fix(napi): bound guest copies and retain queued message ownership

src/guest/abi.rs

@@ -2,7 +2,7 @@ use wasmer::FunctionEnvMut;
 
 use crate::NapiEnv;
 
-use super::util::read_guest_bytes;
+use super::util::{HostCopy, read_guest_bytes};
 
 #[repr(C)]
 struct Wasm32VersionedHeader {
@@ -138,7 +138,7 @@ fn read_versioned(
     guest_ptr: u32,
     prefix_size: usize,
     version: u32,
-) -> Option<Vec<u8>> {
+) -> Option<HostCopy<u8>> {
     if guest_ptr == 0 {
         return None;
     }
@@ -299,6 +299,8 @@ pub(crate) fn read_js_source(
     }
 }
 
+// Kept alongside the versioned ABI while bytecode imports fail closed.
+#[allow(dead_code)]
 pub(crate) struct BytecodeOpen {
     pub source_text: u32,
     pub filename: u32,
@@ -307,11 +309,12 @@ pub(crate) struct BytecodeOpen {
     pub host_defined_option_id: u32,
     pub line_offset: i32,
     pub column_offset: i32,
-    pub cache: Vec<u8>,
+    pub cache: HostCopy<u8>,
     pub has_cache: u8,
     pub cache_policy: u8,
 }
 
+#[allow(dead_code)]
 pub(crate) fn read_bytecode_open(
     env: &mut FunctionEnvMut<NapiEnv>,
     guest_ptr: u32,
@@ -336,7 +339,7 @@ pub(crate) fn read_bytecode_open(
         }
         read_guest_bytes(env, cache_ptr, cache_length)?
     } else {
-        Vec::new()
+        HostCopy::default()
     };
     Some(BytecodeOpen {
         source_text: u32_at(
@@ -557,3 +560,25 @@ impl Wasm32EnvHooksV1 {
         std::mem::offset_of!(Self, oom_error_callback)
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::is_default_engine_flags;
+
+    #[test]
+    fn only_edgejs_default_engine_flags_are_inert() {
+        assert!(is_default_engine_flags(
+            b"--js-source-phase-imports --harmony-import-attributes"
+        ));
+        assert!(is_default_engine_flags(b"--js-source-phase-imports"));
+        assert!(is_default_engine_flags(b"--harmony-import-attributes"));
+        assert!(is_default_engine_flags(b""));
+        assert!(!is_default_engine_flags(b"--allow-natives-syntax"));
+        assert!(!is_default_engine_flags(
+            b"--js-source-phase-imports --allow-natives-syntax"
+        ));
+        assert!(!is_default_engine_flags(
+            b"--harmony-import-attributes --js-source-phase-imports"
+        ));
+    }
+}

src/guest/mod.rs

@@ -25,6 +25,10 @@ pub const MAX_GUEST_CSTRING_SCAN: usize = 64 * 1024;
 /// 2-Mbit integer), which keeps the transient uncounted host memory negligible.
 pub const MAX_NAPI_CALLBACK_ARGS: usize = 64 * 1024;
 pub const MAX_NAPI_BIGINT_WORDS: usize = 32 * 1024;
+/// One N-API definition call rarely needs even hundreds of properties. Bound
+/// its nine host descriptor arrays and copied names independently of memory
+/// limit configuration (which may be unlimited in local tools).
+pub const MAX_NAPI_PROPERTY_DESCRIPTORS: usize = 4096;
 
 /// Byte width for the public `napi_typedarray_type` enum. Keep the mapping in
 /// one place for both guest backends; values outside the public enum are not