Skip errors from fromJSON when parsing numbers with exponents too
large for float64 (e.g., '5e2482'). This is expected behavior from
Go's encoding/json package, not a bug.

Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

Validate argument count before accessing params slice in the get()
function. This prevents a runtime panic when malformed input bypasses
compile-time validation, as discovered by OSS-Fuzz.

Includes regression test for the specific fuzz case.

Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

Skip pattern for the variadic function type mismatch error
format ("reflect: cannot use X as type Y in Call"). Differs from
the regular function error format that was already covered.

Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

Previously, expressions like `$env(abs())` would compile without error
and cause a runtime "stack underflow" panic. The checker now validates
that $env cannot be used as a function callee, producing a clear error
message like "map[string]interface {} is not callable".

Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

…expr (expr-lang#927)

Added GlassFlow.dev in the list of companies using expr

Signed-off-by: Ashish Bagri <ashishbagri@gmail.com>

Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

Add skip pattern for json.UnsupportedTypeError in fuzz
test. The toJSON() builtin returns this error when given
non-serializable types like functions (e.g. toJSON(score)).

The existing skip list only covered json: unsupported value
(for NaN/Inf) but not json: unsupported type (for func,
chan, complex types).

Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
Co-authored-by: Anton Medvedev <anton@medv.io>

As we may not have env/fn override for disabled builtin just yet. For example, during expr.Run, or compile without expr.Env.

As we may not have env/fn override for disabled builtin just yet. For example, during expr.Run, or compile without expr.Env.

WithContext patcher now looks up function types from the Functions
table and Env methods when the callee type is interface{}. This fixes
context injection for custom functions and Env methods nested as
arguments inside method calls with unknown callee types
(e.g., Now2().After(Date2())).

Also improved the regression test to actually verify context is passed
to both functions, and added a test for Env methods.

Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
Co-authored-by: Anton Medvedev <anton@medv.io>

Iteration over slices previously used reflection to access elements,
which was slow and allocated unnecessarily. This change adds
type-specialized fast paths for common slice types ([]int, []float64,
[]string, []any) that bypass reflection entirely. Scope objects are
now pooled and reused across loop iterations. The current scope
pointer is cached to avoid repeated slice lookups.

Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
Co-authored-by: Anton Medvedev <anton@medv.io>

…ang#919)

When date() is called with an invalid timezone string like ".",
time.LoadLocation can return raw OS-level errors such as
"is a directory". Replace the raw error with a consistent
"unknown time zone" message to improve error clarity and match
the fuzz test's known-error skip patterns.

Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

When the type checker cannot determine a concrete struct type at
compile time (e.g. ternary with mixed types), field access
falls through to dynamic OpFetch at runtime. The Fetch function
in vm/runtime and the get function in builtin/lib used
FieldByNameFunc which matched unexported fields, then called
Interface() on the resulting reflect.Value, causing a reflect
error.

Add IsExported() guards after FieldByNameFunc in both Fetch()
and get() so unexported fields are never accessed via
reflection.

Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

Check that the groupBy predicate result is comparable before
using it as a map key. Previously, a non-comparable type such
as a slice would cause a raw Go runtime panic. Now it produces
a clear error message instead.

Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

Signed-off-by: Jesse Suen <jesse@akuity.io>

…ang#954)

emitLoopBackwards uses OpMoreOrEqual + OpJumpIfFalse to check the loop
condition, but never pops the comparison result from the stack. This
leaves a stale bool that corrupts the value stack for the parent context.

When findLast or findLastIndex is used inside a map literal like
{"r": findLast([1, 2, 3], # > 3)}, the OpMap opcode tries to pop a
string key but finds the leftover bool instead, causing:
  interface conversion: interface {} is bool, not string

The forward-iterating emitLoop avoids this by using OpJumpIfEnd, which
checks scope.Index directly without touching the stack.

Fix: add OpPop after OpJumpIfFalse (continue path) and after patchJump
(exit path), matching the convention used by emitCond and every other
OpJumpIfFalse callsite in the compiler.

Fixes expr-lang#950

Co-authored-by: lawrence3699 <lawrence3699@users.noreply.github.com>

…-lang#963)

When a map value resolves to a string at runtime and is followed by a
named-field access (e.g. v.k.missing where v.k is a string), the Fetch
helper falls into the Array/Slice/String branch and calls ToInt on the
field name. ToInt panics with "invalid operation: int(string)", which
is confusing.

Guard the branch: if the index is a string it can only be a property
name, not an integer index, so panic with the canonical
"cannot fetch <field> from <type>" message instead.

Fixes expr-lang#962.

Signed-off-by: Sai Asish Y <say.apm35@gmail.com>

…xpr-lang#952)