Bound Splash VM stack and call frames

Author: ymote

README.md

@@ -41,8 +41,9 @@ and keeps UI support optional rather than making UI the language boundary.
 - Default runtime and capability-host evaluation that rejects noncanonical
   Makepad compatibility syntax before a tool can run.
 - A bounded evaluator with source, individual-string, tracked Splash-owned
-  retained-heap, instruction, and deadline limits. The heap ceiling is not an
-  OS process-memory quota and excludes opaque trusted Rust adapter allocations.
+  retained-heap, VM operand-stack, active-call-frame, instruction, and deadline
+  limits. These VM ceilings are not an OS process-memory quota and exclude
+  opaque trusted Rust adapter allocations.
 - Direct `Runtime` JSON conversion: strict, byte- and depth-bounded
   `.parse_json()` input plus cycle-aware, byte- and depth-bounded `.to_json()`
   output, with ordinary script errors rather than unbounded VM work.

SECURITY.md

@@ -101,16 +101,24 @@ strings, arrays, object storage, slot tables, and intern tables. Sparse array
 and object writes, plus conservative object-map rehashes, are rejected before
 they request their backing allocation; other normal script allocations raise
 the same uncatchable hard resource failure when retained storage crosses the
-cap. This is not a process allocator quota: VM parser/code/stack work,
-allocator metadata, compiled regex internals, and opaque trusted Rust adapter
-allocations remain outside the accounting.
+cap. This heap-only accounting is not a process allocator quota: VM parser/code
+storage, other VM control vectors, allocator metadata, compiled regex internals,
+and opaque trusted Rust adapter allocations remain outside it.
+
+`ExecutionLimits::max_stack_values` caps live VM operand values at 32,768 by
+default, and `ExecutionLimits::max_call_frames` caps active VM call frames,
+including the root frame, at 1,024 by default. Both terminate the current
+evaluation as uncatchable hard resource failures. They do not account for
+native Rust stacks, parser or code storage, other VM control vectors, allocator
+metadata, or opaque trusted adapter allocations.
 Targets that need process-wide memory or effect containment must layer an
 operating-system boundary around the worker.
 
 Canonical `try/catch` handles ordinary script and native-binding errors and
 unwinds Splash function calls, but it is not a sandbox or transaction. It
-cannot catch string-allocation, heap-allocation, instruction-limit, or hard-deadline
-termination, inspect an error object, widen a capability lease, refund a call,
+cannot catch string-allocation, heap-allocation, operand-stack, call-frame,
+instruction-limit, or hard-deadline termination, inspect an error object, widen a
+capability lease, refund a call,
 erase an audit outcome, or bypass a workflow data contract. A caught error is
 discarded before the fallback runs and does not appear in the evaluation
 diagnostics. An uncaught native error is host-facing and may contain

crates/splash-capabilities/src/mobile.rs

@@ -375,6 +375,8 @@ mod tests {
                 max_source_bytes: 32 * 1024,
                 max_string_bytes: 32 * 1024,
                 max_heap_bytes: 2 * 1024 * 1024,
+                max_stack_values: 4 * 1024,
+                max_call_frames: 256,
                 max_syntax_tokens: 4 * 1024,
                 max_syntax_nesting: 64,
                 instruction_limit: DEFAULT_INSTRUCTION_LIMIT,

crates/splash-cli/src/main.rs

@@ -244,6 +244,8 @@ fn profile_output() -> JsonValue {
         "evaluation_limits": {
             "string_bytes": limits.max_string_bytes,
             "heap_bytes": limits.max_heap_bytes,
+            "stack_values": limits.max_stack_values,
+            "call_frames": limits.max_call_frames,
             "instruction_limit": limits.instruction_limit,
             "soft_timeout_ms": soft_timeout_ms,
             "hard_timeout_ms": hard_timeout_ms,
@@ -1170,6 +1172,14 @@ mod tests {
             output["evaluation_limits"]["heap_bytes"],
             json!(limits.max_heap_bytes)
         );
+        assert_eq!(
+            output["evaluation_limits"]["stack_values"],
+            json!(limits.max_stack_values)
+        );
+        assert_eq!(
+            output["evaluation_limits"]["call_frames"],
+            json!(limits.max_call_frames)
+        );
         assert_eq!(
             output["preflight_limits"]["source_bytes"],
             json!(limits.max_source_bytes)

crates/splash-core/src/lib.rs

@@ -51,6 +51,14 @@ pub const DEFAULT_MAX_SCRIPT_STRING_BYTES: usize = 256 * 1024;
 /// intern tables. It is not an operating-system process memory limit and does
 /// not account for opaque trusted Rust adapter allocations.
 pub const DEFAULT_MAX_SCRIPT_HEAP_BYTES: usize = 8 * 1024 * 1024;
+/// Default maximum live operand values in one Splash VM thread.
+///
+/// This bounds the VM execution stack independently from retained heap data.
+pub const DEFAULT_MAX_SCRIPT_STACK_VALUES: usize = 32 * 1024;
+/// Default maximum active Splash VM call frames, including the root frame.
+///
+/// This bounds recursive execution state independently from instruction fuel.
+pub const DEFAULT_MAX_SCRIPT_CALL_FRAMES: usize = 1_024;
 const FORMAT_OUTPUT_MULTIPLIER: usize = 4;
 /// Maximum formatted output size under the default source budget.
 pub const DEFAULT_MAX_FORMATTED_SOURCE_BYTES: usize =
@@ -132,6 +140,14 @@ pub struct ExecutionLimits {
     /// construction fails when it is below the required baseline. Hosts that
     /// need OS-level containment must layer it separately.
     pub max_heap_bytes: usize,
+    /// Maximum live operand values in the VM execution stack.
+    ///
+    /// This does not bound native Rust stacks or opaque host adapter state.
+    pub max_stack_values: usize,
+    /// Maximum active VM call frames, including the root evaluation frame.
+    ///
+    /// This limits recursive script calls but does not bound host recursion.
+    pub max_call_frames: usize,
     pub max_syntax_tokens: usize,
     pub max_syntax_nesting: usize,
     pub instruction_limit: usize,
@@ -146,6 +162,8 @@ impl Default for ExecutionLimits {
             max_source_bytes: DEFAULT_MAX_SOURCE_BYTES,
             max_string_bytes: DEFAULT_MAX_SCRIPT_STRING_BYTES,
             max_heap_bytes: DEFAULT_MAX_SCRIPT_HEAP_BYTES,
+            max_stack_values: DEFAULT_MAX_SCRIPT_STACK_VALUES,
+            max_call_frames: DEFAULT_MAX_SCRIPT_CALL_FRAMES,
             max_syntax_tokens: DEFAULT_MAX_SYNTAX_TOKENS,
             max_syntax_nesting: DEFAULT_MAX_SYNTAX_NESTING,
             instruction_limit: DEFAULT_INSTRUCTION_LIMIT,
@@ -173,6 +191,16 @@ impl ExecutionLimits {
                 "max_heap_bytes must be greater than zero",
             ));
         }
+        if self.max_stack_values == 0 {
+            return Err(RuntimeError::InvalidLimits(
+                "max_stack_values must be greater than zero",
+            ));
+        }
+        if self.max_call_frames == 0 {
+            return Err(RuntimeError::InvalidLimits(
+                "max_call_frames must be greater than zero",
+            ));
+        }
         if self.max_syntax_tokens == 0 {
             return Err(RuntimeError::InvalidLimits(
                 "max_syntax_tokens must be greater than zero",
@@ -1007,6 +1035,7 @@ impl<H: Any, S: Any> Runtime<H, S> {
             // manage several threads, but evaluating new source into a paused
             // frame would make its module/body lifecycle ambiguous.
             vm.bx.threads.set_current_to_first_unpaused_thread();
+            vm.clear_execution_limit_failures();
             Ok(evaluate_with_limits(vm, limits, |vm| {
                 vm.eval(vm::ScriptMod {
                     file: "inline.splash".to_owned(),
@@ -2183,7 +2212,11 @@ fn evaluate_with_limits(
         limits.budget_sample_interval,
     ));
 
-    let value = vm.with_instruction_limit(limits.instruction_limit, operation);
+    let value = vm.with_stack_value_limit(limits.max_stack_values, |vm| {
+        vm.with_call_frame_limit(limits.max_call_frames, |vm| {
+            vm.with_instruction_limit(limits.instruction_limit, operation)
+        })
+    });
     let diagnostics = vm.take_errors();
     let suspended = vm.bx.threads.cur_ref().is_paused();
     vm.bx.run_budget = None;
@@ -5032,6 +5065,32 @@ compute(outer, 2)
         );
     }
 
+    #[test]
+    fn rejects_zero_stack_value_limit() {
+        let limits = ExecutionLimits {
+            max_stack_values: 0,
+            ..ExecutionLimits::default()
+        };
+
+        assert_eq!(
+            check_syntax_named("stack.splash", "true", limits).unwrap_err(),
+            RuntimeError::InvalidLimits("max_stack_values must be greater than zero")
+        );
+    }
+
+    #[test]
+    fn rejects_zero_call_frame_limit() {
+        let limits = ExecutionLimits {
+            max_call_frames: 0,
+            ..ExecutionLimits::default()
+        };
+
+        assert_eq!(
+            check_syntax_named("frames.splash", "true", limits).unwrap_err(),
+            RuntimeError::InvalidLimits("max_call_frames must be greater than zero")
+        );
+    }
+
     #[test]
     fn runtime_rejects_a_heap_limit_below_live_vm_storage() {
         let mut runtime = Runtime::default();
@@ -5132,6 +5191,94 @@ compute(outer, 2)
         assert_eq!(recovered.value.as_u40(), Some(2));
     }
 
+    #[test]
+    fn runtime_bounds_operand_stack_growth_without_catch_recovery() {
+        let limits = ExecutionLimits {
+            max_stack_values: 1,
+            ..ExecutionLimits::default()
+        };
+        let mut runtime = Runtime::with_limits((), (), limits).unwrap();
+
+        let exceeded = runtime.eval("try (1 + 2) catch 99").unwrap();
+
+        assert!(!exceeded.completed());
+        assert!(exceeded
+            .diagnostics
+            .iter()
+            .any(|diagnostic| diagnostic.contains("operand stack limit exceeded")));
+
+        let recovered = runtime.eval("2").unwrap();
+        assert!(recovered.completed(), "{:?}", recovered.diagnostics);
+        assert_eq!(recovered.value.as_u40(), Some(2));
+    }
+
+    #[test]
+    fn runtime_bounds_recursive_call_frames_without_catch_recovery() {
+        let limits = ExecutionLimits {
+            max_call_frames: 4,
+            instruction_limit: 1_024,
+            budget_sample_interval: 64,
+            ..ExecutionLimits::default()
+        };
+        let mut runtime = Runtime::with_limits((), (), limits).unwrap();
+
+        let exceeded = runtime
+            .eval(
+                "fn recurse(value) {\n\
+                 recurse(value + 1)\n\
+                 }\n\
+                 try recurse(0) catch 99",
+            )
+            .unwrap();
+
+        assert!(!exceeded.completed());
+        assert!(exceeded
+            .diagnostics
+            .iter()
+            .any(|diagnostic| diagnostic.contains("call frame limit exceeded")));
+
+        let recovered = runtime.eval("2").unwrap();
+        assert!(recovered.completed(), "{:?}", recovered.diagnostics);
+        assert_eq!(recovered.value.as_u40(), Some(2));
+    }
+
+    #[test]
+    fn call_frame_limit_includes_the_root_evaluation_frame() {
+        let limits = ExecutionLimits {
+            max_call_frames: 1,
+            ..ExecutionLimits::default()
+        };
+        let mut runtime = Runtime::with_limits((), (), limits).unwrap();
+
+        let root_only = runtime.eval("2").unwrap();
+        assert!(root_only.completed(), "{:?}", root_only.diagnostics);
+
+        let exceeded = runtime
+            .eval("fn one() {\n1\n}\ntry one() catch 99")
+            .unwrap();
+        assert!(!exceeded.completed());
+        assert!(exceeded
+            .diagnostics
+            .iter()
+            .any(|diagnostic| diagnostic.contains("call frame limit exceeded")));
+    }
+
+    #[test]
+    fn fresh_evaluation_discards_stale_vm_execution_limit_signals() {
+        let mut runtime = Runtime::default();
+        runtime.configure(|vm| {
+            vm.with_stack_value_limit(1, |vm| {
+                vm.thread_mut().push_stack_unchecked(1.into());
+                vm.thread_mut().push_stack_unchecked(2.into());
+                vm.thread_mut().pop_stack_value();
+            });
+        });
+
+        let evaluation = runtime.eval("2").unwrap();
+        assert!(evaluation.completed(), "{:?}", evaluation.diagnostics);
+        assert_eq!(evaluation.value.as_u40(), Some(2));
+    }
+
     #[test]
     fn heap_limit_bounds_total_string_storage_after_individual_strings_pass() {
         let mut runtime = Runtime::default();

crates/splash-workflow/src/mobile.rs

@@ -722,6 +722,8 @@ mod tests {
                 max_source_bytes: 32 * 1024,
                 max_string_bytes: 32 * 1024,
                 max_heap_bytes: 2 * 1024 * 1024,
+                max_stack_values: 4 * 1024,
+                max_call_frames: 256,
                 max_syntax_tokens: 4 * 1024,
                 max_syntax_nesting: 64,
                 instruction_limit: DEFAULT_INSTRUCTION_LIMIT,

docs/development.md

@@ -296,17 +296,18 @@ catalogs only: the target never starts stdio, reads the URI, resolves modules,
 evaluates Splash, creates a capability host, or invokes an adapter.
 `execution` starts a fresh, capability-free runtime for each syntactically
 accepted input with an 8 KiB source cap, 1,024-token cap, 64-level nesting
-cap, 8 KiB individual-string cap, 4,096 instruction cap, one-instruction
-deadline sampling, and a 32 ms terminal execution deadline. Script-level errors from
+cap, 8 KiB individual-string cap, 1,024 live operand values, 256 active call
+frames, 4,096 instruction cap, one-instruction deadline sampling, and a 32 ms
+terminal execution deadline. Script-level errors from
 unavailable modules are expected. It creates `Runtime<(), ()>`, so no
 capability or Rust adapter can run; a panic or hang is a fuzz failure.
 `execution` explicitly collects its fresh VM after evaluation so retained heap
 state cannot mask resource behavior. Their tracked `.splash` seeds cover
 canonical dataflow, deferred tools, loops, lambdas, recoverable error control
 flow, intentional instruction-limit behavior, and exponential string growth.
-`execution_limits` rotates valid source, individual-string, syntax,
-instruction, sampling, and deadline profiles through a fresh capability-free
-runtime. Equal soft and hard deadlines must terminate rather than leave a
+`execution_limits` rotates valid source, individual-string, retained-heap,
+operand-stack, call-frame, syntax, instruction, sampling, and deadline profiles
+through a fresh capability-free runtime. Equal soft and hard deadlines must terminate rather than leave a
 resumable evaluation. Its cooperative one-nanosecond soft-budget profile may
 yield, but it must then refuse a later `set_limits` request so the continuation
 keeps its original resource contract. A completed evaluation must accept the

docs/grammar.md

@@ -173,8 +173,9 @@ to disambiguate it from the separator.
 
 The language deliberately exposes no error object, message, stack, or pattern
 binding to the fallback. Assertions, type and lookup errors, denied or failed
-tool calls, and a failed deferred tool after `await()` are catchable. An
-instruction-limit stop, hard evaluation deadline, or internal VM bail is not
+tool calls, and a failed deferred tool after `await()` are catchable. A hard
+string-allocation, heap-allocation, operand-stack, call-frame,
+instruction-limit, hard evaluation deadline, or internal VM bail is not
 catchable.
 
 Recovery is control flow, not a transaction. It does not roll back a Rust

docs/language-profile.md

@@ -49,7 +49,10 @@ The default preflight budget is 256 KiB of source, 32,768 lexical tokens, and
 `ExecutionLimits`. Evaluation additionally limits each newly constructed
 script string to 256 KiB by default through `ExecutionLimits::max_string_bytes`
 and tracked retained Splash VM storage to 8 MiB by default through
-`ExecutionLimits::max_heap_bytes`.
+`ExecutionLimits::max_heap_bytes`. It also caps live VM operand values at
+32,768 through `ExecutionLimits::max_stack_values` and active VM call frames,
+including the root frame, at 1,024 through
+`ExecutionLimits::max_call_frames`.
 
 `splash format <file>` applies the same profile and compatibility checks, then
 writes canonical whitespace to standard output without evaluating source or
@@ -330,8 +333,12 @@ Makepad VM owns its upstream JSON behavior. Separately,
 conversion or JSON reconstruction. Exceeding that per-string limit is an
 uncatchable resource failure. `ExecutionLimits::max_heap_bytes` separately
 caps retained script strings, arrays, object storage, slots, and intern tables;
-it is still not a process-memory, code/stack, opaque-adapter, or aggregate
-workflow-data quota.
+`ExecutionLimits::max_stack_values` separately caps live operand values, and
+`ExecutionLimits::max_call_frames` caps active VM call frames, including the
+root evaluation frame. Each is an uncatchable resource failure and both reset
+cleanly for a later evaluation. These are still not process-memory, parser or
+code-storage, native-Rust-stack, opaque-adapter, other VM-control-vector, or
+aggregate-workflow-data quotas.
 
 Hosts can register a `JsonToolContract` to enforce bounded schemas for those
 JSON envelopes. Contract checks run before the handler and before output
@@ -423,7 +430,8 @@ or mutate its keys, input digest, worker observation, or restart policy.
 - Import `mod.tool` before calling a tool.
 - Use canonical `try protected catch fallback` for bounded local recovery. The
   fallback cannot inspect the error, and hard string-allocation,
-  heap-allocation, instruction/deadline termination remains uncatchable. End each block branch
+  heap-allocation, operand-stack, call-frame, instruction, or deadline
+  termination remains uncatchable. End each block branch
   with a value-producing expression; use `nil` when the branch has no other
   result. Parenthesize a record literal used as the whole protected or fallback
   branch.

docs/positioning.md

@@ -91,9 +91,10 @@ the Rust application that already owns the device or service.
 There are three distinct boundaries. They must not be conflated.
 
 1. The canonical grammar and evaluator bound source, syntax work, individual
-   string construction, tracked retained Splash VM storage, instructions, and
-   evaluation time. They reduce interpreter resource risk; the heap bound is
-   not a process-wide allocator quota and they do not authorize effects.
+   string construction, tracked retained Splash VM storage, live operand-stack
+   values, active call frames, instructions, and evaluation time. They reduce
+   interpreter resource risk; these VM bounds are not a process-wide allocator
+   quota and they do not authorize effects.
 2. The capability runtime registers a finite catalog, validates every dynamic
    tool name at reservation time, and uses approval-bound leases that survive
    `await`. Approval-bound workflow data can influence a call but cannot widen
@@ -120,9 +121,10 @@ target:
 1. Freeze a tool catalog and test that generated scripts cannot widen it,
    including across deferred completion and workflow resume.
 2. Define bounded input, output, pending-work, source, individual-string,
-   tracked aggregate-heap, instruction, and event-retention budgets from the target
-   device's memory and latency limits, including the aggregate dataflow context
-   and contract schemas when workflows pass JSON results.
+   tracked aggregate-heap, operand-stack, call-frame, instruction, and
+   event-retention budgets from the target device's memory and latency limits,
+   including the aggregate dataflow context and contract schemas when workflows
+   pass JSON results.
 3. Run effectful adapters in a target-specific containment backend, or prove
    that each in-process adapter has no harmful ambient authority.
 4. Provide a durable checkpoint, idempotency, and reconciliation policy for