Add a browser-compatible Worker polyfill (dedicated workers, structured clone, transfer lists, focused WPT regressions)

.github/lsan_suppressions.txt

@@ -0,0 +1,7 @@
+# LeakSanitizer suppressions for the Linux sanitizer job.
+#
+# WebKitGTK's JavaScriptCore grows global bookkeeping (e.g. WTF::BitVector under
+# JSObjectMake -> JSObject::setPrototypeDirect on a Structure transition) that it never
+# frees at exit, and LSan reports it as a direct leak attributed to whichever caller
+# happened to trigger the growth -- here napi reference creation. Not our allocation.
+leak:libjavascriptcoregtk

.github/workflows/build-ios.yml

@@ -41,5 +41,36 @@ jobs:
       - name: Run Tests
         run: |
           xcrun simctl install booted "Build/iOS/Tests/UnitTests/RelWithDebInfo-iphonesimulator/UnitTests.app"
-          xcrun simctl launch --console booted "com.jsruntimehost.unittests" 2> /tmp/exitCode
-          (exit $(cat /tmp/exitCode))
+          # The app reports its exit code as the last line of stderr (see iOS/App.mm). Tests also
+          # write progress there (the Worker WPT runner does), so only the last line is the code:
+          # handing the whole capture to `exit` made every run with such output fail with 255.
+          xcrun simctl launch --console booted "com.jsruntimehost.unittests" 2> /tmp/stderr
+          cat /tmp/stderr
+          (exit "$(tail -n 1 /tmp/stderr)")
+
+      # A crashed app writes nothing to the exit-code pipe (the step then fails with 255) and the
+      # console shows only what was flushed before the crash; the simulator's crash report is the
+      # only record of where it died.
+      - name: Collect crash reports
+        if: failure()
+        run: |
+          for report in $(ls -t ~/Library/Logs/DiagnosticReports/UnitTests-*.ips 2>/dev/null | head -n 3); do
+            echo "::group::$report"
+            python3 - "$report" <<'EOF'
+          import json, sys
+          raw = open(sys.argv[1]).read()
+          header, body = raw.split("\n", 1)
+          crash = json.loads(body)
+          images = crash.get("usedImages", [])
+          print("exception:", json.dumps(crash.get("exception")), "termination:", json.dumps(crash.get("termination")))
+          faulting = crash.get("faultingThread", 0)
+          for index, thread in enumerate(crash.get("threads", [])):
+              if index != faulting and not thread.get("triggered"):
+                  continue
+              print(f"--- thread {index} {thread.get('name') or ''} {thread.get('queue') or ''}")
+              for frame in thread.get("frames", [])[:40]:
+                  image = images[frame.get("imageIndex", 0)] if frame.get("imageIndex", 0) < len(images) else {}
+                  print(f"  {image.get('name', '?'):28s} {frame.get('symbol', '?')}+{frame.get('symbolLocation', 0)}")
+          EOF
+            echo "::endgroup::"
+          done

.github/workflows/build-linux.yml

@@ -54,6 +54,7 @@ jobs:
         run: ./UnitTests
         env:
           TSAN_OPTIONS: ${{ inputs.enable-thread-sanitizer && format('suppressions={0}/.github/tsan_suppressions.txt', github.workspace) || '' }}
+          LSAN_OPTIONS: ${{ inputs.enable-sanitizers && format('suppressions={0}/.github/lsan_suppressions.txt', github.workspace) || '' }}
           # JSC's concurrent GC on Linux uses SIGUSR1 + sem_wait to suspend mutator
           # threads at safepoints. TSan's signal interception delays SIGUSR1 delivery
           # indefinitely, deadlocking the Collector Thread's sem_wait. Disabling the
@@ -62,3 +63,8 @@ jobs:
           # thread_suspend() and is unaffected.
           JSC_useConcurrentGC: ${{ inputs.enable-thread-sanitizer && '0' || '' }}
 
+          # VM traps (how the execution-time-limit watchdog stops a running script) are delivered
+          # by signal on Linux, which TSan likewise never lets through: a terminated run-forever
+          # worker then spins until the test's runtime teardown joins it, and the job hangs after
+          # the Worker WPT suite has otherwise finished. Polling traps need no signal.
+          JSC_usePollingTraps: ${{ inputs.enable-thread-sanitizer && '1' || '' }}

CMakeLists.txt

@@ -51,6 +51,9 @@ FetchContent_Declare(UrlLib
     GIT_REPOSITORY https://github.com/BabylonJS/UrlLib.git
     GIT_TAG 0c991337a1160ba7a2d062bf8e342d0a66f48dc9
     EXCLUDE_FROM_ALL)
+FetchContent_Declare(zlib
+    URL "https://github.com/madler/zlib/archive/refs/tags/v1.3.1.tar.gz"
+    EXCLUDE_FROM_ALL)
 FetchContent_Declare(quickjs-ng
     GIT_REPOSITORY https://github.com/quickjs-ng/quickjs.git
     GIT_TAG 93d3f7df465027f487ed37e175a0bc3012fee79e
@@ -64,7 +67,9 @@ if(IOS)
     FetchContent_MakeAvailable_With_Message(ios-cmake)
     set(CMAKE_TOOLCHAIN_FILE "${ios-cmake_SOURCE_DIR}/ios.toolchain.cmake" CACHE PATH "")
     set(PLATFORM "OS64COMBINED" CACHE STRING "")
-    set(DEPLOYMENT_TARGET "12" CACHE STRING "")
+    # std::filesystem (used by the Worker polyfill) is unavailable below iOS 13 / macOS 10.15,
+    # and the project floor is well above iOS 12 regardless; keep 13 as the minimum.
+    set(DEPLOYMENT_TARGET "13" CACHE STRING "")
     set(CMAKE_XCODE_GENERATE_SCHEME TRUE)
 endif()
 
@@ -102,6 +107,10 @@ option(JSRUNTIMEHOST_POLYFILL_FILE "Include JsRuntimeHost Polyfill File and File
 option(JSRUNTIMEHOST_POLYFILL_PERFORMANCE "Include JsRuntimeHost Polyfill Performance." ON)
 option(JSRUNTIMEHOST_POLYFILL_TEXTDECODER "Include JsRuntimeHost Polyfill TextDecoder." ON)
 option(JSRUNTIMEHOST_POLYFILL_TEXTENCODER "Include JsRuntimeHost Polyfill TextEncoder." ON)
+option(JSRUNTIMEHOST_POLYFILL_STREAMS "Include JsRuntimeHost Polyfill Web Streams." ON)
+option(JSRUNTIMEHOST_POLYFILL_COMPRESSION "Include JsRuntimeHost Polyfills CompressionStream and DecompressionStream." ON)
+option(JSRUNTIMEHOST_POLYFILL_WORKER "Include JsRuntimeHost Polyfill Worker." ON)
+option(JSRUNTIMEHOST_POLYFILL_INDEXEDDB "Include JsRuntimeHost Polyfill IndexedDB." ON)
 
 # Sanitizers
 option(ENABLE_SANITIZERS "Enable AddressSanitizer and UBSan" OFF)
@@ -154,6 +163,17 @@ endif()
 FetchContent_MakeAvailable_With_Message(arcana.cpp)
 set_property(TARGET arcana PROPERTY FOLDER Dependencies)
 
+if(ANDROID)
+    FetchContent_GetProperties(AndroidExtensions)
+    if(NOT AndroidExtensions_POPULATED)
+        FetchContent_Populate(AndroidExtensions)
+        FetchContent_GetProperties(AndroidExtensions)
+        add_subdirectory(${androidextensions_SOURCE_DIR} ${androidextensions_BINARY_DIR})
+    else()
+        add_subdirectory(${androidextensions_SOURCE_DIR} ${androidextensions_BINARY_DIR})
+    endif()
+endif()
+
 if(JSRUNTIMEHOST_POLYFILL_XMLHTTPREQUEST OR JSRUNTIMEHOST_POLYFILL_FETCH)
     FetchContent_MakeAvailable_With_Message(UrlLib)
     set_property(TARGET UrlLib PROPERTY FOLDER Dependencies)

Core/AppRuntime/CMakeLists.txt

@@ -63,6 +63,8 @@ if(NAPI_JAVASCRIPT_ENGINE STREQUAL "V8" AND JSRUNTIMEHOST_CORE_APPRUNTIME_V8_INS
     set_property(TARGET v8inspector PROPERTY FOLDER Dependencies)
 elseif(NAPI_JAVASCRIPT_ENGINE STREQUAL "QuickJS")
     target_link_libraries(AppRuntime PRIVATE qjs)
+elseif(NAPI_JAVASCRIPT_ENGINE STREQUAL "JavaScriptCore" AND UNIX AND NOT APPLE)
+    target_link_libraries(AppRuntime PRIVATE ${CMAKE_DL_LIBS})
 endif()
 
 set_property(TARGET AppRuntime PROPERTY FOLDER Core)

Core/AppRuntime/Include/Babylon/AppRuntime.h

@@ -26,6 +26,11 @@ namespace Babylon
             // Optional handler for unhandled exceptions.
             std::function<void(const Napi::Error&)> UnhandledExceptionHandler{DefaultUnhandledExceptionHandler};
 
+            // Optional final runtime-thread notification after engine and
+            // environment teardown. The callback is the thread's last action
+            // and must not access that runtime's Napi objects.
+            std::function<void()> ThreadExitHandler{};
+
             // Defines whether to enable the debugger. Only implemented for V8 and Chakra.
             bool EnableDebugger{false};
 
@@ -48,6 +53,17 @@ namespace Babylon
         void Suspend();
         void Resume();
 
+        // Permanently stop accepting work and exit after the currently
+        // executing dispatch returns. Unlike Terminate(), this does not
+        // interrupt JavaScript in the middle of its current task.
+        void Close();
+
+        // Permanently stop accepting work and request interruption of any
+        // JavaScript currently executing. The interruption is immediate on
+        // engines with an interrupt hook (including system JavaScriptCore) and
+        // cooperative between dispatches on the remaining engines.
+        void Terminate();
+
         void Dispatch(Dispatchable<void(Napi::Env)> callback);
 
         // Default unhandled exception handler that outputs the error message to the program output.
@@ -87,6 +103,14 @@ namespace Babylon
 
         Internal::DelayedTaskScheduler& GetDelayedTaskScheduler();
 
+        // Engine tiers may query the shared termination flag without exposing
+        // engine types in the public API.
+        bool IsTerminationRequested() const noexcept;
+
+        // Execution watchdogs use a separate flag so Close() can finish the
+        // current task while Terminate() can still interrupt a tight loop.
+        bool IsExecutionTerminationRequested() const noexcept;
+
         Options m_options;
 
         class Impl;

Core/AppRuntime/Source/AppRuntime.cpp

@@ -6,6 +6,7 @@
 #include <arcana/threading/dispatcher.h>
 
 #include <cassert>
+#include <atomic>
 #include <optional>
 #include <mutex>
 #include <thread>
@@ -40,6 +41,8 @@ namespace Babylon
         std::unique_ptr<Internal::DelayedTaskScheduler> m_delayedTaskScheduler{std::make_unique<Internal::DelayedTaskScheduler>()};
         bool m_delayedTaskSchedulerRegistered{};
         std::thread m_thread;
+        std::atomic_bool m_terminationRequested{false};
+        std::atomic_bool m_executionTerminationRequested{false};
     };
 
     AppRuntime::AppRuntime() :
@@ -51,7 +54,13 @@ namespace Babylon
         : m_options{std::move(options)}
         , m_impl{std::make_unique<Impl>()}
     {
-        m_impl->m_thread = std::thread{[this] { RunPlatformTier(); }};
+        m_impl->m_thread = std::thread{[this] {
+            RunPlatformTier();
+            if (m_options.ThreadExitHandler)
+            {
+                m_options.ThreadExitHandler();
+            }
+        }};
 
         Dispatch([this](Napi::Env env) {
             JsRuntime::CreateForJavaScript(env, [this](auto func) { Dispatch(std::move(func)); });
@@ -67,17 +76,7 @@ namespace Babylon
             m_impl->m_suspensionLock.reset();
         }
 
-        // Cancel immediately so pending work is dropped promptly, then append
-        // a no-op work item to wake the worker thread from blocking_tick. The
-        // no-op goes through push() which acquires the queue mutex, avoiding
-        // the race where a bare notify_all() can be missed by wait().
-        //
-        // NOTE: This preserves the existing shutdown behavior where pending
-        // callbacks are dropped on cancellation. A more complete solution
-        // would add cooperative shutdown (e.g. NotifyDisposing/Rundown) so
-        // consumers can finish cleanup work before the runtime is destroyed.
-        m_impl->m_cancelSource.cancel();
-        m_impl->Append([](Napi::Env) {});
+        Terminate();
 
         m_impl->m_thread.join();
     }
@@ -126,8 +125,44 @@ namespace Babylon
         m_impl->m_suspensionLock.reset();
     }
 
+    void AppRuntime::Terminate()
+    {
+        m_impl->m_executionTerminationRequested.store(true);
+        Close();
+    }
+
+    void AppRuntime::Close()
+    {
+        if (m_impl->m_terminationRequested.exchange(true))
+        {
+            return;
+        }
+
+        m_impl->m_cancelSource.cancel();
+
+        // Queueing under the dispatcher's mutex makes the wake-up immune to
+        // the missed-notification race covered by DestroyDoesNotDeadlock.
+        // The cancelled run loop drops this no-op rather than executing it.
+        m_impl->m_dispatcher.queue([]() {});
+    }
+
+    bool AppRuntime::IsTerminationRequested() const noexcept
+    {
+        return m_impl->m_terminationRequested.load();
+    }
+
+    bool AppRuntime::IsExecutionTerminationRequested() const noexcept
+    {
+        return m_impl->m_executionTerminationRequested.load();
+    }
+
     void AppRuntime::Dispatch(Dispatchable<void(Napi::Env)> func)
     {
+        if (IsTerminationRequested())
+        {
+            return;
+        }
+
         m_impl->Append([this, func{std::move(func)}](Napi::Env env) mutable {
             Execute([this, env, func{std::move(func)}]() mutable {
                 // Some engines (notably Hermes) require an open NAPI handle

Core/AppRuntime/Source/AppRuntime_JavaScriptCore.cpp

@@ -1,12 +1,101 @@
 #include "AppRuntime.h"
 #include <napi/env.h>
 
+#if __has_include(<JavaScriptCore/JSContextRefPrivate.h>)
+#include <JavaScriptCore/JSContextRefPrivate.h>
+#define JSRUNTIMEHOST_HAS_JSC_EXECUTION_TIME_LIMIT 1
+#elif defined(__unix__) || defined(__APPLE__)
+// Apple's SDK ships no JSContextRefPrivate.h either, but the system JavaScriptCore framework
+// exports the same C ABI (it is SPI there); resolving it dynamically keeps Worker::terminate()
+// able to stop a tight loop, exactly as on WebKitGTK. Without it a terminated worker that never
+// yields keeps its thread forever and the finalizer's join deadlocks at teardown.
+#include <dlfcn.h>
+#define JSRUNTIMEHOST_LOOKUP_JSC_EXECUTION_TIME_LIMIT 1
+#endif
+
+namespace
+{
+#if defined(JSRUNTIMEHOST_HAS_JSC_EXECUTION_TIME_LIMIT) || \
+    defined(JSRUNTIMEHOST_LOOKUP_JSC_EXECUTION_TIME_LIMIT)
+    using ShouldTerminateCallback = bool (*)(JSContextRef, void*);
+    using SetExecutionTimeLimit = void (*)(JSContextGroupRef, double, ShouldTerminateCallback, void*);
+    using ClearExecutionTimeLimit = void (*)(JSContextGroupRef);
+
+    // How often running script is polled for Terminate().
+    constexpr double ExecutionTimeLimitSeconds{0.05};
+
+    struct ExecutionWatchdog
+    {
+        Babylon::AppRuntime* Runtime{};
+        SetExecutionTimeLimit Set{};
+        ClearExecutionTimeLimit Clear{};
+        ShouldTerminateCallback Callback{};
+
+        bool Available() const
+        {
+            return Set != nullptr && Clear != nullptr;
+        }
+
+        // JavaScriptCore restarts the watchdog timer only when the callback sets a new limit
+        // itself: its "callback did nothing" branch takes the CPU deadline that has just expired
+        // for a timer the callback started and schedules nothing, so a single declined poll would
+        // otherwise silence the watchdog until the running script returns on its own.
+        void Rearm(JSContextRef context)
+        {
+            Set(JSContextGetGroup(context), ExecutionTimeLimitSeconds, Callback, this);
+        }
+    };
+#endif
+}
+
+#if __APPLE__
+#include <CoreFoundation/CoreFoundation.h>
+#endif
+
 namespace Babylon
 {
     void AppRuntime::RunEnvironmentTier(const char*)
     {
         auto globalContext = JSGlobalContextCreateInGroup(nullptr, nullptr);
 
+#if defined(JSRUNTIMEHOST_HAS_JSC_EXECUTION_TIME_LIMIT) || \
+    defined(JSRUNTIMEHOST_LOOKUP_JSC_EXECUTION_TIME_LIMIT)
+        auto contextGroup = JSContextGetGroup(globalContext);
+        ExecutionWatchdog watchdog{this};
+#if defined(JSRUNTIMEHOST_HAS_JSC_EXECUTION_TIME_LIMIT)
+        watchdog.Set = &JSContextGroupSetExecutionTimeLimit;
+        watchdog.Clear = &JSContextGroupClearExecutionTimeLimit;
+#else
+        // WebKitGTK deliberately omits JSContextRefPrivate.h from its dev
+        // package, but current system builds export the same C ABI. Resolve it
+        // dynamically so JsRuntimeHost stays buildable against the public
+        // package and gracefully falls back to between-dispatch termination on
+        // older builds that do not export the watchdog.
+        watchdog.Set = reinterpret_cast<SetExecutionTimeLimit>(
+            dlsym(RTLD_DEFAULT, "JSContextGroupSetExecutionTimeLimit"));
+        watchdog.Clear = reinterpret_cast<ClearExecutionTimeLimit>(
+            dlsym(RTLD_DEFAULT, "JSContextGroupClearExecutionTimeLimit"));
+#endif
+        // Poll at a modest interval while JS is running. Returning true from
+        // this callback raises a catchable termination exception (a bare
+        // string, "JavaScript execution terminated.") and lets the AppRuntime
+        // thread unwind, so Worker::terminate() also stops a tight loop that
+        // never reaches the dispatch queue.
+        watchdog.Callback = [](JSContextRef context, void* data) {
+            auto* watchdog = static_cast<ExecutionWatchdog*>(data);
+            if (watchdog->Runtime->IsExecutionTerminationRequested())
+            {
+                return true;
+            }
+            watchdog->Rearm(context);
+            return false;
+        };
+        if (watchdog.Available())
+        {
+            watchdog.Set(contextGroup, ExecutionTimeLimitSeconds, watchdog.Callback, &watchdog);
+        }
+#endif
+
 #if __APPLE__
         if (__builtin_available(iOS 16.4, macOS 13.3, *))
         {
@@ -18,6 +107,14 @@ namespace Babylon
 
         Run(env);
 
+#if defined(JSRUNTIMEHOST_HAS_JSC_EXECUTION_TIME_LIMIT) || \
+    defined(JSRUNTIMEHOST_LOOKUP_JSC_EXECUTION_TIME_LIMIT)
+        if (watchdog.Available())
+        {
+            watchdog.Clear(contextGroup);
+        }
+#endif
+
         JSGlobalContextRelease(globalContext);
 
         // Detach must come after JSGlobalContextRelease since it triggers finalizers which require env.
@@ -30,6 +127,11 @@ namespace Babylon
 
     void AppRuntime::DrainMicrotasks(Napi::Env)
     {
-        // JavaScriptCore drains microtasks automatically at script boundaries.
+        // JavaScriptCore drains Promise jobs at script boundaries, but Apple
+        // platform work such as asynchronous WebAssembly compilation completes
+        // through the current thread's run loop.
+#if __APPLE__
+        CFRunLoopRunInMode(kCFRunLoopDefaultMode, 0.0, true);
+#endif
     }
 }