Borrowed Uint8Array.prototype.set.call hits a runtime fence in WASM binding code

Cerrado
  • ¿Algo no está bien?
#1,798 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@MathurAditya724 ya está trabajando en esto.

Desde el 20/10/2026.

  • #1580 de @MathurAditya724 — abierto

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
15/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Estancado
Stack tecnológico
javascript, typescript, wasm
Área
backend, compilers

Línea de trabajo

Start with the linked pull request #1580, which proposes recognizing the borrowed typed-array call and routing it through a checked runtime helper. Review the two linked differential programs for typed and overlapping views and for checked-dynamic receivers and coercion order, then run the ordinary and sanitizer checks and the source-library feature matrix described in the issue. Done means the direct borrowed-call form matches Node's required semantics; the issue notes that broader CLI parity is outside scope.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

We are experimenting with compiling the complete Sentry CLI with scriptc, including its existing SQLite and debug-file processing dependencies, before benchmarking against the current Node SEA build. Generated WASM binding code uses a borrowed typed-array builtin to copy host bytes into linear memory; preserving that behavior is necessary to retain those dependencies.

Reproduction and expected behavior

Save as repro.mjs:

let cached = null;
function memory() {
  if (cached === null) cached = new Uint8Array(4);
  return cached;
}
function copy(target, source, offset) {
  return Uint8Array.prototype.set.call(target, source, offset);
}
console.log(copy(memory(), new Uint8Array([3, 4]), 1));
console.log(String(memory()));

Node prints:

undefined
0,3,4,0

On unpatched main at 1ee5c84, the JavaScript-hosted compiler's analyze API reports no compile diagnostics or preflight failure for this example, but records one SC1090 runtime fence at the borrowed call:

Function.prototype.call on a function whose signature cannot cross the checked-value boundary (call 'Uint8Array.prototype.set(...)' directly) is not supported yet

This distinction matters: a build can succeed while execution is refused at the fence. Both statically known and checked-dynamic receivers need a supported path that produces the same result as Node. Replacing the borrowed builtin with target.set(...) is not equivalent when the receiver has its own set override.

Required semantics

Calling the builtin through .call must not look up a receiver's own set override. It must validate the receiver before offset coercion, preserve source access order, handle overlapping typed-array views and destination element conversion, enforce bounds, and return undefined. A DataView is invalid as the receiver; a plain DataView source has no length and copies zero elements. Primitive sources and offsets must retain their JavaScript behavior.

Proposed implementation and evidence

#1580 recognizes this exact builtin call and sends it to a checked runtime helper that reuses the existing typed-array copy/conversion implementation. The helper is a separate optional runtime unit, selected consistently for packaged and source-built executables and libraries under the existing dynamic-invocation feature.

The PR includes two self-contained Node/native differential programs: typed and overlapping views and checked-dynamic receivers and coercion order. Local ordinary and sanitizer runs pass, as does the four-way source-library feature matrix. A 33-workload comparison produces byte-identical IR, LLVM, and release executables without allow patterns.

This request is scoped to the direct borrowed-call form and the existing fixed-size view representation. The complete CLI still has other compatibility blockers; these checks do not establish full CLI parity or a runtime performance improvement.

Lenguaje dominante
TypeScript
Estrellas
6.4k
Forks
204
Merge medio
7 h 44 min
PR fusionados (30 d)
879

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de vercel-labs/scriptc

Todos los issues de vercel-labs/scriptc

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.