Mathieu Hofman

[Mathieu Hofman @mhofman]

@auchenberg @jaredpalmer I think I'm arguing that we need some testing gate, and that unless agents can prove they ran all tests, that CI is still the gate. Maybe the answer is some proof that tests have been run.

[Mathieu Hofman @mhofman]

@auchenberg @jaredpalmer In my experience I've seen cases where agents either didn't run all CI tests. One case we have is CI too complex to run in a normal dev environment. Also like humans the agent may have made a small change it believed didn't have side effects but it did.

[Mathieu Hofman @mhofman]

@csjh__ @matteocollina Also opting the object out of any future optimizations (unless used as prototype) is also a large hammer for what is essentially a heuristics for "I think the author wants to have dictionary behavior"

[Mathieu Hofman @mhofman]

@csjh__ @matteocollina `Object.create(null)` is not the same intent as `{__proto__: null}`, especially when all properties are defined in the same object literal. I would also argue that `Object.create` with or without properties descriptors is not the same intent.

[Mathieu Hofman @mhofman]

@gibson042 @KentonVarda Yeah we ran into the same issue a while ago. We also have a promise kit constructor that nulls the resolver functions to avoid this leak in manually resolved promises.

The race fix is actually more involved as it disconnects resolvers as soon as any raced promise settles.

[Mathieu Hofman @mhofman]

@blanplan @KentonVarda But in practice the language itself doesn't leak, as a garbage collector is allowed to clean up any values that the program won't observe anymore. That said a program can still OOM, and the spec should be better at specifying the behavior in that case.

[Mathieu Hofman @mhofman]

@blanplan @KentonVarda The spec deals in observable behavior. In this case an implementation has always been free to collect the promise, and multiple did. However, when or if collection happens for anything is not specified. I agree it effectively assumes an infinite memory machine.

[Mathieu Hofman @mhofman]

@bakkoting @KentonVarda The spec didn't need to say it for collection to happen, as the resolved promise object can no longer be observed through actions of the resolver. But yeah for being explicit helps engines like V8 that didn't go further than implement the spec steps.

[Mathieu Hofman @mhofman]

@KentonVarda @_Felipe @dillon_mulroy @threepointone When I read DO facet I assumed it'd be similar to our Exo multifaceted objects, but they seem to not share much state, and have async interactions between them. As such this feels more like a cluster of related vats? Related objects sharing state are already covered by exports?

[Mathieu Hofman @mhofman]

@JoyeeCheung @matteocollina @_rafaelgss @Cloudflare Without a lockdown environment it's technically possible to defensively write platform code in JS that doesn't get affected by user code modifications to the environment but it's extremely tedious / unergonomic and very error prone. I wouldn't advise it.

[Mathieu Hofman @mhofman]

@JoyeeCheung @matteocollina @_rafaelgss @Cloudflare But the JS language itself is the best suited for running untrusted code, as long as the environment is locked down (frozen intrinsic & compartmentalized evaluators). That's the reason we've been pushing for new Global / Compartments. Frozen intrinsic can be done userland.

[Mathieu Hofman @mhofman]

@_rafaelgss If you need availability protection and are fine with async interactions, a worker unlocks you. JS was designed to run untrusted code from websites. It's a memory safe language, and the I/O powers are all deniable enabling full integrity and confidentiality protections.

[Mathieu Hofman @mhofman]

@_rafaelgss It depends on your threat model, and the use cases you want to support. You can get a JS environnement in a shape where you can safely run untrusted code in the same thread if you accept no availability protection (infinite loop). Some code is incompatible, but very little.

[Mathieu Hofman @mhofman]

@Revenode @neogoose_btw Advantage of a language with explicit interleaving points: look for `await`, that's the only place where other code can execute

[Mathieu Hofman @mhofman]

@kettanaito So the fastest way to handle a maybePromise in an async function is to ` try { await maybePromiseReturningFunc(); } catch (err) {}`

[Mathieu Hofman @mhofman]

@kettanaito Actually Promise.try does introduce a tick if the outcome of the func is a promise. It's equivalent to
`new Promise((resolve) => resolve(func()))`

We do want to make promise adoption faster overall in https://t.co/rxzqNFoAke

[Mathieu Hofman @mhofman]

@jimmythedoge1 @kettanaito `await maybePromise` is equivalent to `Promise.resolve(maybePromise).then()` and does not introduce any unnecessary extra tick. In modern engines it will be the fastest way to deal with eventual results.