BROKEN: unified stack frames

source/cell.c

@@ -139,36 +139,57 @@ void script_startup(cell_rt *prt)
   cell_rt *crt = JS_GetContextOpaque(js);
   JS_FreeValue(js, js_blob_use(js));
 
-  JSValue globalThis = JS_GetGlobalObject(js);
+  /* Use GC refs to protect values during allocations.
+     Initialize values to JS_NULL before adding to GC list to avoid
+     scanning uninitialized memory. */
+  JSGCRef globalThis_ref, cell_ref, hidden_fn_ref;
+  globalThis_ref.val = JS_NULL;
+  cell_ref.val = JS_NULL;
+  hidden_fn_ref.val = JS_NULL;
+  JS_AddGCRef(js, &globalThis_ref);
+  JS_AddGCRef(js, &cell_ref);
+  JS_AddGCRef(js, &hidden_fn_ref);
 
-  JSValue cell = JS_NewObject(js);
-  JS_SetPropertyStr(js,globalThis,"cell", cell);
+  globalThis_ref.val = JS_GetGlobalObject(js);
+  cell_ref.val = JS_NewObject(js);
+  JS_SetPropertyStr(js, globalThis_ref.val, "cell", cell_ref.val);
 
-  JSValue hidden_fn = JS_NewObject(js);
+  hidden_fn_ref.val = JS_NewObject(js);
+  JS_SetPropertyStr(js, cell_ref.val, "hidden", hidden_fn_ref.val);
 
-  JS_SetPropertyStr(js, cell, "hidden", hidden_fn);
-  JS_SetPropertyStr(js, hidden_fn, "os", js_os_use(js));
+  /* Call functions that allocate BEFORE using their results as arguments,
+     to avoid GC invalidating already-evaluated arguments. */
+  JSGCRef tmp_ref;
+  tmp_ref.val = JS_NULL;
+  JS_AddGCRef(js, &tmp_ref);
+
+  tmp_ref.val = js_os_use(js);
+  JS_SetPropertyStr(js, hidden_fn_ref.val, "os", tmp_ref.val);
+
+  tmp_ref.val = JS_NewObject(js);
+  crt->actor_sym = tmp_ref.val;
+  tmp_ref.val = JS_DupValue(js, crt->actor_sym);
+  JS_SetPropertyStr(js, hidden_fn_ref.val, "actorsym", tmp_ref.val);
 
-  crt->actor_sym = JS_NewObject(js);
-  JS_SetPropertyStr(js, hidden_fn, "actorsym", JS_DupValue(js,crt->actor_sym));
-  
   if (crt->init_wota) {
-    JS_SetPropertyStr(js, hidden_fn, "init", wota2value(js, crt->init_wota));
+    tmp_ref.val = wota2value(js, crt->init_wota);
+    JS_SetPropertyStr(js, hidden_fn_ref.val, "init", tmp_ref.val);
     // init wota can now be freed
     free(crt->init_wota);
     crt->init_wota = NULL;
   }
 
   // Store the core path for scripts to use
-  JSValue js_cell = JS_GetPropertyStr(js, globalThis, "cell");
-  JSValue hidden = JS_GetPropertyStr(js, js_cell, "hidden");
   if (core_path) {
-    JS_SetPropertyStr(js, hidden, "core_path", JS_NewString(js, core_path));
+    tmp_ref.val = JS_NewString(js, core_path);
+    JS_SetPropertyStr(js, hidden_fn_ref.val, "core_path", tmp_ref.val);
   }
-  JS_FreeValue(js, hidden);
-  JS_FreeValue(js, js_cell);
 
-  JS_FreeValue(js, globalThis);
+  JS_DeleteGCRef(js, &tmp_ref);
+
+  JS_DeleteGCRef(js, &hidden_fn_ref);
+  JS_DeleteGCRef(js, &cell_ref);
+  JS_DeleteGCRef(js, &globalThis_ref);
 
   // Load engine.cm from the core directory
   size_t engine_size;

source/qjs_wota.c

@@ -250,11 +250,14 @@ static char *decode_wota_value(JSContext *ctx, char *data_ptr, JSValue *out_val,
       int scode;
       data_ptr = wota_read_sym(&scode, data_ptr);
       if (scode == WOTA_PRIVATE) {
-        JSValue inner = JS_NULL;
-        data_ptr = decode_wota_value(ctx, data_ptr, &inner, holder, JS_NULL, reviver);
+        JSGCRef inner_ref;
+        JS_PushGCRef(ctx, &inner_ref);
+        inner_ref.val = JS_NULL;
+        data_ptr = decode_wota_value(ctx, data_ptr, &inner_ref.val, holder, JS_NULL, reviver);
         JSValue obj = JS_NewObject(ctx);
         cell_rt *crt = JS_GetContextOpaque(ctx);
-//        JS_SetProperty(ctx, obj, crt->actor_sym, inner);
+//        JS_SetProperty(ctx, obj, crt->actor_sym, inner_ref.val);
+        JS_PopGCRef(ctx, &inner_ref);
         *out_val = obj;
       } else if (scode == WOTA_NULL) *out_val = JS_NULL;
       else if (scode == WOTA_FALSE) *out_val = JS_NewBool(ctx, 0);
@@ -279,34 +282,40 @@ static char *decode_wota_value(JSContext *ctx, char *data_ptr, JSValue *out_val,
     }
     case WOTA_ARR: {
       long long c;
+      JSGCRef arr_ref;
       data_ptr = wota_read_array(&c, data_ptr);
-      JSValue arr = JS_NewArrayLen(ctx, c);
+      JS_PushGCRef(ctx, &arr_ref);
+      arr_ref.val = JS_NewArrayLen(ctx, c);
       for (long long i = 0; i < c; i++) {
         JSValue elem_val = JS_NULL;
         JSValue idx_key = JS_NewInt32(ctx, (int32_t)i);
-        data_ptr = decode_wota_value(ctx, data_ptr, &elem_val, arr, idx_key, reviver);
-        JS_SetPropertyUint32(ctx, arr, i, elem_val);
+        data_ptr = decode_wota_value(ctx, data_ptr, &elem_val, arr_ref.val, idx_key, reviver);
+        JS_SetPropertyUint32(ctx, arr_ref.val, i, elem_val);
       }
-      *out_val = arr;
+      *out_val = JS_PopGCRef(ctx, &arr_ref);
       break;
     }
     case WOTA_REC: {
       long long c;
+      JSGCRef obj_ref;
       data_ptr = wota_read_record(&c, data_ptr);
-      JSValue obj = JS_NewObject(ctx);
+      JS_PushGCRef(ctx, &obj_ref);
+      obj_ref.val = JS_NewObject(ctx);
       for (long long i = 0; i < c; i++) {
         char *tkey = NULL;
         size_t key_len;
         data_ptr = wota_read_text_len(&key_len, &tkey, data_ptr);
         if (!tkey) continue; // invalid key
-        JSValue prop_key = JS_NewStringLen(ctx, tkey, key_len);
+        JSGCRef key_ref;
+        JS_PushGCRef(ctx, &key_ref);
+        key_ref.val = JS_NewStringLen(ctx, tkey, key_len);
         JSValue sub_val = JS_NULL;
-        data_ptr = decode_wota_value(ctx, data_ptr, &sub_val, obj, prop_key, reviver);
-        JS_SetProperty(ctx, obj, prop_key, sub_val);
-        JS_FreeValue(ctx, prop_key);
+        data_ptr = decode_wota_value(ctx, data_ptr, &sub_val, obj_ref.val, key_ref.val, reviver);
+        JS_SetProperty(ctx, obj_ref.val, key_ref.val, sub_val);
+        JS_PopGCRef(ctx, &key_ref);
         free(tkey);
       }
-      *out_val = obj;
+      *out_val = JS_PopGCRef(ctx, &obj_ref);
       break;
     }
     default: