chore: sync quickjs-ng release v0.16.2

deps/quickjs-release.env

@@ -1,5 +1,5 @@
 QUICKJS_NG_REPO="quickjs-ng/quickjs"
-QUICKJS_NG_TAG="v0.16.1"
-QUICKJS_NG_TARBALL_URL="https://api.github.com/repos/quickjs-ng/quickjs/tarball/v0.16.1"
-QUICKJS_NG_RELEASE_URL="https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.1"
-QUICKJS_NG_RELEASED_AT="2026-08-04T09:22:30Z"
+QUICKJS_NG_TAG="v0.16.2"
+QUICKJS_NG_TARBALL_URL="https://api.github.com/repos/quickjs-ng/quickjs/tarball/v0.16.2"
+QUICKJS_NG_RELEASE_URL="https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.2"
+QUICKJS_NG_RELEASED_AT="2026-08-20T12:22:52Z"

deps/quickjs/api-test.c

@@ -2,6 +2,7 @@
 #undef NDEBUG
 #endif
 #include <assert.h>
+#include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include "quickjs.h"
@@ -928,6 +929,59 @@ static void new_errors(void)
     JS_FreeRuntime(rt);
 }
 
+// JS_NewContext() already installs DOMException by way of
+// JS_AddIntrinsicAToB(), so a host that also calls JS_AddIntrinsicDOMException()
+// explicitly installs it twice. The second install must release the prototype
+// the first one left in ctx->class_proto[] instead of overwriting the slot;
+// new_runtime() aborts at JS_FreeRuntime() if it does not.
+static void dom_exception_added_twice(void)
+{
+    JSValue ret;
+    const char *s;
+    int i;
+
+    JSRuntime *rt = new_runtime();
+    JSContext *ctx = JS_NewContext(rt);
+
+    // the implicit install left a working DOMException behind
+    ret = eval(ctx, "DOMException.prototype === "
+                    "Object.getPrototypeOf(new DOMException)");
+    assert(JS_ToBool(ctx, ret) == true);
+    JS_FreeValue(ctx, ret);
+
+    // installing it again, repeatedly, must not leak the previous prototype
+    for (i = 0; i < 3; i++)
+        assert(JS_AddIntrinsicDOMException(ctx) == 0);
+
+    // and the class prototype still matches the global constructor, i.e. the
+    // slot tracks the newest install rather than a freed or stale object
+    ret = eval(ctx, "DOMException.prototype === "
+                    "Object.getPrototypeOf(new DOMException)");
+    assert(JS_ToBool(ctx, ret) == true);
+    JS_FreeValue(ctx, ret);
+
+    ret = eval(ctx, "new DOMException('m', 'InvalidCharacterError').name");
+    assert(!JS_IsException(ret));
+    s = JS_ToCString(ctx, ret);
+    assert(s);
+    assert(!strcmp(s, "InvalidCharacterError"));
+    JS_FreeCString(ctx, s);
+    JS_FreeValue(ctx, ret);
+
+    // the internally thrown DOMExceptions pick up the current prototype too
+    ret = eval(ctx, "try { atob('a') } catch (e) { "
+                    "  e instanceof DOMException && e.name } ");
+    assert(!JS_IsException(ret));
+    s = JS_ToCString(ctx, ret);
+    assert(s);
+    assert(!strcmp(s, "InvalidCharacterError"));
+    JS_FreeCString(ctx, s);
+    JS_FreeValue(ctx, ret);
+
+    JS_FreeContext(ctx);
+    JS_FreeRuntime(rt);
+}
+
 static void backtrace_oom_callsite_array(void)
 {
     static const char setup_code[] =
@@ -1822,6 +1876,182 @@ static void transfer_default_managed_array_buffer(void)
     JS_FreeRuntime(rt);
 }
 
+static void get_class_name(void)
+{
+    static const struct {
+        const char *code;
+        const char *name;
+    } builtins[] = {
+        { "({})",               "Object" },
+        { "[]",                 "Array" },
+        { "new Error()",        "Error" },
+        { "new Date()",         "Date" },
+        { "/re/",               "RegExp" },
+        { "new Map()",          "Map" },
+        { "new ArrayBuffer(0)", "ArrayBuffer" },
+        { "new Uint8Array(0)",  "Uint8Array" },
+        { "(function(){})",     "Function" },
+    };
+    JSClassDef def = (JSClassDef){ .class_name = "MyClass" };
+    JSClassID class_id, unregistered_class_id;
+    JSAtom atom, expected;
+    JSRuntime *rt;
+    JSContext *ctx;
+    const char *s;
+    JSValue obj;
+    size_t i;
+
+    rt = new_runtime();
+    class_id = 0;
+    JS_NewClassID(rt, &class_id);
+    assert(0 == JS_NewClass(rt, class_id, &def));
+
+    /* handed out by JS_NewClassID() but never passed to JS_NewClass() */
+    unregistered_class_id = 0;
+    JS_NewClassID(rt, &unregistered_class_id);
+
+    ctx = JS_NewContext(rt);
+
+    /* the name of a class registered from C, not its class id */
+    expected = JS_NewAtom(ctx, "MyClass");
+    atom = JS_GetClassName(rt, class_id);
+    assert(atom == expected);
+    s = JS_AtomToCString(ctx, atom);
+    assert(s);
+    assert(!strcmp(s, "MyClass"));
+    JS_FreeCString(ctx, s);
+    JS_FreeAtom(ctx, atom);
+    JS_FreeAtom(ctx, expected);
+
+    /* the names of the built-in classes */
+    for (i = 0; i < countof(builtins); i++) {
+        obj = eval(ctx, builtins[i].code);
+        assert(!JS_IsException(obj));
+        atom = JS_GetClassName(rt, JS_GetClassID(obj));
+        assert(atom != JS_ATOM_NULL);
+        s = JS_AtomToCString(ctx, atom);
+        assert(s);
+        assert(!strcmp(s, builtins[i].name));
+        JS_FreeCString(ctx, s);
+        JS_FreeAtom(ctx, atom);
+        JS_FreeValue(ctx, obj);
+    }
+
+    /* class ids without a registered class have no name */
+    assert(JS_ATOM_NULL == JS_GetClassName(rt, JS_INVALID_CLASS_ID));
+    assert(JS_ATOM_NULL == JS_GetClassName(rt, unregistered_class_id));
+    assert(JS_ATOM_NULL == JS_GetClassName(rt, class_id + 4096));
+
+    /* the caller owns the returned atom; the class keeps its own reference,
+       so releasing it repeatedly doesn't free the name out from under it */
+    for (i = 0; i < 64; i++)
+        JS_FreeAtom(ctx, JS_GetClassName(rt, class_id));
+    atom = JS_GetClassName(rt, class_id);
+    s = JS_AtomToCString(ctx, atom);
+    assert(s);
+    assert(!strcmp(s, "MyClass"));
+    JS_FreeCString(ctx, s);
+    JS_FreeAtom(ctx, atom);
+
+    /* every registered class has a name, and it is a name rather than a
+       number: returning the class id instead produced a valid-looking atom,
+       either an unrelated predefined one for a small id or the id spelled out
+       in decimal for a large one, so check the whole table rather than the
+       handful of classes spelled out above */
+    {
+        JSClassID id;
+        int registered = 0;
+
+        for (id = 1; id < class_id + 16; id++) {
+            char decimal[32];
+            if (!JS_IsRegisteredClass(rt, id))
+                continue;
+            registered++;
+            atom = JS_GetClassName(rt, id);
+            assert(atom != JS_ATOM_NULL);
+            s = JS_AtomToCString(ctx, atom);
+            assert(s);
+            // a few internal classes are deliberately unnamed, but none is
+            // named after a number
+            snprintf(decimal, sizeof(decimal), "%u", (unsigned)id);
+            assert(strcmp(s, decimal));
+            assert(s[0] < '0' || s[0] > '9');
+            JS_FreeCString(ctx, s);
+            JS_FreeAtom(ctx, atom);
+        }
+        /* the built-ins alone are far more than this */
+        assert(registered > 20);
+    }
+
+    /* two classes sharing a name share the interned atom, and the name does
+       not depend on which context asks */
+    {
+        JSClassDef def2 = (JSClassDef){ .class_name = "MyClass" };
+        JSClassID class_id2 = 0;
+        JSContext *ctx2;
+        JSAtom a1, a2;
+
+        JS_NewClassID(rt, &class_id2);
+        assert(0 == JS_NewClass(rt, class_id2, &def2));
+        assert(class_id2 != class_id);
+
+        a1 = JS_GetClassName(rt, class_id);
+        a2 = JS_GetClassName(rt, class_id2);
+        assert(a1 == a2);
+        JS_FreeAtom(ctx, a1);
+        JS_FreeAtom(ctx, a2);
+
+        ctx2 = JS_NewContext(rt);
+        a1 = JS_GetClassName(rt, class_id);
+        a2 = JS_GetClassName(rt, class_id);
+        assert(a1 == a2);
+        JS_FreeAtom(ctx2, a1);
+        JS_FreeAtom(ctx2, a2);
+        JS_FreeContext(ctx2);
+    }
+
+    JS_FreeContext(ctx);
+    JS_FreeRuntime(rt);
+}
+
+void object_from(void)
+{
+    JSRuntime *rt = new_runtime();
+    JSContext *ctx = JS_NewContext(rt);
+    JSValue t0 = JS_NewObject(ctx);
+    assert(!JS_IsException(t0));
+    assert(JS_IsObject(t0));
+    JSAtom prop = JS_NewAtomLen(ctx, "prop", 4);
+    assert(prop != JS_ATOM_NULL);
+    JSValue val = JS_NULL;
+    JSValue t1 = JS_NewObjectFrom(ctx, 1, &prop, &val);
+    assert(!JS_IsException(t1));
+    assert(JS_IsObject(t1));
+    uint32_t old_shape_hash_count = js_std_cmd(/*GetShapeHashCount*/4, rt);
+    JSValue t2 = JS_NewObjectFrom(ctx, 1, &prop, &val);
+    assert(!JS_IsException(t2));
+    assert(JS_IsObject(t2));
+    uint32_t new_shape_hash_count = js_std_cmd(/*GetShapeHashCount*/4, rt);
+    assert(old_shape_hash_count == new_shape_hash_count);
+    JS_FreeAtom(ctx, prop);
+    JS_FreeValue(ctx, t2);
+    JS_FreeValue(ctx, t1);
+    JS_FreeValue(ctx, t0);
+    JS_FreeContext(ctx);
+    JS_FreeRuntime(rt);
+}
+
+void add_intrinsic_bigint(void)
+{
+    JSRuntime *rt = new_runtime();
+    JSContext *ctx = JS_NewContextRaw(rt);
+    JS_AddIntrinsicBaseObjects(ctx);
+    JS_AddIntrinsicBigInt(ctx);
+    assert(!JS_HasException(ctx));
+    JS_FreeContext(ctx);
+    JS_FreeRuntime(rt);
+}
+
 int main(void)
 {
     cfunctions();
@@ -1840,6 +2070,7 @@ int main(void)
     promise_hook();
     dump_memory_usage();
     new_errors();
+    dom_exception_added_twice();
     backtrace_oom_current_exception();
     backtrace_oom_callsite_array();
     proxy_own_keys_huge_length();
@@ -1855,5 +2086,8 @@ int main(void)
     transfer_external_array_buffer();
     resize_external_array_buffer();
     transfer_default_managed_array_buffer();
+    get_class_name();
+    object_from();
+    add_intrinsic_bigint();
     return 0;
 }

deps/quickjs/libregexp.c

@@ -1025,7 +1025,7 @@ static int parse_class_string_disjunction(REParseState *s, REStringList *cr,
     for(;;) {
         str.size = 0;
         while (*p != '}' && *p != '|') {
-            c = get_class_atom(s, NULL, &p, false);
+            c = get_class_atom(s, NULL, &p, true);
             if (c < 0)
                 goto fail;
             if (dbuf_put_u32(&str, c)) {
@@ -1119,6 +1119,23 @@ static int get_class_atom(REParseState *s, REStringList *cr,
             if (!inclass && s->is_unicode)
                 goto invalid_escape;
             break;
+        case '&':
+        case '!':
+        case '#':
+        case '%':
+        case ',':
+        case ':':
+        case ';':
+        case '<':
+        case '=':
+        case '>':
+        case '@':
+        case '`':
+        case '~':
+            if (s->is_unicode && (!inclass || !s->unicode_sets))
+                /* Only illegal if in unicode mode and not in a class */
+                goto invalid_escape;
+            break;
         case '^':
         case '$':
         case '\\':

deps/quickjs/meson.build

@@ -1,7 +1,7 @@
 project(
   'quickjs-ng',
   'c',
-  version: '0.16.1',
+  version: '0.16.2',
   default_options: [
     'c_std=gnu11,c11',
     'warning_level=3',

deps/quickjs/quickjs-libc.c

@@ -1920,7 +1920,7 @@ static const JSCFunctionListEntry js_std_funcs[] = {
     JS_CFUNC_DEF("evalScript", 1, js_evalScript ),
     JS_CFUNC_DEF("loadScript", 1, js_loadScript ),
     JS_CFUNC_DEF("getenv", 1, js_std_getenv ),
-    JS_CFUNC_DEF("setenv", 1, js_std_setenv ),
+    JS_CFUNC_DEF("setenv", 2, js_std_setenv ),
     JS_CFUNC_DEF("unsetenv", 1, js_std_unsetenv ),
     JS_CFUNC_DEF("getenviron", 1, js_std_getenviron ),
 #if !defined(__wasi__)
@@ -4449,7 +4449,7 @@ static const JSCFunctionListEntry js_os_funcs[] = {
     JS_CFUNC_DEF("sleepAsync", 1, js_os_sleepAsync ),
     JS_PROP_STRING_DEF("platform", OS_PLATFORM, 0 ),
     JS_CFUNC_DEF("getcwd", 0, js_os_getcwd ),
-    JS_CFUNC_DEF("chdir", 0, js_os_chdir ),
+    JS_CFUNC_DEF("chdir", 1, js_os_chdir ),
     JS_CFUNC_DEF("mkdir", 1, js_os_mkdir ),
     JS_CFUNC_DEF("readdir", 1, js_os_readdir ),
 #if !defined(_WIN32) && !defined(__wasi__)