Fix scala-js/scala-js#3476: Specify that com messages must be valid UTF-16 strings.

* Document it in the Scaladoc of `startWithCom`
* Assert that all messages are valid in the `TestKit`
* Fix `ComTests.largeMessageTest` not to use an invalid message

Author: sjrd

js-envs-test-kit/src/main/scala/org/scalajs/jsenv/test/ComTests.scala

@@ -103,8 +103,13 @@ private[test] class ComTests(config: JSEnvSuiteConfig) {
 
   @Test
   def largeMessageTest: Unit = {
-    // 1MB data
-    replyTest(new String(Array.tabulate(1024 * 1024)(_.toChar)))
+    /* 1MB data.
+     * (i & 0x7f) limits the input to the ASCII repertoire, which will use
+     * exactly 1 byte per Char in UTF-8. This restriction also ensures that we
+     * do not introduce surrogate characters and therefore no invalid UTF-16
+     * strings.
+     */
+    replyTest(new String(Array.tabulate(1024 * 1024)(i => (i & 0x7f).toChar)))
   }
 
   @Test

js-envs-test-kit/src/main/scala/org/scalajs/jsenv/test/kit/ComRun.scala

@@ -31,6 +31,7 @@ class ComRun private[kit] (run: JSComRun, out: IOReader, err: IOReader,
 
   /** Calls [[JSComRun#send]] on the underlying run. */
   final def send(msg: String): this.type = {
+    requireValidMessage(msg)
     run.send(msg)
     this
   }
@@ -41,12 +42,41 @@ class ComRun private[kit] (run: JSComRun, out: IOReader, err: IOReader,
    *  @throws java.util.concurrent.TimeoutException if there is no message for too long.
    */
   final def expectMsg(expected: String): this.type = {
+    requireValidMessage(expected)
     require(!noMessages, "You may not call expectMsg after calling expectNoMsgs")
     val actual = msgs.waitOnMessage(timeout.fromNow)
     assertEquals("got bad message", expected, actual)
     this
   }
 
+  private def requireValidMessage(msg: String): Unit = {
+    val len = msg.length
+    var i = 0
+    while (i < len) {
+      val c = msg.charAt(i)
+
+      def fail(lowOrHigh: String): Nothing = {
+        val msgDescription =
+          if (len > 128) s"Message (of length $len)"
+          else s"Message '$msg'"
+        throw new IllegalArgumentException(
+            s"$msgDescription is not a valid message because it contains an " +
+            s"unpaired $lowOrHigh surrogate 0x${c.toInt.toHexString} at index $i")
+      }
+
+      if (Character.isSurrogate(c)) {
+        if (Character.isLowSurrogate(c))
+          fail("low")
+        else if (i == len - 1 || !Character.isLowSurrogate(msg.charAt(i + 1)))
+          fail("high")
+        else
+          i += 2
+      } else {
+        i += 1
+      }
+    }
+  }
+
   /** Marks that no further messages are expected.
    *
    *  This will make the methods [[closeRun]] / [[fails]] / [[succeeds]] fail if

js-envs/src/main/scala/org/scalajs/jsenv/JSEnv.scala

@@ -51,6 +51,11 @@ trait JSEnv {
    *  scalajsCom.send("my message");
    *  }}}
    *
+   *  All messages, sent in both directions, must be valid UTF-16 strings,
+   *  i.e., they must not contain any unpaired surrogate character. The
+   *  behavior of a communication channel is unspecified if this requirement is
+   *  not met.
+   *
    *  We describe the expected message delivery guarantees by denoting the
    *  transmitter as `t` and  the receiver as `r`. Both the JVM and the JS end
    *  act once as a transmitter and once as a receiver. These two

js-envs/src/main/scala/org/scalajs/jsenv/JSRuns.scala

@@ -62,6 +62,10 @@ object JSRun {
 /** A [[JSRun]] that has a communication channel to the running JS code. */
 trait JSComRun extends JSRun {
   /** Sends a message to the JS end.
+   *
+   *  The `msg` must be a valid UTF-16 string, i.e., it must not contain any
+   *  unpaired surrogate character. The behavior of the communication channel
+   *  is unspecified if this requirement is not met.
    *
    *  Async, nothrow. See [[JSEnv#startWithCom]] for expected message delivery
    *  guarantees.