Fail to run simple SES embedding in QuickJS

[p-bakker]

Hi,

Am trying to evaluate some code inside a Compartment inside QuickJS(-NG) inside quickjs-emscripten in WASM in NodeJS and a basis new Compartment().evaluate('[]') throws this error inside QuickJS:

{
  name: 'SyntaxError',
  message: 'invalid lexical variable name',
  stack: '    at <input>:8:19\n' +
    '    at Function (native)\n' +
    '    at makeEvaluate (eval.js:7692:1)\n' +
    '    at provideEvaluate (eval.js:7748:18)\n' +
    '    at safeEvaluate (eval.js:7759:5)\n' +
    '    at compartmentEvaluate (eval.js:10421:5)\n' +
    '    at evaluate (eval.js:11168:59)\n'
}

Tried with both QuickJS and QuickJS0NG, same error. And I'm 'loading' SES by evalling ./node_modules/ses/dist/ses.umd.js inside QuickJS

These are the environment details:
"@jitl/quickjs-ng-wasmfile-release-sync": "^0.31.0",
"quickjs-emscripten": "^0.31.0",
"ses": "^1.9.0"

Any thoughts?

[mhofman]

That stack is showing that QuickJS is failing to parse some dynamically generated code in the core SES evaluator used by compartments. I know we did some manual superficial checks that lockdown() works on QuickJS, but I'm not sure if we've done extensive testing that QuickJS sufficiently implements the spec to support the Compartment shim (a lot of embedded engines take shortcuts on the niche language features that the SES shim leverages). @kriskowal is working on test262 coverage of Compartments, at which point we'd be able to also run test262 tests on top of the ses shim on arbitrary JS engines.

In the mean time, if you have a reproduction, we could try to see what exactly QuickJS is choking on.

[p-bakker]

Looks like it chokes on const {Infinity,NaN,undefined} = this.globalObject; within this:

with (this.scopeTerminator) {
      with (this.globalObject) {
        with (this.moduleLexicals) {
          with (this.evalScope) {
            const {Infinity,NaN,undefined} = this.globalObject;
            
            return function() {
              'use strict';
              return eval(arguments[0]);
            };
          }
        }
      }
    }

[p-bakker]

Particularly, QJS fails on the simplified code below, which I think is basically what SES is doing, right?

        with (new Proxy({globalThis: {Infinity, NaN, undefined}}, {})) {
          const {Infinity,NaN,undefined} = this.globalThis;
        }

Running the above snippet in GC works fine. Filed an issue with QJS: quickjs-ng/quickjs#633

[mhofman]

Thanks for tracking this down and filing an issue. Yes the compartment evaluator optimizes into a const any non-configurable and non-writable property of the compartment's global to avoid having the lookup for these go through the with machinery.

Similarly the 4 layers of nested with is in part to avoid having to go through a proxy object when simply looking up a name on the compartment's global. The proxy is only there to prevent the lookup from escaping to the actual global scope.

I see in the issue the bug can be reduced to declaring a const undefined which makes sense as the proxy and with aren't really involved here. Interesting that there may not be a test262 to catch this. FYI @gibson042

[gibson042]

Opened tc39/test262#4332 to track this.

[erights]

Added ecosystem-compatibility label. Note that quickjs-ng/quickjs#633 is closed, which likely means this problem goes away once upgraded to depend on a QuickJS incorporating that fix.