Embedded scripts' own positions, a heap that collects, and v0.0.29

An embedded script's stack positions are now counted from its own text, a sandbox's host requests and redirects are bounded and checked, a large script keeps one copy of its source and its compiled code between runs, and a heap ceiling collects before it convicts.

The browser engine compiles a host's script behind its preamble, and stack positions had been counted from the top of the joined text: an app's line N read as line N+154. Call sites now record the host's own positions as they are compiled, setScriptOrigin names a script and moves its positions as Node's vm.Script options do, and a syntax error gives its position (2183f7e2, 1d0f6115). An audit of 22 October found that the embed kit followed a permitted redirect before checking where it went; each redirect is now checked first (3ab80ed0), and a sandbox's host requests have an owner, an abort signal and a bound of 64 at once (35d3f860).

A function's source text is now a range of one shared copy of its script, which takes TypeScript's peak working set from 349 to 310 MiB (176832e7), and zipp js keeps a large script's compiled code between runs, so TypeScript's workload finishes in 0.83 s instead of 1.14 s when run again (63f2e776). A class evaluated more than once now resolves super against its own evaluation (57d4b5ef), and inherited reads and private fields are answered from a site's first cache way (ed09b62a). The release's full security run then failed one test: a script dropping phase after phase under a 24 MiB heap ceiling was convicted with about 7 MB alive, because a minor collection's check did not wait for the major that frees old garbage and the slot tables doubled to hold it. Both are fixed (60cdf143), and v0.0.29 was published on 23 October from 58c92a59.