free the engine's C string copy in to_string_lossy (#1311)

* free the engine's C string copy in to_string_lossy

* return an error from to_string_lossy when the conversion fails

Author: nabeel-dev21

crates/javy/CHANGELOG.md

@@ -15,6 +15,14 @@ Versioning](https://semver.org/spec/v2.0.0.html).
   offset and length against the backing `ArrayBuffer` and return an error for an
   out-of-range or overflowing range instead of panicking. `readSync` no longer
   builds its mutable slice through raw FFI.
+- `to_string_lossy` now returns `rquickjs::Result<String>` and returns
+  `Error::Exception` if the engine runs out of memory converting the string.
+
+### Fixed
+
+- `to_string_lossy` no longer leaks the engine-allocated copy of the string it
+  converts, and no longer constructs a slice from a null pointer when that
+  allocation fails.
 
 ## [8.1.0] - 2026-07-30
 

crates/javy/src/apis/text_encoding/mod.rs

@@ -106,7 +106,7 @@ fn encode(args: Args<'_>) -> Result<Value<'_>> {
         // This is the fast path.
         // The string is already utf-8.
         .to_string()
-        .unwrap_or_else(|error| to_string_lossy(&cx, js_string, error));
+        .or_else(|error| to_string_lossy(&cx, js_string, error))?;
 
     Ok(TypedArray::new(cx, encoded.into_bytes())?
         .as_value()

crates/javy/src/lib.rs

@@ -153,11 +153,25 @@ pub fn to_js_error(cx: Ctx, e: Error) -> JSError {
 
 /// Converts the JavaScript value to a string, replacing any invalid UTF-8 sequences with the
 /// Unicode replacement character (U+FFFD).
+///
+/// Returns [`JSError::Exception`] if the engine runs out of memory while
+/// converting the string; the out-of-memory exception is left pending on the
+/// context.
 // TODO: Upstream this?
-pub fn to_string_lossy<'js>(cx: &Ctx<'js>, string: &JSString<'js>, error: JSError) -> String {
+pub fn to_string_lossy<'js>(
+    cx: &Ctx<'js>,
+    string: &JSString<'js>,
+    error: JSError,
+) -> rquickjs::Result<String> {
     let mut len: qjs::size_t = 0;
     let ptr =
         unsafe { qjs::JS_ToCStringLen2(cx.as_raw().as_ptr(), &mut len, string.as_raw(), false) };
+    if ptr.is_null() {
+        // The conversion only fails when the engine cannot allocate the
+        // buffer for the converted copy, in which case it has thrown an
+        // out-of-memory exception.
+        return Err(JSError::Exception);
+    }
     let buffer = unsafe { std::slice::from_raw_parts(ptr as *const u8, len as usize) };
 
     // The error here *must* be a Utf8 error; the `JSString::to_string()` may
@@ -203,7 +217,10 @@ pub fn to_string_lossy<'js>(cx: &Ctx<'js>, string: &JSString<'js>, error: JSErro
             Err(e) => utf8_error = e,
         }
     }
-    res
+    // The engine allocates a new reference-counted string for the converted
+    // copy on every call; release it now that `res` owns the decoded contents.
+    unsafe { qjs::JS_FreeCString(cx.as_raw().as_ptr(), ptr) };
+    Ok(res)
 }
 
 /// Retrieves the string representation of a JavaScript value.
@@ -212,17 +229,16 @@ pub fn val_to_string<'js>(this: &Ctx<'js>, val: Value<'js>) -> Result<String> {
         if let Some(description) = symbol.description()?.into_string() {
             let description = description
                 .to_string()
-                .unwrap_or_else(|e| to_string_lossy(this, &description, e));
+                .or_else(|e| to_string_lossy(this, &description, e))?;
             Ok(format!("Symbol({description})"))
         } else {
             Ok("Symbol()".into())
         }
     } else {
-        let stringified = <convert::Coerced<JSString>>::from_js(this, val).map(|string| {
-            string
-                .to_string()
-                .unwrap_or_else(|e| to_string_lossy(this, &string.0, e))
-        })?;
+        let string = <convert::Coerced<JSString>>::from_js(this, val)?;
+        let stringified = string
+            .to_string()
+            .or_else(|e| to_string_lossy(this, &string.0, e))?;
         Ok(stringified)
     }
 }

crates/javy/tests/misc.rs

@@ -2,6 +2,10 @@
 use anyhow::Result;
 #[cfg(feature = "json")]
 use javy::{Config, Runtime, quickjs::context::EvalOptions};
+use javy::{
+    quickjs::{Context, Runtime as QuickJSRuntime, String as JSString},
+    to_string_lossy,
+};
 
 #[cfg(feature = "json")]
 #[test]
@@ -40,3 +44,35 @@ fn json_stringify_cycle_checks() -> Result<()> {
 
     Ok(())
 }
+
+#[test]
+fn to_string_lossy_frees_engine_cstring() -> anyhow::Result<()> {
+    let runtime = QuickJSRuntime::new()?;
+    let context = Context::full(&runtime)?;
+
+    let baseline = runtime.memory_usage().malloc_size;
+    context.with(|this| {
+        // A long string ending in a lone surrogate takes the lossy path.
+        let string: JSString = this.eval(r#""a".repeat(65536) + "\uD800""#)?;
+        for _ in 0..64 {
+            let error = string
+                .to_string()
+                .expect_err("conversion should fail on the lone surrogate");
+            let lossy = to_string_lossy(&this, &string, error)?;
+            assert!(lossy.ends_with(char::REPLACEMENT_CHARACTER));
+        }
+        Ok::<_, anyhow::Error>(())
+    })?;
+
+    // Each call makes the engine allocate a ~192 KiB UTF-8 copy of the string.
+    // The copies are reference counted, so if `to_string_lossy` does not free
+    // them, not even a GC pass reclaims them and the ~12 MiB they amount to
+    // here stays allocated.
+    runtime.run_gc();
+    let growth = runtime.memory_usage().malloc_size - baseline;
+    assert!(
+        growth < 1024 * 1024,
+        "engine heap grew by {growth} bytes; the C strings were not freed"
+    );
+    Ok(())
+}