Allow lone-surrogate keyword keys in f(**d) - #8409

#!/bin/bash
set -euo pipefail

echo "== repo files around wasm convert =="
git ls-files | rg '(^|/)crates/wasm/src/convert\.rs$|Cargo\.toml$' | sed -n '1,80p'

echo
echo "== convert.rs outline =="
ast-grep outline crates/wasm/src/convert.rs --view expanded 2>/dev/null | sed -n '1,160p'

echo
echo "== relevant snippets =="
cat -n crates/wasm/src/convert.rs | sed -n '1,280p'

echo
echo "== WASM/wtfs/JsString references =="
rg -n "Wtf8Buf|JsString|Reflect::set|to_string|keyword|kwargs|wtf" crates/wasm crates -S | sed -n '1,220p'

#!/bin/bash
set -euo pipefail

echo "== crate manifests and workspace config =="
cat -n crates/wasm/Cargo.toml | sed -n '1,220p'
echo
cat -n crates/wtf8/Cargo.toml | sed -n '1,160p'
echo
cat -n crates/common/Cargo.toml | sed -n '1,220p'
echo
sed -n '1,120p' Cargo.toml

echo
echo "== wtf8 API =="
rg -n "pub (struct|impl|fn|trait)|Wtf8Buf|Wtf8|from.*utf|utf.*16|TryFrom|From<JsString>|JsValue" crates/wtf8/src crates -S | sed -n '1,260p'

echo
echo "== Python wtf8/string APIs =="
rg -n "impl \.Into.*Wtf8Buf|Wtf8Buf|as_wtf8|into_wtf8|From<.*Wtf8Buf.*>.*PyStr|PyStr" crates/vm crates/common crates/literal -S | sed -n '1,260p'

#!/bin/bash
set -euo pipefail

echo "== Wtf8Buf::from_wide/source =="
cat -n crates/wtf8/src/lib.rs | sed -n '327,372p'

echo
echo "== JsString code unit / UTF-16 docs search in local manifests =="
rg -n "JsString|TextEncoder|char_code_at|iter\\(|is_valid_utf16|from_wide|Wtf8Buf::from" crates wasm -S 2>/dev/null | sed -n '1,220p'

echo
echo "== behavioral model of lone surrogate UTF-16 to Rust String/Wtf8Buf =="
python3 - <<'PY'
import codecs
samples = [
    ("unpaired lead", 0xD800),
    ("unpaired trail", 0xDC00),
    ("surrogate pair", 0x1D306),
]
for name, cp in samples:
    bits = cp if cp <= 0xFFFF else 0xD800 | ((cp - 0x10000) >> 10), 0xDC00 | ((cp - 0x10000) & 0x3ff)
    units = [x for cp in [cp] for x in ([x] if cp <= 0xFFFF else bits)]
    enc_utf8 = codecs.utf_16_encode(bytes().join(i.to_bytes(2, 'big') for i in units))[0] if False else None
    try:
        rust_like = "".join(chr(i) for i in units).encode("utf-8").decode("utf-8")
        print(name, "units", [hex(i) for i in units], "bytes", enc_utf8, "roundtrip", repr(rust_like), "back to units", [ord(c) for c in rust_like])
    except UnicodeDecodeError as e:
        print(name, "Rust UTF-8 decode fails", e)
    else:
        pass
PY

#!/bin/bash
set -euo pipefail

repo="RustPython/RustPython"
title="Define surrogate-safe Python↔JavaScript string conversion at the WASM boundary"
body="$(cat <<'EOF'
## Summary

Define and implement one consistent, surrogate-safe conversion policy for Python strings crossing the RustPython WASM JavaScript boundary.

RustPython keyword arguments now retain lone surrogates internally using WTF-8, but converting only WASM keyword names would be incomplete: other `PyStr` → JavaScript paths (including `py_serde`) can still fail or perform lossy conversion when a string contains an unpaired surrogate.

## Rationale

JavaScript strings are UTF-16 and may contain lone surrogate code units. Python `str` values in RustPython can represent those values through WTF-8. Rust `String` and several wasm-bindgen conversion paths are not a lossless representation for this data, so ad hoc conversions can replace lone surrogates with U+FFFD or panic.

The whole WASM bridge needs an explicit policy that applies consistently to both directions and all relevant string conversion paths.

## Affected areas

- `crates/wasm/src/convert.rs`
  - JavaScript object/keyword keys converted into Python `FuncArgs`
  - Python function keyword keys converted into JavaScript object properties
  - general object conversion paths
- Python-string-to-JavaScript serialization via `py_serde` / `serde_wasm_bindgen`
- Any shared WASM helpers used for `PyStr`, WTF-8, `js_sys::JsString`, or JavaScript UTF-16 conversion

## Required changes

1. Establish and document the intended surrogate policy for Python↔JavaScript string conversion at the WASM boundary.
2. Implement shared, UTF-16-aware conversion helpers where needed so JavaScript strings with lone surrogates can enter the Python/WTF-8 representation without loss.
3. Make the Python→JavaScript conversion behavior match the policy across keyword names, object/string conversion, and serialization paths.
4. Remove or avoid isolated conversions that route surrogate-containing data through Rust `String` when that would be lossy or panic.
5. Add WASM-focused regression coverage for lone lead and trailing surrogates in relevant key and value conversion paths.

## Acceptance criteria

- No PyStr→JS conversion path in the WASM bridge panics solely because a Python string contains a lone surrogate.
- The behavior for lone surrogates is consistent and explicitly defined across kwargs, object properties, and serialized string values.
- JavaScript→Python conversion preserves UTF-16 lone surrogates where the boundary contract requires it.
- Tests cover both directions and demonstrate the agreed behavior for paired and unpaired surrogates.

## Backlinks

- PR `#8409`: https://github.com/RustPython/RustPython/pull/8409
- Review discussion: https://github.com/RustPython/RustPython/pull/8409#discussion_r3670087497
- Related issue: `#8228`

Requested by `@HyoJongPark`.
EOF
)"

gh issue create \
  --repo "$repo" \
  --title "$title" \
  --body "$body" \
  --assignee "HyoJongPark"