Conversation
internal_get, internal_has_property and internal_get_or_missing walked the [[Prototype]] chain via tail self-calls, each link consuming a real Rust host frame. Object.create chains past ~19k links (GET) / ~14k (in) aborted the release process with a stack-overflow SIGABRT where pinned QuickJS returns normally (undefined / false), because its JS_GetPropertyInternal / JS_HasProperty walk prototypes in a C for loop with no depth limit (verified normal at n=1,000,000). internal_set had the same tail self-call on its slow path (reached when a Proxy or typed array lies below the chain tip, disabling the ordinary-set fast path): assigning through such a chain also aborted at depth. Convert all four walks to loops. For internal_set the fast-path verdict for the tip holds for every prototype suffix, so it is evaluated once rather than rescanned per hop (the old recursive shape was O(n^2) when reachable). The original receiver is threaded across hops so an inherited accessor get/set is still invoked with the chain tip as this; the Proxy boundary (trap re-entry per hop), typed-array numeric index handling, and Throw propagation are unchanged. instanceof was already iterative and remains so; deeply nested Proxy chains still throw the same catchable InternalError as pinned. Adds nine unit tests (long-chain missing/data/accessor GET, in, instanceof, SET slow path, receiver identity, throw propagation, proxy trap). Co-Authored-By: Claude Code <noreply@anthropic.com> Co-authored-by: TRAE CLI <traecli@bytedance.com>
Records pre-fix aborts (exit 134: GET >=19k, in >=14k, SET slow path at 50k links), pinned qjs normal returns through n=1,000,000, post-fix byte-identical differentials (including SET semantics and the with-scope get_or_missing path), two SIGABRT mutation checks, and the test262 subset before/after (471 files / 929 variants: 928 pass + 1 frozen unsupported-negative-provenance, row-identical, zero regressions). Co-Authored-By: Claude Code <noreply@anthropic.com> Co-authored-by: TRAE CLI <traecli@bytedance.com>
lfkdsk
force-pushed
the
fix/b9-long-prototype-chain
branch
from
September 18, 2026 06:20
3b6fc9b to
838ecd5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
main@49d1a299in, SET, andinstanceofpathssrc/engine/object/internal_methods.rsThe target base already replaced the recursive legacy
src/runtime/internal_methods.rsimplementation with iterative object/read/set state machines. The conflict resolution therefore preserves those production paths and carries forward the regression tests instead of restoring the deleted module.Verification
cargo test --locked --workspace --all-targetscargo test --locked -p quickjs-oxide long_prototype_chain_tests --lib -- --nocapture(9 passed)cargo fmt --all -- --check-D warnings)./scripts/checks/check-rust-only.shpython3 scripts/checks/check-source-layout.pyin/instanceof/getter exercised at 1,000,000 links and remaining edge/Proxy/SET probes at 50,000 linkstest-test262.sh --checkauthenticated the frozen receipts and reported the already-known stale source fingerprint; no receipts, admissions, hashes, profiles, or deviation entries were changed. The binary-object boundary checker named by the earlier task context was removed by49d1a299; its current replacement, the source-layout gate, passes.