feat(worker): resourceLimits for worker isolates

V8_RELEASE

@@ -1 +1 @@
-v8-14.9.207.39-6
+v8-14.9.207.39-7

test-app/app/src/main/assets/app/mainpage.js

@@ -28,6 +28,7 @@ require("./tests/testEventLoop");
 require("./tests/testMultithreadedJavascript");
 require("./tests/testWorkerTerminateDuringLoad");
 require("./tests/testWorkerOptions");
+require("./tests/testWorkerResourceLimits");
 require("./tests/testInterfaceDefaultMethods");
 require("./tests/testInterfaceStaticMethods");
 require("./tests/testMetadata");

test-app/app/src/main/assets/app/tests/testWorkerResourceLimits.js

@@ -0,0 +1,156 @@
+describe("Worker resourceLimits", function () {
+    var echoEntry = "./workerResourceLimitsEchoWorker.js";
+    var oomEntry = "./workerResourceLimitsOomWorker.js";
+
+    // Jasmine arms a spec's async timeout before calling it, so the interval
+    // has to be raised ahead of the spec, not inside it.
+    var originalTimeout;
+    beforeEach(function () {
+        originalTimeout = jasmine.DEFAULT_TIMEOUT_INTERVAL;
+        jasmine.DEFAULT_TIMEOUT_INTERVAL = 60000;
+    });
+    afterEach(function () {
+        jasmine.DEFAULT_TIMEOUT_INTERVAL = originalTimeout;
+    });
+
+    var expectStarts = function (options, done) {
+        var worker = options === undefined ? new Worker(echoEntry) : new Worker(echoEntry, options);
+        var settled = false;
+        var finish = function () {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            worker.terminate();
+            done();
+        };
+        worker.onmessage = function (msg) {
+            expect(msg.data.started).toBe(true);
+            finish();
+        };
+        worker.onerror = function (e) {
+            expect(String(e && e.message ? e.message : e)).toBe("<no worker error>");
+            finish();
+        };
+    };
+
+    it("starts a worker under a maxYoungGenerationSizeMb cap", function (done) {
+        expectStarts({ resourceLimits: { maxYoungGenerationSizeMb: 8 } }, done);
+    });
+
+    it("starts a worker under both heap caps", function (done) {
+        expectStarts({ resourceLimits: { maxOldGenerationSizeMb: 64, maxYoungGenerationSizeMb: 8 } },
+                     done);
+    });
+
+    it("treats resourceLimits: null like an absent resourceLimits", function (done) {
+        expectStarts({ resourceLimits: null }, done);
+    });
+
+    it("ignores unknown keys inside resourceLimits", function (done) {
+        expectStarts({ resourceLimits: { maxOldGenerationSizeMb: 64, somethingElse: 42 } }, done);
+    });
+
+    it("reports a worker that runs out of heap through onerror", function (done) {
+        var worker = new Worker(oomEntry, { resourceLimits: { maxOldGenerationSizeMb: 32 } });
+        var settled = false;
+
+        // The entry never returns, so nothing can post: a message here means the
+        // cap was not applied at all.
+        worker.onmessage = function () {
+            expect("worker posted a message").toBe("worker exhausted its heap");
+        };
+
+        worker.onerror = function (e) {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            var message = String(e && e.message ? e.message : e);
+            expect(message).toMatch(/out of memory/i);
+            // Naming the cap is what tells this apart from any other failure
+            // the worker could have reported.
+            expect(message).toMatch(/maxOldGenerationSizeMb: 32/);
+            worker.terminate();
+            done();
+        };
+    });
+
+    it("throws a TypeError when resourceLimits is not an object", function () {
+        expect(function () {
+            new Worker(echoEntry, { resourceLimits: 5 });
+        }).toThrowError(TypeError, /"resourceLimits"/);
+    });
+
+    it("throws a TypeError for a non-numeric maxOldGenerationSizeMb", function () {
+        expect(function () {
+            new Worker(echoEntry, { resourceLimits: { maxOldGenerationSizeMb: "64" } });
+        }).toThrowError(TypeError, /"resourceLimits\.maxOldGenerationSizeMb"/);
+    });
+
+    it("throws a RangeError for a maxOldGenerationSizeMb of zero", function () {
+        expect(function () {
+            new Worker(echoEntry, { resourceLimits: { maxOldGenerationSizeMb: 0 } });
+        }).toThrowError(RangeError, /"resourceLimits\.maxOldGenerationSizeMb"/);
+    });
+
+    it("throws a RangeError for a NaN maxYoungGenerationSizeMb", function () {
+        expect(function () {
+            new Worker(echoEntry, { resourceLimits: { maxYoungGenerationSizeMb: NaN } });
+        }).toThrowError(RangeError, /"resourceLimits\.maxYoungGenerationSizeMb"/);
+    });
+
+    // The cap is derived from size_t, so it differs per ABI: 4095 MB where
+    // size_t is 32 bits (armeabi-v7a, x86), (2^44 - 1) MB where it is 64. The
+    // value has to sit above both for the spec to mean anything on every ABI.
+    it("throws a RangeError for a maxOldGenerationSizeMb too large to hold in bytes", function () {
+        expect(function () {
+            new Worker(echoEntry, { resourceLimits: { maxOldGenerationSizeMb: Math.pow(2, 53) } });
+        }).toThrowError(RangeError, /"resourceLimits\.maxOldGenerationSizeMb"/);
+    });
+
+    it("throws a RangeError for a maxYoungGenerationSizeMb below one byte", function () {
+        expect(function () {
+            new Worker(echoEntry, { resourceLimits: { maxYoungGenerationSizeMb: 1e-9 } });
+        }).toThrowError(RangeError, /"resourceLimits\.maxYoungGenerationSizeMb"/);
+    });
+
+    it("propagates the error thrown by a resourceLimits getter", function () {
+        var boom = new Error("boom");
+        var options = { resourceLimits: new Proxy({}, {
+            get: function (target, key) {
+                if (key === "maxOldGenerationSizeMb") {
+                    throw boom;
+                }
+                return undefined;
+            }
+        }) };
+        var thrown;
+        try {
+            new Worker(echoEntry, options);
+        } catch (e) {
+            thrown = e;
+        }
+        expect(thrown).toBe(boom);
+    });
+
+    it("throws a RangeError for a jsDispatchTableSizeMb above the ceiling", function () {
+        expect(function () {
+            new Worker(echoEntry, { resourceLimits: { jsDispatchTableSizeMb: 300 } });
+        }).toThrowError(RangeError, /"resourceLimits\.jsDispatchTableSizeMb"/);
+    });
+
+    it("throws a RangeError for a fractional jsDispatchTableSizeMb", function () {
+        expect(function () {
+            new Worker(echoEntry, { resourceLimits: { jsDispatchTableSizeMb: 1.5 } });
+        }).toThrowError(RangeError, /"resourceLimits\.jsDispatchTableSizeMb"/);
+    });
+
+    it("starts a worker under a jsDispatchTableSizeMb reservation", function (done) {
+        expectStarts({ resourceLimits: { jsDispatchTableSizeMb: 64 } }, done);
+    });
+
+    it("starts a worker under the smallest jsDispatchTableSizeMb reservation", function (done) {
+        expectStarts({ resourceLimits: { jsDispatchTableSizeMb: 1 } }, done);
+    });
+});

test-app/app/src/main/assets/app/tests/workerResourceLimitsEchoWorker.js

@@ -0,0 +1,3 @@
+// Entry for testWorkerResourceLimits: reports that the isolate came up under
+// whatever resourceLimits the parent passed.
+postMessage({ started: true });

test-app/app/src/main/assets/app/tests/workerResourceLimitsOomWorker.js

@@ -0,0 +1,6 @@
+// Entry for testWorkerResourceLimits: allocates and never releases, so the
+// isolate walks into the maxOldGenerationSizeMb cap the parent set.
+var keep = [];
+for (;;) {
+    keep.push(new Array(100000).fill(1));
+}

test-app/runtime/src/main/cpp/CallbackHandlers.cpp

@@ -10,7 +10,10 @@
 #include "JsArgToArrayConverter.h"
 #include "ArgConverter.h"
 #include "v8-profiler.h"
+#include <cmath>
 #include <iostream>
+#include <limits>
+#include <optional>
 #include <sstream>
 #include <fstream>
 #include <cstdio>
@@ -1172,6 +1175,18 @@ std::optional<int> ClampWorkerPriority(Local<Value> value) {
     throw NativeScriptException(isolate, error, message);
 }
 
+[[noreturn]] void ThrowWorkerOptionRangeError(Isolate *isolate, const std::string &message) {
+    Local<Value> error = Exception::RangeError(ArgConverter::ConvertToV8String(isolate, message));
+    throw NativeScriptException(isolate, error, message);
+}
+
+#ifndef V8_HAS_JS_DISPATCH_TABLE_RESERVATION_PARAM
+[[noreturn]] void ThrowWorkerOptionError(Isolate *isolate, const std::string &message) {
+    Local<Value> error = Exception::Error(ArgConverter::ConvertToV8String(isolate, message));
+    throw NativeScriptException(isolate, error, message);
+}
+#endif
+
 // Reads `key` from `object`. A false return means the getter threw: the
 // exception is already pending on the isolate and construction must stop
 // without running anything else on it.
@@ -1265,6 +1280,128 @@ bool GetWorkerThreadPriority(Isolate *isolate, Local<Context> context,
             kWorkerPriorityNames + ".");
 }
 
+constexpr double kBytesPerMegabyte = 1024 * 1024;
+// Bounds the double-to-size_t conversion below: converting a byte count that
+// does not fit size_t is undefined, and size_t is 32 bits on armeabi-v7a and
+// x86. The division floors, so the product always fits. v8 clamps heap sizes
+// far under this on every device, so nothing real is excluded.
+constexpr size_t kMaxLimitMegabytes =
+        std::numeric_limits<size_t>::max() / static_cast<size_t>(kBytesPerMegabyte);
+
+// v8 needs the reservation to be a whole number of table segments and no larger
+// than its compile-time maximum; whole megabytes satisfy the first on every
+// platform's segment size, and 256 is the maximum.
+constexpr double kMaxJsDispatchTableSizeMb = 256;
+
+#ifdef V8_HAS_JS_DISPATCH_TABLE_RESERVATION_PARAM
+// Every isolate otherwise reserves 256 MB of address space for its JS dispatch
+// table; 64 MB still holds four million dispatch entries, far more than a
+// worker allocates. Only workers get the smaller reservation - the main
+// isolate keeps v8's default.
+constexpr size_t kDefaultWorkerJsDispatchTableBytes = 64 * 1024 * 1024;
+#endif
+
+// Reads one megabyte-valued `resourceLimits` key into `megabytes`, leaving it
+// empty when the key is absent (v8's own default stays in place). Returns false
+// when the getter threw (see ReadWorkerOption). A present value must be a
+// finite number worth at least one byte and at most kMaxLimitMegabytes.
+bool ReadMegabyteLimit(Isolate *isolate, Local<Context> context, Local<Object> resourceLimits,
+                       const char *key, std::optional<double> &megabytes) {
+    Local<Value> value;
+    if (!ReadWorkerOption(isolate, context, resourceLimits, key, value)) {
+        return false;
+    }
+    if (value->IsUndefined()) {
+        return true;
+    }
+
+    std::string name = std::string("resourceLimits.") + key;
+    if (!value->IsNumber()) {
+        ThrowWorkerOptionTypeError(isolate, "Worker option \"" + name + "\" must be a number.");
+    }
+
+    double parsed = value.As<Number>()->Value();
+    if (!std::isfinite(parsed) || parsed * kBytesPerMegabyte < 1 ||
+        parsed > static_cast<double>(kMaxLimitMegabytes)) {
+        ThrowWorkerOptionRangeError(isolate,
+                                    "Worker option \"" + name +
+                                            "\" must be a finite number of megabytes worth at "
+                                            "least one byte and at most " +
+                                            std::to_string(kMaxLimitMegabytes) + ".");
+    }
+
+    megabytes = parsed;
+    return true;
+}
+
+/*
+ * Node's `resourceLimits` shape. Unknown keys are ignored, so the options Node
+ * has and this runtime cannot honor (codeRangeSizeMb, stackSizeMb) stay
+ * harmless to pass. Returns false when a getter threw (see ReadWorkerOption).
+ */
+bool ParseWorkerResourceLimits(Isolate *isolate, Local<Context> context,
+                               const v8::FunctionCallbackInfo<v8::Value> &args,
+                               IsolateLimits &limits) {
+    if (args.Length() < 2 || !args[1]->IsObject()) {
+        return true;
+    }
+
+    Local<Value> value;
+    if (!ReadWorkerOption(isolate, context, args[1].As<Object>(), "resourceLimits", value)) {
+        return false;
+    }
+    if (value->IsNullOrUndefined()) {
+        return true;
+    }
+    if (!value->IsObject()) {
+        ThrowWorkerOptionTypeError(isolate, "Worker option \"resourceLimits\" must be an object.");
+    }
+    Local<Object> resourceLimits = value.As<Object>();
+
+    std::optional<double> megabytes;
+
+    if (!ReadMegabyteLimit(isolate, context, resourceLimits, "maxOldGenerationSizeMb", megabytes)) {
+        return false;
+    }
+    if (megabytes) {
+        limits.maxOldGenerationSizeBytes =
+                static_cast<size_t>(*megabytes * kBytesPerMegabyte);
+    }
+
+    megabytes.reset();
+    if (!ReadMegabyteLimit(isolate, context, resourceLimits, "maxYoungGenerationSizeMb",
+                           megabytes)) {
+        return false;
+    }
+    if (megabytes) {
+        limits.maxYoungGenerationSizeBytes =
+                static_cast<size_t>(*megabytes * kBytesPerMegabyte);
+    }
+
+    megabytes.reset();
+    if (!ReadMegabyteLimit(isolate, context, resourceLimits, "jsDispatchTableSizeMb", megabytes)) {
+        return false;
+    }
+    if (megabytes) {
+        if (*megabytes != std::floor(*megabytes) || *megabytes < 1 ||
+            *megabytes > kMaxJsDispatchTableSizeMb) {
+            ThrowWorkerOptionRangeError(
+                    isolate, "Worker option \"resourceLimits.jsDispatchTableSizeMb\" must be a "
+                             "whole number of megabytes between 1 and 256.");
+        }
+#ifdef V8_HAS_JS_DISPATCH_TABLE_RESERVATION_PARAM
+        limits.jsDispatchTableReservationBytes =
+                static_cast<size_t>(*megabytes) * static_cast<size_t>(kBytesPerMegabyte);
+#else
+        ThrowWorkerOptionError(isolate,
+                               "Worker option \"resourceLimits.jsDispatchTableSizeMb\" requires a "
+                               "v8 build with a configurable JS dispatch table.");
+#endif
+    }
+
+    return true;
+}
+
 }  // namespace
 
 void CallbackHandlers::NewThreadCallback(const v8::FunctionCallbackInfo<v8::Value> &args) {
@@ -1322,10 +1459,18 @@ void CallbackHandlers::NewThreadCallback(const v8::FunctionCallbackInfo<v8::Valu
         }
 
         int priority;
-        if (!GetWorkerThreadPriority(isolate, context, args, priority)) {
+        IsolateLimits resourceLimits;
+        if (!GetWorkerThreadPriority(isolate, context, args, priority) ||
+            !ParseWorkerResourceLimits(isolate, context, args, resourceLimits)) {
             return;
         }
 
+#ifdef V8_HAS_JS_DISPATCH_TABLE_RESERVATION_PARAM
+        if (!resourceLimits.jsDispatchTableReservationBytes.has_value()) {
+            resourceLimits.jsDispatchTableReservationBytes = kDefaultWorkerJsDispatchTableBytes;
+        }
+#endif
+
         // An http(s) entry has no filesystem form to validate or to resolve
         // against the caller's directory: it is already absolute, and the
         // module loader's HTTP branch fetches it on the worker's own thread
@@ -1401,8 +1546,8 @@ void CallbackHandlers::NewThreadCallback(const v8::FunctionCallbackInfo<v8::Valu
         // here on the main thread where class loading is safe.
         WorkerWrapper::EnsureJniCached();
 
-        auto wrapper = std::make_shared<WorkerWrapper>(isolate, workerId, entryPath,
-                                                       currentDir, priority, thiz);
+        auto wrapper = std::make_shared<WorkerWrapper>(isolate, workerId, entryPath, currentDir,
+                                                       priority, std::move(resourceLimits), thiz);
         WorkerWrapper::Insert(workerId, wrapper);
 
         DEBUG_WRITE("Called Worker constructor id=%d", workerId);

test-app/runtime/src/main/cpp/NativeScriptException.cpp

@@ -1039,6 +1039,11 @@ string NativeScriptException::GetFullMessage(const TryCatch& tc,
   v8::Local<v8::Context> context = isolate->GetEnteredOrMicrotaskContext();
 
   auto message = tc.Message();
+  // An isolate v8 has been told to terminate hands back an exception with no
+  // v8::Message at all, and every read below needs a real handle.
+  if (message.IsEmpty()) {
+    return jsExceptionMessage;
+  }
 
   stringstream ss;
   ss << jsExceptionMessage;