Say that LimitMemory bounds what a script allocates, not what a host copies out of its result

[lahma]

#4173 charges a deferred + when it is built, so no single value a script hands back can cost more than its budget to read. #4175 is what that leaves open: many values that share characters. This PR does the first thing the issue lists. The documentation now says that LimitMemory bounds what the script allocates while it runs, not what a host copies out of the result afterwards, and it names the read that is bounded.

What the docs now say

docs/guide/constraints.md. The LimitMemory paragraph now states the scope and links to a new section, Bound what the host copies out of a result. The section says:

• A long slice can be a view of the string it was cut from, and a long a + b refers to its operands. Each is charged only for what it adds.
• ToString() and ToObject() copy every value in full, after the operation has ended and outside every constraint. The section gives the measured numbers.
• The bounded read is engine.ConvertResult(value, ResultLimits.Conservative). A compiled sample (docs:guide-bounded-result in Jint.Documentation.Samples) shows it beside ToObject().
• What each limit checks:
  • MaxStringLength is checked against a string's length before its characters are copied.
  • MaxOutputCharacters is counted after each copy.
  • Together they bound a conversion: at most 3,000,000 characters under Conservative.
• A refusal throws ResultLimitExceededException, and its Limit names the bound that was reached.
• Called without limits, ConvertResult uses Options.ResultLimits. That is unlimited by default, and UntrustedCodeLimits.ResultLimits under ForUntrustedCode. An unlimited conversion still runs under LimitMemory, but it is charged only after the copy is made.

The #4173 paragraph that mixed both points keeps only the build-time charge.

XML remarks. No paragraph was added past the four docs/xml-doc-style.md allows.

• MemoryLimitConstraint: the fourth paragraph is reworded, still four lines. The AllocatedBytes sentence it displaced moves to that property's own <remarks>.
• Engine.ConvertResult: a third paragraph says which two limits to set and what each checks.
• JsValue.ToObject: a two-line <remarks> says nothing bounds what it copies, and points to ConvertResult.

Elsewhere.

• untrusted-code.md gets one host-responsibility bullet.
• THREAT_MODEL.md gets a residual-mitigation bullet in TM-06 (memory) and one in TM-17 (result conversion). The TM-17 bullet records the MaxOutputCharacters ordering.
• Jint/Constraints/AGENTS.md is unchanged, at 32,582 bytes. Its Charge a deferred string concatenation to LimitMemory when it is built #4173 bullet already says "values sharing one operand stay open; ResultLimits bounds those".

Why: the two shapes from #4175, measured on this branch

The numbers come from a probe console outside the repository. They are GC.GetAllocatedBytesForCurrentThread deltas and MemoryLimitConstraint.AllocatedBytes, never timings. The engine has LimitMemory(16 MiB), and each variant ran in its own process.

shape	charged while the script ran	host ToObject()	ConvertResult(…, Conservative)	ConvertResult, only MaxOutputCharacters = 2M	ConvertResult, default ResultLimits
64 × s + 'q' over one 1M-char rope	2.2 MB	134 MB	refused on StringLength, 0.0 MB	4.2 MB copied, then refused	134 MB copied, then MemoryLimitExceededException
64 slice views of one 1M-char string	2.2 MB	132 MB	refused on StringLength, 0.0 MB	not run	132 MB copied, then MemoryLimitExceededException
64 × 900,000-char slices (under MaxStringLength)	2.2 MB	not run	2.7M chars observed, 5.4 MB copied, refused on OutputCharacters	5.4 MB, same	not run

The last two columns are why the docs say "set both":

• With only MaxOutputCharacters, a conversion copies the string that crosses the limit before it refuses.
• With neither, LimitMemory sees the copy only after it has been made.

The issue body says MaxOutputCharacters "checks the logical length before anything is flattened". That is not what the code does: ResultConverter counts output characters after ToString(). The #4162 measurement it quotes was refused by MaxStringLength.

Tests

HostDeferredStringMemoryLimitTests.ConvertResultRefusesValuesSharingOneStringBeforeCopyingThem has two cases, slice views and concatenations over one operand. Each asserts that ConvertResult(value, ResultLimits.Conservative) throws ResultLimitExceededException with Limit == StringLength. Each also asserts that the conversion entry's AllocatedBytes is under 1 MB; copying one value would allocate 2 MB. The test uses only the public API. Neither case flattens its subject.

Broken on purpose. I moved CountStringLength after value.ToString() in ResultConverter.ConvertPrimitive. Both cases failed with Expected constraint.AllocatedBytes to be less than 1048576L … but found 2100032L (and 2100720L). I then restored the file.

All runs are Release.

• Jint.Tests.PublicInterface, whole project, net10.0, no --timeout: 3,819 total, 0 failed, 21 skipped (the existing skips).
• HostDeferredStringMemoryLimitTests, HostResultLimitsTests and PublicApiDocumentationTest on net8.0 and net472: 42 total each, 0 failed.
• MigrationGuideTests, AgentInstructionFileTests and SpecCitationTests (net10.0): 11 of 11 passed, before and after the rebase.
• PublicApiTest is unchanged. The change is XML docs only, with no signatures touched.
• Jint builds with 0 warnings on all five TFMs, and every new cref resolves in each TFM's Jint.xml. Jint.Documentation.Samples builds with 0 warnings.
• Docs checks:
  • npm run samples:check: 10 snippets current.
  • npm run lint: 0 issues in 97 files.
  • DOCS_BASE=/jint/ npm run build and npm run check-links: no dead internal links, assets or anchors. That includes the new #bound-what-the-host-copies-out-of-a-result.
  • npm run test:tools: 6 of 7. The failing one, check-links.test.mjs "rejects missing generated targets…", fails on Windows only. It expects guide/start.html and gets guide\start.html. This PR does not touch docs/scripts.

No benchmark was run: the engine has no code change.

Base: 7d9cdcc8fa1179b8ea92db17f617f6154dc56b7e (upstream main).

Part of #4175. The issue's engine-side options are still open: charging a view or rope root when it leaves through the result path, or capping the aggregate logical length reachable from the completion value. This PR only documents the bounded read that exists today.

🤖 Generated with Claude Code