doc, test: document and test vm timeout escapes

Using `process.nextTick()`, `Promise`, or `queueMicrotask()`, it
is possible to escape the `timeout` set when running code with
`vm.runInContext()`, `vm.runInThisContext()`, and
`vm.runInNewContext()`.

This documents the issue and adds three known_issues tests.

Refs: https://github.com/nodejs/node/issues/3020
PR-URL: https://github.com/nodejs/node/pull/23743
Refs: https://github.com/nodejs/node/issues/3020
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Tiancheng "Timothy" Gu <timothygu99@gmail.com>

3 files changed, 120 insertions, 0 deletions

diff --git a/test/known_issues/test-vm-timeout-escape-nexttick.js b/test/known_issues/test-vm-timeout-escape-nexttick.js
new file mode 100644
index 0000000000..8afe2fb8ce
--- /dev/null
+++ b/test/known_issues/test-vm-timeout-escape-nexttick.js
@@ -0,0 +1,41 @@
+'use strict';
+
+// https://github.com/nodejs/node/issues/3020
+// Promises, nextTick, and queueMicrotask allow code to escape the timeout
+// set for runInContext, runInNewContext, and runInThisContext
+
+require('../common');
+const assert = require('assert');
+const vm = require('vm');
+
+const NS_PER_MS = 1000000n;
+
+const hrtime = process.hrtime.bigint;
+const nextTick = process.nextTick;
+
+function loop() {
+  const start = hrtime();
+  while (1) {
+    const current = hrtime();
+    const span = (current - start) / NS_PER_MS;
+    if (span >= 100n) {
+      throw new Error(
+        `escaped timeout at ${span} milliseconds!`);
+    }
+  }
+}
+
+assert.throws(() => {
+  vm.runInNewContext(
+    'nextTick(loop); loop();',
+    {
+      hrtime,
+      nextTick,
+      loop
+    },
+    { timeout: 5 }
+  );
+}, {
+  code: 'ERR_SCRIPT_EXECUTION_TIMEOUT',
+  message: 'Script execution timed out after 5ms'
+});
diff --git a/test/known_issues/test-vm-timeout-escape-promise.js b/test/known_issues/test-vm-timeout-escape-promise.js
new file mode 100644
index 0000000000..4452c83cd1
--- /dev/null
+++ b/test/known_issues/test-vm-timeout-escape-promise.js
@@ -0,0 +1,39 @@
+'use strict';
+
+// https://github.com/nodejs/node/issues/3020
+// Promises, nextTick, and queueMicrotask allow code to escape the timeout
+// set for runInContext, runInNewContext, and runInThisContext
+
+require('../common');
+const assert = require('assert');
+const vm = require('vm');
+
+const NS_PER_MS = 1000000n;
+
+const hrtime = process.hrtime.bigint;
+
+function loop() {
+  const start = hrtime();
+  while (1) {
+    const current = hrtime();
+    const span = (current - start) / NS_PER_MS;
+    if (span >= 100n) {
+      throw new Error(
+        `escaped timeout at ${span} milliseconds!`);
+    }
+  }
+}
+
+assert.throws(() => {
+  vm.runInNewContext(
+    'Promise.resolve().then(loop); loop();',
+    {
+      hrtime,
+      loop
+    },
+    { timeout: 5 }
+  );
+}, {
+  code: 'ERR_SCRIPT_EXECUTION_TIMEOUT',
+  message: 'Script execution timed out after 5ms'
+});
diff --git a/test/known_issues/test-vm-timeout-escape-queuemicrotask.js b/test/known_issues/test-vm-timeout-escape-queuemicrotask.js
new file mode 100644
index 0000000000..8de33bc24d
--- /dev/null
+++ b/test/known_issues/test-vm-timeout-escape-queuemicrotask.js
@@ -0,0 +1,40 @@
+'use strict';
+
+// https://github.com/nodejs/node/issues/3020
+// Promises, nextTick, and queueMicrotask allow code to escape the timeout
+// set for runInContext, runInNewContext, and runInThisContext
+
+require('../common');
+const assert = require('assert');
+const vm = require('vm');
+
+const NS_PER_MS = 1000000n;
+
+const hrtime = process.hrtime.bigint;
+
+function loop() {
+  const start = hrtime();
+  while (1) {
+    const current = hrtime();
+    const span = (current - start) / NS_PER_MS;
+    if (span >= 100n) {
+      throw new Error(
+        `escaped timeout at ${span} milliseconds!`);
+    }
+  }
+}
+
+assert.throws(() => {
+  vm.runInNewContext(
+    'queueMicrotask(loop); loop();',
+    {
+      hrtime,
+      queueMicrotask,
+      loop
+    },
+    { timeout: 5 }
+  );
+}, {
+  code: 'ERR_SCRIPT_EXECUTION_TIMEOUT',
+  message: 'Script execution timed out after 5ms'
+});