Key the host-boundary constraint gate on execution depth and close remaining lanes

[lahma]

Summary

Final hardening pass over the host-boundary constraint mechanism from #2713/#2714 (an adversarial review round completed against #2714's diff after it merged). The headline fix: #2714's gate keyed on the ambient evaluation context, which async resume paths do not install — so all boundary checks were silently disabled during host-driven event-loop drains, and a cancellation could go entirely unobserved there.

Fixes

• Gate on execution-context stack depth, not the ambient evaluation context. Resolving a promise from the host (Advanced.RegisterPromise().Resolve(...), UnwrapIfPromise waits) drains async continuations that create evaluation contexts via _activeEvaluationContext ?? new ... without installing the ambient field, so Gate host-boundary constraint checks on active evaluation and harden coverage #2714's gate saw null mid-drain and skipped every check — while (cond) { slowWork(); await ...; } could ignore cancellation indefinitely. Every execution shape (script evaluation, calls, generator/async resumes, module evaluation) pushes an execution context and idle host-side access does not, so depth > 1 is the reliable "evaluation in progress" signal. A regression test drives the drain from a host-resolved promise.
• Debug exemption narrowed from all debug-mode execution to debugger expression evaluation only (DebugHandler.Evaluate, tracked via an engine flag). Gate host-boundary constraint checks on active evaluation and harden coverage #2714 disabled the checks for the whole lifetime of any debugger-enabled engine; now normal full-speed debug-mode execution keeps full enforcement while watch/breakpoint-condition evaluation stays exempt. Tests cover both directions.
• Throwing host calls now re-check inside the TargetInvocationException conversion handlers — previously a loop of throwing host calls never reached the return-side checks and fell back to the 64-statement countdown.
• Awaitable-result ordering completed in the sibling lanes: MethodInfoFunction and the ReflectionAccessor read lane (check relocated to ReflectionDescriptor.DoGet) now convert results before the check, matching Gate host-boundary constraint checks on active evaluation and harden coverage #2714's DelegateWrapper fix, so an in-flight Task always gets its promise continuation attached.
• Remaining interop lanes covered: dictionary in/delete (ContainsDictionaryKey/TryRemoveDictionaryValue), the ICollection count fast path, array-like integer-index reads (ArrayLikeWrapper.GetAt), wrapped-dictionary key enumeration (for-in/Object.keys, per key pulled from the user enumerator), and CLR operator overloads — checked in the operator call sites outside their catch-alls, so constraint exceptions are no longer laundered into TargetInvocationException (this also restores per-call detection that Gate host-boundary constraint checks on active evaluation and harden coverage #2714 had removed entirely for operators).
• Iterator disposal: a boundary check throwing during MoveNext (before for-of has a successful first step to close from) now disposes the user's enumerator instead of leaking it.
• Flaky-test removal: the idle-timeout host-side test no longer executes an interop read under a live short timeout (it could race the CTS timer on a loaded runner), and the new TimeConstraint boundary test is deterministic — the host call polls the public Constraints.Check() until the budget has observably expired, immune to CTS timer starvation.

Still intentionally uninstrumented: built-in ClrFunction dispatch (per-call cost on hot built-ins; built-ins self-check via Engine.ConstraintCheckInterval) and user-supplied converter/factory callbacks. Entry checks remain deliberately absent: they would block host cleanup calls in JS finally blocks; the documented residual is that a cancelled script can start at most one more host call per boundary.

Verification

10 new/updated tests in ExecutionConstraintTests (61 total in the class), all deterministic; the host-driven async drain, debug-mode enforcement, and debugger-exemption tests fail against #2714 as merged. Full Jint.Tests, Jint.Tests.PublicInterface, Jint.Tests.CommonScripts and Test262 (99,431) pass on net10.0 and net472. The discussion #2707 repro still throws at ~290 ms.

No checks were added to the benchmarked interop read lanes relative to #2714 (the ClrObject/JsonNode check moved after result conversion, the dictionary hit-path check is unchanged and its miss-path double-check was removed); allocations are byte-identical across all benchmark runs.

🤖 Generated with Claude Code