fix(ios): disable the cppgc caged heap

cppgc_enable_caged_heap defaults to true on arm64 and does not track
v8_enable_pointer_compression, so it stayed on despite that being off.
Enabling it forces cppgc pointer compression, whose reservation asks for
twice the cage to satisfy alignment, and V8::Initialize() calls
cppgc::InitializeProcess unconditionally -- so every iOS app reserved
8 GiB of 4 GiB-aligned address space at startup without using cppgc.

iOS budgets virtual address space per process by device RAM. On smaller
devices no such hole exists, the four reservation attempts all fail, and
Oilpan's fatal OOM handler aborts before any JS runs: an iPad Air crashed
on launch where an iPad Pro was fine.

Costs cppgc pointer compression, its young generation and a write-barrier
fast path. Nothing in the cppgc API changes and CppHeap is unaffected.
Android keeps the cage; 64-bit has the address space and 32-bit cannot
enable it anyway.

Author: edusperoni

README.md

@@ -133,7 +133,22 @@ platform), dispatch the workflow with `platforms: android` or `platforms: ios`.
 ## The gn args are load-bearing
 
 They are commented at their definition in `scripts/matrix/build-android.sh` and
-`scripts/matrix/build-ios.sh`. Two worth knowing:
+`scripts/matrix/build-ios.sh`. Three worth knowing:
+
+- `cppgc_enable_caged_heap=false` (iOS only) — it defaults to **true on arm64**
+  and, contrary to how the flags read, does *not* track
+  `v8_enable_pointer_compression`; enabling it forces cppgc's own pointer
+  compression on, whose reservation asks for twice the cage to satisfy
+  alignment. Since `V8::Initialize()` calls `cppgc::InitializeProcess`
+  unconditionally, every app reserved **8 GiB of 4 GiB-aligned address space** at
+  startup regardless of whether it used cppgc. iOS budgets virtual address space
+  per process by device RAM, so on smaller devices that reservation simply fails
+  and Oilpan's fatal OOM handler aborts the process before any JS runs — an iPad
+  Air crashed on launch while an iPad Pro was fine. Turning it off costs cppgc
+  pointer compression (`Member<T>` becomes 8 bytes), the cppgc young generation,
+  and a write-barrier fast path; it costs nothing in API, and `CppHeap` and
+  unified heap tracing are unaffected. Android keeps the cage: 64-bit ABIs have
+  the address space for it, and it is unavailable on the 32-bit ones anyway.
 
 - `v8_array_buffer_internal_field_count=2` — defaulted to 2 in 10.3 and defaults
   to 0 in 14.9. The Android runtime links a `JSInstanceInfo` into internal field

scripts/matrix/build-ios.sh

@@ -70,6 +70,17 @@ MODULES=(
 # iOS proper cannot JIT, so it is built in lite mode. Catalyst runs on macOS,
 # where JIT is permitted, and is deliberately not lite -- keeping the two arg
 # sets distinct preserves what each currently ships.
+#
+# cppgc_enable_caged_heap=false is load-bearing and not implied by anything
+# else here. It defaults to true on arm64 ("Enable heap reservation of size
+# 4GB") independently of v8_enable_pointer_compression, and enabling it forces
+# cppgc_enable_pointer_compression on, whose reservation path asks for twice
+# the cage to satisfy alignment. V8::Initialize() calls cppgc::InitializeProcess
+# unconditionally, so every app reserved 8 GiB of 4 GiB-aligned address space at
+# startup whether or not it used cppgc. iOS budgets virtual address space per
+# process by device RAM, so that reservation fails outright on smaller devices
+# -- four tries, then Oilpan's fatal OOM handler, before any JS runs. It crashed
+# on an iPad Air while an iPad Pro was fine.
 GN_ARGS="
     target_os=\"ios\"
     treat_warnings_as_errors=false
@@ -89,6 +100,7 @@ GN_ARGS="
     v8_enable_pointer_compression=false
     v8_enable_v8_checks=false
     v8_enable_webassembly=false
+    cppgc_enable_caged_heap=false
     symbol_level=0
 "