Gate host-boundary constraint checks on active evaluation and harden coverage

[lahma]

Summary

Follow-up hardening for #2713 (merged before this review pass landed on the branch). An adversarial multi-agent review of the boundary-check mechanism confirmed several edge-case regressions and coverage gaps in the merged version; this PR fixes them.

Regressions fixed

• Host-initiated interop access observed constraint state outside script execution (A/B-verified against the pre-Re-check amortized constraints at interpreter/host-code boundaries #2713 behavior). The time constraint's CTS is re-armed at the end of every run and keeps counting while the engine is idle, and CancellationConstraint state survives execution — so after Re-check amortized constraints at interpreter/host-code boundaries #2713, reading a wrapped object's members from plain C# after execution could throw TimeoutException/ExecutionCanceledException with no script running. The boundary check is now gated on an active evaluation context.
• Entry checks blocked host cleanup calls: with cancellation pending, a CLR delegate invoked inside a JS finally block (release-a-lock pattern) threw before the delegate body ran, skipping cleanup that executed pre-Re-check amortized constraints at interpreter/host-code boundaries #2713. Checks now run only after the host call returns — the post-return check alone preserves the ≤ 1-host-call detection bound.
• Debugger watch evaluation: an engine paused at a breakpoint longer than its TimeoutInterval would deterministically fail every interop read in watch/conditional-breakpoint expressions. Debug-mode engines now keep the pre-existing amortized-countdown-only behavior.
• Unobserved Task: the check between DynamicInvoke and promise conversion could discard a still-running Task returned by an async host delegate, surfacing its eventual fault as TaskScheduler.UnobservedTaskException. Awaitable results now reach ConvertAwaitableToPromise (attaching the continuation) before the check.
• Constraint-exception laundering: the checks inside MethodDescriptor.Call sat inside operator-overload resolution's catch-all, which rethrows as TargetInvocationException — embedder sandbox handlers catching ExecutionCanceledException/TimeoutException would miss. The constructor-lane check moved to TypeReference.Construct, where it now also covers the Options.Interop.CreateTypeReferenceObject factory and Activator value-type branches.

Coverage extended

The #2707 deferred-detection gap also existed in lanes #2713 did not instrument; now covered:

• Dictionary-shaped interop (TryGetDictionaryValue/TrySetDictionaryValue on wrapped IDictionary<,> — e.g. a service-backed dictionary with slow lookups)
• Wrapped-IEnumerable iteration (MoveNext in for-of)
• The Options.Interop.MemberAccessor callback

Also removed the redundant GetterFunction/SetterFunction checks (both consumers either re-check inside ReflectionAccessor or run no host code).

Still intentionally uninstrumented: built-in ClrFunction dispatch (per-call cost on hot built-ins; built-ins self-check via Engine.ConstraintCheckInterval), operator-overload resolution, and user-supplied converter/factory callbacks.

Tests

• The CTS-timer-dependent timeout test from Re-check amortized constraints at interpreter/host-code boundaries #2713 (flaky under thread-pool starvation, cf. the PR Enforce custom regex-engine timeout via an inline deadline instead of a thread-pool timer #2686 investigation) is replaced by a deterministic lone-host-call test that isolates the post-invoke check.
• New regression guards: host-side C# reads must not throw after post-execution cancellation or idle-engine budget expiry; debug-mode engines complete short host-call loops despite mid-loop cancellation.
• New deterministic lane tests for dictionary reads and for-of iteration (cancel inside the 3rd host call, exactly 3 calls asserted).
• Shared scaffolding extracted for the cancellation tests.

Full Jint.Tests, Jint.Tests.PublicInterface, Jint.Tests.CommonScripts and Test262 suites pass on net10.0 and net472. InteropLambdaBenchmark.ForLoop A/B (including the newly covered Dictionary lane) shows no regression — all rows within variance, allocations byte-identical.

🤖 Generated with Claude Code