[Jarred-Sumner]

Follow-up to #972: 194 commits, one for each fix, the fixes for crashes and wrong answers first. Each commit message has the JavaScript that broke, what plain Bun does and what compiled code did. The tests and stored programs for these come with Bun's half.

All but 52 files are under Source/JavaScriptCore/aot. Those 52 are listed at the end, by commit.

Crashes, compiler aborts and builds that were refused

• A built-in function of a native module that was replaced, redefined or deleted before its first use is refused with a TypeError that names the member, where the executable printed Bun's crash banner
• A loop that counts down over a list under an unsigned test (do { .. list[i] ..; if (i === -1) break; if (i === 0) break; i--; } while (i > end)) read in front of the list and could segfault. The clamp of loop bounds no longer takes such loops. Bun's main has it too.
• Reflect.construct() with an heir as its target gave the object the heir's field, and could segfault. Bun's main is right here.
• The compiler failed or aborted on a loop whose counter has two bounds
• The compiler aborted on a copy of a list that is kept under a second name and written in the loop that reads it
• SIGABRT "exception check validation failed" where preload modules were evicted over two layers
• A function with 14,000 live small objects was refused for its stack frame
• No pass writes outside a function's tables of values and blocks in a release build
• "ASSERTION FAILED: m_moduleEnvironment" under bun test --aot in a build with assertions
• bun test --aot over forked export * with a mocked module at the end was killed at 52 GB
• vi.spyOn(EventTarget, "prototype", "get") ended the whole test run
• "Unchecked JS exception" from spyOn() of an export behind two export *
• A hardened arm64 executable starts where a page has 64 KB
• A test that a branch narrows by stays in its loop, wherever the branch stands
• "this assignment always throws" is a build error only if every run reaches the write
• The compiler's own check stopped the build where an object without a prototype is handed to a parameter declared as a list
• Three more things ahead of a locked write make "this assignment always throws" a warning
• "Stopped while compiling" says that an earlier step may be at fault

Miscompilations: an executable at default flags gave a wrong answer without an error

• Modules that hidden code fetches by name are held, not escaped: new Function('process.getBuiltinModule("node:buffer").atob = ..') was not seen. It replaces an earlier commit of this pull request, which let the objects of all public modules escape and cost a large application 8% of its build. Bun's main is right on all the forms.
• What a copy writes onto an object of the realm escapes
• The mark of the deleted prefix is of compact tables alone. Found in review; an earlier commit of this pull request brought it.
• Lists made by one literal of constants were one cell though structuredClone() tells them apart
• A copy of a list is read, written through a second name, and read again
• A store to module.children did not drop the children that were waiting
• A built-in that has escaped and climbs the prototype chain lets out what stands above
• SSA repair no longer gathers the edges into a wide join (no program is known to show it; found in review of this pull request)
• A loader that is out of sight hands out the objects of Bun's own modules (Bun's main is right here)
• SSA repair gathers the equal edges into a wide join again, and compares them behind the renaming (it was switched off in the second push; it now compares behind the renaming, with a release assertion and a test in IR)
• Values copied onto an object of the realm escape
• $<name> in a replacement text reads any name off the groups
• The answer of a loop's first question has one reader
• No copy of a hot loop's reads for a list that may hold undefined

Errors in executables: "was left out of the executable" and its like

• The build warns of names that a copy adds to a built-in that takes no other names: Object.assign(Response.prototype, make()) works where the build can read make(), and is warned of at the build where it cannot
• JSON.stringify with a list of names did not count as reading those names
• using h = monitorEventLoopDelay() failed: "[Symbol.dispose] was not compiled into this executable"
• Accessors copied onto a built-in prototype were left out of the executable
• globalThis[holder].__defineGetter__(key, f) was refused on console, Intl, JSON, Temporal and WebAssembly
• new WebAssembly.Suspending() and new WebAssembly.Tag() without an operand gave another error
• An executable's TypeError for a name that a built-in only inherits gave false advice
• A name that a compiled module's table lacks is refused in plain's class and words
• Getters that a bundler's __export lays on an object of the realm escape

bun test --aot

• A retired realm forgets its unfinished loads: a test file that ended with an import() unsettled kept its realm for good, and a large suite was killed at 60 GB
• The table of stand-ins holds no realm: typeof Bun["s" + "ql"] in each test file kept each file's realm
• While a mock stands that left a loaded module alone, the module keeps its own namespace object
• The state of a held import is handed on, not left in a member. Found in review.
• An export of another image is kept before a mock is laid over it
• A file of the project that a mocked package's original requires gets the mock. Found in review.
• The module object that a require() made goes with the mock
• The original of a file under a mock has the names behind its stars
• The required file takes back all that the waiting mock set
• A second mock factory waits, as the first does
• The mock of a package ends with its test file
• What the loader has let go is mocked ahead of its load
• A mock of a built-in module that a test ends itself goes on for whoever was linked
• The way to a mock goes on through a table that lacks the name. Bun's main is right here.
• What lies behind a module that a mock stands for is not asked for its names
• A helper that mocks a package which the test file comes to through other files
• vi.doMock() leaves alone what a test file has loaded, through two re-exports too
• The accessors of a library module that the test runner hands out are entered
• Every image is told of a file that a plugin's onLoad() filter names
• The factory of a mock that imports the module it mocks, and fails, was called twice
• The mock of one test file reached the next
• vi.spyOn() through a barrel over a mocked module stored the spy where nobody reads it
• In the second test file that mocks a module, vi.spyOn() reached the first file's mock
• With a mocks folder, a require() as the first load of a mocked file got the real file
• The original of a file that had run before a mock was laid over it
• After a test file resets the modules, the next one finds what ran before the first test file
• The body of a linked module did not run when a helper mocked it
• Four walks over "what the loader holds" went through a mocked module to a file it hides
• A mock that lacks a name which a file of the project hands on
• spyOn(Response.prototype, "status", "get") was refused though written out in full
• A name the build left out of a compiled module is named in the error
• What the test runner hands out is held by native code
• An import that went on behind mock factories lost its referrer's order
• A test file stuck on the top-level await of a compiled module was told nothing
• Any mock of a file cost a closed program a tenth of its likeness to the executable
• Under a standing mock, a file that was linked before the mock read the mock's values
• A module that a failed graph left linked runs its body ahead of a mock
• A test file's load is noted in the layers below
• The mock of a built-in module outlived its test file
• A test that ends the mock of a built-in module itself
• Behind export *, a mock that took the original had no names
• A mock of a JSON file never ran over layers
• A mock laid over an ES module that has run adds no name to it
• vi.mock("node:fs") without a factory failed with "Circular import" in a run compiled as several programs
• Two imports that wait for one asynchronous mock factory
• spyOn(Bun.CryptoHasher.prototype, "algorithm", "get") failed in a test run compiled as two layers
• In a test run a built-in object takes a name that it only inherits
• Seven spies on a prototype are taken again
• The image lists the modules that a test may mock and that are loaded under another name
• require() of a module whose import had been mocked failed once the mock had ended
• Behind the mock of a built-in module its importers read the module again
• A mock in the middle of a chain of re-exports answers
• What a mock replaced behind the stars of its file comes back when it ends
• A require() answers the original until an asynchronous mock factory has settled

Build time, each quadratic or cubic in the size of one function or program

• Build time: two new blocks take their parameters without asking who enters them
• Build time: what a use means to a cell of the frame is asked once
• Build time: whoever asks through tests holds the tables
• Build time: what a spread copies is read once for a set of sources
• Build time: three quadratic steps in SSA repair and the greedy register allocator
• Build time: the owner of a block's parameter and the cycle of a block are looked up, not searched for
• Build time: the layouts of the receivers of a key are found once
• Build time: the tables of a loop live as long as the pass
• Build time: phi placement skips up the dominator tree
• Build time: what is copied onto a literal is asked by the set
• Build time: three quadratic steps of PlaceTypeTests and SimplifyControlFlow in one function
• Build time: a comparison walks what its arm dominates and asks the graph once
• Build time: the new objects behind a store are found by one walk
• Build time: tmps passed on the stack through a loop are priced block by block
• Build time: an assumption is found by its value
• A quadratic step in Air's releaseDeadValues
• Build time: what may change a list's length is looked for once
• Build time: the parameter of a wide join waits for its sources
• Build time: a store asks the lengths read above it, the nearest first
• Build time: what runs each turn of a loop is looked for inside the loop

Size

• The run time reaches the mocks through a table that the host answers, so that base code holds no pointer to mock code and a trimmed executable drops it
• The run time reads no overloads: 234,241 bytes of tables that only the compiler reads had come to be kept in executables

Speed of compiled code

• Two Object.create(target) sites made reads of the target's getters 20 times dearer
• A release hint kept a list out of the frame
• Deleting the oldest entry of a Map or Set stepped over every entry deleted before it
• A read of a copy of a list expects the storage of the list it was copied from
• A body asks for the room of its array methods with its own

Precision of flow analysis

• A fused method call declares what its call did
• An import awaited at once begins behind its call
• An import awaited through a cast
• A store to an object that native code holds does not enter setters hidden behind unknown twice
• Where a generic copy of a loop comes back, a test that narrows gets no other definition

Verifying builds (--aot-validate and the verifier's flags) and lowered limits; default builds do not change

• The end of a birth between the stores
• console.log(fs.statSync(".")) stopped a validating build
• Closures made behind an allocation
• The verifier stopped a build on a type test hoisted in front of a loop
• The verifier stopped a build on a union member whose tag no member can hold any more
• f.apply(x, arguments), inlined, with an unknown callee: the list guards the reads of its own elements
• A call that Select loses stops the build
• --aot-validate: a claim inside the value's own type asks nothing
• --aot-validate: what was there before an object was made is not that object
• A verifying build goes on after a verification fails
• "TypeOutOfDate" says which way
• The check of moved loads prints and goes on
• A verifying, layered test run stopped with "InvalidType: type 915 is not canonical"
• An input of the verifier that nobody read is gone
• The row of a run-time function holds what its operation declares
• Nine rows of the table of run-time functions say what their bodies write
• The compiler aborted in ExpandIteration under a lowered limit
• One visitor names every member of ExpandIteration's arm state
• The verifier refuses a store that may create a field below an accessor
• Five counts of the front end become rows of the table of limits

Planted faults, counters, logs and tests

• A planted fault for what stores behind former entry checks hold
• The state of a mock, computed and counted at the doors
• --explain=statistics counts the method calls that are not fused
• Two IR tests of the counter need Bun's table and move to Bun's tree
• Four planted faults and a statistic for three passes that decide things at the top of a file
• Two planted faults for Map and Set lookups
• Two planted faults with their counters
• The bounds put on tallies get a planted fault and a counter
• A planted fault for literals of constants
• One IR test's hand-written Check made its generic version ill-typed
• valueflow-solve every-order also applies flow's results under every order
• The phase log says what an image's tables are made of
• The objects that native code makes by itself go into both dumps of the table of built-ins
• The warning for require inside node:vm is back, narrowed
• Frames of a constant text given to eval or new Function ignored its //# sourceURL=
• The list of planted faults in compile-call.def is laid out anew
• Two planted faults and a counter for two rules of flow analysis
• A planted fault and two counters for lists that a loop leaves alone
• A counter for the walks over a Map or Set that begin behind the deleted entries
• A comment says why a wide join begins at 16 edges
• Three planted faults for what lies in a frame
• The enums of compile-call.def are generated as five Rust modules
• The image that runs is called so
• The schema's generator no longer refuses a long file
• A planted fault for the copy of a hot loop's reads

What a run without compiled code no longer enters

• Three calls into the compiler's run time that a run without compiled code made ask first
• Six more calls into the compiler's run time that a run without compiled code made ask first
• Five more calls into the compiler's run time that a run without compiled code made ask first

The second of them reaches into three folders that this pull request had not touched, bytecode/RepatchInlines.h, llint/LLIntSlowPaths.cpp and interpreter/StackVisitor.cpp, and into runtime/JSObjectInlines.h (two places), which nearly every file includes: +7 -5 in all, every line inside #if ENABLE(AOT).

The run time

• The run time stops a program that changes a compiled object in a way the compiler concluded never happens

B3

• PromoteLoopMemory resets the owners of values, and two checks of assertion builds ask the right thing
• continuesAfterMovedLoadReports for reportsOfMovedLoadsComeBack
• Two graphs take their arguments eagerly

Several images in one realm

• Each image's "is asking the host" is put back to its own
• Every image is asked before any is told of a copy from disk

Doors for Bun

• A door for Bun to say whether a program's texts are held, the engine's half
• A door for the original of a mocked package, the engine's half

Reverted and switched off

• Revert "A JSON.stringify in a run without compiled code no longer watches levels", a commit of this pull request. With it, in a run without compiled code, JSON.stringify of an object that holds itself, with an indent, took about 0.65 s a call, as in Bun 1.4.3; main finds the cycle early (300 calls in 0.1 s). Every answer was right. runtime/JSONObject.cpp is as on main again.
• Switch off the clamp of loop bounds. A later commit of this pull request ("don't clamp the bound of a loop that counts down under an unsigned test") has the cause and switches it on again.

Soundness of flow analysis

• A receiver that leaves may be any object

Builds with assertions or the exception-scope validator

• "ASSERTION FAILED: moduleData.isESModuleOfProgram()" at mock.module() over a CommonJS file that has run. An earlier commit of this pull request brought it; release builds answer the same with and without.
• In a build with assertions a value's number says which renumbering handed it out
• The road of an asynchronous mock factory checks its exceptions
• The run-time counters ask whether a VM still has instances
• Three more places look at the exception first

Names

• Idiomatic names in the B3 files that the JIT shares

Outside aot/

• runtime/CyclicModuleRecord.cpp, +7, and runtime/AbstractModuleRecord.h, +1 ("the factory of a mock that imports the module it mocks, and fails, was called twice"): seven lines inside #if ENABLE(AOT) on the path of an evaluation that threw. They begin with vm.hasCompiledCode() and act only on an AOT::ModuleRecord. The header gets an inline clearTopLevelCapability(), which only that block calls.
• runtime/AbstractModuleRecord.cpp, +13 -3 ("vi.spyOn() through a barrel over a mocked module stored the spy where nobody reads it"): two hunks inside #if ENABLE(AOT), each acting only where dynamicDowncast<AOT::ModuleRecord> answers, which is null for every ordinary record. The first also closes the USE(BUN_JSC_ADDITIONS) block one line earlier; what a build without the compiler compiles is the same text.
• runtime/CyclicModuleRecord.cpp, +8 ("a name the build left out of a compiled module is named in the error"): two hunks inside #if ENABLE(AOT) on the "export not found" path. Both ask globalObject->aotInstance() first, an inline read, so a run without compiled code enters neither.
• runtime/JSModuleRecord.cpp, +5 (""ASSERTION FAILED: m_moduleEnvironment" under bun test --aot in a build with assertions"): an include, and four lines inside #if ENABLE(AOT) that begin with vm.hasCompiledCode(). An import that resolves to a compiled record has no module environment: the block that fills import slots for a shared executable leaves it out.
• runtime/JSOrderedHashTable.h, +6, inside #if ENABLE(AOT) ("Deleting the oldest entry of a Map or Set stepped over every entry deleted before it"): a uint32_t m_deletedPrefix { 0 } in the class behind every Map and Set, and its offset. It lies in what the object's size class leaves unused: sizeof stays 32, by a static_assert. Every Bun stores a 0 there at construction; nothing outside the compiler reads it.
• runtime/ObjectConstructor.cpp +1 -1, runtime/CallData.cpp +3 -1 and runtime/CloneSerializerBase.h +2 -1 ("Three calls into the compiler's run time that a run without compiled code made ask first"): each puts hasCompiledCode() in front of something that stood inside #if ENABLE(AOT) and that a plain run therefore did. No answer of a plain run changes.
• runtime/JSModuleLoader.cpp +7 -6 ("Each image's "is asking the host" is put back to its own"): fetchSynchronously() calls fetch() in one of two arms. The arm inside if (vm.hasCompiledCode()) raises and restores the flags round it; the other is the one call that stood there.
• runtime/JSMicrotask.cpp +3 -2, runtime/JSObject.cpp +2 -2, runtime/RegExpConstructor.cpp +2 -1, runtime/RegExpGlobalData.cpp +2 -1 ("Six more calls into the compiler's run time that a run without compiled code made ask first"): each line stood inside #if ENABLE(AOT) and now asks vm.hasCompiledCode() first.
• bytecode/RepatchInlines.h +2 -1, llint/LLIntSlowPaths.cpp +2 -1, interpreter/StackVisitor.cpp +1 -1, runtime/JSObjectInlines.h +2 -2 ("Five more calls into the compiler's run time that a run without compiled code made ask first"): the same. The first two took a process-wide lock at every "x is not a function".

Shared with the JIT

35 files under b3 and b3/air, in ten commits. B3 and Air are shared with the JIT, so this code also runs in a Bun that has no compiled code. Four of the six remove steps that are quadratic in the size of one function. One renames identifiers and rewords comments that earlier AOT commits added. One adds a boolean, false by default, to a checking mode.

What was run on them: the machine code generated for our corpus of programs was compared function by function before and after each of the four, and is identical. testb3 passes whole in a release build (219,096 cases). testair (807 cases) passes under ASAN with assertions. JSC's stress tests give the same results with and without them.

• "a quadratic step in Air's releaseDeadValues": b3/air/AirReleaseDeadValues.cpp +4 -0.
• "build time: three quadratic steps in SSA repair and the greedy register allocator": b3/air/AirAllocateRegistersByGreedy.cpp +51 -13.
• "build time: phi placement skips up the dominator tree": b3/B3CompilationReport.h +2 -1, b3/B3FixSSA.cpp +164 -14, b3/testb3_bun_thread_jumps.cpp +243 -0.
• "idiomatic names in the B3 files that the JIT shares": 27 files, names and comments alone: b3/B3CompilationReport.h, b3/B3LikelyPaths.cpp, b3/B3LikelyPaths.h, b3/B3LoopInvariance.cpp, b3/B3LoopRangeChecks.cpp, b3/B3LowerToAir.cpp, b3/B3MemoryNumbering.cpp, b3/B3Policy.cpp, b3/B3Policy.h, b3/B3PromoteLoopMemory.cpp, b3/B3PromoteLoopMemory.h, b3/B3ReduceStrength.cpp, b3/B3UnrollLoops.cpp, b3/B3VectorizeLoops.cpp, b3/air/AirAllocateRegistersByGreedy.cpp, b3/air/AirAllocateStackByGraphColoring.cpp, b3/air/AirFoldTrapsIntoAccesses.cpp, b3/air/AirOptimizeBlockOrder.cpp, b3/air/AirOptimizePairedLoadStore.cpp, b3/air/AirReleaseDeadValues.cpp, b3/air/AirShrinkWrapFrame.cpp; and 6 test files.
• "build time: tmps passed on the stack through a loop are priced block by block": b3/B3CompilationReport.h +2 -1, b3/air/AirAllocateRegistersByGreedy.cpp +73 -41, b3/air/testair_bun_allocation.h +79 -0.
• "the check of moved loads prints and goes on": b3/B3MovedLoadCheck.cpp +13 -4, b3/B3Policy.h +1 -0.
• "PromoteLoopMemory resets the owners of values, and two checks of assertion builds ask the right thing": b3/B3PromoteLoopMemory.cpp +1, b3/B3SwitchValue.cpp +1 -1 (inside an ASSERT), b3/testb3_bun_promote_loop_memory.cpp +17, b3/testb3_bun_vectorize_loops.cpp +9 -4. promoteLoopMemory runs only under the compiler's policy; the JIT's pipeline never runs it.
• "continuesAfterMovedLoadReports for reportsOfMovedLoadsComeBack": b3/B3Policy.h +1 -1, b3/B3MovedLoadCheck.cpp +6 -6. A rename.
• "testb3: two graphs take their arguments eagerly": b3/testb3_bun_placement.cpp +1 -1, b3/testb3_bun_selection.cpp +1 -1.
• "switch off the clamp of loop bounds": b3/testb3_bun_policy.cpp +2 -1, b3/testb3_bun_random.cpp +2, b3/testb3_bun_random_program.h +1. Tests alone: the random policy leaves the clamp off as the ahead-of-time compiler's does, and two seeds become regression cases.
• "don't clamp the bound of a loop that counts down under an unsigned test": b3/B3LoopRangeChecks.cpp +2, b3/testb3_bun_loop_plans.cpp +175; b3/testb3_bun_policy.cpp and b3/testb3_bun_random_program.h go back to what they were. The two lines stand behind canClampBound, which only the ahead-of-time compiler's policy sets, so the JIT does not reach them. The test builds 576 kinds of counted loop and runs each from starts and bounds at the extremes against a model: 48 fail without the two lines.
• The last commit of the second push takes out every comment line that this pull request had added under b3, b3/air and runtime: 50 lines in 13 files. No line of code changes.

What was checked

• It compiles and links in Bun's build graph on Linux x64, with the matching Bun sources.
• Every source of testaot compiles by itself, without the precompiled prefix that Bun's graph gives it, as this repository's CMake compiles it. The two that do not (saturatingSum in AOTResolveAccesses.cpp, Options in AOTValueFlowAnalysis.cpp) did not on AOT: crashes and miscompilations found since #971, Map/Set index slots, a bounds test on split() #972 either, and get both names from the prefix header that CMake force-includes.
• All 89 unified sources compile with -mms-bitfields, so the size assertions hold under MSVC's layout of bit-fields; a control with one assertion tightened fails.
• No added line uses a name that a Windows header defines as a macro.
• testaot passes whole on a native Linux arm64 build (8,880 tests).
• Not built at home for macOS, Windows, musl, FreeBSD or Android.