints nothing or draws type of its own, in frames of threaded type, when a text variable binds it, and when its text object doesn't come in as one text object (`crates/eps/src/import/ai/envelope.rs`, `crates/eps/src/import/tests_native.rs`). From 9316c17967a9fdaa8233c9c73bf7002ab7f0ee40 Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sat, 7 Nov 2026 22:00:16 -0800 Subject: [PATCH 22/30] .ai save: the editing copy stops at the reader's object limit The reader stops a whole file past 4,000,000 objects (MAX_NODES), and the writer had no limit of its own. The writer now counts the objects it writes as the reader counts them, across layers, symbol and pattern definitions, opacity masks and art styles, and leaves out art past the limit with a warning. Art that does not fit is given back as a whole: a mask, a pattern or a symbol definition is left out with all its art, and a symbol's definition is written only with room for its instance. The limit is the reader's own constant, re-exported as MAX_EDITING_OBJECTS. --- crates/eps/src/ai_editing.rs | 9 +- crates/eps/src/ai_editing/tests.rs | 162 ++++++++++++ crates/eps/src/ai_editing/writer.rs | 268 ++++++++++++++++---- crates/eps/src/ai_editing/writer/images.rs | 5 + crates/eps/src/ai_editing/writer/paints.rs | 13 +- crates/eps/src/ai_editing/writer/styles.rs | 15 ++ crates/eps/src/ai_editing/writer/symbols.rs | 25 +- crates/eps/src/ai_editing/writer/texts.rs | 6 + crates/eps/src/import.rs | 4 +- crates/eps/src/import/ai.rs | 4 +- crates/eps/src/import/ai/read.rs | 9 + crates/eps/src/import/ai/read/types.rs | 4 +- 12 files changed, 472 insertions(+), 52 deletions(-) diff --git a/crates/eps/src/ai_editing.rs b/crates/eps/src/ai_editing.rs index 828145c9c..9ae80c3c0 100644 --- a/crates/eps/src/ai_editing.rs +++ b/crates/eps/src/ai_editing.rs @@ -167,7 +167,8 @@ //! tiles and the placement of pattern swatches that move, turn or scale their pattern, the opacity and blending modes of single fills and strokes, opacity masks on //! layers and opacity masks nested too deep, and, on objects written without an art style, live //! effects other than geometry effects left out; graphic styles, links to them and every art style -//! on a large canvas are left out. +//! on a large canvas are left out; art past [`crate::import::MAX_EDITING_OBJECTS`] objects in all +//! (the most the reader reads), counted as the reader counts them, is left out. //! //! The data streams hold the program compressed with Zstandard after `%AI24_ZStandard_Data`, with //! the version numbers of the newest files users sent ([`private_data`]). @@ -240,6 +241,11 @@ pub struct AiEditingOutput { /// Write `doc` as the editing data of a `.ai` file: every artboard and layer. pub fn export_ai_editing(doc: &Document, o: &AiEditingOptions) -> Result { + export_within(doc, o, crate::import::MAX_EDITING_OBJECTS) +} + +/// [`export_ai_editing`] writing at most `max_objects` objects, counted as the reader counts them. +fn export_within(doc: &Document, o: &AiEditingOptions, max_objects: usize) -> Result { let board = doc.artboards.first().ok_or("the document has no artboard")?.rect; if !(board.is_finite() && board.width() > 0.0 && board.height() > 0.0) { return Err("the document has no artboard".into()); @@ -280,6 +286,7 @@ pub fn export_ai_editing(doc: &Document, o: &AiEditingOptions) -> Result Vec<(&'static str, Document)> { + vec![ + ("sample", sample()), + ("unsupported", unsupported()), + ("transparent", transparent()), + ("gradients and patterns", gradients_and_patterns()), + ("images", images_doc()), + ("typed", typed()), + ("variables", variables_doc()), + ("symbols", symbols_document()), + ("styles", styles_document()), + ("painted clips", painted_clips()), + ("blend", blend_doc()), + ] +} + +/// A blend of two squares 20 pt apart with a step every 10 pt, written as its steps. +fn blend_doc() -> Document { + let mut doc = Document::new(200.0, 100.0); + let layer = doc.layers[0].id; + let keys = vec![ + Arc::new(square(&mut doc, Rect::new(10.0, 10.0, 12.0, 12.0), Color::gray(0.5))), + Arc::new(square(&mut doc, Rect::new(30.0, 10.0, 32.0, 12.0), Color::gray(0.5))), + ]; + let spec = vectorcraft_doc::BlendSpec { spacing: vectorcraft_doc::BlendSpacing::Distance(10.0), ..Default::default() }; + let blend = Node::new(doc.alloc_id(), NodeKind::Blend { children: keys, spec: Box::new(spec) }); + doc.insert(Some(layer), usize::MAX, blend).unwrap(); + doc +} + +/// Clipping groups whose clipping paths are filled: a square with a color, and a ring (a path of +/// two subpaths) with a color, with a gradient, and with a color and a gradient stroke. +fn painted_clips() -> Document { + let mut doc = Document::new(260.0, 100.0); + let layer = doc.layers[0].id; + let ring = |x: f64| { + let mut p = shapes::rectangle(Rect::new(x, 10.0, x + 20.0, 30.0)); + p.subpaths.extend(shapes::rectangle(Rect::new(x + 5.0, 15.0, x + 15.0, 25.0)).subpaths); + p + }; + let g = Gradient::new( + GradientKind::Linear, + vec![GradientStop::new(0.0, Color::rgb(1.0, 1.0, 1.0)), GradientStop::new(1.0, Color::rgb(0.0, 0.0, 0.0))], + ); + let shade = || Paint::Gradient(Box::new(GradientPaint::new(g.clone()))); + let clips = [ + (10.0, shapes::rectangle(Rect::new(10.0, 10.0, 30.0, 30.0)), solid(Color::rgb(1.0, 0.0, 0.0)), Paint::None), + (70.0, ring(70.0), solid(Color::rgb(0.0, 0.0, 1.0)), Paint::None), + (130.0, ring(130.0), shade(), Paint::None), + (190.0, ring(190.0), solid(Color::rgb(0.0, 1.0, 0.0)), shade()), + ]; + for (x, path, fill, stroke) in clips { + let mut clip = clipping(&mut doc, path); + let width = if matches!(stroke, Paint::None) { 0.0 } else { 2.0 }; + clip.appearance = Appearance::basic(fill, stroke, width).into(); + let inside = square(&mut doc, Rect::new(x - 5.0, 5.0, x + 10.0, 20.0), Color::gray(0.5)); + let g = group(&mut doc, vec![clip, inside], true); + doc.insert(Some(layer), usize::MAX, g).unwrap(); + } + doc +} + +/// The writer counts the objects it writes as the reader counts the objects it reads: with room +/// for as many objects as the reader reads, nothing is left out; with one less, art is left out, +/// with a warning. With room for fewer, the reader never reads more objects than there is room for. +#[test] +fn the_writer_counts_objects_as_the_reader_reads_them() { + let objects = |out: &AiEditingOutput| crate::import::objects_read(&out.program).unwrap(); + let limited = |out: &AiEditingOutput| out.warnings.iter().any(|w| w == writer::OBJECT_LIMIT); + for (name, doc) in counted() { + let all = export_ai_editing(&doc, &opts()).unwrap(); + let read = objects(&all); + assert!(read > 0 && !limited(&all), "{name}: {read} objects, {:?}", all.warnings); + let room = export_within(&doc, &opts(), read).unwrap(); + assert!(!limited(&room), "{name}: nothing is left out with room for {read} objects"); + assert_eq!(room.program, all.program, "{name}"); + for max in 0..read { + let out = export_within(&doc, &opts(), max).unwrap(); + assert!(limited(&out), "{name}: art is left out with room for {max} of {read} objects"); + assert!(objects(&out) <= max, "{name}: {} objects read with room for {max}", objects(&out)); + } + } +} + +/// An opacity mask whose art doesn't all fit within the object limit is left out with its art, +/// and the object it masks is written without it; the art left out leaves room for the objects +/// after it. +#[test] +fn a_mask_whose_art_passes_the_object_limit_is_left_out() { + let mut doc = Document::new(200.0, 100.0); + let layer = doc.layers[0].id; + let mut masked = square(&mut doc, Rect::new(10.0, 10.0, 50.0, 50.0), Color::gray(0.5)); + let a = square(&mut doc, Rect::new(0.0, 0.0, 30.0, 30.0), Color::rgb(1.0, 1.0, 1.0)); + let b = square(&mut doc, Rect::new(30.0, 30.0, 60.0, 60.0), Color::rgb(1.0, 1.0, 1.0)); + let art = group(&mut doc, vec![a, b], false); + masked.extras_mut().mask = Some(Box::new(OpacityMask::new(art, false))); + doc.insert(Some(layer), usize::MAX, masked).unwrap(); + let after = square(&mut doc, Rect::new(100.0, 10.0, 140.0, 50.0), Color::gray(0.5)); + doc.insert(Some(layer), usize::MAX, after).unwrap(); + let text = |max: usize| { + let out = export_within(&doc, &opts(), max).unwrap(); + let limited = out.warnings.iter().any(|w| w == writer::OBJECT_LIMIT); + (String::from_utf8_lossy(&out.program).replace("\r\n", "\n"), limited) + }; + let (all, limited) = text(4); + assert!(!limited && all.contains("(AI9_Mask)"), "{all}"); + let (short, limited) = text(2); + assert!(limited); + assert!(!short.contains("(AI9_Mask)") && !short.contains("%_/ArtDictionary :\n%_/Mask"), "{short}"); + assert_eq!(short.matches("\nf\n").count(), 2, "both squares are written: {short}"); +} + +/// A symbol's definition is written only when there is room for its instance too. +#[test] +fn a_symbol_definition_is_written_only_with_room_for_its_instance() { + let mut doc = Document::new(200.0, 100.0); + let layer = doc.layers[0].id; + let a = square(&mut doc, Rect::new(0.0, 0.0, 10.0, 10.0), Color::gray(0.5)); + let b = square(&mut doc, Rect::new(10.0, 10.0, 20.0, 20.0), Color::gray(0.5)); + let art = group(&mut doc, vec![a, b], false); + doc.symbols.push(Symbol { dynamic: false, name: "Pair".into(), art: Arc::new(art) }); + let placed = instance(&mut doc, "Pair", Affine::translate((50.0, 10.0))); + doc.insert(Some(layer), usize::MAX, placed).unwrap(); + add_rect(&mut doc, Rect::new(100.0, 10.0, 110.0, 20.0)); + let program = export_ai_editing(&doc, &opts()).unwrap().program; + let all = String::from_utf8_lossy(&program).replace("\r\n", "\n"); + assert!(all.contains("%AI14_BeginSymbol") && all.contains("/SymbolInstance :"), "{all}"); + let read = crate::import::objects_read(&program).unwrap(); + for max in 0..read { + let out = export_within(&doc, &opts(), max).unwrap(); + let text = String::from_utf8_lossy(&out.program).replace("\r\n", "\n"); + let defined = text.contains("%AI14_BeginSymbol"); + assert_eq!(defined, text.contains("/SymbolInstance :"), "room for {max} of {read}: {text}"); + } +} + +/// The writer's limit is the reader's, which its warning names. +#[test] +fn the_object_limit_is_the_readers() { + assert_eq!(crate::import::MAX_EDITING_OBJECTS, 4_000_000); + assert!(writer::OBJECT_LIMIT.contains("4,000,000")); +} + +/// Paths past the object limit are left out of a layer of many paths, with a warning: the paths +/// that fit are written. +#[test] +fn paths_past_the_object_limit_are_left_out() { + let mut doc = Document::new(200.0, 100.0); + for i in 0..10 { + add_rect(&mut doc, Rect::new(f64::from(i) * 10.0, 0.0, f64::from(i) * 10.0 + 5.0, 5.0)); + } + let out = export_within(&doc, &opts(), 6).unwrap(); + assert!(out.warnings.iter().any(|w| w == writer::OBJECT_LIMIT), "{:?}", out.warnings); + assert_eq!(crate::import::objects_read(&out.program).unwrap(), 6); + let text = String::from_utf8_lossy(&out.program).replace("\r\n", "\n"); + assert_eq!(text.matches("\nf\n").count(), 6, "the first six paths are written"); +} + #[test] fn a_stained_symbol_instance_is_written_in_its_stained_colors() { let mut doc = Document::new(200.0, 100.0); diff --git a/crates/eps/src/ai_editing/writer.rs b/crates/eps/src/ai_editing/writer.rs index 5bb33aa52..90182c8fd 100644 --- a/crates/eps/src/ai_editing/writer.rs +++ b/crates/eps/src/ai_editing/writer.rs @@ -62,6 +62,7 @@ const GROUPED_LAYER: &str = pub(super) const EFFECTS: &str = "live effects other than geometry effects are left out of the editing data for other apps"; pub(super) const SWATCHES: &str = "freeform gradient swatches, gradient swatches of more than 256 stops, and pattern swatches whose patterns the data can't define, are left out of the editing data for other apps"; pub(super) const SYMBOL_LIMIT: &str = "symbol instances past 16,000,000 objects of symbol art in all are left out of the editing data for other apps"; +pub(super) const OBJECT_LIMIT: &str = "art past 4,000,000 objects in all is left out of the editing data for other apps"; const TEMPLATES: &str = "template layers are written as dimmed layers that don't print in the editing data for other apps"; /// The transparency `mode opacity isolate knockout shape Xy` sets: the blending mode ([`blend_code`]), @@ -117,6 +118,16 @@ fn blend_code(b: BlendMode) -> u8 { } } +/// What the writer had charged when a part of the art started ([`Writer::charges`]). +#[derive(Clone, Copy)] +struct Charges { + objects: usize, + symbol_nodes: u64, + kept_objects: usize, + kept_symbol_nodes: u64, + left_out: usize, +} + pub(super) struct Writer<'a> { doc: &'a Document, /// The document → art space. @@ -144,6 +155,18 @@ pub(super) struct Writer<'a> { brushes: Option>, /// The objects of the symbol art written so far, within [`vectorcraft_doc::MAX_SYMBOL_NODES`]. symbol_nodes: u64, + /// The objects written so far, counted as the reader counts the objects it reads. + objects: usize, + /// How many times art was left out for [`Self::max_objects`]. + left_out: usize, + /// The objects of the pattern and symbol definitions written so far, which stay written when + /// the art that first used them is not ([`Self::give_back`]). + definition_objects: usize, + /// The objects of symbol art in those definitions ([`Self::symbol_nodes`]). + definition_symbol_nodes: u64, + /// The most objects written ([`Self::take_objects`]): the most the reader reads, + /// [`crate::import::MAX_EDITING_OBJECTS`]. + pub(super) max_objects: usize, /// The document → the space gradients' matrices (`Xm`, `Bm`, `Bc`) and focal points are /// written in: art space, and in a pattern's definition [`Self::tile_grad_space`]. grad_space: Affine, @@ -286,6 +309,85 @@ impl<'a> Writer<'a> { styled: HashMap::new(), styles: styles::Styles::default(), in_look: false, + objects: 0, + left_out: 0, + definition_objects: 0, + definition_symbol_nodes: 0, + max_objects: crate::import::MAX_EDITING_OBJECTS, + } + } + + /// Whether `count` more objects may be written: the objects written so far, counted as the + /// reader counts them ([`object_count`]), stay within [`Self::max_objects`]. Past it the art is + /// left out, with a warning. + fn take_objects(&mut self, count: usize) -> bool { + let total = self.objects.saturating_add(count); + if total > self.max_objects { + self.warn(OBJECT_LIMIT); + self.left_out += 1; + return false; + } + self.objects = total; + true + } + + /// Start a group with `op` (`u`, or `q` for a clipping group), counted as one object + /// ([`Self::take_objects`]). False, writing nothing, when there is no room for it. + fn open_group(&mut self, op: &str) -> bool { + if !self.take_objects(1) { + return false; + } + self.line(op); + true + } + + /// Whether `n`, an instance of `symbol` placed by `xf`, is written as a live instance + /// ([`Self::live_instance`]). The instance is one object, without the art of its definition, + /// and room for it is kept before the definition is written. + fn live_instance_in_room(&mut self, n: &Node, symbol: &str, xf: Affine) -> bool { + if !self.take_objects(1) { + return false; + } + if self.live_instance(n, symbol, xf) { + return true; + } + self.objects -= 1; + false + } + + /// What has been charged so far, for [`Self::keep_since`] and [`Self::give_back`]. + fn charges(&self) -> Charges { + Charges { + objects: self.objects, + symbol_nodes: self.symbol_nodes, + kept_objects: self.definition_objects, + kept_symbol_nodes: self.definition_symbol_nodes, + left_out: self.left_out, + } + } + + /// Whether art was left out for [`Self::max_objects`] since `c`. + fn left_out_since(&self, c: Charges) -> bool { + self.left_out != c.left_out + } + + /// A definition that started at `c` is written: what was charged since stays charged when the + /// art that first used it is given back ([`Self::give_back`]). + fn keep_since(&mut self, c: Charges) { + self.definition_objects = c.kept_objects + (self.objects - c.objects); + self.definition_symbol_nodes = c.kept_symbol_nodes + (self.symbol_nodes - c.symbol_nodes); + } + + /// Art written since `c` as `lines` is not used: the objects and symbol art charged since are + /// given back, except those of the definitions written since, and the images `lines` marks + /// are emptied (the others keep their indices). + fn give_back(&mut self, c: Charges, lines: &str) { + self.objects = c.objects + (self.definition_objects - c.kept_objects); + self.symbol_nodes = c.symbol_nodes + (self.definition_symbol_nodes - c.kept_symbol_nodes); + for index in lines.split(PAYLOAD).skip(1).step_by(2) { + if let Some(p) = index.parse::().ok().and_then(|i| self.payloads.get_mut(i)) { + *p = Vec::new(); + } } } @@ -510,19 +612,22 @@ impl<'a> Writer<'a> { NodeKind::Layer { .. } => {} NodeKind::Group { children, clip: true } => self.clip_group(children, xy), NodeKind::Group { children, clip: false } => { - self.line("u"); - for c in children { - self.node(c); + if self.open_group("u") { + for c in children { + self.node(c); + } + self.end_group("U", xy); } - self.end_group("U", xy); } NodeKind::Path { path, rule, guide, .. } => { if *guide { - // Its own transparency, not the one the object before it set. - if path.subpaths.iter().any(|sp| !sp.anchors.is_empty()) { + // A path for each subpath with points, with the guide's own transparency, not + // the one the object before it set. + let subpaths = path.subpaths.iter().filter(|sp| !sp.anchors.is_empty()).count(); + if subpaths > 0 && self.take_objects(subpaths) { self.set_object_xy(xy.object()); + ai_ops::guide(&mut self.body, self.to_art, path, true); } - ai_ops::guide(&mut self.body, self.to_art, path, true); } else { self.shape(n, path, *rule, xy); } @@ -530,8 +635,11 @@ impl<'a> Writer<'a> { NodeKind::Compound { rule, .. } => self.shape(n, &compound_path(n), *rule, xy), NodeKind::Text(_) => self.text(n, xy), NodeKind::Image(im) => self.image(im, xy), - NodeKind::SymbolInstance { symbol, xf } if self.live_instance(n, symbol, *xf) => self.symbol_instance(symbol, *xf, xy), + NodeKind::SymbolInstance { symbol, xf } if self.live_instance_in_room(n, symbol, *xf) => self.symbol_instance(symbol, *xf, xy), NodeKind::SymbolInstance { symbol, xf } => { + if !self.open_group("u") { + return; + } // The canvas places an instance inside a symbol's art where the outer instance puts // it (9-slice guides, stains and patterns included), and this art doesn't move with it. self.wrote_fixed |= self.in_symbol; @@ -541,7 +649,6 @@ impl<'a> Writer<'a> { } else { self.warn(symbols::MISSING_SYMBOL); } - self.line("u"); if let Some(sym) = doc.symbols.iter().find(|s| &s.name == symbol) && self.nest < MAX_NEST { @@ -583,8 +690,10 @@ impl<'a> Writer<'a> { | NodeKind::Repeat(_) | NodeKind::PlacedDocument(_) | NodeKind::Intertwine { .. } => { + if !self.open_group("u") { + return; + } self.warn(LIVE); - self.line("u"); if self.nest < MAX_NEST { let g = vectorcraft_effects::expand_live_deep(Some(self.doc), n); self.nest += 1; @@ -629,11 +738,14 @@ impl<'a> Writer<'a> { if name.is_none() && mask.is_none() && bound.is_empty() && entries.is_none() { return; } + let start = self.body.len(); + let has_id = name.is_some() || !bound.is_empty(); + let has_entries = entries.is_some(); self.body.push_str("%_/ArtDictionary :\n"); if let Some(e) = entries { self.body.push_str(&e); } - if name.is_some() || !bound.is_empty() { + if has_id { let id = self.take_id(name.unwrap_or("XMLID")); let _ = writeln!(self.body, "%_/XMLUID : {} ; (AI10_ArtUID) ,", ps::bytes(id.as_bytes())); if name.is_none() { @@ -644,8 +756,13 @@ impl<'a> Writer<'a> { self.bound.push((n.id, id, bound)); } } - if let Some(m) = mask { - self.mask(m); + // A mask whose art doesn't fit is left out, and with nothing else in it the dictionary too. + if let Some(m) = mask + && !self.mask(m) + && !has_id + && !has_entries + { + return self.body.truncate(start); } self.body.push_str("%_;\n%_\n"); } @@ -673,10 +790,13 @@ impl<'a> Writer<'a> { /// An opacity mask, as an entry of its object's dictionary: `/Mask :`, `X=`, its art on `%_` /// lines (from the state a dictionary's art starts in: unlocked, shown, opaque), `X+`, `(Art) ,`, /// its options as the `/Bool` entries `Clipping`, `Inverted`, `Disabled` and `Linked`, and - /// `; (AI9_Mask) ,`. The art is in document coordinates, as the object's is. - fn mask(&mut self, m: &OpacityMask) { + /// `; (AI9_Mask) ,`. The art is in document coordinates, as the object's is. False, writing + /// nothing, when some of the art is left out for the object limit ([`Self::take_objects`]): a + /// mask without all its art would change what it shows. + fn mask(&mut self, m: &OpacityMask) -> bool { let outer = std::mem::take(&mut self.body); - let (state, clip) = (self.state, self.clip.take()); + let (state, gs, clip) = (self.state, self.gs, self.clip.take()); + let (charges, bound) = (self.charges(), self.bound.len()); (self.state, self.gs) = (Some((false, false)), Some(Xy::OPAQUE)); // The canvas draws the art's root even when it is hidden, and the reader puts a hidden object // in a group that doesn't draw it, so a hidden root is written shown. @@ -709,6 +829,13 @@ impl<'a> Writer<'a> { self.hidden -= 1; self.nest -= 1; let lines = std::mem::replace(&mut self.body, outer); + if self.left_out_since(charges) { + // The art isn't written, nor are the variable bindings of its objects. + self.give_back(charges, &lines); + self.bound.truncate(bound); + (self.state, self.gs, self.clip, self.block_end) = (state, gs, clip, usize::MAX); + return false; + } self.body.push_str("%_/Mask :\n%_X=\n"); hide(&lines, &mut self.body); self.body.push_str("%_X+\n%_(Art) ,\n"); @@ -718,6 +845,7 @@ impl<'a> Writer<'a> { self.body.push_str("%_; (AI9_Mask) ,\n"); // The dictionary ends with the state before it, except the transparency its art set last. (self.state, self.gs, self.clip, self.block_end) = (state, None, clip, usize::MAX); + true } /// Warn that art is cut to clipping object `first` when it isn't a path or compound path (a path @@ -739,12 +867,16 @@ impl<'a> Writer<'a> { if self.clip.is_some() && !children.is_empty() { self.warn(CLIPPING); } - self.line("u"); - self.clip_contents(children); - return self.end_group("U", xy); + if self.open_group("u") { + self.clip_contents(children); + self.end_group("U", xy); + } + return; } let at_q = (self.state, self.gs); - self.line("q"); + if !self.open_group("q") { + return; + } self.clipped(children); (self.state, self.gs) = at_q; self.end_group("Q", xy); @@ -753,7 +885,8 @@ impl<'a> Writer<'a> { /// The members of a clipping group or layer, the first one clipping the others: the others, /// then the first one as the clipping path (see [`Self::clip_group`]), its name after it. Fills /// and strokes the clipping path can't paint itself are paths of their own, the fills under the - /// others and the strokes over them. + /// others and the strokes over them. Without room for the clipping path, nothing is written + /// ([`Self::take_objects`]). fn clipped(&mut self, children: &[Arc]) { let Some((first, rest)) = children.split_first() else { return }; let Some((path, rule)) = clip_path(first) else { @@ -762,6 +895,12 @@ impl<'a> Writer<'a> { }; let items = self.items(first, path.to_bezpath().bounding_box()); let painted = self.plain_paint(&items); + // The clipping path goes after the others, so its objects are counted first. + let subpaths: Vec<&SubPath> = path.subpaths.iter().filter(|sp| !sp.anchors.is_empty()).collect(); + let (fill, stroke) = painted.unwrap_or_default(); + if !self.take_objects(clip_object_count(&subpaths, fill, stroke)) { + return; + } if items.iter().any(|i| i.opacity() < 1.0 || i.blend() != BlendMode::Normal) { self.warn(ITEM_TRANSPARENCY); } @@ -779,12 +918,10 @@ impl<'a> Writer<'a> { self.node(c); } self.clip_paint_part(first, &path, rule, &strokes); - let (fill, stroke) = painted.unwrap_or_default(); self.state(first.locked, !first.visible); let start = self.body.len(); self.paint_state(fill, stroke, Xy::of(first).object(), rule); let op = paint_op(fill.is_some(), stroke.is_some()); - let subpaths: Vec<&SubPath> = path.subpaths.iter().filter(|sp| !sp.anchors.is_empty()).collect(); let several = subpaths.len() > 1; if several { self.line("*u"); @@ -817,7 +954,9 @@ impl<'a> Writer<'a> { if let [one] = items { return self.item(path, rule, one, xy); } - self.line("u"); + if !self.open_group("u") { + return; + } for i in items { self.item(path, rule, i, Xy::PLAIN); } @@ -870,11 +1009,12 @@ impl<'a> Writer<'a> { (Some((fill, stroke)), _) => self.path_object(path, rule, fill, stroke, xy), (None, [one]) => self.item(path, rule, one, xy), (None, items) => { - self.line("u"); - for i in items { - self.item(path, rule, i, Xy::PLAIN); + if self.open_group("u") { + for i in items { + self.item(path, rule, i, Xy::PLAIN); + } + self.end_group("U", xy); } - self.end_group("U", xy); } } } @@ -898,7 +1038,8 @@ impl<'a> Writer<'a> { } /// A brushed stroke `st` of `path` as a group of its brush's art, of transparency `xy`. False - /// when it has no brush the document knows (or brushes nest too deep). + /// when it has no brush the document knows (or brushes nest too deep). Without room for the + /// group ([`Self::take_objects`]), the stroke is left out. fn brush_art(&mut self, path: &PathData, st: &StrokeLayer, xy: Xy) -> bool { if self.nest >= MAX_NEST { return false; @@ -908,8 +1049,10 @@ impl<'a> Writer<'a> { let Some(b) = st.brush.as_deref().and_then(|name| brushes.iter().find(|b| b.name == name)) else { return false }; let art = vectorcraft_brush::stroke_pieces(doc, b, &path.to_bezpath(), st); let state = self.state; + if !self.open_group("u") { + return true; + } self.nest += 1; - self.line("u"); for piece in &art { self.node(piece); } @@ -948,13 +1091,15 @@ impl<'a> Writer<'a> { let flat = FillLayer { paint: Paint::solid(Color::gray(0.5)), ..f.clone() }; return self.path_object(path, rule, Some(&flat), None, xy); } + let state = self.state; + if !self.open_group("u") { + return; + } self.wrote_pattern = true; let outer = self.clip.clone(); let region = self.cut(path, rule); self.clip = Some(region); self.nest += 1; - let state = self.state; - self.line("u"); for t in &tiles { self.node(t); } @@ -979,8 +1124,8 @@ impl<'a> Writer<'a> { } let both = fill.is_some() && stroke.is_some(); let own = if both { Xy::OPAQUE } else { xy.object() }; - if both { - self.line("u"); + if both && !self.open_group("u") { + return; } if fill.is_some() || stroke.is_none() { let region = self.cut(path, rule); @@ -1026,7 +1171,7 @@ impl<'a> Writer<'a> { /// points and painting operator (`*u` … `*U` around several). fn plain_object(&mut self, path: &PathData, rule: FillRule, fill: Option<&FillLayer>, stroke: Option<&StrokeLayer>, xy: Xy) { let subpaths: Vec<&SubPath> = path.subpaths.iter().filter(|sp| !sp.anchors.is_empty()).collect(); - if subpaths.is_empty() { + if subpaths.is_empty() || !self.take_objects(object_count(subpaths.len())) { return; } self.paint_state(fill, stroke, xy, rule); @@ -1057,18 +1202,29 @@ impl<'a> Writer<'a> { fn text(&mut self, n: &Node, xy: Xy) { let NodeKind::Text(t) = &n.kind else { return }; let doc = self.doc; - let placed = if self.hidden > 0 || self.clip.is_some() || self.in_symbol { - None - } else if let Some(thread) = doc.text_threads.iter().find(|th| th.contains(&n.id)) { + let thread = doc.text_threads.iter().find(|th| th.contains(&n.id)); + // Type that can't be a stub is written as its outlines, which count their own objects. + if self.hidden > 0 || self.clip.is_some() || self.in_symbol || (thread.is_none() && !texts::holds(n, t)) { + return self.outlined_text(n, xy); + } + // The stub's objects ([`texts::stub_objects`], [`Self::take_objects`]); without room for + // them, the type is left out before its story goes into the text document. + let stub = texts::stub_objects(t); + if !self.take_objects(stub) { + return; + } + let placed = if let Some(thread) = thread { // A thread is checked for what it loses, in every frame, when its story is written. let placed = self.texts.thread(doc, thread, n.id, self.canvas, &|id| !cut_to_clipping_object(doc, id)); placed.map(|p| (p, self.texts.take_lost())) - } else if texts::holds(n, t) { - self.texts.add(t, self.canvas).map(|story| ((story, 0), texts::loses(t))) } else { - None + self.texts.add(t, self.canvas).map(|story| ((story, 0), texts::loses(t))) + }; + let Some(((story, frame), lost)) = placed else { + // The text document can't hold it: the outlines count their own objects. + self.objects -= stub; + return self.outlined_text(n, xy); }; - let Some(((story, frame), lost)) = placed else { return self.outlined_text(n, xy) }; self.typed = true; if lost { self.warn(texts::TYPE_ATTRIBUTES); @@ -1088,8 +1244,10 @@ impl<'a> Writer<'a> { /// graphics as their symbols' art where the layout places them, as the PDF page draws them; /// the group has the type's transparency `xy`. fn outlined_text(&mut self, n: &Node, xy: Xy) { + if !self.open_group("u") { + return; + } self.warn(TYPE); - self.line("u"); let doc = self.doc; let resolved = match &n.kind { NodeKind::Text(t) => Some(doc.inline_resolved(t).into_owned()), @@ -1343,6 +1501,30 @@ fn paint_op(fill: bool, stroke: bool) -> char { } } +/// The objects the reader makes of a path object of `subpaths` subpaths with points: a path for +/// each, and a compound path holding them when there are several. +fn object_count(subpaths: usize) -> usize { + match subpaths { + 0 => 0, + 1 => 1, + n => n + 1, + } +} + +/// The objects the reader counts for clipping path `subpaths` (those with points) painted with +/// `fill` and `stroke` ([`Writer::clipped`]). Its last subpath carries a gradient fill's or +/// stroke's gradient, so the subpaths of a filled compound clipping path with a gradient paint +/// differently, and the reader reads their fills apart from it: a compound path of a copy of each, +/// which counts the copy and its points ([`object_count`] for the clipping path itself). +fn clip_object_count(subpaths: &[&SubPath], fill: Option<&FillLayer>, stroke: Option<&StrokeLayer>) -> usize { + let own = object_count(subpaths.len()); + let apart = subpaths.len() > 1 && fill.is_some() && (gradient(fill.map(|f| &f.paint)).is_some() || gradient(stroke.map(|s| &s.paint)).is_some()); + if !apart { + return own; + } + subpaths.iter().fold(own.saturating_add(1), |n, sp| n.saturating_add(1).saturating_add(sp.anchors.len())) +} + /// The subpaths of compound path `n`'s members, as one path. fn compound_path(n: &Node) -> PathData { let mut subpaths = vec![]; diff --git a/crates/eps/src/ai_editing/writer/images.rs b/crates/eps/src/ai_editing/writer/images.rs index 898c91aa7..36c21c14e 100644 --- a/crates/eps/src/ai_editing/writer/images.rs +++ b/crates/eps/src/ai_editing/writer/images.rs @@ -107,6 +107,11 @@ impl Writer<'_> { if self.clip.as_ref().is_some_and(|c| c.subpaths.iter().all(|sp| sp.anchors.is_empty())) { return; } + // The image, and where it is cut, the clipping group and its clipping path. + let clipping = self.clip.as_ref().map_or(0, |c| 1 + super::object_count(c.subpaths.iter().filter(|sp| !sp.anchors.is_empty()).count())); + if !self.take_objects(1 + clipping) { + return; + } if deep { self.warn(IMAGE_DEPTH); } diff --git a/crates/eps/src/ai_editing/writer/paints.rs b/crates/eps/src/ai_editing/writer/paints.rs index b4966968e..b9d28253d 100644 --- a/crates/eps/src/ai_editing/writer/paints.rs +++ b/crates/eps/src/ai_editing/writer/paints.rs @@ -381,7 +381,8 @@ impl Writer<'_> { /// Write pattern `name`'s definition, once: `%AI3_BeginPattern: (name)`, `(name) llx lly urx /// ury` (the tile, y up), the tile's box (an unpainted path whose dictionary marks it, /// `AIPattern_Editor_Backing_Tile_Rect`) and the art on `%_` lines, `E`, `%AI3_EndPattern`. - /// False when it can't be ([`Self::pattern_writable`]). + /// False when it can't be ([`Self::pattern_writable`]), or when its box and art don't all fit + /// within the object limit ([`Self::take_objects`]). fn define_pattern(&mut self, name: &str) -> bool { if !self.pattern_writable(name) { return false; @@ -392,7 +393,9 @@ impl Writer<'_> { return true; } let doc = self.doc; - let Some(def) = doc.pattern(name) else { return false }; + // The tile's box is an object of the definition ([`Self::take_objects`]). + let (before, bound) = (self.charges(), self.bound.len()); + let Some(def) = doc.pattern(name).filter(|_| self.take_objects(1)) else { return false }; self.defining.push(name.to_string()); // The art is written in the pattern's space, y up, from the state a definition starts in. let saved = ( @@ -427,6 +430,12 @@ impl Writer<'_> { (art, (self.to_art, self.grad_space, self.canvas), self.state, self.gs, self.clip, self.block_end) = saved; let art = std::mem::replace(&mut self.body, art); self.defining.pop(); + if self.left_out_since(before) { + self.give_back(before, &art); + self.bound.truncate(bound); + return false; + } + self.keep_since(before); let tile = Affine::FLIP_Y.transform_rect_bbox(def.tile); let quoted = ps::bytes(name.as_bytes()); let mut text = format!("%AI3_BeginPattern: {quoted}\n{quoted} "); diff --git a/crates/eps/src/ai_editing/writer/styles.rs b/crates/eps/src/ai_editing/writer/styles.rs index ace7e6b0f..8f52a0daa 100644 --- a/crates/eps/src/ai_editing/writer/styles.rs +++ b/crates/eps/src/ai_editing/writer/styles.rs @@ -504,7 +504,18 @@ impl Writer<'_> { /// after the group's end, `0 0 Xd`, `6 () XW`); the object itself on `%_` lines (a path's or /// compound path's points painted with nothing, or with its gradient fill when its style has /// one; a group with its members), its name and opacity mask; then `1 (name) XW`. + /// The look's group and the object itself are counted first ([`Self::take_objects`]): without + /// room for them, nothing is written. pub(super) fn styled_object(&mut self, n: &Node, orig: &Node, name: &str) { + let own = match &orig.kind { + NodeKind::Path { path, .. } => super::object_count(path.subpaths.iter().filter(|sp| !sp.anchors.is_empty()).count()), + NodeKind::Compound { .. } => super::object_count(compound_path(orig).subpaths.iter().filter(|sp| !sp.anchors.is_empty()).count()), + NodeKind::Group { .. } => 1, + _ => 0, + }; + if !self.take_objects(1 + own) { + return; + } self.state(orig.locked, !orig.visible); let xy = Xy::of(orig); let was = self.in_look; @@ -533,6 +544,10 @@ impl Writer<'_> { let saved = std::mem::take(&mut self.body); self.hidden += 1; let fit = drawn_outline(n, orig).map(|p| p.bounding_box()); + // A path's objects were kept for it above; it counts them itself. + if !matches!(orig.kind, NodeKind::Group { .. }) { + self.objects -= own; + } match &orig.kind { NodeKind::Path { path, rule, .. } => self.styled_outline(orig, path, *rule, fit, xy), NodeKind::Compound { rule, .. } => self.styled_outline(orig, &compound_path(orig), *rule, fit, xy), diff --git a/crates/eps/src/ai_editing/writer/symbols.rs b/crates/eps/src/ai_editing/writer/symbols.rs index ccec95d42..495bc0074 100644 --- a/crates/eps/src/ai_editing/writer/symbols.rs +++ b/crates/eps/src/ai_editing/writer/symbols.rs @@ -183,8 +183,9 @@ impl Writer<'_> { /// written from the top of the nesting whatever the instance that asks for it, so a definition /// is the same wherever its first instance lies. False when it can't be: the document doesn't /// have the symbol, it is being written (its art holds an instance of itself), it is reached - /// through more than [`MAX_NEST`] definitions being written, or the definitions written and - /// being written leave no place under [`MAX_SYMBOLS`]. + /// through more than [`MAX_NEST`] definitions being written, the definitions written and + /// being written leave no place under [`MAX_SYMBOLS`], or its art doesn't all fit within the + /// object limit ([`Self::take_objects`]). pub(super) fn define_symbol(&mut self, name: &str) -> bool { if self.defined_symbols.contains(name) { return true; @@ -204,6 +205,8 @@ impl Writer<'_> { self.warn(SYMBOL_OPTIONS); } self.defining_symbols.push(name.to_string()); + // The objects of this definition and of those it defines first. + let before = self.charges(); let mut used = vec![]; vectorcraft_doc::swatches::walk_with_masks(&sym.art, &mut |m| { if let NodeKind::SymbolInstance { symbol, .. } = &m.kind { @@ -215,9 +218,18 @@ impl Writer<'_> { } if self.symbol_defs.len() + self.defining_symbols.len() > MAX_SYMBOLS { self.defining_symbols.pop(); + self.keep_since(before); self.warn(SYMBOL_COUNT); return false; } + // The group that holds the art is an object of the definition ([`Self::take_objects`]); + // without room for it, or for all the art, there is no definition. + let (art_start, bound) = (self.charges(), self.bound.len()); + if !self.take_objects(1) { + self.defining_symbols.pop(); + self.keep_since(before); + return false; + } // The art is written in the symbol's space, from the state `0 A` and `0 Xw` set, from the // document at its own size. let origin = self.canvas_origin; @@ -261,7 +273,9 @@ impl Writer<'_> { let _ = write!(self.body, "U\n%_/ArtDictionary :\n{entries}%_;\n%_\n9 () XW\n"); } else { // A group always writes its dictionary ([`Self::dictionary`]), which takes the entries. + // It counts itself, in the room kept for it above. self.root_entries = Some((root.id, entries)); + self.objects -= 1; self.node(root); } self.nest = nest; @@ -293,6 +307,13 @@ impl Writer<'_> { self.doc = page_doc; let art = std::mem::replace(&mut self.body, art); self.defining_symbols.pop(); + if self.left_out_since(art_start) { + self.give_back(art_start, &art); + self.bound.truncate(bound); + self.keep_since(before); + return false; + } + self.keep_since(before); let text = format!("%AI14_BeginSymbol\n{}\n0 A\n0 Xw\n0 Ae\n{art}%AI10_EndSymbol\n", ps::bytes(name.as_bytes())); self.defined_symbols.insert(name.to_string()); self.symbol_defs.push(text); diff --git a/crates/eps/src/ai_editing/writer/texts.rs b/crates/eps/src/ai_editing/writer/texts.rs index e8ccda106..c7d95b992 100644 --- a/crates/eps/src/ai_editing/writer/texts.rs +++ b/crates/eps/src/ai_editing/writer/texts.rs @@ -1002,6 +1002,12 @@ fn clone_v(v: &V) -> V { } } +/// The objects the reader reads of [`stub`] for `t`: the text object, and a path for each subpath +/// of its frame's path. +pub(in crate::ai_editing) fn stub_objects(t: &TextObject) -> usize { + 1 + shape(t).map_or(0, |p| p.subpaths.iter().filter(|sp| !sp.anchors.is_empty()).count()) +} + /// The text object stub of story `story`, frame `frame`: `/AI11Text :`, `/FreeUndo`, `/FrameIndex`, /// `/StoryIndex`, for area type and type on a path the frame's path (`/Art :`, `X=`, the path in /// art space through `to_art`, `X+`, `; /ConfiningPath ,`), `/TextAntialiasing`, `;`. diff --git a/crates/eps/src/import.rs b/crates/eps/src/import.rs index 8bc8a174c..21f8f3faa 100644 --- a/crates/eps/src/import.rs +++ b/crates/eps/src/import.rs @@ -70,7 +70,9 @@ use graphics::{GState, Out}; use interp::{Fault, Interp}; use obj::PsError; -pub(crate) use ai::{MAX_GRADIENT_STOPS, MAX_SYMBOLS, read_art_style, symbol_art_member}; +#[cfg(test)] +pub(crate) use ai::objects_read; +pub(crate) use ai::{MAX_EDITING_OBJECTS, MAX_GRADIENT_STOPS, MAX_SYMBOLS, read_art_style, symbol_art_member}; pub(crate) use ate::{MAX_BYTES as MAX_TEXT_DOCUMENT, MAX_FRAMES, MAX_SEGMENTS, MAX_STORY, MAX_VALUES as MAX_TEXT_VALUES}; pub use native::{AiLayers, ai_alone, ai_alone_on_page, ai_layers_alone, ai_opened_artboard, is_loss, layered_ai, layered_ai_from}; pub(crate) use native::{MAX_TEXT, scale_document}; diff --git a/crates/eps/src/import/ai.rs b/crates/eps/src/import/ai.rs index 5537b5d06..7a0075ce5 100644 --- a/crates/eps/src/import/ai.rs +++ b/crates/eps/src/import/ai.rs @@ -40,11 +40,13 @@ pub(crate) use envelope::MAX_CHECKED; pub(crate) use envelope::{WARPED_TYPE_DRAWN, WarpedType}; pub(crate) use frames::text_frames; pub(crate) use paint::MAX_STOPS as MAX_GRADIENT_STOPS; +#[cfg(test)] +pub(crate) use read::objects_read; pub use read::{ BindingRef, Brushes, IMAGE_TOO_LARGE, PaletteSwatches, Structure, active_artboard, artboards, bindings_note, brushes, graphic_styles, palette, read, read_beside, variables, }; -pub(crate) use read::{MAX_SYMBOLS, join_and, read_art_style, slot_frame, slot_of, symbol_art_member}; +pub(crate) use read::{MAX_NODES as MAX_EDITING_OBJECTS, MAX_SYMBOLS, join_and, read_art_style, slot_frame, slot_of, symbol_art_member}; pub(crate) use read::is_look_slot; diff --git a/crates/eps/src/import/ai/read.rs b/crates/eps/src/import/ai/read.rs index 104321918..fa5963df4 100644 --- a/crates/eps/src/import/ai/read.rs +++ b/crates/eps/src/import/ai/read.rs @@ -140,6 +140,7 @@ pub use document::{ pub(crate) use document::{slot_frame, slot_of}; pub(crate) use ops::read_art_style; pub use types::IMAGE_TOO_LARGE; +pub(crate) use types::MAX_NODES; use types::{BLEND_BUDGET, BrushArtColors, FLIP, Frame, GState, Graph, Kind, PatternHead, PendingEnvelope, Place, Raster, SymbolHead}; #[cfg(test)] pub use types::{GRAPH_PLAIN, GRAPH_UNENDED, LINKED_PLACEHOLDERS, NON_NATIVE_ART, NON_NATIVE_ART_UNREAD, VERSIONED_UNENDED}; @@ -235,6 +236,14 @@ pub fn read(data: &[u8], large_canvas: bool) -> Result { r.finish() } +/// How many objects [`read`] counts against [`MAX_NODES`] in the editing data `data`. +#[cfg(test)] +pub(crate) fn objects_read(data: &[u8]) -> Result { + let mut r = Reader::with_names(data); + r.run()?; + Ok(r.nodes) +} + /// [`read`] for editing data kept apart from the program `ps` it came with (an EPS's private /// data): the program's header gives the author and the custom colors the editing data's header /// doesn't. diff --git a/crates/eps/src/import/ai/read/types.rs b/crates/eps/src/import/ai/read/types.rs index 8b9607d18..8a781f8e7 100644 --- a/crates/eps/src/import/ai/read/types.rs +++ b/crates/eps/src/import/ai/read/types.rs @@ -9,8 +9,8 @@ pub(super) const MAX_SUBREADERS: usize = 32; /// Most operands on the stack. pub(super) const MAX_STACK: usize = 1 << 20; -/// Most objects read. -pub(super) const MAX_NODES: usize = 4_000_000; +/// Most objects read. The `.ai` editing data writer writes no more ([`crate::import::MAX_EDITING_OBJECTS`]). +pub(crate) const MAX_NODES: usize = 4_000_000; /// The most objects all the blends of one import may lay out to be checked (each twice) and made /// live; past it, blends keep their drawn steps. From 01c89d4bc5a3bde9ec2b45040faed50687e0a548 Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sun, 8 Nov 2026 05:35:27 -0800 Subject: [PATCH 23/30] JavaScript: a small heap limit no longer leaves a realm without built-ins Installing the built-ins is not bounded by the heap limit: Math and JSON no longer reserve heap while they install, so a realm made with a tiny heap_bytes gets every built-in and runs once the limit is raised. If installing fails, the realm keeps the reason and every run ends with an internal error instead of running against missing built-ins. The json2.js test skips only when the built-in check returns false, and fails on any other result. The parser's progress line says the app does not run scripts yet. --- crates/js/src/builtins.rs | 13 +++++++++---- crates/js/src/builtins/json.rs | 1 - crates/js/src/builtins/math.rs | 3 +-- crates/js/src/builtins_tests.rs | 25 +++++++++++++++++++++++++ crates/js/src/interp.rs | 3 +++ crates/js/src/realm.rs | 6 +++++- crates/js/tests/json2.rs | 10 +++++++--- docs/target-app-parity.md | 2 +- 8 files changed, 51 insertions(+), 12 deletions(-) diff --git a/crates/js/src/builtins.rs b/crates/js/src/builtins.rs index 4fc1adc87..0e437c961 100644 --- a/crates/js/src/builtins.rs +++ b/crates/js/src/builtins.rs @@ -53,12 +53,17 @@ fn constructor(interp: &mut Interp, name: &'static str, ctor: ObjId, proto: ObjI data(interp, global, name, Value::Object(ctor), HIDDEN) } -/// Creates the built-ins and the global object's properties. +/// Creates the built-ins and the global object's properties. Installing is not bounded by +/// [`crate::Limits`]; if it fails, the failure is kept in `interp.install_error` and every run of +/// the realm ends with it. pub(crate) fn install(interp: &mut Interp) { if let Err(e) = try_install(interp) { - // Installing touches only objects it has just made, so this does not happen; a realm - // that somehow lacks a built-in reports it when a script uses it. - let _ = e; + let reason = match e { + Abrupt::Throw(v) => interp.describe(&v), + Abrupt::Limit(kind) => format!("limit reached: {kind:?}"), + Abrupt::Internal(message) => message, + }; + interp.install_error = Some(format!("the built-ins could not be installed: {reason}")); } } diff --git a/crates/js/src/builtins/json.rs b/crates/js/src/builtins/json.rs index 8061379ce..b84d9dc7b 100644 --- a/crates/js/src/builtins/json.rs +++ b/crates/js/src/builtins/json.rs @@ -16,7 +16,6 @@ use crate::interp::{Desc, ErrorType, Hint, Interp, JsResult}; use crate::value::{Str, Value, number_to_str}; pub(super) fn install(interp: &mut Interp) -> JsResult<()> { - interp.reserve_heap(OBJECT_BYTES)?; let proto = interp.intrinsics.object_proto; let json = interp.heap.alloc_object(Object::new(Class::Json, Some(proto))); method(interp, json, "parse", parse, 2)?; diff --git a/crates/js/src/builtins/math.rs b/crates/js/src/builtins/math.rs index 3ad9421ed..08fe96a04 100644 --- a/crates/js/src/builtins/math.rs +++ b/crates/js/src/builtins/math.rs @@ -2,12 +2,11 @@ //! cases the section lists for NaN, signed zeros and infinities. use super::{arg, data, method}; -use crate::heap::{Class, NativeFn, OBJECT_BYTES, Object}; +use crate::heap::{Class, NativeFn, Object}; use crate::interp::{Interp, JsResult}; use crate::value::Value; pub(super) fn install(interp: &mut Interp) -> JsResult<()> { - interp.reserve_heap(OBJECT_BYTES)?; let proto = interp.intrinsics.object_proto; let math = interp.heap.alloc_object(Object::new(Class::Math, Some(proto))); let constants = [ diff --git a/crates/js/src/builtins_tests.rs b/crates/js/src/builtins_tests.rs index 4a4c2aea4..7261054b7 100644 --- a/crates/js/src/builtins_tests.rs +++ b/crates/js/src/builtins_tests.rs @@ -356,6 +356,31 @@ fn define_properties_checks_the_heap_before_each_new_property() { assert!(realm.interp().heap.bytes <= heap_bytes, "{} > {heap_bytes}", realm.interp().heap.bytes); } +#[test] +fn a_heap_limit_smaller_than_the_built_ins_still_installs_every_built_in() { + // The heap limit bounds what scripts make, not the realm's own built-ins: a realm made with a + // tiny limit refuses runs with the heap limit, and has every built-in once the limit is raised. + let mut realm = small(Limits { heap_bytes: 1, ..Limits::default() }); + assert_eq!(limit(&mut realm, "[]"), LimitKind::Heap); + realm.set_limits(Limits::default()); + assert_eq!( + realm.run("typeof Math.max + typeof JSON.stringify + typeof parseInt + typeof escape + typeof decodeURIComponent"), + Ok(JsValue::String("functionfunctionfunctionfunctionfunction".into())) + ); +} + +#[test] +fn a_realm_whose_built_ins_failed_to_install_runs_nothing() { + let mut realm = Realm::new(); + realm.interp().install_error = Some("the built-ins could not be installed: test".into()); + match realm.run("var ran = true; 1") { + Err(RunError { kind: RunErrorKind::Internal, message, .. }) => assert_eq!(message, "the built-ins could not be installed: test"), + other => panic!("{other:?}"), + } + realm.interp().install_error = None; + assert_eq!(realm.run("typeof ran"), Ok(JsValue::String("undefined".into()))); +} + #[test] fn number_parsing_counts_its_copy_toward_the_heap_limit() { // `s` is 1 Mi digits, so parsing it in base 10 copies 1 MiB, which does not fit in the diff --git a/crates/js/src/interp.rs b/crates/js/src/interp.rs index 7168f9dad..32ab99275 100644 --- a/crates/js/src/interp.rs +++ b/crates/js/src/interp.rs @@ -170,6 +170,8 @@ pub(crate) struct Interp { /// charged to `heap.bytes` and added back after each collection, and a native call's /// buffers are released when it returns. pub(crate) held_bytes: usize, + /// Why installing the built-ins failed; a realm with this set runs no script. + pub(crate) install_error: Option, } /// The least heap size a collection waits for. @@ -307,6 +309,7 @@ impl Interp { random: random_seed(), join_stack: Vec::new(), held_bytes: 0, + install_error: None, }; crate::builtins::install(&mut interp); interp.gc_threshold = interp.next_threshold(); diff --git a/crates/js/src/realm.rs b/crates/js/src/realm.rs index f95d57d17..18f39d96b 100644 --- a/crates/js/src/realm.rs +++ b/crates/js/src/realm.rs @@ -170,9 +170,13 @@ impl Realm { } /// Runs `source` as a script in the global environment and returns its completion value (the - /// value of the last expression statement that ran). + /// value of the last expression statement that ran). A realm whose built-ins could not be + /// installed runs nothing and gives an internal error. pub fn run(&mut self, source: &str) -> Result { let interp = &mut self.interp; + if let Some(message) = &interp.install_error { + return Err(RunError { kind: RunErrorKind::Internal, message: message.clone(), line: 0, column: 0 }); + } interp.fuel = interp.limits.fuel; interp.source_units = 0; interp.throw_site = None; diff --git a/crates/js/tests/json2.rs b/crates/js/tests/json2.rs index 8692e9b30..c998e55a9 100644 --- a/crates/js/tests/json2.rs +++ b/crates/js/tests/json2.rs @@ -72,9 +72,13 @@ fn json2_polyfill_round_trips_with_the_built_in_json() { }; let source = std::fs::read_to_string(&path).unwrap_or_else(|e| panic!("{}: {e}", path.display())); let mut realm = Realm::new(); - if realm.run(NEEDS) != Ok(JsValue::Bool(true)) { - println!("json2: SKIPPED (the interpreter lacks Date, String.prototype.replace or RegExp, which json2.js uses)"); - return; + match realm.run(NEEDS) { + Ok(JsValue::Bool(true)) => {} + Ok(JsValue::Bool(false)) => { + println!("json2: SKIPPED (the interpreter lacks Date, String.prototype.replace or RegExp, which json2.js uses)"); + return; + } + other => panic!("json2: the built-in check failed: {other:?}"), } match realm.run(&format!("{BEFORE}\n{source}\n{ROUND_TRIP}")) { Ok(JsValue::String(s)) if s == "ok" => println!("json2: the polyfill and the built-in JSON agree on every sample"), diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md index 32585a163..193066828 100644 --- a/docs/target-app-parity.md +++ b/docs/target-app-parity.md @@ -662,7 +662,7 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur - MCP protocol: five prompts (`prompts/list` / `prompts/get`: poster, icon set, recolour, trace-and-style, export set), `completion/complete` for prompt arguments and template variables read from the live catalogues (formats, effect ids, command ids, trace presets, swatch and object ids), four resource templates (`vectorcraft://object/{id}`, `//command/{id}`, `//effect/{id}`, `//swatch/{name}`) so an agent reads one thing instead of the whole document, and `logging/setLevel` with `notifications/message`. `window.panel` ids are case-insensitive (display labels work too), `vectorcraft://object/{id}` reads through `document.node {summary: true}` (the same reply bytes from one lookup instead of summarizing the whole document: a leaf read on a 2,000-object document drops from ~20 ms to ~0.06 ms), large containers slice with `document.node {depth?, childLimit?}` (truncated levels report `childCount`), `document.inspect` and the `inspect_document` tool slice the same way so a depth-0 read is the layer skeleton (~9.7 KB instead of ~2 MB on a 2,000-object document), `document.find` locates nodes by name/kind/text with ancestor paths, and the CLI sweeps the protocol surface over stdio against the compiled binary. `docs/mcp.md` has a Protocol section covering the capability table and what is deliberately absent (subscriptions, progress, cancellation, sampling, elicitation, Streamable HTTP — all of which need the transport to interleave reads). - Headless CLI (`vectorcraft-cli run`, `convert`, `info`, `bench`, `perf`, `mcp`). A `run` step, like a `command_batch` step over MCP, can use an earlier step's result (`"$1.id"`, #785); `run --commands FILE` (or `-` for standard input) reads the steps from a JSON array or JSON Lines, past the Windows command-line limit (#3147, `apps/vectorcraft-cli/tests/it/cli.rs` `run_reads_*`, `run_refuses_malformed_commands_naming_the_step`). - File › Scripts › Check Script… reads a script written for Illustrator (`.jsx`, `.jsxinc` or a compiled `.jsxbin`) without running any of it and reports what it needs (the document model, files, dialogs, menu commands, features only Illustrator has), what it would do outside the document, the menu commands and document-model members it uses, its directives and included files, and the problems that would stop it loading (`script.check`, which also reads `.js` files); File › Open and drag-and-drop show the report for `.jsx`, `.jsxinc` and `.jsxbin` files. - - `vectorcraft-js` parses JavaScript as ECMAScript 5.1 defines it, with the legacy octal forms, block functions and lenient regular expressions of Annex B, into a syntax tree with source spans; it reads the `#target`, `#include` and other preprocessor lines as directives without running them, and a script that breaks the grammar or an early-error rule gives a `SyntaxError` with its line and column. Nesting past the parser's depth limit (`Options::max_depth`, 200 by default) gives a `SyntaxError` instead of exhausting the stack. `cargo xtask test262` fetches the conformance suite at a pinned commit and parses its ES5 tests: 5,411 of 5,418 runs pass (the 7 others use `let` and `const`). Nothing runs scripts yet. Tests: `crates/js/src/tests.rs`, `crates/engine/tests/it/js_lexer_vs_scriptcheck.rs`. + - `vectorcraft-js` parses JavaScript as ECMAScript 5.1 defines it, with the legacy octal forms, block functions and lenient regular expressions of Annex B, into a syntax tree with source spans; it reads the `#target`, `#include` and other preprocessor lines as directives without running them, and a script that breaks the grammar or an early-error rule gives a `SyntaxError` with its line and column. Nesting past the parser's depth limit (`Options::max_depth`, 200 by default) gives a `SyntaxError` instead of exhausting the stack. `cargo xtask test262` fetches the conformance suite at a pinned commit and parses its ES5 tests: 5,411 of 5,418 runs pass (the 7 others use `let` and `const`). The app does not run scripts yet. Tests: `crates/js/src/tests.rs`, `crates/engine/tests/it/js_lexer_vs_scriptcheck.rs`. - `vectorcraft-js`'s `Realm` runs ECMAScript 5.1 scripts: the parsed script compiles to verified bytecode that a non-recursive interpreter runs, with closures, `this`, `arguments`, `with`, direct and indirect `eval`, `new Function`, `try`/`catch`/`finally`, labeled `break` and `continue`, and `for`-`in` in insertion order, over a mark-and-sweep heap, with the built-ins the next entry lists. Every run is bounded by fuel, heap bytes, frames, nested host calls and an interrupt flag (smaller defaults in the wasm build), and a run that reaches a limit stops with a limit error that `try` cannot catch. `cargo xtask test262` also runs the suite's ES5 language tests that need only the built-ins present: 3,362 of 3,387 runs pass (4 of the others expect the completion values of later editions, and 21 call `String` or `Number` methods). The app does not call it yet. Tests: `crates/js/src/interp_tests.rs`, `crates/js/tests/test262.rs`. - `vectorcraft-js` provides the ECMAScript 5.1 built-ins `Object` with its property-descriptor functions, `create`, `keys`, `seal` and `freeze` (section 15.2), `Function.prototype.bind` (15.3.4.5), `Array` with every ES5 method (15.4), the error types (15.11), `Math` (15.8), `JSON` with revivers, replacers and indentation (15.12), and the global functions with Annex B's `escape` and `unescape` (15.1, B.2). The array methods work on array-like objects and visit only the indices that exist, so `new Array(4294967295).join("")` ends at once; `join` writes a cycle back to an array as an empty string, `JSON.stringify` throws a `TypeError` on a cycle, and deep `JSON` nesting uses no native stack. Every loop takes fuel and every result is checked against the heap limit. `cargo xtask test262` runs the suite's ES5 built-in tests that need only these built-ins: 4,480 of 4,556 runs pass (16 of the failing tests call `String`, `Number` or `Boolean` methods, and 22 expect rules of later editions). It also fetches the `json2.js` polyfill at a pinned commit to compare with the built-in `JSON`; that test runs once `Date`, `String.prototype.replace` and `RegExp` exist. Tests: `crates/js/src/builtins_tests.rs`, `crates/js/tests/test262.rs`, `crates/js/tests/json2.rs`. - **UI:** Illustrator 2026 layout restyled to measured values: From b6404f2f8b54140bbd74ecfd138de49a545b7b17 Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sun, 8 Nov 2026 05:54:07 -0800 Subject: [PATCH 24/30] JavaScript: toLocaleString calls toString on the boxed value, and overwriting an element reserves no heap Object.prototype.toLocaleString passed the primitive this value to toString; section 15.2.4.3 calls it on ToObject(this), so a strict toString now sees the object. The array methods' element write reserved room for a new element even when it only replaced an own property, so a heap at its limit stopped reverse or sort writes that add nothing. --- crates/js/src/builtins.rs | 18 ++++++++++++------ crates/js/src/builtins_tests.rs | 32 ++++++++++++++++++++++++++++++++ 2 files changed, 44 insertions(+), 6 deletions(-) diff --git a/crates/js/src/builtins.rs b/crates/js/src/builtins.rs index 0e437c961..885bf81d5 100644 --- a/crates/js/src/builtins.rs +++ b/crates/js/src/builtins.rs @@ -159,12 +159,17 @@ fn has_at(interp: &mut Interp, o: ObjId, k: f64) -> JsResult { /// The estimated bytes a new element adds. const ELEMENT_BYTES: usize = PROP_BYTES + 32 + 2 * 10; -/// `o[k] = v` as the array methods assign: a failure throws. `v` stays rooted while heap is -/// reserved for it, since the caller may hold it nowhere else. -fn put_at(interp: &mut Interp, o: ObjId, k: f64, v: Value) -> JsResult<()> { +/// `o[k] = v` as the array methods assign: a failure throws. When `o` has no own property `k`, `v` +/// stays rooted while heap is reserved for the new element, since the caller may hold it nowhere +/// else; overwriting an own property reserves nothing. +pub(crate) fn put_at(interp: &mut Interp, o: ObjId, k: f64, v: Value) -> JsResult<()> { + let k = key_of(k); + if interp.heap.object(o).is_some_and(|obj| obj.props.contains(&k)) { + return interp.put(o, k, v, true); + } interp.rooted(std::slice::from_ref(&v), |i| { i.reserve_heap(ELEMENT_BYTES)?; - i.put(o, key_of(k), v.clone(), true) + i.put(o, k.clone(), v.clone(), true) }) } @@ -357,11 +362,12 @@ fn object_to_string(interp: &mut Interp, this: Value, _: &[Value], _: bool) -> J fn object_to_locale_string(interp: &mut Interp, this: Value, _: &[Value], _: bool) -> JsResult { let o = interp.to_object(&this)?; - let f = interp.get_from(o, &key("toString"), &this)?; + let receiver = Value::Object(o); + let f = interp.get_from(o, &key("toString"), &receiver)?; if !interp.is_callable(&f) { return Err(interp.type_error("toString is not a function")); } - interp.call(&f, &this, &[]) + interp.call(&f, &receiver, &[]) } fn object_value_of(interp: &mut Interp, this: Value, _: &[Value], _: bool) -> JsResult { diff --git a/crates/js/src/builtins_tests.rs b/crates/js/src/builtins_tests.rs index 7261054b7..f3d2cb7f6 100644 --- a/crates/js/src/builtins_tests.rs +++ b/crates/js/src/builtins_tests.rs @@ -369,6 +369,38 @@ fn a_heap_limit_smaller_than_the_built_ins_still_installs_every_built_in() { ); } +#[test] +fn to_locale_string_calls_to_string_on_the_boxed_value() { + assert_eq!( + string( + "Object.defineProperty(Object.getPrototypeOf(Object(5)), 'toString', {value: function () { 'use strict'; return typeof this; }}); \ + Object.prototype.toLocaleString.call(5)" + ), + "object" + ); +} + +#[test] +fn array_methods_overwriting_elements_need_no_heap_for_new_ones() { + // With the heap exactly at its limit, an array method's write over an existing element + // succeeds, and a write that adds an element stops with the heap limit. + use crate::heap::key; + use crate::interp::Abrupt; + use crate::value::Value; + let mut realm = small(Limits::default()); + assert_eq!(realm.run("var a = [1, 2]; 0"), Ok(JsValue::Number(0.0))); + let interp = realm.interp(); + let global = interp.global; + let a = match interp.get_from(global, &key("a"), &Value::Object(global)) { + Ok(Value::Object(a)) => a, + other => panic!("{other:?}"), + }; + interp.collect_garbage(); + interp.limits.heap_bytes = interp.heap.bytes; + assert!(crate::builtins::put_at(interp, a, 0.0, Value::Number(5.0)).is_ok()); + assert!(matches!(crate::builtins::put_at(interp, a, 2.0, Value::Number(5.0)), Err(Abrupt::Limit(LimitKind::Heap)))); +} + #[test] fn a_realm_whose_built_ins_failed_to_install_runs_nothing() { let mut realm = Realm::new(); From 48fe46be1f7a64e043f073a169571d3b949db6bf Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sun, 8 Nov 2026 15:04:51 -0800 Subject: [PATCH 25/30] Tests: .ai object limit tests check the symbol's limit and derive the mask's The symbol test now requires a warning and at most the given number of objects at every limit below what the reader reads. The mask test takes its limits from the objects the reader reads and finds where the mask first fits. --- crates/eps/src/ai_editing/tests.rs | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/crates/eps/src/ai_editing/tests.rs b/crates/eps/src/ai_editing/tests.rs index 0ad914589..3895c4f45 100644 --- a/crates/eps/src/ai_editing/tests.rs +++ b/crates/eps/src/ai_editing/tests.rs @@ -941,9 +941,16 @@ fn a_mask_whose_art_passes_the_object_limit_is_left_out() { let limited = out.warnings.iter().any(|w| w == writer::OBJECT_LIMIT); (String::from_utf8_lossy(&out.program).replace("\r\n", "\n"), limited) }; - let (all, limited) = text(4); + let read = crate::import::objects_read(&export_ai_editing(&doc, &opts()).unwrap().program).unwrap(); + let (all, limited) = text(read); assert!(!limited && all.contains("(AI9_Mask)"), "{all}"); - let (short, limited) = text(2); + let has_mask = |max: usize| text(max).0.contains("(AI9_Mask)"); + let Some(fit) = (0..=read).find(|&max| has_mask(max)) else { panic!("the mask fits with room for {read} objects") }; + assert!(fit > 2, "the mask needs room beyond the two squares: {fit}"); + for max in fit..=read { + assert!(has_mask(max), "room for {max} of {read}, the mask fits in {fit}"); + } + let (short, limited) = text(fit - 1); assert!(limited); assert!(!short.contains("(AI9_Mask)") && !short.contains("%_/ArtDictionary :\n%_/Mask"), "{short}"); assert_eq!(short.matches("\nf\n").count(), 2, "both squares are written: {short}"); @@ -970,6 +977,9 @@ fn a_symbol_definition_is_written_only_with_room_for_its_instance() { let text = String::from_utf8_lossy(&out.program).replace("\r\n", "\n"); let defined = text.contains("%AI14_BeginSymbol"); assert_eq!(defined, text.contains("/SymbolInstance :"), "room for {max} of {read}: {text}"); + assert!(out.warnings.iter().any(|w| w == writer::OBJECT_LIMIT), "art is left out with room for {max} of {read} objects"); + let objects = crate::import::objects_read(&out.program).unwrap(); + assert!(objects <= max, "{objects} objects read with room for {max}"); } } From ba5c57790f3c15d51bcd2d67aec5c4c2b4264a60 Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sun, 8 Nov 2026 15:08:45 -0800 Subject: [PATCH 26/30] Docs: array methods skip holes only in long sparse ranges A range of 4,096 indices or fewer is visited index by index, and so is a longer one that is at most 8 times the properties on the object and its prototypes. Each index visited takes fuel. --- docs/target-app-parity.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md index 35a04de69..b881173e0 100644 --- a/docs/target-app-parity.md +++ b/docs/target-app-parity.md @@ -683,7 +683,7 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur - File › Scripts › Check Script… reads a script written for Illustrator (`.jsx`, `.jsxinc` or a compiled `.jsxbin`) without running any of it and reports what it needs (the document model, files, dialogs, menu commands, features only Illustrator has), what it would do outside the document, the menu commands and document-model members it uses, its directives and included files, and the problems that would stop it loading (`script.check`, which also reads `.js` files); File › Open and drag-and-drop show the report for `.jsx`, `.jsxinc` and `.jsxbin` files. - `vectorcraft-js` parses JavaScript as ECMAScript 5.1 defines it, with the legacy octal forms, block functions and lenient regular expressions of Annex B, into a syntax tree with source spans; it reads the `#target`, `#include` and other preprocessor lines as directives without running them, and a script that breaks the grammar or an early-error rule gives a `SyntaxError` with its line and column. Nesting past the parser's depth limit (`Options::max_depth`, 200 by default) gives a `SyntaxError` instead of exhausting the stack. `cargo xtask test262` fetches the conformance suite at a pinned commit and parses its ES5 tests: 5,411 of 5,418 runs pass (the 7 others use `let` and `const`). This entry covers parsing; the next entry covers running scripts. Tests: `crates/js/src/tests.rs`, `crates/engine/tests/it/js_lexer_vs_scriptcheck.rs`. - `vectorcraft-js`'s `Realm` runs ECMAScript 5.1 scripts: the parsed script compiles to verified bytecode that a non-recursive interpreter runs, with closures, `this`, `arguments`, `with`, direct and indirect `eval`, `new Function`, `try`/`catch`/`finally`, labeled `break` and `continue`, and `for`-`in` in insertion order, over a mark-and-sweep heap, with the built-ins the next entry lists. Every run is bounded by fuel, heap bytes, frames, nested host calls and an interrupt flag (smaller defaults in the wasm build), and a run that reaches a limit stops with a limit error that `try` cannot catch. `cargo xtask test262` also runs the suite's ES5 language tests that need only the built-ins present: 3,362 of 3,387 runs pass (4 of the others expect the completion values of later editions, and 21 call `String` or `Number` methods). The app does not call it yet. Tests: `crates/js/src/interp_tests.rs`, `crates/js/tests/test262.rs`. - - `vectorcraft-js` provides the ECMAScript 5.1 built-ins `Object` with its property-descriptor functions, `create`, `keys`, `seal` and `freeze` (section 15.2), `Function.prototype.bind` (15.3.4.5), `Array` with every ES5 method (15.4), the error types (15.11), `Math` (15.8), `JSON` with revivers, replacers and indentation (15.12), and the global functions with Annex B's `escape` and `unescape` (15.1, B.2). The array methods work on array-like objects and visit only the indices that exist, so `new Array(4294967295).join("")` ends at once; `join` writes a cycle back to an array as an empty string, `JSON.stringify` throws a `TypeError` on a cycle, and deep `JSON` nesting uses no native stack. Every loop takes fuel and every result is checked against the heap limit. `cargo xtask test262` runs the suite's ES5 built-in tests that need only these built-ins: 4,480 of 4,556 runs pass (16 of the failing tests call `String`, `Number` or `Boolean` methods, and 22 expect rules of later editions). It also fetches the `json2.js` polyfill at a pinned commit to compare with the built-in `JSON`; that test runs once `Date`, `String.prototype.replace` and `RegExp` exist. Tests: `crates/js/src/builtins_tests.rs`, `crates/js/tests/test262.rs`, `crates/js/tests/json2.rs`. + - `vectorcraft-js` provides the ECMAScript 5.1 built-ins `Object` with its property-descriptor functions, `create`, `keys`, `seal` and `freeze` (section 15.2), `Function.prototype.bind` (15.3.4.5), `Array` with every ES5 method (15.4), the error types (15.11), `Math` (15.8), `JSON` with revivers, replacers and indentation (15.12), and the global functions with Annex B's `escape` and `unescape` (15.1, B.2). The array methods work on array-like objects. A method visits only the indices that exist when its range is longer than 4,096 indices and more than 8 times the properties on the object and its prototypes, so `new Array(4294967295).join("")` ends at once; a shorter range is visited index by index, holes included, and each index takes fuel. `join` writes a cycle back to an array as an empty string, `JSON.stringify` throws a `TypeError` on a cycle, and deep `JSON` nesting uses no native stack. Every loop takes fuel and every result is checked against the heap limit. `cargo xtask test262` runs the suite's ES5 built-in tests that need only these built-ins: 4,480 of 4,556 runs pass (16 of the failing tests call `String`, `Number` or `Boolean` methods, and 22 expect rules of later editions). It also fetches the `json2.js` polyfill at a pinned commit to compare with the built-in `JSON`; that test runs once `Date`, `String.prototype.replace` and `RegExp` exist. Tests: `crates/js/src/builtins_tests.rs`, `crates/js/tests/test262.rs`, `crates/js/tests/json2.rs`. - **UI:** Illustrator 2026 layout restyled to measured values: - Medium Dark theme, categorized and Advanced toolbars (a tool group's flyout opens on a right press, a long press or a press on its corner triangle), 35 pt document tabs, 33 pt panel tabs. - Hint bar, contextual task bar, 19 dock panels with ≡ menus. From 4afee338cf60e1bf23b72d2786c52f235860b94e Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sun, 8 Nov 2026 15:43:09 -0800 Subject: [PATCH 27/30] JavaScript: toLocaleString writes the primitive value of Number, String and Boolean objects `[1, 'x', true].toLocaleString()` gave `[object Number],[object String],[object Boolean]` because the wrappers' prototypes have no `toString` on this branch and the lookup reached Object.prototype.toString. Object.prototype.toLocaleString now returns the string form of the object's primitive value when `toString` is not found on the object or on its chain up to its standard prototype. A `toString` on the object or that prototype is still called. --- crates/js/src/builtins.rs | 20 ++++++++++++++++++++ crates/js/src/builtins/json.rs | 2 +- crates/js/src/builtins_tests.rs | 15 +++++++++++++++ 3 files changed, 36 insertions(+), 1 deletion(-) diff --git a/crates/js/src/builtins.rs b/crates/js/src/builtins.rs index 885bf81d5..815a2f6ab 100644 --- a/crates/js/src/builtins.rs +++ b/crates/js/src/builtins.rs @@ -360,8 +360,28 @@ fn object_to_string(interp: &mut Interp, this: Value, _: &[Value], _: bool) -> J Ok(Value::str(&format!("[object {class}]"))) } +/// The string form of a Number, String or Boolean object's [[PrimitiveValue]] (sections 8.6.2 and +/// 9.9), when `toString` is not found on the object or on its prototype chain up to and including +/// its standard prototype. Returns `None` otherwise, and for any other object. +fn boxed_primitive_string(interp: &mut Interp, o: ObjId) -> JsResult> { + let (primitive, proto) = match interp.heap.object(o).map(|x| &x.class) { + Some(Class::Number(n)) => (Value::Number(*n), interp.intrinsics.number_proto), + Some(Class::String(s)) => (Value::String(s.clone()), interp.intrinsics.string_proto), + Some(Class::Boolean(b)) => (Value::Bool(*b), interp.intrinsics.boolean_proto), + _ => return Ok(None), + }; + if !json::reaches_prototype(interp, o, proto, "toString")? { + return Ok(None); + } + Ok(Some(Value::String(interp.primitive_to_str(&primitive)))) +} + +/// `Object.prototype.toLocaleString` (section 15.2.4.3). fn object_to_locale_string(interp: &mut Interp, this: Value, _: &[Value], _: bool) -> JsResult { let o = interp.to_object(&this)?; + if let Some(s) = boxed_primitive_string(interp, o)? { + return Ok(s); + } let receiver = Value::Object(o); let f = interp.get_from(o, &key("toString"), &receiver)?; if !interp.is_callable(&f) { diff --git a/crates/js/src/builtins/json.rs b/crates/js/src/builtins/json.rs index b84d9dc7b..b9f4a6c6f 100644 --- a/crates/js/src/builtins/json.rs +++ b/crates/js/src/builtins/json.rs @@ -574,7 +574,7 @@ fn unwrap_primitive(interp: &mut Interp, v: &Value, as_string: bool) -> JsResult /// Whether looking up `name` from `o` reaches the object `proto` on the prototype chain before /// any object on the way, `proto` included, has its own property `name`. -fn reaches_prototype(interp: &mut Interp, o: ObjId, proto: ObjId, name: &str) -> JsResult { +pub(super) fn reaches_prototype(interp: &mut Interp, o: ObjId, proto: ObjId, name: &str) -> JsResult { let k = key(name); let mut cur = Some(o); while let Some(id) = cur { diff --git a/crates/js/src/builtins_tests.rs b/crates/js/src/builtins_tests.rs index f3d2cb7f6..8d9ad318c 100644 --- a/crates/js/src/builtins_tests.rs +++ b/crates/js/src/builtins_tests.rs @@ -380,6 +380,21 @@ fn to_locale_string_calls_to_string_on_the_boxed_value() { ); } +#[test] +fn to_locale_string_writes_the_primitive_of_a_boxed_value() { + assert_eq!(string("[1, 'x', true, false, 1.5].toLocaleString()"), "1,x,true,false,1.5"); + assert_eq!(string("Object.prototype.toLocaleString.call(5)"), "5"); + assert_eq!(string("Object.prototype.toLocaleString.call(Object('s'))"), "s"); + // Object.prototype.toString comes after the standard prototypes on the chain. + assert_eq!(string("Object.prototype.toString = function () { return 'z'; }; [1, 'x', true].toLocaleString()"), "1,x,true"); + // A toString on the object or on its standard prototype is called. + assert_eq!(string("var n = Object(1); n.toString = function () { return 'own'; }; [n].toLocaleString()"), "own"); + assert_eq!(string("Object.getPrototypeOf(true).toString = function () { return 'p'; }; [true].toLocaleString()"), "p"); + assert_eq!(string("Object.getPrototypeOf(1).toString = Object.prototype.toString; [1].toLocaleString()"), "[object Number]"); + // Other objects still reach Object.prototype.toString. + assert_eq!(string("Object.prototype.toLocaleString.call({})"), "[object Object]"); +} + #[test] fn array_methods_overwriting_elements_need_no_heap_for_new_ones() { // With the heap exactly at its limit, an array method's write over an existing element From 5bd49c000e783160c10ec85c79caf293cf14bc94 Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sun, 8 Nov 2026 15:54:03 -0800 Subject: [PATCH 28/30] JSON: parse counts a string it has read and a flattened text toward the heap limit A string value the parser has read is held only by the parser until it is stored. The property reservation can start a collection, which dropped the string from the heap total. The value now stays rooted across that reservation, for array elements and for object members. `JSON.parse` also charges the buffer it flattens a concatenated text into, through the helper `parseInt` and `parseFloat` use. --- crates/js/src/builtins/global.rs | 2 +- crates/js/src/builtins/json.rs | 9 +++------ crates/js/src/builtins_tests.rs | 34 ++++++++++++++++++++++++++++++++ 3 files changed, 38 insertions(+), 7 deletions(-) diff --git a/crates/js/src/builtins/global.rs b/crates/js/src/builtins/global.rs index 261bfa146..182f3aad5 100644 --- a/crates/js/src/builtins/global.rs +++ b/crates/js/src/builtins/global.rs @@ -35,7 +35,7 @@ fn trim_start(s: &[u16]) -> &[u16] { /// ToString of the first argument, as code units, with each one taking a unit of fuel. A /// concatenation is flattened into a new buffer, which is charged to the heap. -fn units_of(interp: &mut Interp, args: &[Value]) -> JsResult> { +pub(super) fn units_of(interp: &mut Interp, args: &[Value]) -> JsResult> { let s = interp.to_str(&arg(args, 0))?; for _ in 0..s.len() { interp.use_fuel()?; diff --git a/crates/js/src/builtins/json.rs b/crates/js/src/builtins/json.rs index b9f4a6c6f..8e27dec30 100644 --- a/crates/js/src/builtins/json.rs +++ b/crates/js/src/builtins/json.rs @@ -158,10 +158,7 @@ fn syntax(interp: &mut Interp, why: &str, at: usize) -> crate::interp::Abrupt { /// `JSON.parse` (section 15.12.2). fn parse(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { - let text = interp.to_str(&arg(args, 0))?.flat(); - for _ in 0..text.len() { - interp.use_fuel()?; - } + let text = super::global::units_of(interp, args)?; let mark = interp.temp_roots.len(); let r = parse_text(interp, &text).and_then(|v| { let reviver = arg(args, 1); @@ -273,7 +270,7 @@ fn parse_text(interp: &mut Interp, text: &[u16]) -> JsResult { Open::Array { obj, next } => { let (obj, i) = (*obj, *next); *next = next.saturating_add(1); - interp.reserve_heap(ELEMENT_BYTES)?; + interp.rooted(std::slice::from_ref(&v), |i| i.reserve_heap(ELEMENT_BYTES))?; interp.define(obj, key_of(f64::from(i)), Prop::Data { value: v, flags: OPEN })?; p.skip_space(); if p.eat(b',') { @@ -288,7 +285,7 @@ fn parse_text(interp: &mut Interp, text: &[u16]) -> JsResult { Open::Object { obj, name } => { let obj = *obj; let Some(k) = name.take() else { return Err(syntax(interp, "a member has no name", p.pos)) }; - interp.reserve_heap(ELEMENT_BYTES)?; + interp.rooted(std::slice::from_ref(&v), |i| i.reserve_heap(ELEMENT_BYTES))?; interp.define(obj, k, Prop::Data { value: v, flags: OPEN })?; p.skip_space(); if p.eat(b',') { diff --git a/crates/js/src/builtins_tests.rs b/crates/js/src/builtins_tests.rs index 8d9ad318c..9fefc209b 100644 --- a/crates/js/src/builtins_tests.rs +++ b/crates/js/src/builtins_tests.rs @@ -659,6 +659,40 @@ fn json_stringify_unwraps_number_string_and_boolean_objects() { assert_eq!(string("Object.getPrototypeOf(Object('')).toString = function () { return 'q'; }; JSON.stringify(Object('abc'))"), "\"q\""); } +#[test] +fn json_parse_counts_a_string_while_it_reserves_the_property_for_it() { + // The limits around the parsed value's size include one where the reservation for the string's + // property is what starts a collection. The text is a concatenation, so the parse also flattens + // it. Whenever the parse fits, the heap total counts everything that is live. + let setup = |text: &str| format!("var s = new Array(4097).join('x'); var text = {text}; 0"); + for text in ["'[\"' + s + '\"]'", "'{\"k\":\"' + s + '\"}'"] { + let setup = setup(text); + let parse = "var a = JSON.parse(text); 0"; + let mut measure = small(Limits::default()); + assert_eq!(measure.run(&setup), Ok(JsValue::Number(0.0))); + measure.interp().collect_garbage(); + assert_eq!(measure.run(parse), Ok(JsValue::Number(0.0))); + let full = measure.interp().heap.bytes; + let (mut fits, mut over) = (0, 0); + for heap_bytes in (full - 8192..=full + 256).step_by(4) { + let mut realm = small(Limits { heap_bytes, ..Limits::default() }); + assert_eq!(realm.run(&setup), Ok(JsValue::Number(0.0))); + realm.interp().collect_garbage(); + match realm.run(parse) { + Ok(_) => { + let counted = realm.interp().heap.bytes; + let live = realm.collect_garbage(); + assert!(counted >= live, "{text}: {counted} bytes counted with {live} live under a limit of {heap_bytes}"); + fits += 1; + } + Err(RunError { kind: RunErrorKind::Limit(LimitKind::Heap), .. }) => over += 1, + Err(e) => panic!("{text}: {e:?}"), + } + } + assert!(fits > 0 && over > 0, "{text}: {fits} limits fit and {over} did not"); + } +} + #[test] fn deep_json_nesting_needs_no_native_stack() { let handle = std::thread::Builder::new() From fb4c38db5dd1b38614fb6544cbf0f74197d54517 Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sun, 8 Nov 2026 16:27:59 -0800 Subject: [PATCH 29/30] JavaScript: JSON.parse counts its text and pending names toward the heap limit The text a non-string argument converts to stays rooted while the parse runs, so a collection still counts it. A property name read from the text is charged to the heap until its property is defined. Boolean.prototype.toString and valueOf are added, so a Boolean object writes `true` or `false`. The json2 sample no longer includes U+2028: the polyfill escapes it and section 15.12.3 does not. --- crates/js/src/builtins/json.rs | 19 +++++++++--- crates/js/src/builtins_tests.rs | 54 +++++++++++++++++++++++++++++++-- crates/js/tests/json2.rs | 4 ++- 3 files changed, 69 insertions(+), 8 deletions(-) diff --git a/crates/js/src/builtins/json.rs b/crates/js/src/builtins/json.rs index 8e27dec30..14c370f03 100644 --- a/crates/js/src/builtins/json.rs +++ b/crates/js/src/builtins/json.rs @@ -158,9 +158,12 @@ fn syntax(interp: &mut Interp, why: &str, at: usize) -> crate::interp::Abrupt { /// `JSON.parse` (section 15.12.2). fn parse(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult { - let text = super::global::units_of(interp, args)?; + let source = Value::String(interp.to_str(&arg(args, 0))?); let mark = interp.temp_roots.len(); - let r = parse_text(interp, &text).and_then(|v| { + // The text stays rooted for the whole parse, so a collection still counts it. + interp.temp_roots.push(source.clone()); + let r = super::global::units_of(interp, std::slice::from_ref(&source)).and_then(|text| { + let v = parse_text(interp, &text)?; let reviver = arg(args, 1); if !interp.is_callable(&reviver) { return Ok(v); @@ -214,7 +217,12 @@ fn member_name(interp: &mut Interp, p: &mut Parser<'_>, first: bool) -> JsResult return Err(syntax(interp, "a property name must be a string", at)); } let units = p.string().map_err(|why| syntax(interp, why, at))?; - interp.reserve_heap(string_bytes(units.len()))?; + let bytes = string_bytes(units.len()); + interp.reserve_heap(bytes)?; + // The name is counted while it waits for its value; `parse_text` releases it before `define` + // accounts for it, and the native call's return releases it on every other path. + interp.heap.bytes = interp.heap.bytes.saturating_add(bytes); + interp.held_bytes = interp.held_bytes.saturating_add(bytes); p.skip_space(); if !p.eat(b':') { return Err(syntax(interp, "a property name must be followed by ':'", p.pos)); @@ -286,6 +294,9 @@ fn parse_text(interp: &mut Interp, text: &[u16]) -> JsResult { let obj = *obj; let Some(k) = name.take() else { return Err(syntax(interp, "a member has no name", p.pos)) }; interp.rooted(std::slice::from_ref(&v), |i| i.reserve_heap(ELEMENT_BYTES))?; + let held = string_bytes(k.len()); + interp.heap.bytes = interp.heap.bytes.saturating_sub(held); + interp.held_bytes = interp.held_bytes.saturating_sub(held); interp.define(obj, k, Prop::Data { value: v, flags: OPEN })?; p.skip_space(); if p.eat(b',') { @@ -571,7 +582,7 @@ fn unwrap_primitive(interp: &mut Interp, v: &Value, as_string: bool) -> JsResult /// Whether looking up `name` from `o` reaches the object `proto` on the prototype chain before /// any object on the way, `proto` included, has its own property `name`. -pub(super) fn reaches_prototype(interp: &mut Interp, o: ObjId, proto: ObjId, name: &str) -> JsResult { +fn reaches_prototype(interp: &mut Interp, o: ObjId, proto: ObjId, name: &str) -> JsResult { let k = key(name); let mut cur = Some(o); while let Some(id) = cur { diff --git a/crates/js/src/builtins_tests.rs b/crates/js/src/builtins_tests.rs index 9fefc209b..703bb9626 100644 --- a/crates/js/src/builtins_tests.rs +++ b/crates/js/src/builtins_tests.rs @@ -388,13 +388,25 @@ fn to_locale_string_writes_the_primitive_of_a_boxed_value() { // Object.prototype.toString comes after the standard prototypes on the chain. assert_eq!(string("Object.prototype.toString = function () { return 'z'; }; [1, 'x', true].toLocaleString()"), "1,x,true"); // A toString on the object or on its standard prototype is called. - assert_eq!(string("var n = Object(1); n.toString = function () { return 'own'; }; [n].toLocaleString()"), "own"); + assert_eq!(string("var b = Object(true); b.toString = function () { return 'own'; }; [b].toLocaleString()"), "own"); assert_eq!(string("Object.getPrototypeOf(true).toString = function () { return 'p'; }; [true].toLocaleString()"), "p"); - assert_eq!(string("Object.getPrototypeOf(1).toString = Object.prototype.toString; [1].toLocaleString()"), "[object Number]"); + assert_eq!(string("Object.getPrototypeOf(true).toString = Object.prototype.toString; [true].toLocaleString()"), "[object Boolean]"); // Other objects still reach Object.prototype.toString. assert_eq!(string("Object.prototype.toLocaleString.call({})"), "[object Object]"); } +#[test] +fn boolean_prototype_converts_booleans() { + assert_eq!(string("true.toString() + false.toString()"), "truefalse"); + assert_eq!(string("Object(false).toString()"), "false"); + truth("true.valueOf() === true && Object(false).valueOf() === false"); + assert_eq!(num("Object(true) + 1"), 2.0); + assert_eq!(string("'' + Object(false)"), "false"); + truth("Object.getPrototypeOf(true).valueOf() === false && Object.getPrototypeOf(true).toString() === 'false'"); + throws("Object.getPrototypeOf(true).toString.call(1)", "TypeError"); + throws("Object.getPrototypeOf(true).valueOf.call({})", "TypeError"); +} + #[test] fn array_methods_overwriting_elements_need_no_heap_for_new_ones() { // With the heap exactly at its limit, an array method's write over an existing element @@ -598,7 +610,7 @@ fn math_functions_follow_the_special_cases() { #[test] fn json_parse_reads_the_grammar_of_section_15_12_1() { assert_eq!(num("var v = JSON.parse(' {\"a\": [1, -2.5e1, true, null, \"x\\\\u0041\\\\n\"], \"b\": {}} '); v.a[1] + v.a.length"), -20.0); - assert_eq!(string("JSON.parse('\"\\\\ud800\"').charCodeAt === undefined ? 'no string methods' : ''"), "no string methods"); + assert_eq!(num("JSON.parse('\"\\\\ud800\"').charCodeAt(0)"), 55296.0); truth("JSON.parse('[]').length === 0 && JSON.parse('0') === 0 && 1 / JSON.parse('-0') === -Infinity && JSON.parse('{\"a\":1,\"a\":2}').a === 2"); for bad in ["'{a: 1}'", "'[1,]'", "'01'", "'1.'", "'.5'", "'\"\\t\"'", "\"'x'\"", "'[1] 2'", "''", "'+1'", "'\"\\\\x\"'", "'{\"a\" 1}'"] { throws(&format!("JSON.parse({bad})"), "SyntaxError"); @@ -693,6 +705,42 @@ fn json_parse_counts_a_string_while_it_reserves_the_property_for_it() { } } +#[test] +fn json_parse_keeps_its_text_counted_for_the_whole_parse() { + // The text exists only as the ToString result of the argument, and the parsed value needs a + // collection. Without the text the value fits under the limit; with it the value does not. + let setup = "var ws = new Array(8193).join(' '); var items = new Array(257).join('{},'); \ + var o = {toString: function () { return ws + '[' + items + '{}]'; }}; 0"; + let parse = "var a = JSON.parse(o); 0"; + let mut measure = small(Limits::default()); + assert_eq!(measure.run(setup), Ok(JsValue::Number(0.0))); + measure.interp().collect_garbage(); + assert_eq!(measure.run(parse), Ok(JsValue::Number(0.0))); + let full = measure.interp().heap.bytes; + let text = 2 * (8192 + 2 + 3 * 256 + 2); + let mut realm = small(Limits { heap_bytes: full - text / 2, ..Limits::default() }); + assert_eq!(realm.run(setup), Ok(JsValue::Number(0.0))); + realm.interp().collect_garbage(); + assert_eq!(limit(&mut realm, parse), LimitKind::Heap); +} + +#[test] +fn json_parse_counts_names_that_wait_for_their_values() { + // An unterminated text: every name read waits for a value that never comes, so nothing but + // the parser holds them, and the names together pass the limit before the text ends. + let setup = "var k = new Array(2049).join('k'); var text = new Array(33).join('{\"' + k + '\":'); 0"; + let mut measure = small(Limits::default()); + assert_eq!(measure.run(setup), Ok(JsValue::Number(0.0))); + let heap_bytes = measure.collect_garbage() + (96 << 10); + let mut realm = small(Limits { heap_bytes, ..Limits::default() }); + assert_eq!(realm.run(setup), Ok(JsValue::Number(0.0))); + assert_eq!(limit(&mut realm, "JSON.parse(text)"), LimitKind::Heap); + // A complete text gives its names back as it stores them, so one that fits parses. + let mut realm = small(Limits { heap_bytes: heap_bytes + (64 << 10), ..Limits::default() }); + assert_eq!(realm.run(setup), Ok(JsValue::Number(0.0))); + assert_eq!(realm.run("var a = JSON.parse('{\"' + k + '\":{\"' + k + 'x\":1}}'); 0"), Ok(JsValue::Number(0.0))); +} + #[test] fn deep_json_nesting_needs_no_native_stack() { let handle = std::thread::Builder::new() diff --git a/crates/js/tests/json2.rs b/crates/js/tests/json2.rs index c998e55a9..af408a4fe 100644 --- a/crates/js/tests/json2.rs +++ b/crates/js/tests/json2.rs @@ -6,6 +6,8 @@ //! written by the polyfill and by the built-in `JSON.stringify` (ECMA-262 5.1 section 15.12.3), //! which must give the same text, and the text is read back by the polyfill's `parse` and by the //! built-in `JSON.parse` (section 15.12.2), which must give values that write the same text again. +//! The samples leave out U+2028 and U+2029: the polyfill escapes them, and section 15.12.3 does not +//! escape them. //! //! The polyfill uses `Date`, `String.prototype.replace` and regular expression `test`. While the //! interpreter lacks any of them, the test prints that it skipped and passes. @@ -36,7 +38,7 @@ const BEFORE: &str = "var NATIVE = JSON; delete this.JSON; this.JSON = undefined const ROUND_TRIP: &str = r#" var POLY = JSON; var samples = [ - 0, -1.5, 1e21, "", "plain", "quote \" backslash \\ newline \n tab \t \u0001 
 é", + 0, -1.5, 1e21, "", "plain", "quote \" backslash \\ newline \n tab \t \u0001 é", true, false, null, [], {}, [1, [2, [3, []]]], {a: 1, b: [true, null, "x"], c: {d: {}}}, [undefined, function () {}], {skip: undefined, f: function () {}, keep: 2}, [NaN, Infinity, -Infinity] ]; From 5faa5c4d1dc4bdf9f94894343bac03f4fedc0954 Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sun, 8 Nov 2026 16:34:49 -0800 Subject: [PATCH 30/30] JavaScript: JSON.parse releases its text before the reviver runs The text is rooted and held only while the parse runs. A reviver can use the room the text took. --- crates/js/src/builtins/json.rs | 19 ++++++++++--------- crates/js/src/builtins_tests.rs | 8 ++++++++ 2 files changed, 18 insertions(+), 9 deletions(-) diff --git a/crates/js/src/builtins/json.rs b/crates/js/src/builtins/json.rs index 14c370f03..4375303fe 100644 --- a/crates/js/src/builtins/json.rs +++ b/crates/js/src/builtins/json.rs @@ -162,15 +162,16 @@ fn parse(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult