feat: deliver worker callbacks on the worker's thread, unbox Object values

- WinRT delegates and .NET callbacks created in a worker run on that worker's thread when
  invoked from another thread (the worker loop now waits on commands, messages and timers).
- A callback whose worker has terminated is refused instead of running on a disposed isolate.
- Messages a worker posts on its own reach the main thread without it polling.
- The classic engine unboxes IPropertyValue results (Tag, PropertySet values) to JS primitives.
- test-app: worker and boxing specs; hooks of fully skipped suites don't run.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: triniwiz

runtime/src/global_fns.rs

@@ -1080,6 +1080,46 @@ pub(crate) fn handle_worker_post_message(
     }
 }
 
+/// Runs on a worker's creating thread when the worker has queued messages: hands them to that
+/// `Worker` object (`__nsWorkerDeliver`, installed by the Worker shim).
+pub(crate) fn deliver_worker_events(worker_id: u64) {
+    let isolate_ptr = crate::DELEGATE_ISOLATE_PTR.with(|c| c.get());
+    if isolate_ptr.is_null() {
+        return;
+    }
+    let isolate: &mut v8::Isolate = unsafe { &mut *isolate_ptr };
+    v8::scope!(scope, isolate);
+    let Some(ctx_global) = scope.get_slot::<v8::Global<v8::Context>>().cloned() else {
+        return;
+    };
+    let context = v8::Local::new(scope, &ctx_global);
+    let scope = &mut v8::ContextScope::new(scope, context);
+    v8::tc_scope!(tc, scope);
+
+    let global = context.global(tc);
+    let Some(key) = v8::String::new(tc, "__nsWorkerDeliver") else {
+        return;
+    };
+    let Some(deliver) = global
+        .get(tc, key.into())
+        .and_then(|v| v8::Local::<v8::Function>::try_from(v).ok())
+    else {
+        return;
+    };
+    let id: v8::Local<v8::Value> = v8::Number::new(tc, worker_id as f64).into();
+    let _ = deliver.call(tc, global.into(), &[id]);
+    if tc.has_caught() {
+        if let Some(ex) = tc.exception() {
+            let msg = ex.to_rust_string_lossy(tc);
+            crate::store_last_js_error(msg);
+        }
+        tc.reset();
+    }
+    if !crate::defer_microtask_drain() {
+        tc.perform_microtask_checkpoint();
+    }
+}
+
 pub(crate) fn handle_worker_poll_messages(
     scope: &mut v8::PinScope<'_, '_>,
     args: v8::FunctionCallbackArguments,
@@ -4510,18 +4550,23 @@ pub(crate) unsafe extern "C" fn invoke_dotnet_js_callback(
     _resp_len: *mut i32,
 ) {
     let isolate_ptr = crate::DELEGATE_ISOLATE_PTR.with(|c| c.get());
-    if isolate_ptr.is_null() {
+    let owner = crate::dotnet_callback_owner(callback_id);
+    if isolate_ptr.is_null() || owner.is_some_and(|o| o != isolate_ptr) {
         // A managed delegate, event, Task continuation or overridden member running on a thread
-        // other than the JS thread: hand the call to the JS (UI) thread and wait for it, so the
-        // callback runs and its result reaches the managed caller (see `run_on_ui_thread_sync`).
-        if !crate::ui_dispatcher::is_ui_thread() {
-            let (args, resp, resp_len) = (args_ptr as usize, _resp_ptr as usize, _resp_len as usize);
-            let delivered = crate::ui_dispatcher::run_on_ui_thread_sync(move || {
-                invoke_dotnet_js_callback(callback_id, args as *const u8, args_len, resp as *mut *mut u8, resp_len as *mut i32)
-            });
-            if delivered.is_none() {
-                write_callback_response(&[0x0F, 0, 0, 0, 0][..], _resp_ptr, _resp_len);
-            }
+        // other than the one its JS function belongs to (the UI thread or a worker): hand the call
+        // to that thread and wait for it, so the callback runs and its result reaches the managed
+        // caller (see `run_on_js_thread_sync`).
+        let (args, resp, resp_len) = (args_ptr as usize, _resp_ptr as usize, _resp_len as usize);
+        let call = move || {
+            invoke_dotnet_js_callback(callback_id, args as *const u8, args_len, resp as *mut *mut u8, resp_len as *mut i32)
+        };
+        let delivered = match owner {
+            Some(owner) => crate::run_on_js_thread_sync(owner, call),
+            None if !crate::ui_dispatcher::is_ui_thread() => crate::ui_dispatcher::run_on_ui_thread_sync(call),
+            None => None,
+        };
+        if delivered.is_none() {
+            write_callback_response(&[0x0F, 0, 0, 0, 0][..], _resp_ptr, _resp_len);
         }
         return;
     }
@@ -4590,6 +4635,7 @@ pub(crate) unsafe extern "C" fn invoke_dotnet_js_callback(
             crate::DOTNET_JS_CALLBACKS.with(|m| {
                 m.borrow_mut().remove(&callback_id);
             });
+            crate::forget_dotnet_callback_owner(callback_id);
             set.remove(&callback_id);
         }
     });
@@ -4620,18 +4666,43 @@ unsafe fn write_callback_response(bytes: &[u8], resp_ptr: *mut *mut u8, resp_len
     }
 }
 
-/// Drops the JS functions whose managed delegates the .NET GC has collected.
+/// Drops the JS functions whose managed delegates the .NET GC has collected. The release queue is
+/// process-wide; a function that belongs to another JS thread (a worker's) is dropped there.
 pub(crate) fn release_collected_js_callbacks() {
     let released = crate::dotnet::take_released_js_callbacks();
     if released.is_empty() {
         return;
     }
+    let current = crate::DELEGATE_ISOLATE_PTR.with(|c| c.get());
+    let mut elsewhere: HashMap<usize, Vec<i32>> = HashMap::new();
     crate::DOTNET_JS_CALLBACKS.with(|m| {
         let mut m = m.borrow_mut();
         for id in released {
-            m.remove(&id);
+            match crate::dotnet_callback_owner(id) {
+                Some(owner) if owner != current => elsewhere.entry(owner as usize).or_default().push(id),
+                _ => {
+                    m.remove(&id);
+                    crate::forget_dotnet_callback_owner(id);
+                }
+            }
         }
     });
+    for (owner, ids) in elsewhere {
+        let owned = ids.clone();
+        let queued = crate::post_to_js_thread(owner as *mut v8::Isolate, move || {
+            crate::DOTNET_JS_CALLBACKS.with(|m| {
+                let mut m = m.borrow_mut();
+                for id in ids {
+                    m.remove(&id);
+                    crate::forget_dotnet_callback_owner(id);
+                }
+            });
+        });
+        if !queued {
+            // That runtime is gone and took its functions with it.
+            owned.into_iter().for_each(crate::forget_dotnet_callback_owner);
+        }
+    }
 }
 
 /// Registers `func` as a callback the bridge can invoke and returns its id.
@@ -4640,6 +4711,7 @@ pub(crate) fn register_dotnet_js_callback(scope: &mut v8::PinScope<'_, '_>, func
     crate::DOTNET_JS_CALLBACKS.with(|m| {
         m.borrow_mut().insert(cb_id, v8::Global::new(scope, func));
     });
+    crate::record_dotnet_callback_owner(cb_id);
     cb_id
 }
 
@@ -4700,6 +4772,7 @@ pub(crate) fn handle_dotnet_create_delegate(
     crate::DOTNET_JS_CALLBACKS.with(|m| {
         m.borrow_mut().insert(cb_id, v8::Global::new(scope, func));
     });
+    crate::record_dotnet_callback_owner(cb_id);
 
     // opcode 0x09 | type_name (str16) | callback_id (i32)
     let mut req: Vec<u8> = Vec::with_capacity(32);
@@ -4787,6 +4860,7 @@ pub(crate) fn handle_dotnet_create_js_subclass(
     crate::DOTNET_JS_CALLBACKS.with(|m| {
         m.borrow_mut().insert(cb_id, v8::Global::new(scope, cb_fn));
     });
+    crate::record_dotnet_callback_owner(cb_id);
 
     let mut req: Vec<u8> = Vec::with_capacity(64);
     req.push(0x0A);
@@ -4871,6 +4945,8 @@ pub(crate) fn handle_dotnet_await_task(
         map.insert(resolve_id, v8::Global::new(scope, resolve_fn));
         map.insert(reject_id, v8::Global::new(scope, reject_fn));
     });
+    crate::record_dotnet_callback_owner(resolve_id);
+    crate::record_dotnet_callback_owner(reject_id);
 
     // Binary instance call: 0x01 | handle(i32) | "__dotnet_await__"(str16) | 2 | i32 resolveId | i32 rejectId
     let mut req: Vec<u8> = Vec::with_capacity(32);
@@ -4889,6 +4965,8 @@ pub(crate) fn handle_dotnet_await_task(
             map.remove(&resolve_id);
             map.remove(&reject_id);
         });
+        crate::forget_dotnet_callback_owner(resolve_id);
+        crate::forget_dotnet_callback_owner(reject_id);
         throw_js_error(scope, &e);
     }
 }

runtime/src/lib.rs

@@ -374,6 +374,89 @@ pub fn pump_messages() -> bool {
     dispatched
 }
 
+/// Runs `f` on the JS thread whose isolate is `owner` (the UI thread's or a worker's) and waits for
+/// its result: inline when that is the current thread, otherwise handed over the way a callback
+/// invoked on a background thread is. `None` when that thread can't run it (gone, or unknown).
+#[cfg(feature = "classic")]
+pub(crate) fn run_on_js_thread_sync<R: Send>(owner: *mut v8::Isolate, f: impl FnOnce() -> R + Send) -> Option<R> {
+    if !is_live_isolate(owner) {
+        return None;
+    }
+    if DELEGATE_ISOLATE_PTR.with(|c| c.get()) == owner {
+        return Some(f());
+    }
+    if worker_threads::is_worker_isolate(owner as usize) {
+        return worker_threads::run_on_worker_sync(owner as usize, f);
+    }
+    if ui_dispatcher::is_ui_thread() {
+        return None;
+    }
+    ui_dispatcher::run_on_ui_thread_sync(f)
+}
+
+/// Queues `f` on the JS thread whose isolate is `owner` without waiting; runs it inline when that
+/// is the current thread. `false` when there is no such thread to run it on.
+#[cfg(feature = "classic")]
+pub(crate) fn post_to_js_thread(owner: *mut v8::Isolate, f: impl FnOnce() + Send + 'static) -> bool {
+    if !is_live_isolate(owner) {
+        return false;
+    }
+    if DELEGATE_ISOLATE_PTR.with(|c| c.get()) == owner {
+        f();
+        return true;
+    }
+    if worker_threads::is_worker_isolate(owner as usize) {
+        return worker_threads::post_to_worker(owner as usize, f);
+    }
+    if !ui_dispatcher::is_initialized() {
+        return false;
+    }
+    ui_dispatcher::post_to_ui_thread(f);
+    true
+}
+
+/// The isolates of the runtimes alive in this process (the UI thread's and each worker's). A
+/// callback that outlives its worker can't run anywhere: work for a disposed isolate is refused.
+#[cfg(feature = "classic")]
+static LIVE_ISOLATES: std::sync::LazyLock<std::sync::Mutex<std::collections::HashSet<usize>>> =
+    std::sync::LazyLock::new(|| std::sync::Mutex::new(std::collections::HashSet::new()));
+
+#[cfg(feature = "classic")]
+fn is_live_isolate(isolate: *mut v8::Isolate) -> bool {
+    !isolate.is_null() && LIVE_ISOLATES.lock().is_ok_and(|live| live.contains(&(isolate as usize)))
+}
+
+/// The isolate each .NET callback's JS function belongs to (callback ids are process-wide, the
+/// functions live in their JS thread's `DOTNET_JS_CALLBACKS`), so a callback the bridge invokes on
+/// another thread is run on the right one.
+#[cfg(feature = "classic")]
+static DOTNET_CALLBACK_OWNERS: std::sync::LazyLock<std::sync::Mutex<HashMap<i32, usize>>> =
+    std::sync::LazyLock::new(|| std::sync::Mutex::new(HashMap::new()));
+
+#[cfg(feature = "classic")]
+pub(crate) fn record_dotnet_callback_owner(callback_id: i32) {
+    let owner = DELEGATE_ISOLATE_PTR.with(|c| c.get()) as usize;
+    if let Ok(mut owners) = DOTNET_CALLBACK_OWNERS.lock() {
+        owners.insert(callback_id, owner);
+    }
+}
+
+#[cfg(feature = "classic")]
+pub(crate) fn dotnet_callback_owner(callback_id: i32) -> Option<*mut v8::Isolate> {
+    DOTNET_CALLBACK_OWNERS
+        .lock()
+        .ok()
+        .and_then(|owners| owners.get(&callback_id).copied())
+        .map(|o| o as *mut v8::Isolate)
+}
+
+#[cfg(feature = "classic")]
+pub(crate) fn forget_dotnet_callback_owner(callback_id: i32) {
+    if let Ok(mut owners) = DOTNET_CALLBACK_OWNERS.lock() {
+        owners.remove(&callback_id);
+    }
+}
+
 /// Retrieve (and clear) the last stored JS error.
 pub fn get_last_js_error() -> Option<String> {
     LAST_JS_ERROR.with(|e| e.borrow_mut().take())
@@ -8009,8 +8092,8 @@ pub(crate) struct JsDelegateData {
     /// For a delegate whose Invoke the shared vtable can't implement (see [`delegate_invoke`]):
     /// the typed Invoke and the delegate's own vtable, which points at it.
     typed: Option<(delegate_invoke::TypedInvoke, Box<JsDelegateVtbl>)>,
-    /// The isolate `js_func` belongs to: the UI thread's, or null for a delegate created where no
-    /// isolate is registered (a worker), which can't be handed to the UI thread.
+    /// The isolate `js_func` belongs to (the UI thread's or a worker's): Invoke and the final
+    /// Release run on that isolate's thread.
     owner_isolate: *mut v8::Isolate,
 }
 
@@ -8090,15 +8173,21 @@ unsafe extern "system" fn js_delegate_release(this: *mut JsDelegate) -> u32 {
         std::sync::atomic::fence(AtomicOrdering::Acquire);
         let b = Box::from_raw(this);
         let data = Box::from_raw(b.data);
-        // The function handle belongs to the UI thread's isolate: a final release on a background
-        // thread (the component that invoked the delegate there) frees it on the UI thread.
-        if !data.owner_isolate.is_null() && !ui_dispatcher::is_ui_thread() && ui_dispatcher::is_initialized() {
-            struct SendData(Box<JsDelegateData>);
-            unsafe impl Send for SendData {}
-            let data = SendData(data);
-            ui_dispatcher::post_to_ui_thread(move || drop(data));
-        } else {
+        // The function handle belongs to its JS thread's isolate: a final release on another thread
+        // (the component that invoked the delegate there) frees it on that thread.
+        let owner = data.owner_isolate;
+        if DELEGATE_ISOLATE_PTR.with(|c| c.get()) == owner || owner.is_null() {
             drop(data);
+        } else {
+            // Never dropped elsewhere: if that thread is gone (a terminated worker), the handle
+            // leaks rather than being freed into a disposed isolate.
+            struct SendData(std::mem::ManuallyDrop<Box<JsDelegateData>>);
+            unsafe impl Send for SendData {}
+            let data = SendData(std::mem::ManuallyDrop::new(data));
+            post_to_js_thread(owner, move || {
+                let data = data;
+                drop(std::mem::ManuallyDrop::into_inner(data.0));
+            });
         }
         // b (JsDelegate) dropped here
     }
@@ -8183,23 +8272,16 @@ fn js_delegate_invoke_with_args(
     result_slot: *mut c_void,
 ) -> HRESULT {
     let isolate_ptr = DELEGATE_ISOLATE_PTR.with(|c| c.get());
-    if !isolate_ptr.is_null() && isolate_ptr != data.owner_isolate {
-        // Never run a function against an isolate it doesn't belong to.
-        return HRESULT(0x8001010Eu32 as i32); // RPC_E_WRONG_THREAD
-    }
-    if isolate_ptr.is_null() {
-        // Invoked directly on a background thread (a component that calls its handlers without
-        // marshaling them back to the registering apartment): run the JS on the JS (UI) thread
-        // and wait, so the call is delivered and its result written before Invoke returns. The
-        // arguments are borrowed for the duration of Invoke, which is exactly how long they're used.
-        // Only the UI thread's functions can go there; a worker's stay undeliverable.
-        if ui_dispatcher::is_ui_thread() || data.owner_isolate.is_null() {
-            return HRESULT(0x80004005u32 as i32);
-        }
+    if isolate_ptr != data.owner_isolate {
+        // Invoked on another thread (a component that calls its handlers without marshaling them
+        // back to the registering apartment): run the JS on the thread that owns the function —
+        // the UI thread or a worker — and wait, so the call is delivered and its result written
+        // before Invoke returns. The arguments are borrowed for the duration of Invoke, which is
+        // exactly how long they're used.
         struct SendPtr(*mut JsDelegate, *mut c_void);
         unsafe impl Send for SendPtr {}
         let ptrs = SendPtr(this, result_slot);
-        return ui_dispatcher::run_on_ui_thread_sync(move || {
+        return run_on_js_thread_sync(data.owner_isolate, move || {
             let ptrs = ptrs;
             // SAFETY: the caller holds a reference on the delegate for the duration of Invoke.
             let data = unsafe { &*(*ptrs.0).data };
@@ -9036,6 +9118,9 @@ impl Runtime {
     pub fn register_delegate_isolate_ptr(&mut self) {
         let raw_isolate: *mut v8::Isolate = &mut *self.isolate as *mut v8::Isolate;
         DELEGATE_ISOLATE_PTR.with(|cell| cell.set(raw_isolate));
+        if let Ok(mut live) = LIVE_ISOLATES.lock() {
+            live.insert(raw_isolate as usize);
+        }
     }
 
     /// Provides mutable access to the underlying V8 isolate.
@@ -9352,6 +9437,9 @@ impl Drop for Runtime {
         // raw isolate pointers) must be cleared here, while `self.isolate` is
         // still alive. Anything left behind dangles into freed isolate memory
         // and crashes the next Runtime created on this thread.
+        if let Ok(mut live) = LIVE_ISOLATES.lock() {
+            live.remove(&(&mut *self.isolate as *mut v8::Isolate as usize));
+        }
         crate::wrapper_cache::clear();
         EVENT_REGISTRY.with(|m| m.borrow_mut().clear());
         ESM_MODULE_REGISTRY.with(|m| m.borrow_mut().clear());
@@ -9360,6 +9448,8 @@ impl Drop for Runtime {
         ESM_HTTP_URLS.with(|m| m.borrow_mut().clear());
         ESM_LOAD_ERRORS.with(|m| m.borrow_mut().clear());
         crate::esm_http::clear_thread_vocabulary();
+        // The ids keep their owner: a managed delegate that outlives this runtime (a terminated
+        // worker's) is refused rather than run elsewhere, until .NET releases it.
         DOTNET_JS_CALLBACKS.with(|m| m.borrow_mut().clear());
         DOTNET_ONESHOT_JS_CALLBACKS.with(|m| m.borrow_mut().clear());
         crate::timers::clear_thread_tasks();