VM: expose ordinary activation bindings to direct eval

[chrisbbreuer]

Parent: #465
Related: #498

Problem

Ordinary function bytecode has exact frame slots, TDZ metadata, arguments objects, receiver/home-object state, and direct-eval call opcodes, but compilePlainFunctionInner and nested-template compilation still reject every function whose parser metadata sets uses_direct_eval. The interpreter therefore remains the only activation model in which direct eval can observe and mutate a caller function local. This is now a causal universal-bytecode boundary, not a missing parser or eval implementation.

Scope

• Give a running ordinary bytecode activation an explicit direct-eval binding view over parameters, var/function bindings, lexical slots and TDZ state, mapped/unmapped arguments, this, super, new.target, and private-name context.
• Preserve EvalDeclarationInstantiation for strict and sloppy direct eval, including deletable eval declarations, var/lexical conflicts, parameter-environment restrictions, catch/Annex B interactions, and mutation of the exact caller binding.
• Lower fixed and spread direct-eval calls, tail-position eval calls, nested arrows, methods, constructors, recursive/reentrant activations, and eval that defines or invokes closures without effect replay.
• Keep indirect/member/optional eval global, preserve cross-realm intrinsic identity, and retain causal admission reasons for syntax whose dynamic environment is still incomplete.
• Make the activation view precise under moving GC, deterministic OOM, debugger/watchdog state, shared-chunk no-GIL execution, and activation teardown.

No-workaround rules

• No source rewriting, local-value snapshots that lose writes or TDZ identity, eager heap allocation of every frame local, AST callback from required bytecode, globalizing direct eval, permissive policy default, or hidden tree-walker fallback.
• No stacks, queues, jobs, Promise/microtask, Worker lifecycle, or Map/Set iterator implementation changes.

Acceptance

• Forced tree-walker and required bytecode agree for reads/writes/declarations across parameters, var, let/const/class, shadowing, TDZ, catch, mapped/unmapped arguments, this, super, new.target, and private names.
• Fixed, spread, tail-position, arrow, method, constructor, nested/reentrant, closure-producing, strict/sloppy, direct/indirect, and cross-realm eval controls preserve exact results, errors, side effects, and step/debugger ordering.
• The activation binding view is bounded, moving-GC safe, failure-atomic under injected OOM, race-free under shared no-GIL/TSan execution, and released at activation teardown.
• Admission inventory removes the broad uses_direct_eval rejection only for complete semantics; unsupported nested syntax remains causally fail-closed with no interpreter callback.
• Focused compiler/VM/frontend, full units, relevant exact Test262 eval/function/class accounting, TSan, no-GIL, threadfuzz, debugger, watchdog, and moving-GC gates pass with zero regressions.
• A conventional commit lands directly on main and cross-links VM: make correct JavaScript universally bytecode-eligible #465 and VM: build a fast no-JIT execution tier for restricted hosts #498; flips and exact measured boundaries are recorded without a performance claim.

[chrisbbreuer]

First live-activation layer landed in c82295c2:

• compiler freezes name-sorted, scope-preserving binding plans across defining VM frames; NUL-prefixed compiler temporaries are excluded
• runtime-Environment gaps remain causally rejected instead of being flattened or reordered
• Environment resolution reads/writes the real frame cell, including mapped arguments, TDZ/const classification, captured Reference identity, and escaped-frame locking
• moving GC traces and relocates the live activation slots; escaping eval closures mark the backing frame non-recyclable
• focused compiler/live-view/relocation tests pass 4/4, and the live-view + relocation witnesses pass under TSan 2/2

The broad uses_direct_eval admission barrier is still intentionally closed. Next is lazy per-call Environment materialization plus opcode plan threading; this issue remains open until the full semantic matrix and gates pass.

[chrisbbreuer]

Lazy activation-Environment materialization landed in f525dd46: the VM now constructs the compiler-described scope chain over exact defining frames, roots both the closure environment and unpublished records across moving collection, reverses/links without allocation, and publishes only after the complete plan succeeds. Injected first-allocation OOM leaves vm.env unchanged. The focused witness passes 1/1 normally and under TSan with no leaks. Broad uses_direct_eval admission remains deliberately closed until opcode plan threading and the declaration/context matrix are complete.

[chrisbbreuer]

Activation-aware call-site threading landed in 03f7bc58: distinct fixed, spread, receiver, and tail-position eval opcodes carry validated immutable plan indexes. Runtime materializes live activation views only when the resolved callee is the realm eval intrinsic; shadowed eval remains an ordinary call, and the caller environment is restored after evaluation. Compiler emission passes 1/1 across fixed/spread/tail forms; the exact live-slot opcode passes 1/1 normally and under TSan, no leaks. The universal uses_direct_eval admission barrier remains closed until persistent sloppy declarations and the remaining parameter/named/runtime-scope contexts are modeled.

[chrisbbreuer]

Landed 1761996e (feat(vm): retain direct eval declaration environments (#771)). Ordinary VM activations now retain one atomically published variable Environment, so sloppy direct-eval declarations survive later eval calls and inner materialization can anchor at an already-materialized defining frame. Call-site lexical wrappers remain transient, complete plans are validated before publication, frame reuse clears the cache, and the new edge is traced/relocated by precise and concurrent GC. Materialization is deferred until parsing and inherited early-error checks succeed, so non-string, empty, and syntax-error eval does not allocate or mutate frame state. Focused materialization/opcode/relocation tests pass 3/3; materialization/opcode pass under TSan 2/2; no leaks. Admission remains fail-closed: re-entrant parent-cache refresh plus parameter, named-function, runtime-environment, and debugger contexts are still unresolved. This commit flips 0 test262 cases.

[chrisbbreuer]

Re-entrant and concurrent activation-cache convergence landed in 9e9462a8 (fix(vm): converge reentrant direct eval environments (#771)). Cold inner materialization now allocates and relocation-roots the complete scope graph before publishing every defining function Environment outer-to-inner. A later outer eval therefore reuses the same declaration target, and concurrent contenders converge with atomic compare-exchange; losing unpublished children are reparented with managed-edge barriers. External frame-root publication now fires the insertion barrier, and escaped defining scopes retain synchronized Environment access. Focused transactional materialization plus activation-opcode witnesses pass 2/2 normally and 2/2 under TSan, zero leaks; an injected-OOM sweep proves both defining-frame caches and vm.env remain unchanged at every allocation failure. Admission remains fail-closed for the parameter/named/runtime/debugger semantic matrix. This commit flips 0 test262 cases.

[chrisbbreuer]

Ordinary simple-frame admission landed in a74f2029 after parse-phase classification in 4f792e14. Direct eval now receives immutable live-activation plans and an implicit arguments slot when dynamically observable; fixed, spread, and proper-tail forms compile, while shadowed/indirect eval retain ordinary/global semantics. Non-simple ParameterEnvironment layouts, methods, derived constructors, and runtime Environment gaps remain causally rejected with no callback or fallback. Compiler probes pass 4/4; normal and TSan direct-eval subsets pass 16/16 each with zero failures/leaks, and the forced tree-walker/required-bytecode witness agrees exactly across mapped arguments, live locals, strict isolation, persistent sloppy declarations, shadowing, nesting/reentrancy, and indirect eval. Test262 accounting and the remaining acceptance matrix are still pending, so #771 remains open.