Add first draft of sandboxing suggestions. Sandboxing is not yet fully
thought out so these suggestions are not complete. Duktape 1.0 does not
yet have bytecode executor timeout functionality, so there is no way to
implement protection against CPU hogging. Internal property access and
buffer value access are in conflict and may need a better solution in a
later version.
Detect accidentally unwrapped math functions etc in code policy check. This
would have caught the missing fpclassify() wrapping which broke the build on
some platforms.
This merge also fixes various offenders, and fixes a few small bugs.
Without the suffixes the struct used "free", "alloc", and "realloc". These
shadow names from the standard library. Usually this is not an issue, but
if the standard names are #defines, compile can fail.
Fix resolution of relative paths which were off by one component.
For instance, if current module ID was `foo/bar` and the module require()'d
`./quux`, this would be incorrectly resolved to `foo/bar/quux` instead of the
expected `foo/quux`.
Testcases were testing for the wrong behavior - they are also fixed by this
commit. A specific bug testcase was also added for the particular issue
found by andoma.
Technically this should probably not be necessary: Duktape module loader
is a fully own implementation based on the CommonJS module loading
specification. The specification is not shipped with the distributable,
just the master repo. But it's perhaps best to mention it in the README
still.