Bump Jint from 4.16.0 to 4.16.2

[dependabot]

Updated Jint from 4.16.0 to 4.16.2.

Release notes

Sourced from Jint's releases.

4.16.2

Jint 4.16.2 is a maintenance release from the 4.x branch: correctness and conformance fixes backported from main, and nothing that changes an existing API or an existing default. If you are on 4.16.1 it is a drop-in update — every public signature is the one 4.16.0 shipped, on all five target frameworks, and the per-framework snapshots in Jint.Tests.PublicInterface/Verify/ are unchanged. main remains 5.0.0 development; what is coming there is recorded as it lands in docs/v5-migration.md.

Highlights

Failures that used to end the process, or never end. A native error raised while a call's arguments are being evaluated is propagated instead of leaving an empty value behind, which on 4.16.1 could recurse until the process died — decodeURIComponent on a malformed sequence was enough (#​4009). Native recursion and the forwarding paths through bound functions and proxies are guarded so a deep native chain raises a catchable error (#​4007). A module graph too deep to link raises an error the host can catch instead of overflowing the stack (#​3548). Temporal and Intl parsing cannot throw an uncatchable RegexMatchTimeoutException because the machine was busy (#​3543), a Temporal difference past a calendar's range raises RangeError instead of spinning forever (#​3555), and the process-wide Intl culture cache and Temporal zone cache are read-only and bounded, with a rejected zone no longer remembered — closing a script-driven unbounded growth (#​3546).

Generators and built-ins, step by step. A yield* delegation reached again by a loop both re-delegates and keeps its place: countdown(3) in a loop no longer hangs, and a delegating generator no longer returns the memoized first result (#​3545). Array.prototype.map and slice hand a @@​species constructor the length ToLength produced, and a non-callable map argument is a TypeError (#​3547). A trailing NUL pads neither a numeric string nor an array index (#​3552). A removed property slot is a tombstone rather than a free slot to reuse, so enumeration order survives a delete-and-readd (#​3318), and LengthOfArrayLike no longer clamps through a uint overload (#​3328).

Interop that answers for the right engine. Two engines in one process no longer decide each other's conversions and operators (#​3559), a host type converter's answer stays with the engine whose converter gave it (#​3563), and a value the host registers on a ShadowRealm — and the members its wrapper builds eagerly — belong to that realm (#​3557). Realm construction state is restored after nesting or a failure (#​4008). Overload selection is by the arguments in hand: an operator overload is chosen that way (#​3611), a params overload is chosen by the array's element type with a failing element declining rather than throwing (#​3782), an overload the argument cannot bind to is not a match, and a host operator that throws reports what it threw (#​3554). An index on a wrapped host collection is one property however it is spelled, and a member filter that hides the indexer hides it (#​3562); a read-only host collection refuses a write with a JavaScript TypeError rather than the CLR's NotSupportedException (#​3556).

Internationalization and Temporal. The Persian calendar extends into proleptic years on its 33-year cycle, so the ends of Temporal's range land in the right Persian year (#​4006); a calendar that counts Gregorian months writes their names (#​3612); and a -u- extension carrying more than one key is read whole (#​3613).

Errors. Only a string-valued stack counts as a pre-existing stack when a JavaScriptException is built, so an accessor or non-string stack on a thrown object no longer breaks error reporting (#​3677, reported by @​jeske).

Every change was verified failing-first against the unfixed branch on both .NET Framework and .NET 10, and the release was gated on a paired SunSpider and Dromaeo comparison against 4.16.1 on an idle machine: no row regressed outside run-to-run noise, most run 1–4 % faster.

What's Changed

• Backport: a removed property slot is a tombstone, not a free slot to reuse (#​3273) by @​lahma in Backport: a removed property slot is a tombstone, not a free slot to reuse (#3273) sebastienros/jint#3318
• Backport: LengthOfArrayLike, delete the uint overload rather than clamp it (#​3248) by @​lahma in Backport: LengthOfArrayLike, delete the uint overload rather than clamp it (#3248) sebastienros/jint#3328
• Temporal and Intl parsing cannot fail because the machine was busy (#​3486) by @​lahma in Temporal and Intl parsing cannot fail because the machine was busy (#3486) sebastienros/jint#3543
• Backport: the process-wide Intl culture cache and Temporal zone cache are read-only and bounded, and a rejected zone is not remembered by @​lahma in Backport: the process-wide Intl culture cache and Temporal zone cache are read-only and bounded, and a rejected zone is not remembered sebastienros/jint#3546
• Array: map and slice hand a @@​species constructor the length ToLength produced (#​3510) by @​lahma in Array: map and slice hand a @@species constructor the length ToLength produced (#3510) sebastienros/jint#3547
• Generators: a yield* delegation both re-delegates and keeps its place (backport of #​3506 and #​3518) by @​lahma in Generators: a yield* delegation both re-delegates and keeps its place (backport of #3506 and #3518) sebastienros/jint#3545
• A module graph too deep to link raises an error the host can catch, instead of ending the process (#​3415) by @​lahma in A module graph too deep to link raises an error the host can catch, instead of ending the process (#3415) sebastienros/jint#3548
• String to number: a trailing NUL pads neither a number string nor an array index (backport of #​3544) by @​lahma in String to number: a trailing NUL pads neither a number string nor an array index (backport of #3544) sebastienros/jint#3552
• Interop: a host operator reports what it threw, and an overload the argument cannot bind to is not a match by @​lahma in Interop: a host operator reports what it threw, and an overload the argument cannot bind to is not a match sebastienros/jint#3554
• Temporal: a difference past a calendar's range raises RangeError instead of spinning (#​3452) by @​lahma in Temporal: a difference past a calendar's range raises RangeError instead of spinning (#3452) sebastienros/jint#3555
• Interop: a read-only host collection refuses script with a JavaScript error, not the CLR's own (backport of #​3385) by @​lahma in Interop: a read-only host collection refuses script with a JavaScript error, not the CLR's own (backport of #3385) sebastienros/jint#3556
• ShadowRealm: a value the host registers, and the members its wrapper builds eagerly, belong to that realm by @​lahma in ShadowRealm: a value the host registers, and the members its wrapper builds eagerly, belong to that realm sebastienros/jint#3557
• Interop: two engines in one process do not decide each other's conversions and operators (backport of #​3521 and #​3526) by @​lahma in Interop: two engines in one process do not decide each other's conversions and operators (backport of #3521 and #3526) sebastienros/jint#3559
• Interop: an index on a wrapped host collection is one property, and a filter that hides the indexer hides it by @​lahma in Interop: an index on a wrapped host collection is one property, and a filter that hides the indexer hides it sebastienros/jint#3562
• Interop: a host type converter's answer stays with the engine whose converter gave it by @​lahma in Interop: a host type converter's answer stays with the engine whose converter gave it sebastienros/jint#3563
• Interop: an operator overload is chosen by the arguments in hand (backport of #​3578) by @​lahma in Interop: an operator overload is chosen by the arguments in hand (backport of #3578) sebastienros/jint#3611
• Intl: a calendar counting Gregorian months writes their names (backport of #​3589) by @​lahma in Intl: a calendar counting Gregorian months writes their names (backport of #3589) sebastienros/jint#3612
• Intl: a -u- extension carrying more than one key is read whole (backport of #​3594) by @​lahma in Intl: a -u- extension carrying more than one key is read whole (backport of #3594) sebastienros/jint#3613
• JavaScriptException: only a string "stack" counts as a pre-existing stack (#​3607 backport) by @​lahma in JavaScriptException: only a string "stack" counts as a pre-existing stack (#3607 backport) sebastienros/jint#3677
• Interop: a params overload is chosen by the array's element type, and a failing element declines instead of throwing (#​3764) by @​lahma in Interop: a params overload is chosen by the array's element type, and a failing element declines instead of throwing (#3764) sebastienros/jint#3782
• Backport #​3751 to 4.x: Temporal: the persian calendar extends into proleptic years on the 33-year cycle by @​lahma in Backport #3751 to 4.x: Temporal: the persian calendar extends into proleptic years on the 33-year cycle sebastienros/jint#4006
• Backport #​3922 to 4.x: Restore realm construction state after nesting or failure by @​lahma in Backport #3922 to 4.x: Restore realm construction state after nesting or failure sebastienros/jint#4008
• Backport #​3845 to 4.x: Propagate native errors during call argument evaluation by @​lahma in Backport #3845 to 4.x: Propagate native errors during call argument evaluation sebastienros/jint#4009
• Backport #​3877 to 4.x: Guard native recursion and forwarding paths by @​lahma in Backport #3877 to 4.x: Guard native recursion and forwarding paths sebastienros/jint#4007

Full Changelog: sebastienros/jint@v4.16.1...v4.16.2

4.16.1

Jint 4.16.1 is the first release from the new 4.x maintenance branch, and it marks the point where the two lines separate: main is now 5.0.0 development, and 4.x is where the 4.16.x line continues.

What that means for you. If you are on 4.16.0, this is a drop-in update — it is correctness and conformance work only, no API change and no changed default. Every public signature is the same one 4.16.0 shipped, on all five target frameworks. If you want the 4.x line, take it from 4.x and expect fixes rather than features. If you want to follow where the engine is going, watch main — v5 brings breaking API changes, an opt-in WHATWG web API surface, Web Workers, Node compatibility and a raised .NET Framework floor, and every one of them is recorded as it lands in docs/v5-migration.md.

From this release onward the 4.x public surface is snapshotted per target framework in Jint.Tests.PublicInterface/Verify/, so "did the API move?" is a diff rather than a judgement call — on this branch a diff there is a bug, and comparing those files against main's is the v4→v5 delta.

Highlights

Conformance, from a suite that now runs more of test262. The staging/ directory is generated and executed for the first time (#​3016), which is roughly 2,800 additional cases — largely SpiderMonkey's own suite contributed upstream, covering behaviour the stable directories never reach. Much of the work below is what it found.

Built-ins do what the spec says, step by step. The array built-ins perform the internal methods they name rather than equivalents (#​3066); Array.from honours IsConstructor and a typed array's length write throws (#​3043); an array truncation walks downwards and the generics report the writes they fail (#​3072); argument validation and evaluation order are corrected in five built-ins (#​3069); Map and Set get the [[SetData]] tombstone their traversals are specified over (#​3073); Date.prototype.setTime stores the clipped time value (#​3042); and Array.prototype.values/keys/entries no longer gate on an array-like receiver (#​3236).

Iterators and control flow. A throw from the iterator step no longer closes the iterator (#​3047); the done flag is consulted before stepping again (#​3048); a rejected return() propagates out of an abandoned for await loop (#​3113); an optional-chain short circuit is distinguished from a genuine undefined (#​3040); a computed property key is evaluated even when spelled as a literal (#​3039) and survives an await or yield intact (#​3144, #​3150); and destructuring the rest of an exhausted array yields an empty array rather than 2³² elements (#​3263).

Numeric and string accuracy. Math.acosh, asinh, atanh, cbrt, expm1 and log1p are ported from fdlibm for correctly-rounded results across every target framework (#​3050); toFixed formats from the double's exact value and reads this from [[NumberData]] (#​3071); String.prototype case conversion derives from Jint's own Unicode tables rather than the host's culture data (#​3068); and the regex engine is chosen per subject, with RegExp.prototype.replace no longer rewriting lastIndex (#​3070).

Bounds that hold. JavaScript strings have a maximum length instead of a wrapped array rent (#​3015); a JSON document too long to become a string is refused while it is being built (#​3028); a frame displaced by a proper tail call keeps counting while its trampoline runs, so MaxRecursionDepth cannot be evaded by leaving and re-entering the trampoline (#​3022); and an Atomics waiter is released when nothing can ever notify it again (#​3029).

Error messages no longer run user JavaScript (#​3041) — rendering a message for a value with a script-supplied toString used to invoke it, from inside the failure path.

Internationalization. The five Temporal members the proposal removed are dropped (#​3014), and u-extension options are canonicalized with every date format the spec allows (#​3018).

Two fixes in this release come from @​svenrog — a sloppy function answering its own arguments (#​3061) and the outer link on a parked Function-constructor environment (#​3063).

What's Changed

• Drop the five Temporal members the proposal removed by @​lahma in Drop the five Temporal members the proposal removed sebastienros/jint#3014
• Canonicalize u-extension options and format every date the spec allows by @​lahma in Canonicalize u-extension options and format every date the spec allows sebastienros/jint#3018
• Mark a global created by an unresolvable assignment, and stop a waitAsync timeout outliving its engine by @​lahma in Mark a global created by an unresolvable assignment, and stop a waitAsync timeout outliving its engine sebastienros/jint#3019
• Run test262's staging/ directory too by @​lahma in Run test262's staging/ directory too sebastienros/jint#3016
• Give JavaScript strings a maximum length instead of a wrapped array rent by @​lahma in Give JavaScript strings a maximum length instead of a wrapped array rent sebastienros/jint#3015
• Let a for-of frame decline the unwind it can only rethrow by @​lahma in Let a for-of frame decline the unwind it can only rethrow sebastienros/jint#3017
• Keep counting a frame a tail call replaced while its trampoline runs by @​lahma in Keep counting a frame a tail call replaced while its trampoline runs sebastienros/jint#3022
• Unpark staging/Temporal/removed-methods.js, which #​3014 already fixed by @​lahma in Unpark staging/Temporal/removed-methods.js, which #3014 already fixed sebastienros/jint#3023
• Drop the Islamic date conversions no calendar path reaches by @​lahma in Drop the Islamic date conversions no calendar path reaches sebastienros/jint#3027
• Let an Atomics waiter go when nothing can ever notify it again by @​lahma in Let an Atomics waiter go when nothing can ever notify it again sebastienros/jint#3029
• Refuse a JSON document too long to be a string while it is being built by @​lahma in Refuse a JSON document too long to be a string while it is being built sebastienros/jint#3028
• Bump the microsoft group with 3 updates by @​dependabot[bot] in Bump the microsoft group with 3 updates sebastienros/jint#3033
• Bump the analyzers group with 1 update by @​dependabot[bot] in Bump the analyzers group with 1 update sebastienros/jint#3031
• Add initial threat model for untrusted scripts by @​sebastienros in Add initial threat model for untrusted scripts sebastienros/jint#3030
• Stop ClassBenchmark rebuilding its engine per iteration by @​lahma in Stop ClassBenchmark rebuilding its engine per iteration sebastienros/jint#3053
• createRealm installs a full $262 on the new realm and returns it by @​lahma in createRealm installs a full $262 on the new realm and returns it sebastienros/jint#3044
• Give the benchmark suite a measurement environment by @​lahma in Give the benchmark suite a measurement environment sebastienros/jint#3055
• Evaluate a computed property key even when it is spelled as a literal by @​lahma in Evaluate a computed property key even when it is spelled as a literal sebastienros/jint#3039
• Stop error messages from running user JavaScript by @​lahma in Stop error messages from running user JavaScript sebastienros/jint#3041
• Array.from honours IsConstructor, and a typed array's length write throws by @​lahma in Array.from honours IsConstructor, and a typed array's length write throws sebastienros/jint#3043
• Consult the iterator's done flag before stepping it again by @​lahma in Consult the iterator's done flag before stepping it again sebastienros/jint#3048
• Date.prototype.setTime must store the clipped time value by @​lahma in Date.prototype.setTime must store the clipped time value sebastienros/jint#3042
• Answer a sloppy function's own arguments instead of throwing by @​svenrog in Answer a sloppy function's own arguments instead of throwing sebastienros/jint#3061
• Keep the outer link on a parked Function-constructor environment by @​svenrog in Keep the outer link on a parked Function-constructor environment sebastienros/jint#3063
• A throw from the iterator step must not close the iterator by @​lahma in A throw from the iterator step must not close the iterator sebastienros/jint#3047
  ... (truncated)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)