Move JS string escaping to support/string and escape the JS printer's string literals

Per review feedback, move the escaping logic into support/string.{h,cpp}
as a reusable String::printEscapedJS utility; wasm2js.h keeps a thin
escapeJSString wrapper so call sites are unchanged.

Also apply the escaping in cashew's printString, which previously
emitted string contents verbatim between double quotes. This covers the
imports object accesses in the asm.js function body (e.g.
imports["mod'ule"] in the --emscripten output path) that the earlier
commit missed.

Add gtest coverage for printEscapedJS and an end-to-end wasm2js golden
test (string_escapes.wast) with quote/backslash metacharacters in
import module and base names. Regenerating the wasm2js expectations
produced no changes to existing tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: sumleo

src/emscripten-optimizer/simple_ast.h

@@ -29,6 +29,7 @@
 #include <limits>
 #include <ostream>
 #include <set>
+#include <sstream>
 #include <unordered_map>
 #include <unordered_set>
 #include <vector>
@@ -37,6 +38,7 @@
 #include "snprintf.h"
 #include "support/mixed_arena.h"
 #include "support/safe_integer.h"
+#include "support/string.h"
 
 #define errv(str, ...) fprintf(stderr, str "\n", __VA_ARGS__);
 #define printErr(str) fprintf(stderr, str "\n");
@@ -1080,8 +1082,12 @@ struct JSPrinter {
   }
 
   void printString(Ref node) {
+    // String contents (e.g. wasm module and base names) are arbitrary and may
+    // contain JS string metacharacters, so they must be escaped.
+    std::ostringstream escaped;
+    wasm::String::printEscapedJS(escaped, node[1]->getCString());
     emit('"');
-    emit(node[1]->getCString());
+    emit(escaped.str().c_str());
     emit('"');
   }
 

src/support/string.cpp

@@ -468,6 +468,50 @@ std::ostream& printEscapedJSON(std::ostream& os, std::string_view str) {
   return os << '"';
 }
 
+std::ostream& printEscapedJS(std::ostream& os, std::string_view str) {
+  for (size_t i = 0; i < str.size(); i++) {
+    unsigned char c = str[i];
+    switch (c) {
+      case '\\':
+        os << "\\\\";
+        break;
+      case '\'':
+        os << "\\'";
+        break;
+      case '"':
+        os << "\\\"";
+        break;
+      case '\n':
+        os << "\\n";
+        break;
+      case '\r':
+        os << "\\r";
+        break;
+      default:
+        // Check for U+2028 (LINE SEPARATOR) and U+2029 (PARAGRAPH SEPARATOR)
+        // which are valid in JSON strings but act as line terminators in JS.
+        // They are encoded as E2 80 A8 and E2 80 A9 in UTF-8.
+        if (c == 0xE2 && i + 2 < str.size() &&
+            static_cast<unsigned char>(str[i + 1]) == 0x80) {
+          unsigned char c2 = str[i + 2];
+          if (c2 == 0xA8) {
+            os << "\\u2028";
+            i += 2;
+            break;
+          }
+          if (c2 == 0xA9) {
+            os << "\\u2029";
+            i += 2;
+            break;
+          }
+        }
+        os << char(c);
+        break;
+    }
+  }
+  return os;
+}
+
 bool isUTF8(std::string_view str) {
   while (str.size()) {
     auto u = takeWTF8CodePoint(str);

src/support/string.h

@@ -97,6 +97,13 @@ std::ostream& printEscaped(std::ostream& os, std::string_view str);
 // `str` must be a valid WTF-16 string.
 std::ostream& printEscapedJSON(std::ostream& os, std::string_view str);
 
+// Escape a UTF-8 string for safe inclusion in a JavaScript string literal.
+// Escapes both quote characters (so the result is usable in either a single-
+// or double-quoted literal), backslashes, newlines, and the U+2028/U+2029
+// separators that are line terminators in JS. Does not emit surrounding
+// quotes.
+std::ostream& printEscapedJS(std::ostream& os, std::string_view str);
+
 std::ostream& writeWTF8CodePoint(std::ostream& os, uint32_t u);
 
 std::ostream& writeWTF16CodePoint(std::ostream& os, uint32_t u);

src/wasm2js.h

@@ -43,6 +43,7 @@
 #include "passes/passes.h"
 #include "support/base64.h"
 #include "support/file.h"
+#include "support/string.h"
 #include "wasm-builder.h"
 #include "wasm-io.h"
 #include "wasm-validator.h"
@@ -2656,49 +2657,9 @@ void Wasm2JSBuilder::addMemoryGrowFunc(Ref ast, Module* wasm) {
 // WebAssembly module/base names are arbitrary UTF-8 and may contain characters
 // that are JS string metacharacters (quotes, backslashes, newlines, etc.).
 static std::string escapeJSString(std::string_view str) {
-  std::string result;
-  result.reserve(str.size());
-  for (size_t i = 0; i < str.size(); i++) {
-    unsigned char c = str[i];
-    switch (c) {
-      case '\\':
-        result += "\\\\";
-        break;
-      case '\'':
-        result += "\\'";
-        break;
-      case '"':
-        result += "\\\"";
-        break;
-      case '\n':
-        result += "\\n";
-        break;
-      case '\r':
-        result += "\\r";
-        break;
-      default:
-        // Check for U+2028 (LINE SEPARATOR) and U+2029 (PARAGRAPH SEPARATOR)
-        // which are valid in JSON strings but act as line terminators in JS.
-        // They are encoded as E2 80 A8 and E2 80 A9 in UTF-8.
-        if (c == 0xE2 && i + 2 < str.size() &&
-            static_cast<unsigned char>(str[i + 1]) == 0x80) {
-          unsigned char c2 = str[i + 2];
-          if (c2 == 0xA8) {
-            result += "\\u2028";
-            i += 2;
-            break;
-          }
-          if (c2 == 0xA9) {
-            result += "\\u2029";
-            i += 2;
-            break;
-          }
-        }
-        result += static_cast<char>(c);
-        break;
-    }
-  }
-  return result;
+  std::ostringstream ss;
+  String::printEscapedJS(ss, str);
+  return ss.str();
 }
 
 // Wasm2JSBuilder emits the core of the module - the functions etc. that would

test/gtest/CMakeLists.txt

@@ -30,6 +30,7 @@ set(unittest_SOURCES
   printing.cpp
   public-type-validator.cpp
   scc.cpp
+  string.cpp
   stringify.cpp
   subtype-exprs.cpp
   suffix_tree.cpp

test/gtest/string.cpp

@@ -0,0 +1,70 @@
+#include <sstream>
+
+#include "support/string.h"
+#include "gtest/gtest.h"
+
+using namespace wasm;
+
+using StringTest = ::testing::Test;
+
+namespace {
+
+std::string escapeJS(std::string_view str) {
+  std::stringstream ss;
+  String::printEscapedJS(ss, str);
+  return ss.str();
+}
+
+} // anonymous namespace
+
+TEST_F(StringTest, PrintEscapedJSPlain) {
+  EXPECT_EQ(escapeJS(""), "");
+  EXPECT_EQ(escapeJS("env"), "env");
+  EXPECT_EQ(escapeJS("wasi_snapshot_preview1"), "wasi_snapshot_preview1");
+}
+
+TEST_F(StringTest, PrintEscapedJSQuotes) {
+  // Both quote characters are escaped so the result is safe in either a
+  // single- or double-quoted literal.
+  EXPECT_EQ(escapeJS("it's"), "it\\'s");
+  EXPECT_EQ(escapeJS("say \"hi\""), "say \\\"hi\\\"");
+  EXPECT_EQ(escapeJS("mixed'and\"quotes"), "mixed\\'and\\\"quotes");
+}
+
+TEST_F(StringTest, PrintEscapedJSBackslash) {
+  EXPECT_EQ(escapeJS("a\\b"), "a\\\\b");
+  // A backslash followed by a quote must not collapse into a lone escape.
+  EXPECT_EQ(escapeJS("\\'"), "\\\\\\'");
+}
+
+TEST_F(StringTest, PrintEscapedJSNewlines) {
+  EXPECT_EQ(escapeJS("line1\nline2"), "line1\\nline2");
+  EXPECT_EQ(escapeJS("line1\r\nline2"), "line1\\r\\nline2");
+}
+
+TEST_F(StringTest, PrintEscapedJSLineSeparators) {
+  // U+2028 and U+2029 are valid unescaped in JSON strings but are line
+  // terminators in JavaScript, so they must be escaped.
+  EXPECT_EQ(escapeJS("a\xE2\x80\xA8"
+                     "b"),
+            "a\\u2028b");
+  EXPECT_EQ(escapeJS("a\xE2\x80\xA9"
+                     "b"),
+            "a\\u2029b");
+  // Other characters in the same UTF-8 range pass through unchanged.
+  EXPECT_EQ(escapeJS("a\xE2\x80\xA6"
+                     "b"),
+            "a\xE2\x80\xA6"
+            "b");
+  // A truncated sequence at the end of the string is passed through
+  // byte-by-byte rather than read out of bounds.
+  EXPECT_EQ(escapeJS("\xE2\x80"), "\xE2\x80");
+}
+
+TEST_F(StringTest, PrintEscapedJSNonASCII) {
+  // Non-ASCII UTF-8 is passed through unmodified.
+  EXPECT_EQ(escapeJS("m\xC3\xB3"
+                     "dulo"),
+            "m\xC3\xB3"
+            "dulo");
+}

test/wasm2js/string_escapes.2asm.js

@@ -0,0 +1,28 @@
+import * as mod_ule_x from 'mod\'ule\"x';
+
+function asmFunc(imports) {
+ var Math_imul = Math.imul;
+ var Math_fround = Math.fround;
+ var Math_abs = Math.abs;
+ var Math_clz32 = Math.clz32;
+ var Math_min = Math.min;
+ var Math_max = Math.max;
+ var Math_floor = Math.floor;
+ var Math_ceil = Math.ceil;
+ var Math_trunc = Math.trunc;
+ var Math_sqrt = Math.sqrt;
+ var mod_ule_x = imports["mod\'ule\"x"];
+ var base = mod_ule_x["ba\\se\'"];
+ function exported() {
+  base();
+ }
+ 
+ return {
+  "exported": exported
+ };
+}
+
+var retasmFunc = asmFunc({
+  "mod\'ule\"x": mod_ule_x,
+});
+export var exported = retasmFunc.exported;

test/wasm2js/string_escapes.2asm.js.opt

@@ -0,0 +1,28 @@
+import * as mod_ule_x from 'mod\'ule\"x';
+
+function asmFunc(imports) {
+ var Math_imul = Math.imul;
+ var Math_fround = Math.fround;
+ var Math_abs = Math.abs;
+ var Math_clz32 = Math.clz32;
+ var Math_min = Math.min;
+ var Math_max = Math.max;
+ var Math_floor = Math.floor;
+ var Math_ceil = Math.ceil;
+ var Math_trunc = Math.trunc;
+ var Math_sqrt = Math.sqrt;
+ var mod_ule_x = imports["mod\'ule\"x"];
+ var base = mod_ule_x["ba\\se\'"];
+ function exported() {
+  base();
+ }
+ 
+ return {
+  "exported": exported
+ };
+}
+
+var retasmFunc = asmFunc({
+  "mod\'ule\"x": mod_ule_x,
+});
+export var exported = retasmFunc.exported;

test/wasm2js/string_escapes.wast

@@ -0,0 +1,6 @@
+(module
+ (import "mod'ule\"x" "ba\\se'" (func $base))
+ (func $exported (export "exported")
+  (call $base)
+ )
+)