quickjs-emscripten-sync 1.8.4 → 1.9.1

package/src/index.ts

@@ -2,6 +2,7 @@ import type {
   QuickJSDeferredPromise,
   QuickJSHandle,
   QuickJSContext,
+  QuickJSAsyncContext,
   SuccessOrFail,
   VmCallResult,
   Intrinsics,
@@ -11,9 +12,20 @@ import { wrapContext, QuickJSContextEx } from "./contextex";
 import { defaultRegisteredObjects } from "./default";
 import marshal from "./marshal";
 import unmarshal from "./unmarshal";
+import unmarshalHostRef from "./unmarshal/hostref";
 import { complexity, isES2015Class, isObject, walkObject } from "./util";
 import VMMap from "./vmmap";
-import { call, isHandleObject, json, consumeAll, mayConsume, handleFrom } from "./vmutil";
+import {
+  call,
+  isHandleObject,
+  json,
+  consume,
+  consumeAll,
+  mayConsume,
+  handleFrom,
+  enableFnCache,
+  disposeFnCache,
+} from "./vmutil";
 import { wrap, wrapHandle, unwrap, unwrapHandle, Wrapped } from "./wrapper";
 
 export {
@@ -53,6 +65,10 @@ export type Options = {
   compat?: boolean;
   /** Experimental: use QuickJSContextEx, which wraps existing QuickJSContext. */
   experimentalContextEx?: boolean;
+  /** Globally enable sync mode (default `true`). When `false`, objects are not wrapped with proxies and marshalled handles are disposed after use, so `arena.sync` has no effect but objects are not retained for their whole lifetime. Useful to avoid memory growth when frequently exchanging short-lived objects. */
+  syncEnabled?: boolean;
+  /** A callback that returns whether an object should be passed to the VM by reference (as an opaque HostRef) instead of being marshalled by value/proxy. The guest cannot read such objects, but can hold them and pass them back to the host, where they resolve to the original object. */
+  marshalByReference?: (target: any) => boolean;
 };
 
 /**
@@ -63,6 +79,14 @@ export class Arena {
   _map: VMMap;
   _registeredMap: VMMap;
   _registeredMapDispose = new Set<any>();
+  // Handles with no owner: "json" copies and BigInt values. Unlike
+  // proxy-marshalled objects they are not identity-tracked in `_map`. A nested
+  // one is disposed by its parent consumer via `_disposeTransient` as soon as
+  // the value has been copied; this set is the fallback that frees any that
+  // were never nested (e.g. a top-level value before its caller consumes it) on
+  // dispose. Top-level handles are removed in `_marshal` since their caller
+  // disposes them via `mayConsume`.
+  _transientHandles = new Set<QuickJSHandle>();
   _sync = new Set<any>();
   _temporalSync = new Set<any>();
   _symbol = Symbol();
@@ -80,6 +104,7 @@ export class Arena {
     }
 
     this.context = options?.experimentalContextEx ? wrapContext(ctx) : ctx;
+    enableFnCache(this.context);
     this._options = options;
     this._symbolHandle = ctx.unwrapResult(ctx.evalCode(`Symbol()`));
     this._map = new VMMap(ctx);
@@ -91,12 +116,22 @@ export class Arena {
    * Dispose of the arena and managed handles. This method won't dispose the VM itself, so the VM has to be disposed of manually.
    */
   dispose() {
+    for (const h of this._transientHandles) {
+      if (h.alive) h.dispose();
+    }
+    this._transientHandles.clear();
     this._map.dispose();
     this._registeredMap.dispose();
     this._symbolHandle.dispose();
+    disposeFnCache(this.context);
     this.context.disposeEx?.();
   }
 
+  /** Allows `using arena = new Arena(...)` to dispose the arena automatically. */
+  [Symbol.dispose]() {
+    this.dispose();
+  }
+
   /**
    * Evaluate JS code in the VM and get the result as an object on the host side. It also converts and re-throws error objects when an error is thrown during evaluation.
    */
@@ -150,7 +185,7 @@ export class Arena {
     if ("value" in result) {
       return result.value;
     }
-    throw this._unwrapIfNotSynced(result.error.consume(this._unmarshal));
+    throw this._unwrapIfNotSynced(consume(result.error, this._unmarshal));
   }
 
   /**
@@ -355,12 +390,12 @@ export class Arena {
     if ("value" in result) {
       return result.value;
     }
-    throw this._unwrapIfNotSynced(result.error.consume(this._unmarshal));
+    throw this._unwrapIfNotSynced(consume(result.error, this._unmarshal));
   }
 
   _unwrapResultAndUnmarshal(result: VmCallResult<QuickJSHandle> | undefined): any {
     if (!result) return;
-    return this._unwrapIfNotSynced(this._unwrapResult(result).consume(this._unmarshal));
+    return this._unwrapIfNotSynced(consume(this._unwrapResult(result), this._unmarshal));
   }
 
   _isMarshalable = (t: unknown): boolean | "json" => {
@@ -368,6 +403,19 @@ export class Arena {
     return (typeof im === "function" ? im(this._unwrap(t)) : im) ?? "json";
   };
 
+  _marshalByReference = (t: unknown): boolean => {
+    return !!this._options?.marshalByReference?.(this._unwrap(t));
+  };
+
+  // Register an opaque HostRef handle by its host value without wrapping it.
+  _registerHostRef = (t: unknown, handle: QuickJSHandle): QuickJSHandle => {
+    const u = this._unwrap(t);
+    const existing = this._map.get(u);
+    if (existing) return existing;
+    this._map.set(u, handle);
+    return handle;
+  };
+
   _marshalFind = (t: unknown) => {
     const unwrappedT = this._unwrap(t);
     const handle =
@@ -383,8 +431,29 @@ export class Arena {
     h: QuickJSHandle | QuickJSDeferredPromise,
     mode: true | "json" | undefined,
   ): Wrapped<QuickJSHandle> | undefined => {
-    if (mode === "json") return;
-    return this._register(t, handleFrom(h), this._map)?.[1];
+    if (mode === "json") {
+      // json handles have no identity to track; register as transient so they
+      // are disposed once consumed (or on dispose) instead of leaking.
+      this._registerTransient(handleFrom(h));
+      return;
+    }
+    const registered = this._register(t, handleFrom(h), this._map);
+    if (registered) return registered[1];
+    // `_register` bails for value-only built-ins that `_wrap` excludes (Map,
+    // Set, Date, ArrayBuffer, TypedArray): they are marshalled by value with no
+    // entry in `_map`, so their handle has no owner. Track it as transient so a
+    // nested one is disposed once consumed, like the json path. (Objects already
+    // owned by `_registeredMap` are reached via `_marshalFind`, not here.)
+    if (!this._registeredMap.has(t)) this._registerTransient(handleFrom(h));
+    return;
+  };
+
+  _registerTransient = (handle: QuickJSHandle): void => {
+    this._transientHandles.add(handle);
+  };
+
+  _disposeTransient = (handle: QuickJSHandle): void => {
+    if (this._transientHandles.delete(handle) && handle.alive) handle.dispose();
   };
 
   _marshalPreApply = (target: (...args: any[]) => any, that: unknown, args: unknown[]): void => {
@@ -405,21 +474,35 @@ export class Arena {
       return [registered, false];
     }
 
-    const handle = marshal(this._wrap(target) ?? target, {
+    // Pass-by-reference objects must reference the original, not a proxy wrapper.
+    const marshalTarget = this._marshalByReference(target)
+      ? this._unwrap(target)
+      : this._wrap(target) ?? target;
+
+    const handle = marshal(marshalTarget, {
       ctx: this.context,
       unmarshal: this._unmarshal,
       isMarshalable: this._isMarshalable,
+      marshalByReference: this._marshalByReference,
+      registerHostRef: this._registerHostRef,
       find: this._marshalFind,
       pre: this._marshalPre,
+      registerTransient: this._registerTransient,
+      disposeTransient: this._disposeTransient,
       preApply: this._marshalPreApply,
       custom: this._options?.customMarshaller,
     });
 
-    return [handle, !this._map.hasHandle(handle)];
+    // A top-level transient handle is disposed by the caller via `mayConsume`,
+    // so it must not also be retained (and re-disposed) by the transient set.
+    this._transientHandles.delete(handle);
+
+    const syncEnabled = this._options?.syncEnabled ?? true;
+    return [handle, !syncEnabled || !this._map.hasHandle(handle)];
   };
 
   _preUnmarshal = (t: any, h: QuickJSHandle): Wrapped<any> => {
-    return this._register(t, h, undefined, true)?.[0];
+    return this._register(t, h, undefined, this._options?.syncEnabled ?? true)?.[0];
   };
 
   _unmarshalFind = (h: QuickJSHandle): unknown => {
@@ -432,6 +515,12 @@ export class Arena {
       return registered;
     }
 
+    // Resolve opaque HostRefs before wrapping, since a proxy would hide them.
+    if (this._options?.marshalByReference) {
+      const ref = unmarshalHostRef(this.context, handle);
+      if (ref) return ref.value;
+    }
+
     const [wrappedHandle] = this._wrapHandle(handle);
     return unmarshal(wrappedHandle ?? handle, {
       ctx: this.context,
@@ -439,6 +528,7 @@ export class Arena {
       find: this._unmarshalFind,
       pre: this._preUnmarshal,
       custom: this._options?.customUnmarshaller,
+      hostRef: !!this._options?.marshalByReference,
     });
   };
 
@@ -487,6 +577,7 @@ export class Arena {
       this._marshal,
       this._syncMode,
       this._options?.isWrappable,
+      this._options?.syncEnabled ?? true,
     );
   }
 
@@ -508,6 +599,7 @@ export class Arena {
       this._unmarshal,
       this._syncMode,
       this._options?.isHandleWrappable,
+      this._options?.syncEnabled ?? true,
     );
   }
 
@@ -515,3 +607,28 @@ export class Arena {
     return unwrapHandle(this.context, target, this._symbolHandle);
   }
 }
+
+/**
+ * An Arena backed by a {@link QuickJSAsyncContext}. In addition to everything
+ * `Arena` offers, it can evaluate code asynchronously with `evalCodeAsync`,
+ * which lets the VM await host promises (e.g. async module loaders or async
+ * functions exposed from the host) without manually pumping pending jobs.
+ */
+export class AsyncArena extends Arena {
+  asyncContext: QuickJSAsyncContext;
+
+  constructor(ctx: QuickJSAsyncContext, options?: Options) {
+    super(ctx, options);
+    this.asyncContext = ctx;
+  }
+
+  /**
+   * Evaluate JS code asynchronously in the VM and get the result on the host
+   * side. Like `evalCode`, it converts and re-throws errors thrown during
+   * evaluation. Use this when the code awaits host-provided promises.
+   */
+  async evalCodeAsync<T = any>(code: string, filename?: string): Promise<T> {
+    const result = await this.asyncContext.evalCodeAsync(code, filename);
+    return this._unwrapResultAndUnmarshal(result);
+  }
+}

package/src/jsonleak.test.ts

@@ -0,0 +1,178 @@
+import variant from "@jitl/quickjs-wasmfile-debug-sync";
+import { newQuickJSWASMModuleFromVariant } from "quickjs-emscripten";
+import { describe, expect, it } from "vitest";
+
+import { Arena } from ".";
+
+// A non-plain object that defaultIsMarshalable would reject, forcing the
+// "json" marshal path.
+class Weird {
+  x = 1;
+}
+
+const jsonIsMarshalable = (t: unknown) =>
+  typeof t !== "object" || t === null || Object.getPrototypeOf(t) === Object.prototype
+    ? true
+    : "json";
+
+async function withArena(
+  options: ConstructorParameters<typeof Arena>[1],
+  fn: (arena: Arena) => void,
+) {
+  const mod = await newQuickJSWASMModuleFromVariant(variant as any);
+  const ctx = mod.newContext();
+  const arena = new Arena(ctx, options);
+  fn(arena);
+  arena.dispose();
+  // The debug-sync runtime aborts on dispose if any GC object handle leaked, so
+  // simply reaching here without an Emscripten abort means no leak.
+  expect(() => ctx.dispose()).not.toThrow();
+}
+
+describe("json marshal path handle leak", () => {
+  it("does not leak when a nested value is marshalled via json", async () => {
+    await withArena({ isMarshalable: jsonIsMarshalable }, arena => {
+      // Outer object goes through the proxy/object path; the nested `weird`
+      // property resolves to "json", creating a JSON.parse handle that nobody
+      // would otherwise dispose.
+      arena.expose({ obj: { weird: new Weird() } });
+      expect(arena.evalCode(`obj.weird.x`)).toBe(1);
+    });
+  });
+
+  it("does not leak nor double-dispose a top-level json value", async () => {
+    await withArena({ isMarshalable: jsonIsMarshalable }, arena => {
+      // host fn receives a top-level json value as an argument; the handle is
+      // disposed by mayConsume and must not be re-disposed on dispose().
+      let received: any;
+      arena.expose({ sink: (v: any) => (received = v) });
+      arena.evalCode(`sink`);
+      const fn = arena.evalCode(`sink`);
+      fn(new Weird());
+      expect(received).toEqual({ x: 1 });
+    });
+  });
+
+  it("does not leak with the default marshal mode (json)", async () => {
+    // With no isMarshalable option the default mode is "json", so even a plain
+    // nested object exercises the json path that used to leak. (Functions are
+    // dropped by json serialization, so this path only carries plain values.)
+    await withArena(undefined, arena => {
+      arena.expose({ data: { a: { b: 1 } } });
+      expect(arena.evalCode(`data.a.b`)).toBe(1);
+    });
+  });
+
+  it("does not leak when a json value round-trips VM -> host", async () => {
+    await withArena({ isMarshalable: jsonIsMarshalable }, arena => {
+      const received: any[] = [];
+      arena.expose({ host: { f: (v: any) => received.push(v) } });
+      // VM builds a non-plain object and passes it to the host callback.
+      arena.evalCode(`
+        const o = Object.create({ tag: "proto" });
+        o.a = 1;
+        host.f({ nested: o });
+      `);
+      expect(received).toEqual([{ nested: { a: 1 } }]);
+    });
+  });
+});
+
+describe("value-marshalled built-ins do not leak when nested", () => {
+  // Map/Set/Date/ArrayBuffer/TypedArray are excluded from proxy wrapping and
+  // marshalled by value, so they get no entry in `_map`. A top-level one is
+  // disposed by mayConsume, but a nested one used to have no owner and leaked
+  // its handle (aborting the debug runtime on dispose).
+  const builtinMarshalable = (t: unknown) =>
+    t instanceof Map || t instanceof Set ? true : jsonIsMarshalable(t);
+
+  it("nested Map", async () => {
+    await withArena({ isMarshalable: builtinMarshalable }, arena => {
+      arena.expose({ data: { m: new Map<string, unknown>([["b", new Weird()]]) } });
+      expect(arena.evalCode(`data.m.get("b").x`)).toBe(1);
+    });
+  });
+
+  it("nested Set", async () => {
+    await withArena({ isMarshalable: builtinMarshalable }, arena => {
+      arena.expose({ data: { s: new Set<number>([1, 2]) } });
+      expect(arena.evalCode(`data.s.size`)).toBe(2);
+    });
+  });
+
+  it("nested Date and TypedArray", async () => {
+    await withArena({ isMarshalable: true }, arena => {
+      arena.expose({ data: { d: new Date(0), a: new Uint8Array([1, 2, 3]) } });
+      expect(arena.evalCode(`data.a[1]`)).toBe(2);
+    });
+  });
+
+  it("deeply nested Map", async () => {
+    await withArena({ isMarshalable: builtinMarshalable }, arena => {
+      arena.expose({ data: { a: { b: { m: new Map<string, number>([["x", 9]]) } } } });
+      expect(arena.evalCode(`data.a.b.m.get("x")`)).toBe(9);
+    });
+  });
+});
+
+describe("transient handles are freed as they are consumed (no accumulation)", () => {
+  // Marshal `make(i)` many times, disposing the top-level handle each time
+  // (mirroring `mayConsume`). With syncEnabled:false nothing is retained in
+  // `_map`, so any growth in live VM memory / object count is a genuine leak of
+  // a nested transient (json copy or BigInt) that was not disposed.
+  async function liveGrowth(
+    make: (i: number) => unknown,
+    isMarshalable: ConstructorParameters<typeof Arena>[1] extends infer O
+      ? O extends { isMarshalable?: infer M }
+        ? M
+        : never
+      : never,
+  ) {
+    const mod = await newQuickJSWASMModuleFromVariant(variant as any);
+    const ctx = mod.newContext();
+    const arena = new Arena(ctx, { isMarshalable, syncEnabled: false }) as any;
+    const mem = () => ctx.runtime.computeMemoryUsage().consume((h: any) => ctx.dump(h));
+    const marshalOne = (i: number) => {
+      // `_marshal` returns [handle, shouldBeDisposed]; honour it like mayConsume.
+      const [h, shouldDispose] = arena._marshal(make(i));
+      if (shouldDispose && h.alive) h.dispose();
+    };
+    // Warm up so one-time shape/atom allocations are not counted.
+    for (let i = 0; i < 30; i++) marshalOne(i);
+    const before = mem();
+    for (let i = 0; i < 200; i++) marshalOne(i + 100000);
+    const after = mem();
+    arena.dispose();
+    ctx.dispose();
+    return {
+      usedBytes: after.memory_used_size - before.memory_used_size,
+      objects: after.obj_count - before.obj_count,
+    };
+  }
+
+  it("does not leak nested BigInt values", async () => {
+    // Pre-fix this leaked ~7 bytes of BigInt storage per iteration.
+    const { usedBytes } = await liveGrowth(i => ({ b: BigInt(i) * 99999999n }), true);
+    expect(usedBytes).toBeLessThan(400);
+  });
+
+  it("does not accumulate nested json objects", async () => {
+    // Pre-fix each iteration retained one JSON.parse object until dispose.
+    const { objects } = await liveGrowth(() => ({ w: new Weird() }), jsonIsMarshalable);
+    expect(objects).toBeLessThan(20);
+  });
+
+  it("frees json/BigInt values stored in a Map or Set", async () => {
+    // A top-level Map/Set so the collection handle itself is not retained; this
+    // isolates the lifetime of its BigInt/json entries, which must be freed.
+    const collMarshalable = (t: unknown) =>
+      t instanceof Map || t instanceof Set ? true : jsonIsMarshalable(t);
+    const map = await liveGrowth(
+      i => new Map<string, unknown>([["a", BigInt(i)], ["b", new Weird()]]),
+      collMarshalable,
+    );
+    expect(map.usedBytes).toBeLessThan(400);
+    const set = await liveGrowth(() => new Set<unknown>([new Weird()]), collMarshalable);
+    expect(set.usedBytes).toBeLessThan(400);
+  });
+});

package/src/marshal/custom.ts

@@ -1,6 +1,6 @@
 import type { QuickJSContext, QuickJSHandle } from "quickjs-emscripten";
 
-import { call } from "../vmutil";
+import { call, consumeAll } from "../vmutil";
 
 export default function marshalCustom(
   ctx: QuickJSContext,
@@ -33,4 +33,18 @@ export function date(target: unknown, ctx: QuickJSContext): QuickJSHandle | unde
   return handle;
 }
 
-export const defaultCustom = [symbol, date];
+export function arrayBuffer(target: unknown, ctx: QuickJSContext): QuickJSHandle | undefined {
+  if (target instanceof ArrayBuffer) {
+    return ctx.newArrayBuffer(target.slice(0));
+  }
+  if (ArrayBuffer.isView(target)) {
+    // TypedArray or DataView: copy the viewed bytes and rebuild in the VM.
+    const bytes = new Uint8Array(target.buffer, target.byteOffset, target.byteLength).slice();
+    return consumeAll(
+      [ctx.newArrayBuffer(bytes.buffer), ctx.newString(target.constructor.name)],
+      ([buf, name]) => call(ctx, `(buf, name) => new globalThis[name](buf)`, undefined, buf, name),
+    );
+  }
+}
+
+export const defaultCustom = [symbol, date, arrayBuffer];

package/src/marshal/function.ts

@@ -12,6 +12,7 @@ export default function marshalFunction(
   unmarshal: (handle: QuickJSHandle) => unknown,
   preMarshal: (target: unknown, handle: QuickJSHandle) => QuickJSHandle | undefined,
   preApply?: (target: (...args: any[]) => any, thisArg: unknown, args: unknown[]) => any,
+  disposeTransient: (handle: QuickJSHandle) => void = () => {},
 ): QuickJSHandle | undefined {
   if (typeof target !== "function") return;
 
@@ -24,7 +25,10 @@ export default function marshalFunction(
         // Class constructors cannot be invoked without new expression, and new.target is not changed
         const result = new target(...args);
         Object.entries(result).forEach(([key, value]) => {
-          ctx.setProp(this, key, marshal(value));
+          const valueHandle = marshal(value);
+          ctx.setProp(this, key, valueHandle);
+          // setProp dup'd the value into `this`; drop ours if it was transient.
+          disposeTransient(valueHandle);
         });
         return this;
       }
@@ -47,7 +51,7 @@ export default function marshalFunction(
     );
 
   const handle = preMarshal(target, raw) ?? raw;
-  marshalProperties(ctx, target, raw, marshal);
+  marshalProperties(ctx, target, raw, marshal, disposeTransient);
 
   return handle;
 }

package/src/marshal/hostref.ts

@@ -0,0 +1,18 @@
+import type { QuickJSContext, QuickJSHandle } from "quickjs-emscripten";
+
+/**
+ * Marshal a host object as an opaque HostRef handle instead of deep-copying or
+ * proxying it. The guest cannot read the object, but can hold it and pass it
+ * back to the host, where it unmarshals to the original object by reference.
+ */
+export default function marshalHostRef(
+  ctx: QuickJSContext,
+  target: unknown,
+  // Registers handle <-> target without wrapping (a proxy would hide the opaque
+  // HostRef). Keeps identity and lets the arena dispose the handle on teardown.
+  register: (target: unknown, handle: QuickJSHandle) => QuickJSHandle,
+): QuickJSHandle | undefined {
+  if (typeof target !== "object" && typeof target !== "function") return;
+  if (target === null) return;
+  return register(target, ctx.newHostRef(target as object).handle);
+}

package/src/marshal/index.ts

@@ -2,7 +2,9 @@ import type { QuickJSDeferredPromise, QuickJSHandle, QuickJSContext } from "quic
 
 import marshalCustom, { defaultCustom } from "./custom";
 import marshalFunction from "./function";
+import marshalHostRef from "./hostref";
 import marshalJSON from "./json";
+import marshalMapSet from "./mapset";
 import marshalObject from "./object";
 import marshalPrimitive from "./primitive";
 import marshalPromise from "./promise";
@@ -11,7 +13,15 @@ export type Options = {
   ctx: QuickJSContext;
   unmarshal: (handle: QuickJSHandle) => unknown;
   isMarshalable?: (target: unknown) => boolean | "json";
+  marshalByReference?: (target: unknown) => boolean;
+  registerHostRef?: (target: unknown, handle: QuickJSHandle) => QuickJSHandle;
   find: (target: unknown) => QuickJSHandle | undefined;
+  // Track a handle that nobody else owns (json copies, BigInt) so it can be
+  // disposed once consumed.
+  registerTransient?: (handle: QuickJSHandle) => void;
+  // Dispose a handle previously registered as transient, right after a parent
+  // consumer has copied it into the parent value. A no-op for owned handles.
+  disposeTransient?: (handle: QuickJSHandle) => void;
   pre: (
     target: unknown,
     handle: QuickJSHandle | QuickJSDeferredPromise,
@@ -27,6 +37,10 @@ export function marshal(target: unknown, options: Options): QuickJSHandle {
   {
     const primitive = marshalPrimitive(ctx, target);
     if (primitive) {
+      // BigInt handles are heap-allocated and, unlike strings and numbers, are
+      // not reclaimed unless explicitly disposed. Track them as transient so a
+      // nested one is freed by its parent consumer (or on dispose as a fallback).
+      if (typeof target === "bigint") options.registerTransient?.(primitive);
       return primitive;
     }
   }
@@ -36,6 +50,13 @@ export function marshal(target: unknown, options: Options): QuickJSHandle {
     if (handle) return handle;
   }
 
+  // Opt-in pass-by-reference: hand the object to the VM as an opaque HostRef
+  // instead of marshalling its contents. Bypasses isMarshalable on purpose.
+  if (options.marshalByReference?.(target) && options.registerHostRef) {
+    const handle = marshalHostRef(ctx, target, options.registerHostRef);
+    if (handle) return handle;
+  }
+
   const marshalable = isMarshalable?.(target);
   if (marshalable === false) {
     return ctx.undefined;
@@ -48,11 +69,13 @@ export function marshal(target: unknown, options: Options): QuickJSHandle {
   }
 
   const marshal2 = (t: unknown) => marshal(t, options);
+  const disposeTransient = options.disposeTransient;
   return (
     marshalCustom(ctx, target, pre2, [...defaultCustom, ...(options.custom ?? [])]) ??
     marshalPromise(ctx, target, marshal2, pre2) ??
-    marshalFunction(ctx, target, marshal2, unmarshal, pre2, options.preApply) ??
-    marshalObject(ctx, target, marshal2, pre2) ??
+    marshalFunction(ctx, target, marshal2, unmarshal, pre2, options.preApply, disposeTransient) ??
+    marshalMapSet(ctx, target, marshal2, pre2, disposeTransient) ??
+    marshalObject(ctx, target, marshal2, pre2, disposeTransient) ??
     ctx.undefined
   );
 }

package/src/marshal/mapset.ts

@@ -0,0 +1,37 @@
+import type { QuickJSContext, QuickJSHandle } from "quickjs-emscripten";
+
+import { call } from "../vmutil";
+
+export default function marshalMapSet(
+  ctx: QuickJSContext,
+  target: unknown,
+  marshal: (target: unknown) => QuickJSHandle,
+  preMarshal: (target: unknown, handle: QuickJSHandle) => QuickJSHandle | undefined,
+  disposeTransient: (handle: QuickJSHandle) => void = () => {},
+): QuickJSHandle | undefined {
+  if (target instanceof Map) {
+    const raw = call(ctx, "() => new Map()");
+    const handle = preMarshal(target, raw) ?? raw;
+    for (const [k, v] of target) {
+      const kh = marshal(k);
+      const vh = marshal(v);
+      call(ctx, "(m, k, v) => m.set(k, v)", undefined, raw, kh, vh).dispose();
+      // set() has taken its own references; drop ours if they were transient.
+      disposeTransient(kh);
+      disposeTransient(vh);
+    }
+    return handle;
+  }
+
+  if (target instanceof Set) {
+    const raw = call(ctx, "() => new Set()");
+    const handle = preMarshal(target, raw) ?? raw;
+    for (const v of target) {
+      const vh = marshal(v);
+      call(ctx, "(s, v) => s.add(v)", undefined, raw, vh).dispose();
+      // add() has taken its own reference; drop ours if it was transient.
+      disposeTransient(vh);
+    }
+    return handle;
+  }
+}

package/src/marshal/object.ts

@@ -9,6 +9,7 @@ export default function marshalObject(
   target: unknown,
   marshal: (target: unknown) => QuickJSHandle,
   preMarshal: (target: unknown, handle: QuickJSHandle) => QuickJSHandle | undefined,
+  disposeTransient: (handle: QuickJSHandle) => void = () => {},
 ): QuickJSHandle | undefined {
   if (typeof target !== "object" || target === null) return;
 
@@ -23,9 +24,11 @@ export default function marshalObject(
       : undefined;
   if (prototypeHandle) {
     call(ctx, "Object.setPrototypeOf", undefined, handle, prototypeHandle).dispose();
+    // setPrototypeOf has taken its own reference; drop ours if it was transient.
+    disposeTransient(prototypeHandle);
   }
 
-  marshalProperties(ctx, target, raw, marshal);
+  marshalProperties(ctx, target, raw, marshal, disposeTransient);
 
   return handle;
 }

package/src/marshal/primitive.ts

@@ -1,7 +1,5 @@
 import type { QuickJSContext, QuickJSHandle } from "quickjs-emscripten";
 
-// import { call } from "../vmutil";
-
 export default function marshalPrimitive(
   ctx: QuickJSContext,
   target: unknown,
@@ -15,17 +13,10 @@ export default function marshalPrimitive(
       return ctx.newString(target);
     case "boolean":
       return target ? ctx.true : ctx.false;
+    case "bigint":
+      return ctx.newBigInt(target);
     case "object":
       return target === null ? ctx.null : undefined;
-
-    // BigInt is not supported by quickjs-emscripten
-    // case "bigint":
-    //   return call(
-    //     ctx,
-    //     `s => BigInt(s)`,
-    //     undefined,
-    //     ctx.newString(target.toString())
-    //   );
   }
 
   return undefined;