Enforce a chunk size limit to streaming fetch (#26898)

Enforce a chunk size limit to streaming fetch, so that JS -> Wasm
onprogress handlers for streaming fetches will not blow up the
WebAssembly heap size, which would revert a streaming fetch back to a
non-streaming one.

Fixes browser.test_fetch_stream_file on macOS Tahoe 26 on Safari 26.0.1.

Author: juj

ChangeLog.md

@@ -20,6 +20,11 @@ See docs/process.md for more on how version tagging works.
 
 5.0.8 (in development)
 ----------------------
+- When performing a streaming Fetch operation, the max chunk size of downloaded
+  bytes that is handed over to the Wasm side from JS is now capped to maximum
+  of 8 megabytes. This ensures that a streaming Fetch stays streaming, rather
+  than transferring the whole (potentially large) file as one huge chunk, which
+  might not fit in the WebAssembly memory. (#26898)
 - The minimum versions of browser engines supported by emscripten's generated
   code were bumped, allowing us to remove our internal support for transpilation
   via babel:

src/Fetch.js

@@ -661,30 +661,47 @@ function fetchXHR(fetch, onsuccess, onerror, onprogress, onreadystatechange) {
       return;
     }
     var ptrLen = (fetchAttrLoadToMemory && fetchAttrStreamData) ? xhr.response?.byteLength ?? 0 : 0;
-    var ptr = 0;
-    if (ptrLen > 0 && fetchAttrLoadToMemory && fetchAttrStreamData) {
+
+    // Specifies the maximum chunk size that a streaming fetch will transfer from
+    // JS over to WebAssembly side. Used to cap a streaming fetch to avoid
+    // overallocating WebAssembly memory needlessly.
+    var FETCH_STREAMING_MAX_CHUNK_SIZE = 8*1024*1024;
+
+    for (var bytePos = 0; bytePos < ptrLen || !ptrLen;) {
+      var sz = Math.min(ptrLen - bytePos, FETCH_STREAMING_MAX_CHUNK_SIZE);
+
+      var ptr = 0;
+      if (sz > 0 && fetchAttrLoadToMemory && fetchAttrStreamData) {
+        // Even though we are doing a streaming fetch (i.e. in small chunks), Safari may call onprogress with a huge
+        // chunk size. This will be a problem for Wasm applications that intend to use streaming fetch to process
+        // an input file in small chunks (to avoid blowing up the WebAssembly heap size). Therefore apply a max
+        // chunk size ceiling to the received chunks, and transfer the data over to WebAssembly using max sized chunks.
+
 #if FETCH_DEBUG
-      dbg(`fetch: allocating ${ptrLen} bytes in Emscripten heap for xhr data`);
+        dbg(`fetch: allocating ${sz} bytes in Emscripten heap for xhr data`);
 #endif
 #if ASSERTIONS
-      assert(onprogress, 'streaming fetch requires an onprogress handler');
+        assert(onprogress, 'streaming fetch requires an onprogress handler');
 #endif
-      // The data pointer malloc()ed here has the same lifetime as the emscripten_fetch_t structure itself has, and is
-      // freed when emscripten_fetch_close() is called.
-      ptr = _realloc({{{ makeGetValue('fetch', C_STRUCTS.emscripten_fetch_t.data, '*') }}}, ptrLen);
-      HEAPU8.set(new Uint8Array(/** @type{Array<number>} */(xhr.response)), ptr);
+        // The data pointer malloc()ed here has the same lifetime as the emscripten_fetch_t structure itself has, and is
+        // freed when emscripten_fetch_close() is called.
+        ptr = _realloc({{{ makeGetValue('fetch', C_STRUCTS.emscripten_fetch_t.data, '*') }}}, sz);
+        HEAPU8.set(new Uint8Array(/** @type{Array<number>} */(xhr.response), bytePos, sz), ptr);
+      }
+      {{{ makeSetValue('fetch', C_STRUCTS.emscripten_fetch_t.data, 'ptr', '*') }}}
+      writeI53ToI64(fetch + {{{ C_STRUCTS.emscripten_fetch_t.numBytes }}}, sz);
+      writeI53ToI64(fetch + {{{ C_STRUCTS.emscripten_fetch_t.dataOffset }}}, e.loaded - ptrLen + bytePos);
+      writeI53ToI64(fetch + {{{ C_STRUCTS.emscripten_fetch_t.totalBytes }}}, e.total);
+      {{{ makeSetValue('fetch', C_STRUCTS.emscripten_fetch_t.readyState, 'xhr.readyState', 'i16') }}}
+      var status = xhr.status;
+      // If loading files from a source that does not give HTTP status code, assume success if we get data bytes
+      if (xhr.readyState >= 3 && xhr.status === 0 && e.loaded > 0) status = 200;
+      {{{ makeSetValue('fetch', C_STRUCTS.emscripten_fetch_t.status, 'status', 'i16') }}}
+      if (xhr.statusText) stringToUTF8(xhr.statusText, fetch + {{{ C_STRUCTS.emscripten_fetch_t.statusText }}}, 64);
+      onprogress(fetch, e);
+      bytePos += sz;
+      if (!ptrLen) break;
     }
-    {{{ makeSetValue('fetch', C_STRUCTS.emscripten_fetch_t.data, 'ptr', '*') }}}
-    writeI53ToI64(fetch + {{{ C_STRUCTS.emscripten_fetch_t.numBytes }}}, ptrLen);
-    writeI53ToI64(fetch + {{{ C_STRUCTS.emscripten_fetch_t.dataOffset }}}, e.loaded - ptrLen);
-    writeI53ToI64(fetch + {{{ C_STRUCTS.emscripten_fetch_t.totalBytes }}}, e.total);
-    {{{ makeSetValue('fetch', C_STRUCTS.emscripten_fetch_t.readyState, 'xhr.readyState', 'i16') }}}
-    var status = xhr.status;
-    // If loading files from a source that does not give HTTP status code, assume success if we get data bytes
-    if (xhr.readyState >= 3 && xhr.status === 0 && e.loaded > 0) status = 200;
-    {{{ makeSetValue('fetch', C_STRUCTS.emscripten_fetch_t.status, 'status', 'i16') }}}
-    if (xhr.statusText) stringToUTF8(xhr.statusText, fetch + {{{ C_STRUCTS.emscripten_fetch_t.statusText }}}, 64);
-    onprogress(fetch, e);
   };
   xhr.onreadystatechange = (e) => {
     // check if xhr was aborted by user and don't try to call back