diff --git a/Cargo.lock b/Cargo.lock index e38aa372..f5144ff3 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1160,7 +1160,7 @@ dependencies = [ [[package]] name = "oxide_builtins" -version = "0.8.89" +version = "0.8.90" dependencies = [ "chrono", "fast-float", @@ -1185,7 +1185,7 @@ dependencies = [ [[package]] name = "oxide_bytecode" -version = "0.8.89" +version = "0.8.90" dependencies = [ "num-bigint", "oxide_log", @@ -1193,7 +1193,7 @@ dependencies = [ [[package]] name = "oxide_cfg" -version = "0.8.89" +version = "0.8.90" dependencies = [ "oxide_bytecode", "oxide_emit", @@ -1204,7 +1204,7 @@ dependencies = [ [[package]] name = "oxide_cli" -version = "0.8.89" +version = "0.8.90" dependencies = [ "ansi_term", "bumpalo", @@ -1226,7 +1226,7 @@ dependencies = [ [[package]] name = "oxide_code_cache" -version = "0.8.89" +version = "0.8.90" dependencies = [ "lru", "oxide_bytecode", @@ -1235,7 +1235,7 @@ dependencies = [ [[package]] name = "oxide_compiler" -version = "0.8.89" +version = "0.8.90" dependencies = [ "oxide_bytecode", "oxide_cfg", @@ -1255,7 +1255,7 @@ dependencies = [ [[package]] name = "oxide_dce" -version = "0.8.89" +version = "0.8.90" dependencies = [ "oxide_bytecode", "oxide_cfg", @@ -1269,7 +1269,7 @@ dependencies = [ [[package]] name = "oxide_emit" -version = "0.8.89" +version = "0.8.90" dependencies = [ "num-bigint", "oxc_allocator", @@ -1284,7 +1284,7 @@ dependencies = [ [[package]] name = "oxide_engine" -version = "0.8.89" +version = "0.8.90" dependencies = [ "oxide_bytecode", "oxide_compiler", @@ -1296,7 +1296,7 @@ dependencies = [ [[package]] name = "oxide_ir" -version = "0.8.89" +version = "0.8.90" dependencies = [ "oxide_bytecode", "oxide_log", @@ -1305,7 +1305,7 @@ dependencies = [ [[package]] name = "oxide_kernel" -version = "0.8.89" +version = "0.8.90" dependencies = [ "bumpalo", "dashmap", @@ -1319,7 +1319,7 @@ dependencies = [ [[package]] name = "oxide_liveness" -version = "0.8.89" +version = "0.8.90" dependencies = [ "oxide_bytecode", "oxide_cfg", @@ -1331,7 +1331,7 @@ dependencies = [ [[package]] name = "oxide_log" -version = "0.8.89" +version = "0.8.90" dependencies = [ "tracing", "tracing-appender", @@ -1340,7 +1340,7 @@ dependencies = [ [[package]] name = "oxide_parser" -version = "0.8.89" +version = "0.8.90" dependencies = [ "oxc_allocator", "oxc_ast", @@ -1355,7 +1355,7 @@ dependencies = [ [[package]] name = "oxide_regalloc" -version = "0.8.89" +version = "0.8.90" dependencies = [ "oxide_bytecode", "oxide_cfg", @@ -1371,7 +1371,7 @@ dependencies = [ [[package]] name = "oxide_runtime_api" -version = "0.8.89" +version = "0.8.90" dependencies = [ "num-bigint", "num-traits", @@ -1384,7 +1384,7 @@ dependencies = [ [[package]] name = "oxide_test262" -version = "0.8.89" +version = "0.8.90" dependencies = [ "oxide_bytecode", "oxide_compiler", @@ -1402,7 +1402,7 @@ dependencies = [ [[package]] name = "oxide_types" -version = "0.8.89" +version = "0.8.90" dependencies = [ "bumpalo", "dashmap", @@ -1415,7 +1415,7 @@ dependencies = [ [[package]] name = "oxide_vm" -version = "0.8.89" +version = "0.8.90" dependencies = [ "bumpalo", "chrono", diff --git a/Cargo.toml b/Cargo.toml index 3f12c30c..f60538c5 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -23,7 +23,7 @@ members = [ ] [workspace.package] -version = "0.8.89" +version = "0.8.90" edition = "2021" license = "MIT" rust-version = "1.80" diff --git a/crates/oxide_builtins/src/broadcast_channel.rs b/crates/oxide_builtins/src/broadcast_channel.rs index 99bd9685..93972403 100644 --- a/crates/oxide_builtins/src/broadcast_channel.rs +++ b/crates/oxide_builtins/src/broadcast_channel.rs @@ -1,23 +1,27 @@ -//! BroadcastChannel 载荷盒：mpsc 发送/接收对与通道名存于对象 `native_fn` 槽， -//! 向 GC 家族表暴露 size/drop 两自由函数。 +//! BroadcastChannel 行为面：`new BroadcastChannel(name)` 构造器（建通道对象并 +//! 登记 per-realm 注册表）、`postMessage` 原型方法（向同名全部其他通道同步 +//! 广播交付）、`close`（注销并关闭）、`onmessage` 普通 own 属性与 `name` / +//! `readyState` 原型 getter。 //! -//! 载荷盒无对象边（mpsc 非 GC 边、通道名为 Rust `String`），家族表 `ops_for` -//! 臂三边函数全 `None`，mark 链不消费本模块。 +//! 通道载荷盒（mpsc 对与通道名）存于对象 `native_fn` 槽，向 GC 家族表暴露 +//! size/drop 两自由函数。 +use std::collections::HashSet; use std::mem; use oxide_kernel::message_queue; -use oxide_types::object::JsObject; +use oxide_kernel::shape_forge::EMPTY_SHAPE_ID; +use oxide_runtime_api::{to_string_full, NativeResult, ProtoKind, VmHost}; +use oxide_types::object::{JsObject, NativeFnPtr, PropAttributes}; +use oxide_types::value::JsValue; -use crate::message_value::MessageValue; +use crate::message_value::{detach_message, rehydrate_message, MessageValue}; /// BroadcastChannel 载荷盒：存于对象 `native_fn` 槽（`Box::into_raw`，realm /// 局部单线程）。`name` 是通道名（Rust `String`，注册表键），`tx` 是本通道的 /// mpsc 发送端（`Send`），`rx` 是配对的 mpsc 接收端（`!Send`，realm 局部）， /// `closed` 是关闭标志。`tx` 与 `rx` 是 `channel()` 配对，`tx.send(v)` 写入本 /// 通道 `rx`。 -/// -#[expect(dead_code)] // 字段由构造器与方法消费，载荷盒当前仅建盒与释放 struct BroadcastChannelInner { name: String, tx: message_queue::Sender, @@ -65,6 +69,257 @@ pub fn drop_broadcast_channel_native(obj: &mut JsObject) -> u64 { bytes } +/// BroadcastChannel 构造器：建通道对象（载荷盒 + onmessage own 属性）并登记 +/// per-realm 注册表，返回通道对象。 +/// +/// # 步骤 +/// 1. 非构造形态（`!constructing_native`）抛 TypeError（HTML 规范只有 +/// [[Construct]]，无 [[Call]]） +/// 2. `name` 实参经 `to_string_full` 强转 Rust `String`（DOMString 语义：非 +/// 字符串经 ToPrimitive(string hint)，Symbol 抛 TypeError，不静默降级） +/// 3. 建 mpsc 通道（载荷类型 `MessageValue`），建通道对象（proto = +/// %BroadcastChannel.prototype%，载荷盒入 native_fn 槽） +/// 4. define onmessage 数据属性 = null（非枚举） +/// 5. 登记通道对象进 per-realm 注册表（弱引用） +/// +/// # 副作用 +/// - 通道对象经 `alloc_object` 入对象表即成 GC 根； +/// - 注册表条目为弱引用，不保活通道（GC sweep 剪枝）。 +/// +/// # 注意事项 +/// - 通道固定挂 %BroadcastChannel.prototype%，不读 new.target； +/// - 构造器不占 BuiltinWorld P 字段（绑定层就地填充占位）。 +pub fn broadcast_channel_constructor(vm: &mut H, args: &[u8]) -> NativeResult { + if !vm.constructing_native() { + return NativeResult::Err(crate::error::create_type_error(vm, "BroadcastChannel constructor requires new")); + } + + let name_val = if args.len() > 1 { vm.reg(args[1]) } else { JsValue::undefined() }; + let name = match to_string_full(name_val, vm) { + Ok(s) => s, + Err(e) => { + if let Some(exc) = vm.take_uncaught_value() { + return NativeResult::Err(exc); + } + return NativeResult::Err(crate::error::create_type_error(vm, &e)); + } + }; + + let (tx, rx) = message_queue::channel::(); + let proto_val = JsValue::from_js_object(vm.builtin_proto(ProtoKind::BroadcastChannelProto)); + let mut obj = JsObject::new_empty(EMPTY_SHAPE_ID, proto_val); + obj.type_tag = JsObject::OBJ_TYPE_BROADCAST_CHANNEL; + let inner = Box::into_raw(Box::new(BroadcastChannelInner { name, tx, rx, closed: false })); + // SAFETY: 通道对象不可调用，native_fn 存不透明 `Box` 指针， + // 与 ArrayBuffer / RegExp 的类型化存储模式一致。 + obj.set_native_fn(Some(unsafe { NativeFnPtr::from_raw(inner as *const ()) })); + let ptr = vm.alloc_object(obj); + + // onmessage：普通 own 数据属性（非枚举），初值 null。 + let si_onmessage = vm.perm_intern("onmessage"); + // SAFETY: ptr 是本函数刚 alloc_object 的通道对象，存活且本段无别名。 + unsafe { + let channel_obj = &mut *ptr; + let _ = + vm.define_data_property(channel_obj, si_onmessage, JsValue::null(), PropAttributes::new(true, false, true)); + } + + // 登记 per-realm 注册表（弱引用，不保活通道）。 + // SAFETY: 盒内 name 字段本函数所有，借用短命、不跨 JS 调用。 + let name_str = unsafe { &(*inner).name }; + vm.bc_register(name_str, ptr); + + NativeResult::Ok(JsValue::from_js_object(ptr)) +} + +/// BroadcastChannel.postMessage(message)：detach 消息、向同名全部其他通道 +/// 同步广播交付。 +/// +/// # 步骤 +/// 1. this 须为 BroadcastChannel，closed 则 TypeError +/// 2. `detach_message` 产 `MessageValue`（空 transfer 集，ArrayBuffer 一律克隆； +/// 失败原值透传） +/// 3. 发送阶段（无用户调用、无 GC）：查注册表全部同名通道（排除自身），逐条 +/// 入队对端 mpsc +/// 4. 交付阶段（用户调用、可触发 GC）：逐通道排空队列并触发其 onmessage； +/// 每个 drain 前重新校验存活（GC sweep 已剪枝死通道） +/// +/// # 边界与前提 +/// - 源对象由调用方寄存器保活； +/// - 不广播给自己（`peer_ptr == this_ptr` 跳过）； +/// - 同步重入：handler 内再 postMessage 同通道则嵌套广播（try_recv 非阻塞，无死锁）。 +pub fn broadcast_channel_post_message(vm: &mut H, args: &[u8]) -> NativeResult { + let this_val = vm.reg(args[0]); + if !this_val.is_object() { + return NativeResult::Err(crate::error::create_type_error(vm, "postMessage called on a non-object")); + } + let this_ptr = this_val.as_js_object_ptr(); + // SAFETY: is_object 保证非空指针；对象在 native 执行期间被根保持、不被回收。 + let this_obj = unsafe { &*this_ptr }; + let Some(inner_ptr) = broadcast_channel_payload_ptr(this_obj) else { + return NativeResult::Err(crate::error::create_type_error(vm, "postMessage called on a non-BroadcastChannel")); + }; + // SAFETY: inner_ptr 经 broadcast_channel_payload_ptr 校验为存活载荷盒；标量读取 + // 短命，不跨 JS 调用。 + if unsafe { (*inner_ptr).closed } { + return NativeResult::Err(crate::error::create_type_error(vm, "channel is closed")); + } + + let message = if args.len() > 1 { vm.reg(args[1]) } else { JsValue::undefined() }; + let empty_transfer = HashSet::new(); + let mv = match detach_message(vm, message, &empty_transfer) { + Ok(m) => m, + Err(e) => return NativeResult::Err(e), + }; + + // SAFETY: 同 inner_ptr 校验；盒内 name 字段本函数所有，借用短命、不跨 JS 调用。 + let name = unsafe { &(*inner_ptr).name }; + + // 发送阶段：无用户调用、无 GC，peers 指针全部有效。 + let peers = vm.bc_lookup(name); + for peer_ptr in &peers { + if *peer_ptr == this_ptr { + continue; + } + // SAFETY: peer_ptr 来自注册表登记，native 执行期间有效。 + let peer_obj = unsafe { &**peer_ptr }; + let Some(peer_inner) = broadcast_channel_payload_ptr(peer_obj) else { + continue; + }; + // SAFETY: 对端 rx 由对端载荷盒保活，对端存活则接收端存活，SendError 理论 + // 不达（防御性报 TypeError）。 + if unsafe { (*peer_inner).tx.send(mv.clone()) }.is_err() { + return NativeResult::Err(crate::error::create_type_error(vm, "peer channel is gone")); + } + } + + // 交付阶段：用户调用、可触发 GC；每个 drain 前重新校验存活（GC sweep 已 + // 剪枝死通道），校验通过即该通道在最后一次 sweep 被标记存活、对象仍分配。 + for peer_ptr in &peers { + if *peer_ptr == this_ptr { + continue; + } + if !vm.bc_lookup(name).contains(peer_ptr) { + continue; + } + if let Err(e) = drain_channel(vm, name, *peer_ptr) { + return NativeResult::Err(e); + } + } + NativeResult::Ok(JsValue::undefined()) +} + +/// 排空一个通道的队列：逐条 rehydrate 并触发其 onmessage。 +/// +/// # 步骤 +/// 1. 读通道载荷盒（通道必存活——调用前已校验），盒缺失防御性返回 Ok +/// 2. try_recv 循环：Empty / Disconnected 退出；`rehydrate_message` 得 data； +/// `ordinary_get` 读 handler（读期用户代码窗口，异常原值透传）；读后二次 +/// 校验存活（getter 窗口 GC 防护）；handler 是函数则 +/// `call_function_sync(handler, channel, [data])`（用户异常原值透传，返回 +/// Err 结束 drain）；handler 非函数（null / undefined / 非函数）则静默丢弃该条 +/// +/// # 边界与前提 +/// - rehydrate 新对象经 `alloc_object` 入对象表即成根，交付后无引用自然回收； +/// - 同步重入：handler 内再 postMessage 同通道则嵌套 drain（try_recv 非阻塞，无死锁）。 +fn drain_channel(vm: &mut H, name: &str, channel: *mut JsObject) -> Result<(), JsValue> { + // SAFETY: channel 是有效通道对象（调用前已校验存活）。 + let channel_obj = unsafe { &*channel }; + let Some(inner_ptr) = broadcast_channel_payload_ptr(channel_obj) else { + return Ok(()); + }; + let channel_val = JsValue::from_js_object(channel); + let si_onmessage = vm.perm_intern("onmessage"); + // SAFETY: inner_ptr 是有效载荷盒，rx 的 try_recv 非阻塞、不跨 JS 调用。 + while let Ok(mv) = unsafe { (*inner_ptr).rx.try_recv() } { + let data = rehydrate_message(vm, &mv); + let handler = match vm.ordinary_get(channel_obj, si_onmessage, channel_val) { + Ok(h) => h, + Err(e) => { + if let Some(exc) = vm.take_uncaught_value() { + return Err(exc); + } + return Err(crate::error::create_type_error(vm, &e)); + } + }; + // getter 窗口二次校验：onmessage 读取是用户代码窗口，期间 GC 可释放本 + // 通道并剪枝注册表条目；校验失败即停止 drain（data 是根，无悬垂）。 + if !vm.bc_lookup(name).contains(&channel) { + return Ok(()); + } + if !crate::iterator::is_callable(handler) { + continue; + } + if let Err(e) = vm.call_function_sync(handler, channel_val, &[data]) { + if let Some(exc) = vm.take_uncaught_value() { + return Err(exc); + } + return Err(crate::iterator::engine_error(vm, &e)); + } + } + Ok(()) +} + +/// BroadcastChannel.close()：置 closed 标志并从 per-realm 注册表注销 +/// （幂等，重复关闭 no-op）。 +/// +/// # 边界 +/// - this 须为 BroadcastChannel； +/// - 不拆 tx/rx 环（两端口自然共亡）。 +pub fn broadcast_channel_close(vm: &mut H, args: &[u8]) -> NativeResult { + let this_val = vm.reg(args[0]); + if !this_val.is_object() { + return NativeResult::Err(crate::error::create_type_error(vm, "close called on a non-object")); + } + let this_ptr = this_val.as_js_object_ptr(); + // SAFETY: is_object 保证非空指针；对象在 native 执行期间被根保持、不被回收。 + let this_obj = unsafe { &*this_ptr }; + let Some(inner_ptr) = broadcast_channel_payload_ptr(this_obj) else { + return NativeResult::Err(crate::error::create_type_error(vm, "close called on a non-BroadcastChannel")); + }; + // SAFETY: inner_ptr 是有效载荷盒，标志写短命、不跨 JS 调用。 + unsafe { (*inner_ptr).closed = true }; + // 注册表注销（幂等，重复关闭不报错）。 + // SAFETY: 盒内 name 字段本函数所有，借用短命、不跨 JS 调用。 + let name = unsafe { &(*inner_ptr).name }; + vm.bc_unregister(name, this_ptr); + NativeResult::Ok(JsValue::undefined()) +} + +/// BroadcastChannel.name：读通道名字段返 JS 字符串。 +pub fn broadcast_channel_name(vm: &mut H, args: &[u8]) -> NativeResult { + let this_val = vm.reg(args[0]); + if !this_val.is_object() { + return NativeResult::Err(crate::error::create_type_error(vm, "name called on a non-object")); + } + let this_ptr = this_val.as_js_object_ptr(); + // SAFETY: is_object 保证非空指针；对象在 native 执行期间被根保持、不被回收。 + let this_obj = unsafe { &*this_ptr }; + let Some(inner_ptr) = broadcast_channel_payload_ptr(this_obj) else { + return NativeResult::Err(crate::error::create_type_error(vm, "name called on a non-BroadcastChannel")); + }; + // SAFETY: inner_ptr 是有效载荷盒，name 字段读短命、不跨 JS 调用。 + let name = unsafe { (*inner_ptr).name.clone() }; + NativeResult::Ok(vm.new_string_owned(name)) +} + +/// BroadcastChannel.readyState：读 closed 标志返 "open" / "closed"。 +pub fn broadcast_channel_ready_state(vm: &mut H, args: &[u8]) -> NativeResult { + let this_val = vm.reg(args[0]); + if !this_val.is_object() { + return NativeResult::Err(crate::error::create_type_error(vm, "readyState called on a non-object")); + } + let this_ptr = this_val.as_js_object_ptr(); + // SAFETY: is_object 保证非空指针；对象在 native 执行期间被根保持、不被回收。 + let this_obj = unsafe { &*this_ptr }; + let Some(inner_ptr) = broadcast_channel_payload_ptr(this_obj) else { + return NativeResult::Err(crate::error::create_type_error(vm, "readyState called on a non-BroadcastChannel")); + }; + // SAFETY: inner_ptr 是有效载荷盒，标志读短命、不跨 JS 调用。 + let closed = unsafe { (*inner_ptr).closed }; + NativeResult::Ok(vm.new_string(if closed { "closed" } else { "open" })) +} + #[cfg(test)] mod tests { use super::*; @@ -127,4 +382,394 @@ mod tests { // SAFETY: 测试构造的盒，恰好释放一次。 unsafe { drop(Box::from_raw(payload_ptr)) }; } + + // ---- 端到端行为面（经 Vm 跑脚本，验证构造器与方法绑定）---- + + use oxide_vm::vm::Vm; + + /// 编译并执行单脚本，返回 VM 与完成值。 + fn eval(source: &str) -> Result<(Vm, JsValue), String> { + let allocator = oxide_parser::Allocator::default(); + let program = oxide_parser::parse(&allocator, source).map_err(|e| format!("parse: {:?}", e))?; + let module = oxide_compiler::compiler::Compiler::new() + .compile(&program) + .map_err(|e| format!("compile: {e}"))?; + let mut vm = Vm::new(); + let result = vm.run(&std::sync::Arc::new(module))?; + Ok((vm, result)) + } + + /// 跑一段返回布尔的断言脚本，断言为真。 + fn assert_script(source: &str) { + let (_vm, result) = eval(source).unwrap(); + assert!(result.as_bool(), "script failed: {source}"); + } + + #[test] + fn constructor_shape_and_identity() { + assert_script( + r#" + (function() { + var ch = new BroadcastChannel("test"); + return ( + typeof ch === 'object' && + BroadcastChannel.length === 1 && + BroadcastChannel.name === 'BroadcastChannel' && + ch.name === 'test' && + Object.getPrototypeOf(ch).constructor === BroadcastChannel + ); + })() + "#, + ); + } + + #[test] + fn channel_type_tag_is_broadcast_channel() { + let (_vm, result) = eval("new BroadcastChannel('test')").unwrap(); + assert!(result.is_object()); + // SAFETY: result 是脚本返回的通道对象，测试期间存活。 + let obj = unsafe { &*result.as_js_object_ptr() }; + assert_eq!(obj.type_tag, JsObject::OBJ_TYPE_BROADCAST_CHANNEL); + } + + #[test] + fn channel_onmessage_is_own_non_enumerable() { + assert_script( + r#" + (function() { + var ch = new BroadcastChannel("test"); + var desc = Object.getOwnPropertyDescriptor(ch, 'onmessage'); + return ( + desc !== undefined && + desc.value === null && + desc.writable === true && + desc.enumerable === false && + desc.configurable === true + ); + })() + "#, + ); + } + + #[test] + fn basic_broadcast_and_no_self_delivery() { + // ch2 收到同构对象，ch1 自身不收到（发送方不投递自己）。 + assert_script( + r#" + (function() { + var ch1 = new BroadcastChannel("basic"); + var ch2 = new BroadcastChannel("basic"); + var received2 = null; + var received1 = null; + ch1.onmessage = function(d) { received1 = d; }; + ch2.onmessage = function(d) { received2 = d; }; + ch1.postMessage({a: 1}); + return received2 !== null && received2.a === 1 && received1 === null; + })() + "#, + ); + } + + #[test] + fn roundtrip_all_cloneable_types() { + assert_script( + r#" + (function() { + var ch1 = new BroadcastChannel("roundtrip"); + var ch2 = new BroadcastChannel("roundtrip"); + var got = null; + ch2.onmessage = function(d) { got = d; }; + ch1.postMessage({ + num: 42, + neg: -1.5, + big: 10n, + str: 'hello', + bool: true, + nil: null, + undef: undefined, + arr: [1, 2, 3], + obj: {x: 1, y: 'z'}, + map: new Map([['k', 1]]), + set: new Set([1, 2]), + date: new Date(1700000000000), + re: /ab+c/g, + err: new Error('boom'), + ab: new ArrayBuffer(4) + }); + if (got.num !== 42 || got.neg !== -1.5 || got.big !== 10n) return false; + if (got.str !== 'hello' || got.bool !== true || got.nil !== null) return false; + if (!('undef' in got) || got.undef !== undefined) return false; + if (got.arr.length !== 3 || got.arr[1] !== 2) return false; + if (got.obj.x !== 1 || got.obj.y !== 'z') return false; + if (got.map.get('k') !== 1) return false; + if (got.set.size !== 2 || !got.set.has(2)) return false; + if (got.date.getTime() !== 1700000000000) return false; + if (got.re.source !== 'ab+c' || got.re.flags !== 'g') return false; + if (got.err.name !== 'Error' || got.err.message !== 'boom') return false; + if (got.ab.byteLength !== 4) return false; + return true; + })() + "#, + ); + } + + #[test] + fn clone_path_keeps_source_alive() { + // 未列入 transfer 的 ArrayBuffer 走克隆路径：源不 detach。 + assert_script( + r#" + (function() { + var ch1 = new BroadcastChannel("clone"); + var ch2 = new BroadcastChannel("clone"); + var ab = new ArrayBuffer(4); + var received = null; + ch2.onmessage = function(d) { received = d; }; + ch1.postMessage(ab); + return ab.byteLength === 4 && received.byteLength === 4 && received !== ab; + })() + "#, + ); + } + + #[test] + fn data_clone_error_on_function() { + assert_script( + r#" + (function() { + var ch1 = new BroadcastChannel("clone"); + var ch2 = new BroadcastChannel("clone"); + try { + ch1.postMessage(function(){}); + return false; + } catch (e) { + return e.name === 'DataCloneError'; + } + })() + "#, + ); + } + + #[test] + fn data_clone_error_on_circular() { + assert_script( + r#" + (function() { + var ch1 = new BroadcastChannel("clone"); + var ch2 = new BroadcastChannel("clone"); + var a = {}; + a.self = a; + try { + ch1.postMessage(a); + return false; + } catch (e) { + return e.name === 'DataCloneError'; + } + })() + "#, + ); + } + + #[test] + fn data_clone_error_on_shared_array_buffer() { + assert_script( + r#" + (function() { + var ch1 = new BroadcastChannel("clone"); + var ch2 = new BroadcastChannel("clone"); + try { + ch1.postMessage(new SharedArrayBuffer(8)); + return false; + } catch (e) { + return e.name === 'DataCloneError'; + } + })() + "#, + ); + } + + #[test] + fn close_semantics() { + assert_script( + r#" + (function() { + var ch1 = new BroadcastChannel("close"); + var ch2 = new BroadcastChannel("close"); + if (ch1.readyState !== 'open') return false; + ch1.close(); + if (ch1.readyState !== 'closed') return false; + // 重复关闭幂等 no-op。 + ch1.close(); + try { + ch1.postMessage(1); + return false; + } catch (e) { + if (e.name !== 'TypeError') return false; + } + // close 后 ch1 不再收到广播（ch2.postMessage 不触发 ch1.onmessage）。 + var received = false; + ch1.onmessage = function(d) { received = true; }; + ch2.postMessage(1); + return received === false; + })() + "#, + ); + } + + #[test] + fn no_handler_silently_drops() { + // 未设 handler 时 postMessage 不抛错、不派发。 + assert_script( + r#" + (function() { + var ch1 = new BroadcastChannel("nohandler"); + var ch2 = new BroadcastChannel("nohandler"); + ch1.postMessage({a: 1}); + ch1.postMessage('x'); + return ch1.readyState === 'open' && ch2.readyState === 'open'; + })() + "#, + ); + } + + #[test] + fn multi_channel_broadcast() { + // 三通道同名，ch1.postMessage 触发 ch2 与 ch3 的 onmessage（不触发 ch1）。 + assert_script( + r#" + (function() { + var ch1 = new BroadcastChannel("multi"); + var ch2 = new BroadcastChannel("multi"); + var ch3 = new BroadcastChannel("multi"); + var r1 = null; + var r2 = null; + var r3 = null; + ch1.onmessage = function(d) { r1 = d; }; + ch2.onmessage = function(d) { r2 = d; }; + ch3.onmessage = function(d) { r3 = d; }; + ch1.postMessage({a: 1}); + return r2 !== null && r2.a === 1 && r3 !== null && r3.a === 1 && r1 === null; + })() + "#, + ); + } + + #[test] + fn different_name_isolation() { + // 异名通道互不广播。 + assert_script( + r#" + (function() { + var ch1 = new BroadcastChannel("a"); + var ch2 = new BroadcastChannel("b"); + var received = false; + ch2.onmessage = function(d) { received = true; }; + ch1.postMessage(1); + return received === false; + })() + "#, + ); + } + + #[test] + fn gc_prunes_dead_channel_from_registry() { + // ch2 释放引用（IIFE 局部）加 $262.gc() 强制收集，断言 ch2 被回收 + // （注册表剪枝生效）；ch1 仍存活（用户持有引用）；再 postMessage 不抛错 + // （注册表已无 ch2，广播到空集）。 + assert_script( + r#" + (function() { + var ch1 = new BroadcastChannel("gc"); + var received = false; + (function() { + var ch2 = new BroadcastChannel("gc"); + ch2.onmessage = function(d) { received = true; }; + })(); + $262.gc(); + ch1.postMessage(2); + return received === false; + })() + "#, + ); + } + + #[test] + fn reentry_nested_broadcast_no_deadlock() { + // handler 内再 postMessage 同通道，嵌套广播不死锁（try_recv 非阻塞）。 + assert_script( + r#" + (function() { + var ch1 = new BroadcastChannel("reentry"); + var ch2 = new BroadcastChannel("reentry"); + var nested = false; + ch2.onmessage = function(d) { + ch2.postMessage("nested"); + nested = true; + }; + ch1.postMessage(1); + return nested === true; + })() + "#, + ); + } + + #[test] + fn non_construct_form_type_error() { + assert_script( + r#" + (function() { + try { + BroadcastChannel("x"); + return false; + } catch (e) { + return e.name === 'TypeError'; + } + })() + "#, + ); + } + + #[test] + fn name_coercion_domstring() { + // DOMString 强转：非字符串经 ToPrimitive(string hint)，不静默降级。 + assert_script( + r#" + (function() { + var ch = new BroadcastChannel(123); + if (ch.name !== '123') return false; + var ch2 = new BroadcastChannel(); + return ch2.name === 'undefined'; + })() + "#, + ); + } + + #[test] + fn non_channel_receiver_type_error() { + // 对非对象 this 直调 native 入口抛 TypeError。 + let (mut vm, _result) = eval("new BroadcastChannel('x')").unwrap(); + vm.set_reg(0, JsValue::int(1)); + vm.set_reg(1, JsValue::int(42)); + let args = [0u8, 1]; + match broadcast_channel_post_message(&mut vm, &args) { + NativeResult::Err(e) => { + assert!(e.is_object()); + } + _ => panic!("expected TypeError"), + } + } + + #[test] + fn non_channel_object_type_error() { + // 对象但非 BroadcastChannel（plain 对象）调 postMessage 抛 TypeError。 + let (mut vm, plain) = eval("({})").unwrap(); + vm.set_reg(0, plain); + vm.set_reg(1, JsValue::int(42)); + let args = [0u8, 1]; + match broadcast_channel_post_message(&mut vm, &args) { + NativeResult::Err(e) => { + assert!(e.is_object()); + } + _ => panic!("expected TypeError"), + } + } } diff --git a/crates/oxide_vm/src/bindings/bind_broadcast_channel.rs b/crates/oxide_vm/src/bindings/bind_broadcast_channel.rs new file mode 100644 index 00000000..8a892256 --- /dev/null +++ b/crates/oxide_vm/src/bindings/bind_broadcast_channel.rs @@ -0,0 +1,137 @@ +use std::sync::Arc; + +use crate::bind_constructor; +use crate::bindings::{apply_binding_table, bind_accessor_getter, configure_native_constructor}; +use oxide_kernel::kernel::{KernelCore, KernelSession}; +use oxide_types::object::{JsObject, PropAttributes}; +use oxide_types::value::JsValue; + +/// 把 BroadcastChannel 构造器与原型方法绑定到 global。 +/// +/// 935.2.1 的两枚 P 字段（`broadcast_channel_constructor` / +/// `broadcast_channel_proto`）是空对象占位，本函数就地填充（不新建对象—— +/// P 字段本身就是槽位，快照/脏检查/收尾枚举已覆盖）。 +/// +/// # 幂等 +/// 本函数从三条路径到达：`init_kernel_builtins`（占位是空对象）、`rebind_dirty_ +/// builtins` 的 `broadcast_channel` 分支（占位是重建后的空对象）、global-dirty +/// 路径（占位可能已填满）。全部槽写经 `lookup_position` 前置守卫，有槽即跳过； +/// `bind_constructor!` 的全局槽臂自带既有槽原位更新，天然幂等。 +/// +/// `realm_id` 未使用（BroadcastChannel 无 well-known 符号键），保留签名与其他 +/// 绑定函数一致。 +pub fn bind_broadcast_channel(core: &Arc, session: &KernelSession, global: &mut JsObject, _realm_id: u32) { + let world = session.builtin_world(); + let ctor_ptr = world.broadcast_channel_constructor.as_ptr() as *mut JsObject; + let ctor = unsafe { &mut *ctor_ptr }; + let proto_ptr = world.broadcast_channel_proto.as_ptr() as *mut JsObject; + let proto = unsafe { &mut *proto_ptr }; + + let sf = core.perm_interner().as_ref(); + let sh = core.shape_forge().as_ref(); + + // ---- 填构造器占位 ---- + ctor.set_function(true); + + // prototype 槽 → 原型对象（描述符 {f,f,f}）。 + let si_prototype = sf.intern("prototype").0; + if sh.lookup_position(ctor.shape_id(), si_prototype).is_none() { + let shape = sh.make_shape(ctor.shape_id(), si_prototype); + ctor.set_shape_id(shape); + let pos = ctor.push_prop(JsValue::from_js_object(proto_ptr)); + ctor.set_data_meta(pos, PropAttributes::new(false, false, false)); + ctor.bump_generation(); + } + + // name 槽 → "BroadcastChannel"（描述符 {f,f,t}）。 + let si_name = sf.intern("name").0; + if sh.lookup_position(ctor.shape_id(), si_name).is_none() { + let shape = sh.make_shape(ctor.shape_id(), si_name); + ctor.set_shape_id(shape); + ctor.ensure_hash_props() + .push(JsValue::perm_string(sf.string_ptr(sf.intern("BroadcastChannel").0))); + let pos = ctor.hash_props_vec().map_or(0, |v| v.len() as u32).saturating_sub(1); + ctor.set_data_meta(pos, PropAttributes::new(false, false, true)); + ctor.bump_generation(); + } + + // [[Prototype]] → Function.prototype（幂等，裸写槽）。 + let fn_proto_val = JsValue::from_js_object(world.function_proto.as_ptr() as *mut JsObject); + let _ = ctor.set_proto(fn_proto_val); + + configure_native_constructor( + ctor, + oxide_builtins::broadcast_channel::broadcast_channel_constructor:: as *const (), + 1, + ); + bind_constructor!( + core, + global, + "BroadcastChannel", + ctor_ptr, + oxide_builtins::broadcast_channel::broadcast_channel_constructor::, + 1, + hash: true + ); + + // ---- 填原型占位 ---- + // constructor 槽 → 构造器对象（描述符 {t,f,t}）。 + let si_constructor = sf.intern("constructor").0; + if sh.lookup_position(proto.shape_id(), si_constructor).is_none() { + let shape = sh.make_shape(proto.shape_id(), si_constructor); + proto.set_shape_id(shape); + let pos = proto.push_prop(JsValue::from_js_object(ctor_ptr)); + proto.set_data_meta(pos, PropAttributes::new(true, false, true)); + proto.bump_generation(); + } + + // [[Prototype]] → Object.prototype（幂等，裸写槽）。 + let object_proto_val = JsValue::from_js_object(world.object_proto.as_ptr() as *mut JsObject); + let _ = proto.set_proto(object_proto_val); + + // 原型方法：postMessage / close（每方法先 lookup_position 守卫）。 + let si_post_message = sf.intern("postMessage").0; + if sh.lookup_position(proto.shape_id(), si_post_message).is_none() { + apply_binding_table( + world, + proto, + core, + &[ + ( + "postMessage", + oxide_builtins::broadcast_channel::broadcast_channel_post_message:: as *const (), + 1, + ), + ( + "close", + oxide_builtins::broadcast_channel::broadcast_channel_close:: as *const (), + 0, + ), + ], + ); + } + + // name 原型访问器（set 恒 undefined），lookup_position 守卫。 + let si_name_proto = sf.intern("name").0; + if sh.lookup_position(proto.shape_id(), si_name_proto).is_none() { + bind_accessor_getter( + core, + session, + proto, + "name", + oxide_builtins::broadcast_channel::broadcast_channel_name:: as *const (), + ); + } + + // readyState 原型访问器（set 恒 undefined），lookup_position 守卫。 + let si_ready_state = sf.intern("readyState").0; + if sh.lookup_position(proto.shape_id(), si_ready_state).is_none() { + bind_accessor_getter( + core, + session, + proto, + "readyState", + oxide_builtins::broadcast_channel::broadcast_channel_ready_state:: as *const (), + ); + } +} diff --git a/crates/oxide_vm/src/bindings/mod.rs b/crates/oxide_vm/src/bindings/mod.rs index 1c769613..89dc3096 100644 --- a/crates/oxide_vm/src/bindings/mod.rs +++ b/crates/oxide_vm/src/bindings/mod.rs @@ -14,6 +14,8 @@ pub mod bind_atomics; pub mod bind_bigint; /// Boolean 构造器与原型的 native 方法绑定。 pub mod bind_boolean; +/// BroadcastChannel 构造器与原型方法的 native 绑定（就地填充占位）。 +pub mod bind_broadcast_channel; /// Console 单例对象及其方法绑定。 pub mod bind_console; /// DataView 构造器与原型的 native 方法绑定。 @@ -1057,6 +1059,11 @@ pub fn bind_global_builtin_slots( oxide_builtins::message_channel::message_channel_constructor:: as *const (), 0, ); + configure_existing_ctor( + &world.broadcast_channel_constructor, + oxide_builtins::broadcast_channel::broadcast_channel_constructor:: as *const (), + 1, + ); for (name, value) in [ ("Object", JsValue::from_js_object(world.object_constructor.as_ptr() as *mut JsObject)), @@ -1084,6 +1091,10 @@ pub fn bind_global_builtin_slots( "MessageChannel", JsValue::from_js_object(world.message_channel_constructor.as_ptr() as *mut JsObject), ), + ( + "BroadcastChannel", + JsValue::from_js_object(world.broadcast_channel_constructor.as_ptr() as *mut JsObject), + ), ("Math", JsValue::from_js_object(world.math_object.as_ptr() as *mut JsObject)), ("JSON", JsValue::from_js_object(world.json_object.as_ptr() as *mut JsObject)), ("Temporal", JsValue::from_js_object(world.temporal_object.as_ptr() as *mut JsObject)), @@ -1326,6 +1337,9 @@ pub fn rebind_dirty_builtins( if dirty.map_or(true, |d| d.message_channel) { bind_message_channel::bind_message_channel(core, session, global, realm_id); } + if dirty.map_or(true, |d| d.broadcast_channel) { + bind_broadcast_channel::bind_broadcast_channel(core, session, global, realm_id); + } if dirty.map_or(true, |d| d.console) { bind_console::bind_console(core, session, global); } diff --git a/crates/oxide_vm/src/session_gc.rs b/crates/oxide_vm/src/session_gc.rs index d329a910..398196b5 100644 --- a/crates/oxide_vm/src/session_gc.rs +++ b/crates/oxide_vm/src/session_gc.rs @@ -676,6 +676,24 @@ impl SessionGc { } } + // 注册表剪枝：按 mark 位移除死通道对象（此刻全部对象仍分配、位域可读， + // 与弱键定夺同时序）。死通道对象在随后的分流循环被释放，注册表已先移除 + // 其条目，无悬垂；空列表删键。 + for channels in vm.realm.gc.borrow_mut().broadcast_channels.values_mut() { + channels.retain(|&ptr| { + if ptr.is_null() { + return false; + } + // SAFETY: ptr 来自 session 对象表登记，sweep 运行期间有效。 + unsafe { (*ptr).is_gc_marked() } + }); + } + vm.realm + .gc + .borrow_mut() + .broadcast_channels + .retain(|_, channels| !channels.is_empty()); + // 按 mark 位分流：存活保留清位，死对象释放本体、堆区与 upvalue 出表。 let mut dead = 0u64; let mut freed_bytes = 0u64;