BROKEN: unified stack frames

source/cell.c

@@ -139,36 +139,57 @@ void script_startup(cell_rt *prt)
   cell_rt *crt = JS_GetContextOpaque(js);
   JS_FreeValue(js, js_blob_use(js));
 
-  JSValue globalThis = JS_GetGlobalObject(js);
+  /* Use GC refs to protect values during allocations.
+     Initialize values to JS_NULL before adding to GC list to avoid
+     scanning uninitialized memory. */
+  JSGCRef globalThis_ref, cell_ref, hidden_fn_ref;
+  globalThis_ref.val = JS_NULL;
+  cell_ref.val = JS_NULL;
+  hidden_fn_ref.val = JS_NULL;
+  JS_AddGCRef(js, &globalThis_ref);
+  JS_AddGCRef(js, &cell_ref);
+  JS_AddGCRef(js, &hidden_fn_ref);
 
-  JSValue cell = JS_NewObject(js);
-  JS_SetPropertyStr(js,globalThis,"cell", cell);
+  globalThis_ref.val = JS_GetGlobalObject(js);
+  cell_ref.val = JS_NewObject(js);
+  JS_SetPropertyStr(js, globalThis_ref.val, "cell", cell_ref.val);
 
-  JSValue hidden_fn = JS_NewObject(js);
+  hidden_fn_ref.val = JS_NewObject(js);
+  JS_SetPropertyStr(js, cell_ref.val, "hidden", hidden_fn_ref.val);
 
-  JS_SetPropertyStr(js, cell, "hidden", hidden_fn);
-  JS_SetPropertyStr(js, hidden_fn, "os", js_os_use(js));
+  /* Call functions that allocate BEFORE using their results as arguments,
+     to avoid GC invalidating already-evaluated arguments. */
+  JSGCRef tmp_ref;
+  tmp_ref.val = JS_NULL;
+  JS_AddGCRef(js, &tmp_ref);
+
+  tmp_ref.val = js_os_use(js);
+  JS_SetPropertyStr(js, hidden_fn_ref.val, "os", tmp_ref.val);
+
+  tmp_ref.val = JS_NewObject(js);
+  crt->actor_sym = tmp_ref.val;
+  tmp_ref.val = JS_DupValue(js, crt->actor_sym);
+  JS_SetPropertyStr(js, hidden_fn_ref.val, "actorsym", tmp_ref.val);
 
-  crt->actor_sym = JS_NewObject(js);
-  JS_SetPropertyStr(js, hidden_fn, "actorsym", JS_DupValue(js,crt->actor_sym));
-  
   if (crt->init_wota) {
-    JS_SetPropertyStr(js, hidden_fn, "init", wota2value(js, crt->init_wota));
+    tmp_ref.val = wota2value(js, crt->init_wota);
+    JS_SetPropertyStr(js, hidden_fn_ref.val, "init", tmp_ref.val);
     // init wota can now be freed
     free(crt->init_wota);
     crt->init_wota = NULL;
   }
 
   // Store the core path for scripts to use
-  JSValue js_cell = JS_GetPropertyStr(js, globalThis, "cell");
-  JSValue hidden = JS_GetPropertyStr(js, js_cell, "hidden");
   if (core_path) {
-    JS_SetPropertyStr(js, hidden, "core_path", JS_NewString(js, core_path));
+    tmp_ref.val = JS_NewString(js, core_path);
+    JS_SetPropertyStr(js, hidden_fn_ref.val, "core_path", tmp_ref.val);
   }
-  JS_FreeValue(js, hidden);
-  JS_FreeValue(js, js_cell);
 
-  JS_FreeValue(js, globalThis);
+  JS_DeleteGCRef(js, &tmp_ref);
+
+  JS_DeleteGCRef(js, &hidden_fn_ref);
+  JS_DeleteGCRef(js, &cell_ref);
+  JS_DeleteGCRef(js, &globalThis_ref);
 
   // Load engine.cm from the core directory
   size_t engine_size;

source/qjs_wota.c

@@ -250,11 +250,14 @@ static char *decode_wota_value(JSContext *ctx, char *data_ptr, JSValue *out_val,
       int scode;
       data_ptr = wota_read_sym(&scode, data_ptr);
       if (scode == WOTA_PRIVATE) {
-        JSValue inner = JS_NULL;
-        data_ptr = decode_wota_value(ctx, data_ptr, &inner, holder, JS_NULL, reviver);
+        JSGCRef inner_ref;
+        JS_PushGCRef(ctx, &inner_ref);
+        inner_ref.val = JS_NULL;
+        data_ptr = decode_wota_value(ctx, data_ptr, &inner_ref.val, holder, JS_NULL, reviver);
         JSValue obj = JS_NewObject(ctx);
         cell_rt *crt = JS_GetContextOpaque(ctx);
-//        JS_SetProperty(ctx, obj, crt->actor_sym, inner);
+//        JS_SetProperty(ctx, obj, crt->actor_sym, inner_ref.val);
+        JS_PopGCRef(ctx, &inner_ref);
         *out_val = obj;
       } else if (scode == WOTA_NULL) *out_val = JS_NULL;
       else if (scode == WOTA_FALSE) *out_val = JS_NewBool(ctx, 0);
@@ -279,34 +282,40 @@ static char *decode_wota_value(JSContext *ctx, char *data_ptr, JSValue *out_val,
     }
     case WOTA_ARR: {
       long long c;
+      JSGCRef arr_ref;
       data_ptr = wota_read_array(&c, data_ptr);
-      JSValue arr = JS_NewArrayLen(ctx, c);
+      JS_PushGCRef(ctx, &arr_ref);
+      arr_ref.val = JS_NewArrayLen(ctx, c);
       for (long long i = 0; i < c; i++) {
         JSValue elem_val = JS_NULL;
         JSValue idx_key = JS_NewInt32(ctx, (int32_t)i);
-        data_ptr = decode_wota_value(ctx, data_ptr, &elem_val, arr, idx_key, reviver);
-        JS_SetPropertyUint32(ctx, arr, i, elem_val);
+        data_ptr = decode_wota_value(ctx, data_ptr, &elem_val, arr_ref.val, idx_key, reviver);
+        JS_SetPropertyUint32(ctx, arr_ref.val, i, elem_val);
       }
-      *out_val = arr;
+      *out_val = JS_PopGCRef(ctx, &arr_ref);
       break;
     }
     case WOTA_REC: {
       long long c;
+      JSGCRef obj_ref;
       data_ptr = wota_read_record(&c, data_ptr);
-      JSValue obj = JS_NewObject(ctx);
+      JS_PushGCRef(ctx, &obj_ref);
+      obj_ref.val = JS_NewObject(ctx);
       for (long long i = 0; i < c; i++) {
         char *tkey = NULL;
         size_t key_len;
         data_ptr = wota_read_text_len(&key_len, &tkey, data_ptr);
         if (!tkey) continue; // invalid key
-        JSValue prop_key = JS_NewStringLen(ctx, tkey, key_len);
+        JSGCRef key_ref;
+        JS_PushGCRef(ctx, &key_ref);
+        key_ref.val = JS_NewStringLen(ctx, tkey, key_len);
         JSValue sub_val = JS_NULL;
-        data_ptr = decode_wota_value(ctx, data_ptr, &sub_val, obj, prop_key, reviver);
-        JS_SetProperty(ctx, obj, prop_key, sub_val);
-        JS_FreeValue(ctx, prop_key);
+        data_ptr = decode_wota_value(ctx, data_ptr, &sub_val, obj_ref.val, key_ref.val, reviver);
+        JS_SetProperty(ctx, obj_ref.val, key_ref.val, sub_val);
+        JS_PopGCRef(ctx, &key_ref);
         free(tkey);
       }
-      *out_val = obj;
+      *out_val = JS_PopGCRef(ctx, &obj_ref);
       break;
     }
     default:

source/quickjs.h

@@ -176,6 +176,8 @@ void JS_DeleteGCRef(JSContext *ctx, JSGCRef *ref);
    Value Extraction
    ============================================================ */
 
+#define JS_VALUE_GET_INT(v) ((int)(v) >> 1)
+
 /* Get primary tag (low 2-3 bits) */
 static inline int
 JS_VALUE_GET_TAG (JSValue v) {
@@ -809,14 +811,7 @@ typedef enum JSCFunctionEnum {
   JS_CFUNC_1, /* JSValue f(ctx, this_val, arg0) */
   JS_CFUNC_2, /* JSValue f(ctx, this_val, arg0, arg1) */
   JS_CFUNC_3, /* JSValue f(ctx, this_val, arg0, arg1, arg2) */
-  JS_CFUNC_4,
-  /* Pure functions (no this_val) - for global utility functions */
-  JS_CFUNC_PURE,    /* JSValue f(ctx, argc, argv) - generic pure */
-  JS_CFUNC_PURE_0,  /* JSValue f(ctx) */
-  JS_CFUNC_PURE_1,  /* JSValue f(ctx, arg0) */
-  JS_CFUNC_PURE_2,  /* JSValue f(ctx, arg0, arg1) */
-  JS_CFUNC_PURE_3,  /* JSValue f(ctx, arg0, arg1, arg2) */
-  JS_CFUNC_PURE_4   /* JSValue f(ctx, arg0, arg1, arg2, arg3) */
+  JS_CFUNC_4
 } JSCFunctionEnum;
 
 /* Fixed-arity C function types for fast paths */
@@ -832,16 +827,6 @@ typedef JSValue JSCFunction4 (JSContext *ctx, JSValue this_val,
                               JSValue arg0, JSValue arg1,
                               JSValue arg2, JSValue arg3);
 
-/* Pure function types (no this_val) */
-typedef JSValue JSCFunctionPure (JSContext *ctx, int argc, JSValue *argv);
-typedef JSValue JSCFunctionPure0 (JSContext *ctx);
-typedef JSValue JSCFunctionPure1 (JSContext *ctx, JSValue arg0);
-typedef JSValue JSCFunctionPure2 (JSContext *ctx, JSValue arg0, JSValue arg1);
-typedef JSValue JSCFunctionPure3 (JSContext *ctx, JSValue arg0, JSValue arg1,
-                                   JSValue arg2);
-typedef JSValue JSCFunctionPure4 (JSContext *ctx, JSValue arg0, JSValue arg1,
-                                   JSValue arg2, JSValue arg3);
-
 typedef union JSCFunctionType {
   JSCFunction *generic;
   JSValue (*generic_magic) (JSContext *ctx, JSValue this_val, int argc,
@@ -854,13 +839,6 @@ typedef union JSCFunctionType {
   JSCFunction2 *f2;
   JSCFunction3 *f3;
   JSCFunction4 *f4;
-  /* Pure function pointers */
-  JSCFunctionPure *pure;
-  JSCFunctionPure0 *pure0;
-  JSCFunctionPure1 *pure1;
-  JSCFunctionPure2 *pure2;
-  JSCFunctionPure3 *pure3;
-  JSCFunctionPure4 *pure4;
 } JSCFunctionType;
 
 JSValue JS_NewCFunction2 (JSContext *ctx, JSCFunction *func, const char *name,
@@ -977,43 +955,6 @@ typedef struct JSCFunctionListEntry {
       .u                                                                      \
       = {.func = { 3, JS_CFUNC_3, { .f3 = func1 } } }                         \
   }
-/* Pure function (no this_val) macros */
-#define JS_CFUNC_PURE_DEF(name, length, func1)                                \
-  {                                                                           \
-    name, 0, JS_DEF_CFUNC, 0,                                                 \
-      .u                                                                      \
-      = {.func = { length, JS_CFUNC_PURE, { .pure = func1 } } }               \
-  }
-#define JS_CFUNC_PURE0_DEF(name, func1)                                       \
-  {                                                                           \
-    name, 0, JS_DEF_CFUNC, 0,                                                 \
-      .u                                                                      \
-      = {.func = { 0, JS_CFUNC_PURE_0, { .pure0 = func1 } } }                 \
-  }
-#define JS_CFUNC_PURE1_DEF(name, func1)                                       \
-  {                                                                           \
-    name, 0, JS_DEF_CFUNC, 0,                                                 \
-      .u                                                                      \
-      = {.func = { 1, JS_CFUNC_PURE_1, { .pure1 = func1 } } }                 \
-  }
-#define JS_CFUNC_PURE2_DEF(name, func1)                                       \
-  {                                                                           \
-    name, 0, JS_DEF_CFUNC, 0,                                                 \
-      .u                                                                      \
-      = {.func = { 2, JS_CFUNC_PURE_2, { .pure2 = func1 } } }                 \
-  }
-#define JS_CFUNC_PURE3_DEF(name, func1)                                       \
-  {                                                                           \
-    name, 0, JS_DEF_CFUNC, 0,                                                 \
-      .u                                                                      \
-      = {.func = { 3, JS_CFUNC_PURE_3, { .pure3 = func1 } } }                 \
-  }
-#define JS_CFUNC_PURE4_DEF(name, func1)                                       \
-  {                                                                           \
-    name, 0, JS_DEF_CFUNC, 0,                                                 \
-      .u                                                                      \
-      = {.func = { 4, JS_CFUNC_PURE_4, { .pure4 = func1 } } }                 \
-  }
 #define JS_ITERATOR_NEXT_DEF(name, length, func1, magic)                      \
   {                                                                           \
     name, 0, JS_DEF_CFUNC, magic, .u = {                                      \