fix(runtime): implement resizable ArrayBuffer — new ArrayBuffer(n, { maxByteLength }), resize, length-tracking views (#10873)

changelog.d/10916-resizable-arraybuffer.md

@@ -0,0 +1,9 @@
+Implemented resizable `ArrayBuffer` (ES2024): `new ArrayBuffer(length, { maxByteLength })`, `ArrayBuffer.prototype.resize`, real `resizable` / `maxByteLength` getters, length-tracking and fixed-length views, and `transfer()` preserving resizability (#10873).
+
+`new ArrayBuffer(len, { maxByteLength })` silently returned a fixed-length buffer: the `"ArrayBuffer"` arm in `perry-codegen`'s `lower_call/builtin.rs` lowered only the first argument (the options bag was never evaluated), `ArrayBuffer.prototype.resize` did not exist, and `get_field_by_name_tail.rs` hard-coded `resizable` to `false`. A program using one — guest271314's TypeScript Native Messaging host keeps a single `new ArrayBuffer(0, { maxByteLength: 64 MiB })` and `resize()`s it per message — died on its first `.resize()` with `TypeError: (Buffer).resize is not a function`.
+
+Storage model (`perry-runtime/src/buffer/resizable.rs`): buffer bytes live inline after the `BufferHeader` and every view aliases its backing by raw address, so a resize must never move the payload. A resizable buffer reserves `maxByteLength` once (its `capacity`) and `resize()` only rewrites `length`. Construction clears the initial `length` bytes only; a per-buffer `dirty_end` boundary records where the reserved tail is known-zero, so a grow clears exactly what may be dirty — `new ArrayBuffer(0, { maxByteLength: 64 MiB })` reserves address space, not resident memory, and `resize(64 MiB)` into never-touched or released pages costs 0.04 ms (a first cut that memset the range cost 224 ms). A shrink of at least 64 KiB hands the dropped pages back to the OS with the same `madvise` detach uses, so RSS follows `byteLength`, not the high-water mark.
+
+Views are re-lengthed eagerly on every `resize` — the way detach zeroes them — so every fast tier that reads a view's length is unchanged: a view constructed without an explicit length (and a `subarray()` without `end` of one) tracks `byteLength`; a fixed-length view reads as length 0 / byteOffset 0 while it no longer fits and comes back when the buffer regrows; an out-of-bounds `DataView` throws `TypeError` from its accessors and `byteLength`. `transfer()` keeps a buffer resizable (and `RangeError`s past `maxByteLength`), `transferToFixedLength()` drops it. `resize` / `transfer` / `transferToFixedLength` and the `resizable` / `maxByteLength` / `detached` accessors are installed on `ArrayBuffer.prototype`; the dynamic constructor path (`class_registry/construct.rs`) passes the options too. Every probe added to a shared path is gated on one `RegistryLatch` load, and the per-access `ViewInfo` / `ViewMeta` copies stay two words; measured `instructions:u` on typed-array, view, DataView and ArrayBuffer micro-rows are within ±0.6% of `main`.
+
+Verified: `test-files/test_gap_10873_resizable_arraybuffer.ts` byte-identical against node 26.5.1 (fails on unpatched `main` at its first line), also under `PERRY_GC_SCHEDULE_SEED=1 PERRY_GC_SCHEDULE_RATE=1 PERRY_GC_SCHEDULE_ALLOC_KB=0 PERRY_GC_PROTECT_FROMSPACE=1 PERRY_GC_VERIFY_EVACUATION=1` (1572 forced copying minors); eleven unit tests in `buffer/resizable_tests.rs`; the test262 `resizable-arraybuffer` built-ins subset goes from 33 to 156 of 408 passing. Not covered yet: growable `SharedArrayBuffer`, and `%TypedArray%.prototype` method semantics for a receiver that shrinks mid-iteration (the bulk of the remaining test262 cases; `test-compat/test262/features-applicable.txt` says so).

crates/perry-codegen/src/lower_call/builtin.rs

@@ -247,6 +247,31 @@ pub(super) fn lower_builtin_new<'a>(
         // Uint8Array — i.e. ArrayBuffers — are aliased rather than
         // copied). SharedArrayBuffer uses the same storage allocation with a
         // separate runtime registry so util.types can distinguish it.
+        // #10873: `new ArrayBuffer(length, { maxByteLength })`. The options bag
+        // used to be dropped here — never even evaluated — so a resizable
+        // buffer silently came back fixed-length. The runtime reads
+        // `maxByteLength` AFTER `ToIndex(length)`, per spec, so both operands
+        // go over raw. `length` can be an object (its `valueOf` runs in the
+        // runtime), and lowering the options literal allocates: root it.
+        "ArrayBuffer" if args.len() >= 2 => {
+            let size_collects = rooting::any_operand_may_collect(ctx, args[1..].iter());
+            let size_idx = group.lower(ctx, &args[0], size_collects)?;
+            let options_idx = adopt_optional_arg(ctx, args, 1, group)?;
+            for arg in args.iter().skip(2) {
+                let _ = lower_expr(ctx, arg)?;
+            }
+            let size_box = group.reread(ctx, size_idx)?;
+            let options_box = match options_idx {
+                Some(i) => group.reread(ctx, i)?,
+                None => double_literal(f64::from_bits(crate::nanbox::TAG_UNDEFINED)),
+            };
+            let handle = ctx.block().call(
+                I64,
+                "js_array_buffer_new_with_options",
+                &[(DOUBLE, &size_box), (DOUBLE, &options_box)],
+            );
+            Ok(Some(nanbox_pointer_inline(ctx.block(), &handle)))
+        }
         "ArrayBuffer" | "SharedArrayBuffer" => {
             let size_box = if !args.is_empty() {
                 lower_expr(ctx, &args[0])?

crates/perry-codegen/src/runtime_decls/strings_part2.rs

@@ -681,6 +681,8 @@ pub(crate) fn declare_phase_b_strings_part2(module: &mut LlModule) {
     module.declare_function("js_array_buffer_new", I64, &[I32]);
     module.declare_function("js_shared_array_buffer_new", I64, &[I32]);
     module.declare_function("js_array_buffer_new_value", I64, &[DOUBLE]);
+    // #10873: `new ArrayBuffer(length, { maxByteLength })`.
+    module.declare_function("js_array_buffer_new_with_options", I64, &[DOUBLE, DOUBLE]);
     module.declare_function("js_shared_array_buffer_new_value", I64, &[DOUBLE]);
     // JSON full-featured stringify/parse (replacer + indent + reviver).
     module.declare_function("js_json_stringify_full", I64, &[DOUBLE, DOUBLE, DOUBLE]);

crates/perry-runtime/src/buffer/dataview.rs

@@ -104,6 +104,13 @@ fn throw_dataview_oob() -> ! {
     super::numeric::throw_dataview_offset_out_of_bounds()
 }
 
+/// A DataView whose resizable buffer shrank past it (ES2024 IsViewOutOfBounds).
+fn throw_dataview_out_of_bounds_view() -> ! {
+    crate::collection_iter::throw_type_error(
+        "Cannot perform DataView operation on an out-of-bounds view",
+    )
+}
+
 fn throw_dataview_detached() -> ! {
     crate::collection_iter::throw_type_error(
         "Cannot perform DataView access on a detached ArrayBuffer",
@@ -178,6 +185,12 @@ unsafe fn read_bytes<const N: usize>(buf: *const BufferHeader, offset: i64) -> [
     }
     let len = (*buf).length as i64;
     if offset + (N as i64) > len {
+        // Failure path only: a view its resizable buffer shrank past has a
+        // zeroed length, and the spec's answer for it is a TypeError
+        // (IsViewOutOfBounds), not the ordinary RangeError (#10873).
+        if len == 0 && super::view::is_out_of_bounds_view(buf as usize) {
+            throw_dataview_out_of_bounds_view();
+        }
         throw_dataview_oob();
     }
     let base = super::view::resolve_data_ptr(buf).add(offset as usize);
@@ -199,6 +212,9 @@ unsafe fn write_bytes(buf: *mut BufferHeader, offset: i64, bytes: &[u8]) {
     if len == 0 && super::detach::is_detached_buffer(super::view::backing_of(buf as usize)) {
         throw_dataview_detached();
     }
+    if len == 0 && super::view::is_out_of_bounds_view(buf as usize) {
+        throw_dataview_out_of_bounds_view();
+    }
     if offset + (bytes.len() as i64) > len {
         throw_dataview_oob();
     }

crates/perry-runtime/src/buffer/detach.rs

@@ -96,7 +96,7 @@ pub fn detach_array_buffer(addr: usize) {
 /// affected. Failure is harmless (the advice is best-effort), so the return
 /// value is ignored.
 #[cfg(unix)]
-fn decommit_payload_pages(data: *mut u8, capacity: usize) {
+pub(super) fn decommit_payload_pages(data: *mut u8, capacity: usize) {
     let page = unsafe { libc::sysconf(libc::_SC_PAGESIZE) };
     if page <= 0 {
         return;
@@ -129,20 +129,61 @@ fn decommit_payload_pages(data: *mut u8, capacity: usize) {
 }
 
 #[cfg(not(unix))]
-fn decommit_payload_pages(_data: *mut u8, _capacity: usize) {}
+pub(super) fn decommit_payload_pages(_data: *mut u8, _capacity: usize) {}
+
+/// Release `[data, data + len)` AND report whether every byte of it is now
+/// guaranteed to read as zero (#10873: what lets a resizable buffer regrow into
+/// the range without clearing — i.e. without touching — it).
+///
+/// Linux only: `MADV_DONTNEED` on private anonymous memory is specified to
+/// zero-fill on the next touch, so the whole pages go back to the OS and only
+/// the two partial edge pages (< 2 pages) are cleared by hand. macOS's
+/// `MADV_FREE_REUSABLE` makes no such promise (a page not yet reclaimed keeps
+/// its bytes), so there this only releases and answers `false`.
+#[cfg(all(unix, not(target_os = "macos")))]
+pub(super) fn decommit_payload_pages_zeroed(data: *mut u8, len: usize) -> bool {
+    let page = unsafe { libc::sysconf(libc::_SC_PAGESIZE) };
+    if page <= 0 {
+        return false;
+    }
+    let page = page as usize;
+    let begin = data as usize;
+    let start = begin.wrapping_add(page - 1) & !(page - 1);
+    let end = (begin + len) & !(page - 1);
+    if end <= start {
+        return false;
+    }
+    unsafe {
+        if libc::madvise(start as *mut libc::c_void, end - start, libc::MADV_DONTNEED) != 0 {
+            return false;
+        }
+        std::ptr::write_bytes(data, 0, start - begin);
+        std::ptr::write_bytes(end as *mut u8, 0, begin + len - end);
+    }
+    true
+}
+
+#[cfg(not(all(unix, not(target_os = "macos"))))]
+pub(super) fn decommit_payload_pages_zeroed(data: *mut u8, len: usize) -> bool {
+    decommit_payload_pages(data, len);
+    false
+}
 
 fn throw_type_error(message: &str) -> ! {
     let msg = crate::string::js_string_from_bytes(message.as_ptr(), message.len() as u32);
     let err = crate::error::js_error_new_with_name_message(b"TypeError", msg);
     crate::exception::js_throw(crate::value::js_nanbox_pointer(err as i64))
 }
 
-/// `ArrayBuffer.prototype.transfer(newLength?)` and `transferToFixedLength`.
-/// Perry has no resizable ArrayBuffers, so both produce a fixed-length result
-/// and are identical: allocate a zero-filled buffer of `newLength` (default:
-/// the current byteLength), copy `min(oldLength, newLength)` bytes, detach the
-/// source, and return the new buffer.
-pub(crate) fn array_buffer_transfer(addr: usize, args: &[f64]) -> f64 {
+/// `ArrayBuffer.prototype.transfer(newLength?)` and `transferToFixedLength`
+/// (ES2024 ArrayBufferCopyAndDetach): allocate a zero-filled buffer of
+/// `newLength` (default: the current byteLength), copy
+/// `min(oldLength, newLength)` bytes, detach the source, and return the new
+/// buffer. `transfer` preserves resizability — a resizable source yields a
+/// resizable result with the same `maxByteLength` (and a `newLength` past it is
+/// a RangeError) — while `transferToFixedLength` always yields a fixed-length
+/// one. Over a fixed-length source the two are identical.
+pub(crate) fn array_buffer_transfer(addr: usize, args: &[f64], preserve_resizability: bool) -> f64 {
     // ES2024 ArrayBufferCopyAndDetach ordering: ToIndex(newLength) runs FIRST
     // — it can execute user code (`valueOf`) that detaches this very buffer —
     // and IsDetachedBuffer is checked after, so a mid-coercion detach is
@@ -159,8 +200,26 @@ pub(crate) fn array_buffer_transfer(addr: usize, args: &[f64]) -> f64 {
     let src = addr as *mut BufferHeader;
     let old_len = unsafe { (*src).length } as i32;
     let new_len = requested_len.unwrap_or(old_len);
-    let dst = super::from::zeroed_array_buffer_storage(new_len);
-    mark_as_array_buffer(dst as usize);
+    let preserved_max = if preserve_resizability {
+        super::resizable_max_byte_length(addr)
+    } else {
+        None
+    };
+    let dst = match preserved_max {
+        Some(max) => {
+            if new_len as i64 > max as i64 {
+                crate::typedarray::throw_range_error(b"Invalid array buffer length");
+            }
+            // Allocates: re-read nothing from `src` across this call other
+            // than through its (non-moving, old-arena) address.
+            super::resizable::alloc_resizable_array_buffer(new_len, max as i32)
+        }
+        None => {
+            let dst = super::from::zeroed_array_buffer_storage(new_len);
+            mark_as_array_buffer(dst as usize);
+            dst
+        }
+    };
     let copy_len = old_len.min(new_len);
     if copy_len > 0 {
         unsafe {

crates/perry-runtime/src/buffer/from.rs

@@ -600,6 +600,9 @@ pub extern "C" fn js_uint8array_new(val: f64) -> *mut BufferHeader {
                     let view = js_buffer_slice(src, 0, len);
                     mark_as_uint8array(view as usize);
                     set_buffer_ab_alias(view as usize, resolve_buffer_ab_alias(raw));
+                    // No explicit length: over a resizable ArrayBuffer the
+                    // view's length follows `byteLength` (#10873).
+                    super::view::mark_length_tracking(view as usize);
                     return view;
                 }
             }
@@ -723,6 +726,9 @@ pub extern "C" fn js_uint8array_view(
         let view = js_buffer_slice(src, start, end);
         mark_as_uint8array(view as usize);
         set_buffer_ab_alias(view as usize, resolve_buffer_ab_alias(raw));
+        if requested.is_none() {
+            super::view::mark_length_tracking(view as usize);
+        }
         view
     }
 }
@@ -941,6 +947,9 @@ pub extern "C" fn js_data_view_new(value: f64, offset_value: f64, length_value:
     let start = offset as u32;
     let len = view_len as u32;
     let view = super::view::alloc_data_view(src, start, len);
+    if length_jv.is_undefined() {
+        super::view::mark_length_tracking(view as usize);
+    }
     mark_as_data_view(view as usize);
     set_buffer_ab_alias(view as usize, resolve_buffer_ab_alias(addr));
     f64::from_bits(crate::value::JSValue::pointer(view as *mut u8).bits())

crates/perry-runtime/src/buffer/header.rs

@@ -142,6 +142,14 @@ crate::perry_thread_local! {
     /// backing store. Track constructor-created views so util.types can
     /// distinguish the ArrayBufferView predicate from TypedArray predicates.
     static DATA_VIEW_REGISTRY: RefCell<PtrHashSet<usize>> = RefCell::new(new_ptr_hash_set());
+    /// #10873: `ArrayBuffer addr -> maxByteLength` for RESIZABLE buffers.
+    /// Presence IS the `[[ArrayBufferMaxByteLength]]` internal slot. The same
+    /// population and lifetime as the identity sets above: a plain
+    /// address-keyed attribute of a non-moving buffer, never dereferenced and
+    /// never a root, pruned in `finalize_collected_dead_buffer` (the #6080 ABA
+    /// class). The resize logic lives in `buffer::resizable`.
+    static RESIZABLE_BUFFER_MAX: RefCell<PtrHashMap<usize, ResizableInfo>> =
+        RefCell::new(new_ptr_hash_map());
     /// Issue #1225: ArrayBuffer-identity alias map for Buffers produced by
     /// copy paths like `Buffer.from(buf)`.  Node-compatible semantics: the
     /// new Buffer's `.buffer` returns the same ArrayBuffer object as the
@@ -316,6 +324,9 @@ pub(crate) fn note_buffer_like_registered(addr: usize) {
 static ARRAY_BUFFER_EVER_MARKED: RegistryLatch = RegistryLatch::new();
 static SHARED_ARRAY_BUFFER_EVER_MARKED: RegistryLatch = RegistryLatch::new();
 static DATA_VIEW_EVER_MARKED: RegistryLatch = RegistryLatch::new();
+/// #10873: armed by the first resizable ArrayBuffer. Every probe the feature
+/// adds to a shared path answers from this one load in a program without one.
+static RESIZABLE_BUFFER_EVER_MARKED: RegistryLatch = RegistryLatch::new();
 static UINT8ARRAY_EVER_MARKED: RegistryLatch = RegistryLatch::new();
 
 /// Smallest and largest address ever marked as a `new Uint8Array(...)`
@@ -379,6 +390,61 @@ pub fn is_array_buffer(addr: usize) -> bool {
     ARRAY_BUFFER_REGISTRY.with(|r| r.borrow().contains(&addr))
 }
 
+/// Per-buffer state of a resizable ArrayBuffer (#10873). Plain integers.
+#[derive(Copy, Clone, Debug)]
+pub(crate) struct ResizableInfo {
+    /// `[[ArrayBufferMaxByteLength]]` — also the payload's reserved capacity.
+    pub max_byte_length: u32,
+    /// Every payload byte at or past this offset is known to read as zero, so
+    /// a grow only has to clear `[old byteLength, dirty_end)`. Never below the
+    /// current `byteLength`. See `buffer::resizable`.
+    pub dirty_end: u32,
+}
+
+/// Record `addr` as a resizable ArrayBuffer.
+pub(crate) fn mark_as_resizable_buffer(addr: usize, info: ResizableInfo) {
+    // Arm before the insert — see `crate::registry_latch`.
+    RESIZABLE_BUFFER_EVER_MARKED.arm();
+    RESIZABLE_BUFFER_MAX.with(|r| {
+        r.borrow_mut().insert(addr, info);
+    });
+}
+
+/// The resizable state of `addr`, or `None` for a fixed-length buffer.
+#[inline]
+pub(crate) fn resizable_info(addr: usize) -> Option<ResizableInfo> {
+    if RESIZABLE_BUFFER_EVER_MARKED.is_idle() {
+        return None;
+    }
+    RESIZABLE_BUFFER_MAX.with(|r| r.borrow().get(&addr).copied())
+}
+
+/// Move a resizable buffer's known-zero boundary. A no-op for any other address.
+pub(crate) fn set_resizable_dirty_end(addr: usize, dirty_end: u32) {
+    RESIZABLE_BUFFER_MAX.with(|r| {
+        if let Some(info) = r.borrow_mut().get_mut(&addr) {
+            info.dirty_end = dirty_end;
+        }
+    });
+}
+
+/// True once any resizable ArrayBuffer has existed in this process.
+#[inline]
+pub(crate) fn any_resizable_buffer() -> bool {
+    RESIZABLE_BUFFER_EVER_MARKED.is_armed()
+}
+
+/// `[[ArrayBufferMaxByteLength]]`, or `None` for a fixed-length buffer.
+#[inline]
+pub fn resizable_max_byte_length(addr: usize) -> Option<u32> {
+    resizable_info(addr).map(|info| info.max_byte_length)
+}
+
+#[cfg(test)]
+pub(crate) fn test_resizable_registry_len() -> usize {
+    RESIZABLE_BUFFER_MAX.with(|r| r.borrow().len())
+}
+
 pub fn mark_as_shared_array_buffer(addr: usize) {
     SHARED_ARRAY_BUFFER_EVER_MARKED.arm();
     SHARED_ARRAY_BUFFER_REGISTRY.with(|r| {
@@ -1213,6 +1279,12 @@ pub(crate) fn finalize_collected_dead_buffer(addr: usize) {
     DATA_VIEW_REGISTRY.with(|r| {
         r.borrow_mut().remove(&addr);
     });
+    // #10873: a recycled address must not inherit resizability.
+    if RESIZABLE_BUFFER_EVER_MARKED.is_armed() {
+        RESIZABLE_BUFFER_MAX.with(|r| {
+            r.borrow_mut().remove(&addr);
+        });
+    }
     BUFFER_AB_ALIAS.with(|r| {
         r.borrow_mut().remove(&addr);
     });

crates/perry-runtime/src/buffer/mod.rs

@@ -30,6 +30,10 @@ mod mutate;
 mod numeric;
 mod own_props;
 mod query;
+mod resizable;
+/// #10873: resizable ArrayBuffer storage model + view relength.
+#[cfg(test)]
+mod resizable_tests;
 mod transcode;
 mod u8_codec;
 pub mod validate;
@@ -91,6 +95,16 @@ pub use own_props::{
     buffer_own_prop_names, buffer_own_props_possible, buffer_read_own_prop, buffer_set_own_prop,
     clear_buffer_own_props, scan_buffer_own_props_roots_mut,
 };
+// ---- Re-exports: resizable ArrayBuffer (#10873) ----
+pub use header::resizable_max_byte_length;
+pub(crate) use header::{
+    any_resizable_buffer, mark_as_resizable_buffer, resizable_info, set_resizable_dirty_end,
+    ResizableInfo,
+};
+pub(crate) use resizable::{array_buffer_resize, view_length_after_resize};
+pub use resizable::{
+    is_out_of_bounds_data_view, is_resizable_buffer, js_array_buffer_new_with_options,
+};
 
 // ---- Re-exports: #8149 integer-indexed-exotic discrimination ----
 // `ArrayBuffer` / `SharedArrayBuffer` / `DataView` share `BufferHeader` and the