diff --git a/Cargo.lock b/Cargo.lock index 3ab71678..53c0b2c6 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1095,7 +1095,7 @@ dependencies = [ [[package]] name = "oxide_builtins" -version = "0.8.20" +version = "0.8.21" dependencies = [ "chrono", "fast-float", @@ -1120,7 +1120,7 @@ dependencies = [ [[package]] name = "oxide_bytecode" -version = "0.8.20" +version = "0.8.21" dependencies = [ "num-bigint", "oxide_log", @@ -1128,7 +1128,7 @@ dependencies = [ [[package]] name = "oxide_cfg" -version = "0.8.20" +version = "0.8.21" dependencies = [ "oxide_bytecode", "oxide_emit", @@ -1139,7 +1139,7 @@ dependencies = [ [[package]] name = "oxide_cli" -version = "0.8.20" +version = "0.8.21" dependencies = [ "ansi_term", "bumpalo", @@ -1159,7 +1159,7 @@ dependencies = [ [[package]] name = "oxide_code_cache" -version = "0.8.20" +version = "0.8.21" dependencies = [ "lru", "oxide_bytecode", @@ -1168,7 +1168,7 @@ dependencies = [ [[package]] name = "oxide_compiler" -version = "0.8.20" +version = "0.8.21" dependencies = [ "oxide_bytecode", "oxide_cfg", @@ -1187,7 +1187,7 @@ dependencies = [ [[package]] name = "oxide_dce" -version = "0.8.20" +version = "0.8.21" dependencies = [ "oxide_bytecode", "oxide_cfg", @@ -1201,7 +1201,7 @@ dependencies = [ [[package]] name = "oxide_emit" -version = "0.8.20" +version = "0.8.21" dependencies = [ "num-bigint", "oxc_allocator", @@ -1216,7 +1216,7 @@ dependencies = [ [[package]] name = "oxide_ir" -version = "0.8.20" +version = "0.8.21" dependencies = [ "oxide_bytecode", "oxide_log", @@ -1225,7 +1225,7 @@ dependencies = [ [[package]] name = "oxide_kernel" -version = "0.8.20" +version = "0.8.21" dependencies = [ "bumpalo", "dashmap", @@ -1240,7 +1240,7 @@ dependencies = [ [[package]] name = "oxide_liveness" -version = "0.8.20" +version = "0.8.21" dependencies = [ "oxide_bytecode", "oxide_cfg", @@ -1252,7 +1252,7 @@ dependencies = [ [[package]] name = "oxide_log" -version = "0.8.20" +version = "0.8.21" dependencies = [ "tracing", "tracing-appender", @@ -1261,7 +1261,7 @@ dependencies = [ [[package]] name = "oxide_parser" -version = "0.8.20" +version = "0.8.21" dependencies = [ "oxc_allocator", "oxc_ast", @@ -1276,7 +1276,7 @@ dependencies = [ [[package]] name = "oxide_regalloc" -version = "0.8.20" +version = "0.8.21" dependencies = [ "oxide_bytecode", "oxide_cfg", @@ -1292,7 +1292,7 @@ dependencies = [ [[package]] name = "oxide_runtime_api" -version = "0.8.20" +version = "0.8.21" dependencies = [ "num-bigint", "num-traits", @@ -1304,7 +1304,7 @@ dependencies = [ [[package]] name = "oxide_test262" -version = "0.8.20" +version = "0.8.21" dependencies = [ "oxide_bytecode", "oxide_compiler", @@ -1321,7 +1321,7 @@ dependencies = [ [[package]] name = "oxide_types" -version = "0.8.20" +version = "0.8.21" dependencies = [ "bumpalo", "hashbrown 0.14.5", @@ -1333,7 +1333,7 @@ dependencies = [ [[package]] name = "oxide_vm" -version = "0.8.20" +version = "0.8.21" dependencies = [ "bumpalo", "chrono", diff --git a/Cargo.toml b/Cargo.toml index 6dc272e9..dd82a3c1 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -22,7 +22,7 @@ members = [ ] [workspace.package] -version = "0.8.20" +version = "0.8.21" edition = "2021" license = "MIT" rust-version = "1.80" diff --git a/crates/oxide_emit/src/expr/assignment.rs b/crates/oxide_emit/src/expr/assignment.rs index 086502d2..6e792f71 100644 --- a/crates/oxide_emit/src/expr/assignment.rs +++ b/crates/oxide_emit/src/expr/assignment.rs @@ -99,12 +99,15 @@ impl Emitter { } let is_tier = self.is_global_tier_name(ctx, name); let is_implicit = ctx.is_implicit_global_reg(var_reg); + let is_builtin = ctx.is_builtin(name) && !ctx.is_local_shadowing_builtin(name); if is_implicit && ctx.is_strict { // 严格模式未声明复合写:未解析引用不可 put,值无关抛 ReferenceError。 return self.emit_strict_undeclared_write(name, ctx); } // RMW 前从全局对象属性取旧值:tier 名(顶层已声明 var)与未声明名同, - // 属性缺失按 undefined(GetBaseValue 语义,不抛)。 + // 属性缺失按 undefined(GetBaseValue 语义,不抛);已知 builtin 名(非局部 + // 遮蔽)读 A 侧属性,属性缺失(delete 真删后)抛 ReferenceError,与裸读 + // 同形——镜像槽不反映删除,无法自区分缺位与在位 undefined。 if is_tier || is_implicit { let key_idx = ctx.add_constant(Constant::String(name.to_string())); ctx.inst(Inst::new( @@ -113,6 +116,14 @@ impl Emitter { Operand::Const(key_idx), Operand::None, )); + } else if is_builtin { + let key_idx = ctx.add_constant(Constant::String(name.to_string())); + ctx.inst(Inst::new( + OpCode::LOAD_GLOBAL, + Operand::Reg(var_reg), + Operand::Const(key_idx), + Operand::None, + )); } ctx.inst(Inst::new(op, Operand::Reg(var_reg), Operand::Reg(rhs), Operand::None)); if is_tier { @@ -389,7 +400,10 @@ impl Emitter { } else { let var_reg = ctx.lookup_or_global(name); // 顶层已声明 var(tier)与未声明名同:旧值读前从全局对象 - // 属性取当前值,缺失按 undefined(不抛)。 + // 属性取当前值,缺失按 undefined(不抛);已知 builtin 名 + // (非局部遮蔽)读 A 侧属性,属性缺失(delete 真删后)抛 + // ReferenceError,与裸读同形——镜像槽不反映删除,无法自 + // 区分缺位与在位 undefined。 if self.is_global_tier_name(ctx, name) || ctx.is_implicit_global_reg(var_reg) { let key_idx = ctx.add_constant(Constant::String(name.to_string())); ctx.inst(Inst::new( @@ -398,6 +412,14 @@ impl Emitter { Operand::Const(key_idx), Operand::None, )); + } else if ctx.is_builtin(name) && !ctx.is_local_shadowing_builtin(name) { + let key_idx = ctx.add_constant(Constant::String(name.to_string())); + ctx.inst(Inst::new( + OpCode::LOAD_GLOBAL, + Operand::Reg(var_reg), + Operand::Const(key_idx), + Operand::None, + )); } ctx.inst(Inst::new( OpCode::LOAD_VAR, diff --git a/crates/oxide_emit/src/expr/operator/mod.rs b/crates/oxide_emit/src/expr/operator/mod.rs index 44101ce9..43528459 100644 --- a/crates/oxide_emit/src/expr/operator/mod.rs +++ b/crates/oxide_emit/src/expr/operator/mod.rs @@ -830,12 +830,16 @@ impl Emitter { } let is_tier = self.is_global_tier_name(ctx, name); let is_implicit = ctx.is_implicit_global_reg(var_reg); + let is_builtin = ctx.is_builtin(name) && !ctx.is_local_shadowing_builtin(name); if is_implicit && ctx.is_strict { // 严格模式未声明更新写:值无关抛 ReferenceError。 return self.emit_strict_undeclared_write(name, ctx); } // RMW 前从全局对象属性取旧值:tier 名(顶层已声明 var)与未声明名同, - // 属性缺失按 undefined(update 旧值角落,GetBaseValue 语义,不抛)。 + // 属性缺失按 undefined(update 旧值角落,GetBaseValue 语义,不抛); + // 已知 builtin 名(非局部遮蔽)读 A 侧属性,属性缺失(delete 真删后) + // 抛 ReferenceError,与裸读同形——镜像槽不反映删除,无法自区分缺位 + // 与在位 undefined。 if is_tier || is_implicit { let key_idx = ctx.add_constant(Constant::String(name.to_string())); ctx.inst(Inst::new( @@ -844,6 +848,14 @@ impl Emitter { Operand::Const(key_idx), Operand::None, )); + } else if is_builtin { + let key_idx = ctx.add_constant(Constant::String(name.to_string())); + ctx.inst(Inst::new( + OpCode::LOAD_GLOBAL, + Operand::Reg(var_reg), + Operand::Const(key_idx), + Operand::None, + )); } let op = match (update.operator, update.prefix) { (UpdateOperator::Increment, true) => OpCode::INC_PRE, diff --git a/crates/oxide_vm/tests/delete_builtin_assign_tests.rs b/crates/oxide_vm/tests/delete_builtin_assign_tests.rs new file mode 100644 index 00000000..e0e70e77 --- /dev/null +++ b/crates/oxide_vm/tests/delete_builtin_assign_tests.rs @@ -0,0 +1,187 @@ +//! delete 已知 builtin 名后的复合/逻辑赋值与 update 表达式 LHS 旧值读: +//! 旧值读须经 A 侧全局对象属性在位判定,缺位(delete 真删后)抛 +//! ReferenceError,与裸读同形;在位时语义不变(A 侧读 + 写回)。 +//! +//! 镜像槽无法自区分「A 侧缺位」与「A 侧在位值 undefined」(两者槽值皆 +//! undefined),delete 真删后旧值读走镜像槽会不抛且以计算值复活属性。 +//! 本面只改旧值读路由(三读点前插 LOAD_GLOBAL),写回路径零改动。 + +use std::sync::Arc; + +use oxide_compiler::compiler::Compiler; +use oxide_parser::Allocator; +use oxide_types::value::JsValue; +use oxide_vm::vm::Vm; + +fn eval_js(source: &str) -> Result<(Vm, JsValue), String> { + let allocator = Allocator::default(); + let program = oxide_parser::parse(&allocator, source).map_err(|e| format!("parse: {e:?}"))?; + let module = Arc::new(Compiler::new().compile(&program).map_err(|e| format!("compile: {e}"))?); + let mut vm = Vm::new(); + let val = vm.run(&module)?; + Ok((vm, val)) +} + +fn eval_str(source: &str) -> Result { + let (vm, val) = eval_js(source)?; + Ok(vm.lookup_str(val).unwrap_or_else(|| format!("{val:?}"))) +} + +fn eval_truthy(source: &str) { + let (_vm, val) = eval_js(source).expect("run"); + assert!(val.is_bool() && val.as_bool(), "expected true, got: {val:?}\nsource: {source}"); +} + +/// 删后 LHS 旧值读抛 ReferenceError 钉:运行期错误文本须含种类与名字。 +fn expect_re(source: &str, name: &str) { + let err = match eval_js(source) { + Err(e) => e, + Ok(_) => panic!("expected ReferenceError, got ok: {source}"), + }; + let lower = err.to_lowercase(); + assert!(lower.contains("referenceerror"), "expected ReferenceError, got: {err}\nsource: {source}"); + assert!(lower.contains(name), "expected name in message, got: {err}\nsource: {source}"); +} + +// ── 红族:删后 LHS 旧值读抛 ReferenceError(修前不抛且以计算值复活属性)── + +// 复合主形态:顶层 delete 后复合赋值旧值读。 +#[test] +fn delete_array_compound_add_reference_error() { + expect_re("delete Array; Array += 1", "array"); +} + +// 复合换算符:减。 +#[test] +fn delete_array_compound_sub_reference_error() { + expect_re("delete Array; Array -= 1", "array"); +} + +// 复合换算符:乘。 +#[test] +fn delete_array_compound_mul_reference_error() { + expect_re("delete Array; Array *= 2", "array"); +} + +// 逻辑主形态:||= 旧值读。 +#[test] +fn delete_array_logical_or_reference_error() { + expect_re("delete Array; Array ||= 2", "array"); +} + +// 逻辑短路面:&&= 旧值读(短路测试前抛)。 +#[test] +fn delete_array_logical_and_reference_error() { + expect_re("delete Array; Array &&= 2", "array"); +} + +// 逻辑空值面:??= 旧值读。 +#[test] +fn delete_array_logical_nullish_reference_error() { + expect_re("delete Array; Array ??= 2", "array"); +} + +// update 前缀主形态。 +#[test] +fn delete_array_update_prefix_increment_reference_error() { + expect_re("delete Array; Array++", "array"); +} + +// update 前缀换算符:递减。 +#[test] +fn delete_array_update_prefix_decrement_reference_error() { + expect_re("delete Array; --Array", "array"); +} + +// update 后缀面。 +#[test] +fn delete_array_update_postfix_reference_error() { + expect_re("delete Array; Array--", "array"); +} + +// 换名族:Promise 单名复合。 +#[test] +fn delete_promise_compound_reference_error() { + expect_re("delete Promise; Promise += 1", "promise"); +} + +// 帧读面:delete 在外层,嵌套函数内复合赋值旧值读缺失。 +#[test] +fn delete_array_nested_fn_compound_reference_error() { + expect_re("delete Array; (function(){Array += 1})()", "array"); +} + +// 成员复合守卫钉:成员面旧值读走对象属性(非镜像槽),零涉本面; +// 基引用 Math 裸读经 221.1 路由抛 ReferenceError,成员复合路径不改变该抛点。 +#[test] +fn delete_math_member_compound_base_read_reference_error() { + expect_re("delete Math; Math.max += 1", "math"); +} + +// with 复合回退面:with 对象无该属性时回退静态复合路径,旧值读缺失抛。 +#[test] +fn delete_array_with_compound_fallback_reference_error() { + expect_re("delete Array; with(globalThis){Array += 1}", "array"); +} + +// with update 回退面:同复合回退面,update 表达式。 +#[test] +fn delete_array_with_update_fallback_reference_error() { + expect_re("delete Array; with(globalThis){Array++}", "array"); +} + +// with 逻辑赋值无对象回退:with 体自由标识符逻辑赋值走静态路径,旧值读缺失抛。 +#[test] +fn delete_array_with_logical_fallback_reference_error() { + expect_re("delete Array; with({x: 1}){Array ||= 2}", "array"); +} + +// ── 绿族:修后须保真 ── + +// 未删在位复合:A 侧读 + 写回,语义不变。 +#[test] +fn builtin_compound_add_present_value() { + assert_eq!(eval_str("Array = 1; Array += 1; String(Array)").unwrap(), "2"); +} + +// 局部 var 零涉:非 builtin 名复合赋值。 +#[test] +fn local_var_compound_add_value() { + assert_eq!(eval_str("var x = 1; x += 1; String(x)").unwrap(), "2"); +} + +// 遮蔽守卫:局部 var Array 遮蔽 builtin 槽,复合走局部槽。 +#[test] +fn local_var_shadow_array_compound_value() { + assert_eq!(eval_str("function g(){var Array=1; Array += 1; return Array}; String(g())").unwrap(), "2",); +} + +// 只读三常量零涉:c:false 拒删保值,复合旧值读不抛。 +#[test] +fn delete_nan_compound_no_throw() { + eval_truthy("delete NaN === false && Number.isNaN(NaN += 1)"); +} + +// 删后重写再复合:A 侧在位,旧值读见新值。 +#[test] +fn delete_array_rewrite_compound_value() { + assert_eq!(eval_str("delete Array; Array = 42; Array += 1; String(Array)").unwrap(), "43"); +} + +// 成员面零涉:对象属性 delete 后成员复合不抛(GetBaseValue 缺位按 undefined)。 +#[test] +fn member_compound_after_delete_no_throw() { + eval_truthy("var obj = {p: 1}; delete obj.p; obj.p += 1; Number.isNaN(obj.p)"); +} + +// 221.1 保真:typeof 不抛。 +#[test] +fn delete_array_typeof_undefined() { + assert_eq!(eval_str("delete Array; typeof Array").unwrap(), "undefined"); +} + +// 221.1 保真:裸读抛 ReferenceError。 +#[test] +fn delete_array_bare_read_reference_error() { + expect_re("delete Array; Array", "array"); +}