doc, test: document and test vm timeout escapes

Using `process.nextTick()`, `Promise`, or `queueMicrotask()`, it
is possible to escape the `timeout` set when running code with
`vm.runInContext()`, `vm.runInThisContext()`, and
`vm.runInNewContext()`.

This documents the issue and adds three known_issues tests.

Refs: https://github.com/nodejs/node/issues/3020
PR-URL: https://github.com/nodejs/node/pull/23743
Refs: https://github.com/nodejs/node/issues/3020
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Tiancheng "Timothy" Gu <timothygu99@gmail.com>

1 files changed, 32 insertions, 0 deletions

diff --git a/doc/api/vm.md b/doc/api/vm.md
index 5bf09de379..842ae3b81a 100644
--- a/doc/api/vm.md
+++ b/doc/api/vm.md
@@ -962,6 +962,38 @@ within which it can operate. The process of creating the V8 Context and
 associating it with the `sandbox` object is what this document refers to as
 "contextifying" the `sandbox`.
 
+## Timeout limitations when using process.nextTick(), Promises, and queueMicrotask()
+
+Because of the internal mechanics of how the `process.nextTick()` queue and
+the microtask queue that underlies Promises are implemented within V8 and
+Node.js, it is possible for code running within a context to "escape" the
+`timeout` set using `vm.runInContext()`, `vm.runInNewContext()`, and
+`vm.runInThisContext()`.
+
+For example, the following code executed by `vm.runInNewContext()` with a
+timeout of 5 milliseconds schedules an infinite loop to run after a promise
+resolves. The scheduled loop is never interrupted by the timeout:
+
+```js
+const vm = require('vm');
+
+function loop() {
+  while (1) console.log(Date.now());
+}
+
+vm.runInNewContext(
+  'Promise.resolve().then(loop);',
+  { loop, console },
+  { timeout: 5 }
+);
+```
+
+This issue also occurs when the `loop()` call is scheduled using
+the `process.nextTick()` and `queueMicrotask()` functions.
+
+This issue occurs because all contexts share the same microtask and nextTick
+queues.
+
 [`Error`]: errors.html#errors_class_error
 [`ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING`]: errors.html#ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING
 [`URL`]: url.html#url_class_url