ReviewOS

zig-utils/zig-js

Math.sumPrecise: capture the iterator next method once

#750
Closed chris opened this 9 days ago ·
9 days ago

Parents: #475, #493 Related: #473

Problem

Math.sumPrecise obtains the iterator object once, but calls callMethod(iter, "next", ...) for every step. That re-reads the observable next property each iteration instead of retaining the [[NextMethod]] captured by GetIterator. A getter or mutation can therefore change the method mid-consumption, diverging from ECMA-262 and potentially repeating attacker-controlled lookup side effects.

Scope

  • Capture the iterator next method once before the first step.
  • Invoke that exact value with the iterator as this on every step.
  • Preserve IteratorClose precedence for a non-Number element and all existing exact-summation behavior.
  • Cover a next getter, mutation after the first step, non-callable captured methods, and abrupt completion.

No-workaround rules

  • No array-only fast path, source rewriting, repeated property lookup, swallowed primary exception, skipped IteratorClose, or coercion of non-Number elements.
  • No stack, queue, job, Promise, Worker, or Map/Set iterator implementation changes.

Acceptance

  • The next getter is observed exactly once and later mutation does not change the captured method.
  • Non-callable/throwing paths preserve the specified error and IteratorClose behavior.
  • Focused units and the complete Test262 Math.sumPrecise subtree pass with exact nonzero accounting.
  • Full integration gates pass with 0 unrelated Test262 flips.
9 days ago

Implementation progress:

  • Math.sumPrecise now captures the iterator record's [[NextMethod]] once and reuses it for every IteratorStepValue call.
  • Added regression coverage for an observable next getter, mutation of iterator.next after the first step, a non-callable captured method, and IteratorClose preserving the original TypeError when return() throws.
  • Focused unit evidence: exact regression 1/1 passed; the complete Math.sumPrecise filter 2/2 passed; zig build test262-bin passed.

The official test/built-ins/Math/sumPrecise 10-file run and wider gates are queued until an unrelated active Zig corpus/build job clears, per the repository's no-overlapping-corpus rule.

9 days ago

Landed on main as 28482211. Exact-parent Test262 evidence for test/built-ins/Math/sumPrecise: 10 pass -> 10 pass, 0 fail, 0 flips. Final focused regression: 1/1 passed, 0 leaked. Leaving this issue open until the main CI integration run completes.

9 days ago

Main integration run: CI 32804374678. It is queued; this supersedes the prior main run under the repository concurrency policy.

9 days ago

The #750-only run was superseded by the immediate #751 follow-up. Its full integration gate is now CI 32804791010, which contains both fixes.

9 days ago

Final descendant integration run containing #750, #751, and the proof-only follow-up: CI 32804870572.

9 days ago

Descendant CI 32804870572 completed 51 jobs successfully, including all unit/TSan unit shards, Test262 parallel, every TSan no-GIL corpus shard, Wasm smokes, docs, private ABI, and lifecycle fuzzing. Its sole functional failure is the separately tracked #722 mc-lock-stop-vs-park assertion; the benchmark harness was canceled only when the next direct-main #752 push superseded the run. The full-integration acceptance box therefore remains deliberately unchecked pending a descendant matrix without #722 red.

9 days ago

Full integration remains deliberately open. CI 32890815195 completed 52 required jobs successfully (including all unit, TSan, Test262, no-GIL corpus, threadfuzz, docs, Wasm, and ABI legs); the sole remaining benchmark-comparison-harness leg was automatically cancelled at the matrix's exact 60-minute limit, with no test failure reported. The causal CI-duration defect is tracked in #765. I am not treating a cancelled leg as a pass.

9 days ago

Full integration is now proven by main CI run 32923883777: all 53 required jobs passed, the sole nightly-only job was skipped as configured, and 0 jobs failed or were cancelled. This includes all unit/TSan, Test262, threading/no-GIL, fuzz, Wasm, docs, ABI, and benchmark harness gates. The implementation remains 28482211, with exact-parent Math.sumPrecise Test262 evidence 10/10 -> 10/10 and 0 flips.

Sign in to comment on this issue.