Harden JavaScript native boundaries

.github/workflows/build.yml

@@ -124,6 +124,9 @@ jobs:
           .\bindings\py\.venv\Scripts\python.exe -m mypy.stubtest dynwinrt_py --allowlist bindings\py\stubtest_allowlist.txt --ignore-disjoint-bases
       - name: Run E2E tests
         run: .\tests\e2e\e2e_test.ps1 -SkipBuild
+      - name: Test JS TSFN lifecycle and queue handling
+        working-directory: bindings/js
+        run: npm run test:tsfn
 
   # dynwinrt-codegen (x64 + arm64)
   dynwinrt-codegen:

bindings/js/Cargo.toml

@@ -11,6 +11,9 @@ repository = "https://github.com/microsoft/dynwinrt"
 [lib]
 crate-type = ["cdylib"]
 
+[features]
+test-hooks = []
+
 [dependencies]
 napi = { version = "3", features = ["napi7"] }
 napi-derive = "3.0.0"

bindings/js/__test__/index.spec.ts

@@ -924,9 +924,19 @@ if (missingWinuiFixtures.length > 0) {
 
 test('round-trip WinRT values', (t) => {
   t.is(DynWinRtValue.i32(42).toNumber(), 42)
+  t.is(DynWinRtValue.u32(0xffffffff).toNumber(), 0xffffffff)
   t.is(DynWinRtValue.i64(-42n).toI64Bigint(), -42n)
   t.is(DynWinRtValue.u64(2n ** 63n).toU64Bigint(), 2n ** 63n)
   t.is(DynWinRtValue.u64(42).toI64(), 42)
+  t.throws(() => DynWinRtValue.i64(9_007_199_254_740_992n).toI64(), {
+    message: /safe-integer range.*bigint conversion/,
+  })
+  t.throws(() => DynWinRtValue.u64(9_007_199_254_740_992n).toI64(), {
+    message: /safe-integer range.*bigint conversion/,
+  })
+  t.throws(() => DynWinRtValue.u64(2n ** 63n).toI64(), {
+    message: /greater than i64::MAX/,
+  })
   t.throws(() => DynWinRtValue.u64(-1), {
     message: /non-negative safe integer/,
   })
@@ -941,6 +951,81 @@ test('round-trip WinRT values', (t) => {
   t.true(DynWinRtValue.nullValue().isNull())
 })
 
+test('invalid WinRT value conversions throw JavaScript errors', (t) => {
+  const value = DynWinRtValue.hstring('not numeric')
+
+  t.throws(() => value.toNumber(), { message: /Cannot convert.*to number/ })
+  t.throws(() => value.toBool(), { message: /Cannot convert.*to number/ })
+  t.throws(() => value.toI64(), { message: /Cannot convert.*to number/ })
+  t.throws(() => value.toF64(), { message: /Cannot convert.*to number/ })
+  t.throws(() => value.asRaw(), { message: /non-object/ })
+  t.throws(() => DynCom.toNumber(value), { message: /Cannot convert.*to number/ })
+})
+
+test('u64 arrays and struct fields preserve the full unsigned range', (t) => {
+  const values = [0n, 2n ** 63n, 2n ** 64n - 1n]
+  const array = DynWinRtArray.fromU64Values(values)
+  t.deepEqual(array.toU64Vec(), values)
+  t.deepEqual(DynWinRtArray.fromU64Values([42]).toU64Vec(), [42n])
+  t.throws(() => DynWinRtArray.fromU64Values([-1]), {
+    message: /non-negative safe integer/,
+  })
+  t.throws(() => DynWinRtArray.fromU64Values([2n ** 64n]), {
+    message: /fit in an unsigned 64-bit integer/,
+  })
+
+  const structType = DynWinRtType.structType('DynWinRT.Tests.IntegerBoundary', [
+    DynWinRtType.u64(),
+    DynWinRtType.i64(),
+  ])
+  const value = DynWinRtStruct.create(structType)
+  value.setU64(0, 2n ** 64n - 1n)
+  t.is(value.getU64(0), 2n ** 64n - 1n)
+  t.throws(() => value.setU64(0, -1n), {
+    message: /fit in an unsigned 64-bit integer/,
+  })
+  value.setI64(1, -(2n ** 63n))
+  t.is(value.getI64(1), -(2n ** 63n))
+  t.throws(() => value.setI64(1, 2n ** 63n), {
+    message: /fit in a signed 64-bit integer/,
+  })
+
+  const signedValues = [-(2n ** 63n), 0n, 2n ** 63n - 1n]
+  t.deepEqual(DynWinRtArray.fromI64Values(signedValues).toI64Vec(), signedValues)
+  t.throws(() => DynWinRtArray.fromI64Values([2n ** 63n]), {
+    message: /fit in a signed 64-bit integer/,
+  })
+})
+
+test('struct field access rejects invalid indexes, types, ranges, and identities', (t) => {
+  t.throws(() => DynWinRtStruct.create(DynWinRtType.i32()), {
+    message: /requires a struct type/,
+  })
+
+  const scalarType = DynWinRtType.structType('DynWinRT.Tests.ValidatedScalarFields', [
+    DynWinRtType.i32(),
+    DynWinRtType.u8(),
+  ])
+  const scalar = DynWinRtStruct.create(scalarType)
+  t.throws(() => scalar.getI32(2), { message: /out of bounds/ })
+  t.throws(() => scalar.getI32(2 ** 32), { message: /u32 range/ })
+  t.throws(() => scalar.getI32(1.9), { message: /integer in the u32 range/ })
+  t.throws(() => scalar.getU64(0), { message: /expected u64/ })
+  t.throws(() => scalar.setU8(1, 256), { message: /outside the u8 range/ })
+  t.throws(() => scalar.setU8(1, 2 ** 32), { message: /u32 range/ })
+  t.throws(() => scalar.setU8(1, 1.9), { message: /integer in the u32 range/ })
+  t.throws(() => scalar.setI32(0, 2 ** 32), { message: /i32 range/ })
+
+  const innerAType = DynWinRtType.structType('DynWinRT.Tests.InnerA', [DynWinRtType.i32()])
+  const innerBType = DynWinRtType.structType('DynWinRT.Tests.InnerB', [DynWinRtType.i32()])
+  const outerType = DynWinRtType.structType('DynWinRT.Tests.Outer', [innerAType])
+  const outer = DynWinRtStruct.create(outerType)
+  const innerB = DynWinRtStruct.create(innerBType)
+  t.throws(() => outer.setStruct(0, innerB), {
+    message: /requires Struct.*found Struct/,
+  })
+})
+
 test('box IReference values', (t) => {
   const valueType = DynWinRtType.u32()
   const referenceType = DynWinRtType.parameterized(WinGuid.parse('61c17706-2d65-11e0-9ae8-d48564015472'), [valueType])
@@ -992,10 +1077,16 @@ test('release WinRT object values deterministically', (t) => {
 test('round-trip WinRT value arrays', (t) => {
   const array = DynWinRtArray.fromI32Values([1, 2, 3])
   t.is(array.len(), 3)
+  t.deepEqual(array.toI32Vec(), [1, 2, 3])
   t.deepEqual(
     array.toValues().map((value) => value.toNumber()),
     [1, 2, 3],
   )
+  t.deepEqual([...DynWinRtArray.fromU8Values([1, 2, 3]).toBuffer()], [1, 2, 3])
+  t.throws(() => array.toU64Vec(), { message: /element type I32/ })
+  t.throws(() => array.get(3), { message: /out of bounds/ })
+  t.throws(() => array.get(2 ** 32), { message: /u32 range/ })
+  t.throws(() => array.get(1.9), { message: /integer in the u32 range/ })
 })
 
 test('create empty vectors for large struct element types', (t) => {

bindings/js/__test__/tsfn-exception-child.mjs

@@ -0,0 +1,20 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+import { createRequire } from 'node:module'
+
+const runtime = createRequire(import.meta.url)(process.env.DYNWINRT_TEST_RUNTIME)
+const timeout = setTimeout(() => {
+  console.error('TSFN callback exception was not observed')
+  process.exit(1)
+}, 2_000)
+
+process.once('uncaughtException', (error) => {
+  clearTimeout(timeout)
+  console.log(`tsfn-uncaught:${error.message}`)
+  process.exit(0)
+})
+
+runtime.tsfnTestStartUnbounded(() => {
+  throw new Error('TSFN callback failure')
+}, 1, 0)

bindings/js/__test__/tsfn-liveness-child.mjs

@@ -0,0 +1,29 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+import { createRequire } from 'node:module'
+
+const runtime = createRequire(import.meta.url)(process.env.DYNWINRT_TEST_RUNTIME)
+const mode = process.argv[2]
+
+if (mode === 'strong') {
+  runtime.tsfnTestHoldStrong(() => {})
+  const release = setTimeout(() => {
+    runtime.tsfnTestReleaseHeld()
+    console.log('strong-release-fired')
+  }, 300)
+  release.unref()
+} else if (mode === 'weak') {
+  runtime.tsfnTestHoldWeak(() => {})
+  process.once('beforeExit', () => {
+    runtime.tsfnTestReleaseHeld()
+    console.log('weak-exited-without-timer')
+  })
+  const shouldNotFire = setTimeout(() => {
+    console.error('weak TSFN kept the event loop alive')
+    process.exit(1)
+  }, 1_000)
+  shouldNotFire.unref()
+} else {
+  throw new Error(`Unknown TSFN liveness mode: ${mode}`)
+}

bindings/js/__test__/tsfn-teardown-child.mjs

@@ -0,0 +1,29 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+import assert from 'node:assert/strict'
+import { createRequire } from 'node:module'
+import { Worker } from 'node:worker_threads'
+
+const runtimePath = process.env.DYNWINRT_TEST_RUNTIME
+const runtime = createRequire(import.meta.url)(runtimePath)
+runtime.tsfnTestReset()
+
+const worker = new Worker(new URL('./tsfn-teardown-worker.mjs', import.meta.url), {
+  workerData: { runtimePath },
+})
+const queued = await new Promise((resolve, reject) => {
+  worker.once('message', resolve)
+  worker.once('error', reject)
+})
+assert.equal(queued.produced, 10_000)
+assert.equal(queued.accepted, 10_000)
+assert.equal(queued.dropped, 0)
+
+await worker.terminate()
+await new Promise((resolve) => setTimeout(resolve, 100))
+
+const stats = runtime.tsfnTestStats()
+console.log(JSON.stringify(stats))
+assert.equal(stats.produced, 10_000)
+assert.equal(stats.dropped, stats.produced)

bindings/js/__test__/tsfn-teardown-worker.mjs

@@ -0,0 +1,15 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+import { createRequire } from 'node:module'
+import { parentPort, workerData } from 'node:worker_threads'
+
+const runtime = createRequire(import.meta.url)(workerData.runtimePath)
+const count = 10_000
+runtime.tsfnTestStartUnbounded(() => {}, count, 0)
+if (!runtime.tsfnTestWaitProduced(count, 2_000)) {
+  throw new Error('TSFN producer did not enqueue every payload before the timeout')
+}
+parentPort.postMessage(runtime.tsfnTestStats())
+
+Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 5_000)

bindings/js/__test__/tsfn-worker-delegate-child.mjs

@@ -0,0 +1,34 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+import assert from 'node:assert/strict'
+import { createRequire } from 'node:module'
+import { Worker } from 'node:worker_threads'
+
+const runtimePath = process.env.DYNWINRT_TEST_RUNTIME
+const runtime = createRequire(import.meta.url)(runtimePath)
+const worker = new Worker(new URL('./tsfn-worker-delegate-worker.mjs', import.meta.url), {
+  workerData: { runtimePath },
+})
+
+await new Promise((resolve, reject) => {
+  worker.once('message', resolve)
+  worker.once('error', reject)
+})
+runtime.tsfnTestArmCallPause()
+runtime.tsfnTestStartRetainedDelegateStress(1)
+assert.equal(runtime.tsfnTestWaitCallPaused(2_000), true)
+const termination = worker.terminate()
+assert.equal(runtime.tsfnTestWaitCleanupWaiting(2_000), true)
+assert.equal(runtime.tsfnTestCleanupAcquired(), false)
+runtime.tsfnTestReleaseCallPause()
+await termination
+assert.equal(runtime.tsfnTestCleanupAcquired(), true)
+const stress = runtime.tsfnTestWaitRetainedDelegateStress(5_000)
+assert.equal(stress.succeeded + stress.failed, 1)
+await new Promise((resolve) => setTimeout(resolve, 50))
+
+const hr = runtime.tsfnTestInvokeRetainedDelegate()
+console.log(`late-delegate-hr:${hr}`)
+assert.equal(hr, 0x80004005 | 0)
+runtime.tsfnTestReleaseRetainedDelegate()

bindings/js/__test__/tsfn-worker-delegate-worker.mjs

@@ -0,0 +1,16 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+import { createRequire } from 'node:module'
+import { parentPort, workerData } from 'node:worker_threads'
+
+const runtime = createRequire(import.meta.url)(workerData.runtimePath)
+const delegate = runtime.DynWinRtDelegate.create(
+  runtime.WinGuid.parse('8b4e9f50-8a4c-4f10-9cc0-df934c32015f'),
+  [],
+  () => {},
+)
+runtime.tsfnTestRetainDelegate(delegate)
+parentPort.postMessage('retained')
+
+Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 5_000)