lib: bound the generated source map cache

Signed-off-by: Lazizbek Ergashev <lazerg2@gmail.com>

Author: lazerg

doc/api/module.md

@@ -1924,6 +1924,10 @@ added:
 `path` is the resolved path for the file for which a corresponding source map
 should be fetched.
 
+Source maps of code generated by `eval` or `new Function` are held in a cache of
+limited capacity, so the oldest of them are dropped once enough generated code
+has been evaluated.
+
 ### `module.setSourceMapsSupport(enabled[, options])`
 
 <!-- YAML

lib/internal/source_map/source_map_cache.js

@@ -36,10 +36,13 @@ const getModuleSourceMapCache = getLazy(() => {
   return new SourceMapCacheMap();
 });
 
-// The generated source module/script instance is not accessible, so we can use
-// a Map without memory concerns. Separate generated source entries with the module
-// source entries to avoid overriding the module source entries with arbitrary
-// source url magic comments.
+// The generated source module/script instance is not accessible, so these entries
+// cannot be keyed weakly like the module source entries are. The cache is bounded
+// instead, or generated sources evaluated under a changing source url would
+// retain every payload they ever mapped.
+// Separate generated source entries with the module source entries to avoid
+// overriding the module source entries with arbitrary source url magic comments.
+const kGeneratedSourceMapCacheLimit = 256;
 const generatedSourceMapCache = new SafeMap();
 const kLeadingProtocol = /^\w+:\/\//;
 const kSourceMappingURLMagicComment = /\/[*/]#\s+sourceMappingURL=(?<sourceMappingURL>[^\s]+)/g;
@@ -189,7 +192,12 @@ function maybeCacheSourceMap(filename, content, moduleInstance, isGeneratedSourc
   };
 
   if (isGeneratedSource) {
+    // Delete first so that re-evaluating a source moves it back to the newest end.
+    generatedSourceMapCache.delete(filename);
     generatedSourceMapCache.set(filename, entry);
+    if (generatedSourceMapCache.size > kGeneratedSourceMapCacheLimit) {
+      generatedSourceMapCache.delete(generatedSourceMapCache.keys().next().value);
+    }
     return;
   }
   // If it is not a generated source, we assume we are in a "cjs/esm"

test/parallel/test-source-map-generated-cache-limit.js

@@ -0,0 +1,39 @@
+// Flags: --enable-source-maps
+'use strict';
+
+/**
+ * This test verifies that the cache of source maps of generated sources is
+ * bounded, so evaluating code under a new source url evicts the oldest entry.
+ */
+
+require('../common');
+const assert = require('node:assert');
+const { findSourceMap } = require('node:module');
+
+const payload = Buffer.from(JSON.stringify({
+  version: 3,
+  sources: ['a.js'],
+  names: [],
+  mappings: 'AAAA',
+})).toString('base64');
+
+function evaluate(id) {
+  eval(`(() => {})\n` +
+       `//# sourceURL=file:///generated-${id}.js\n` +
+       `//# sourceMappingURL=data:application/json;base64,${payload}`);
+}
+
+evaluate(0);
+assert.ok(findSourceMap('file:///generated-0.js'));
+
+// More generated sources than the limit in
+// internal/source_map/source_map_cache.js, so that the first one is evicted.
+for (let i = 1; i <= 300; i++) {
+  evaluate(i);
+}
+
+assert.strictEqual(findSourceMap('file:///generated-0.js'), undefined);
+
+const sourceMap = findSourceMap('file:///generated-300.js');
+assert.ok(sourceMap);
+assert.strictEqual(sourceMap.findEntry(0, 0).originalLine, 0);