Parents: #473, #495 Related: #480, #493
Problem
Private ZigString and BunString ingress correctly decodes external Latin-1/UTF-16/UTF-8 into a String Value, but several downstream consumers immediately expose Value.asStr() as if it were canonical WTF-8. Once flat-Latin-1 storage is enabled, that leaks the physical one-byte image into canonical property-key interning, URL and form parsing, error construction, host-function/structure names, atom interning, time-zone validation, and string property-path parsing. Equal non-ASCII inputs can then corrupt bytes, miss keys, or trip parser/debug invariants.
Confirmed boundaries include privateZigStringPropertyKey, privateBunStringPropertyKey, URLSearchParams__create, ZigString__toAtomicValue, JSGlobalObject__setTimeZone, private Error/SystemError/DOMException constructors, JSFunction__createFromZig, JSC__createStructure, and JSC__JSValue__getIfPropertyExistsFromPath. Existing serialized output views and true representation-native predicates are separate and must remain allocation-aware.
Module loading and every Promise, stack, queue, job, Worker, and Map/Set iterator surface are explicitly excluded and remain user-owned.
Scope
- Inventory every in-scope private ABI path that converts an externally decoded String Value back to semantic bytes.
- Introduce one ownership- and OOM-correct canonical WTF-8 borrow/conversion boundary.
- Route semantic byte consumers through it while preserving representation-native is8Bit and outward Latin-1 view behavior.
- Keep ASCII and canonical storage borrowed with zero conversion allocation; physical flat Latin-1 uses at most one bounded conversion per consumed value.
- Preserve exact exception publication, VM/realm ownership, atom identity, URL/form semantics, error fields, and ABI layouts/symbols.
No-workaround rules
- No global flat-storage disable, lossy UTF-8 replacement, invalid-byte acceptance, duplicate hidden copy, system transcoder, ABI fork, or input-specific special case.
- No module, stack, queue, job, Promise, Worker, or Map/Set iterator changes.
Acceptance
- Property keys, atoms, host-function names, structure names, and string property paths preserve exact non-ASCII identity across canonical and physical flat-Latin-1 layouts.
- URLSearchParams, FormData URL query, DOMURL, time-zone, Error, SystemError, AggregateError, and DOMException ingress consume exact canonical bytes.
- ASCII/canonical inputs borrow storage; physical flat Latin-1 performs one bounded conversion with exact OOM publication.
- Public/private ABI audits and fixtures, focused/full units, OOM, GC, no-GIL/TSan where shared, and relevant Test262/Web Platform controls remain exact.
- No public/private symbol, enum, or layout changes.