Discovered while isolating #827.
A managed child-realm function that calls a foreign native and triggers moving collection inside nested user code exposes raw caller-realm restores. The direct Array.from case is fixed under #827, but the same exact operation still reproduces through adjacent wrappers:
Function.prototype.call restores the raw saved_env in funcProtoMethod after the nested moving callback, so the child function resumes in a stale/wrong environment and its next global lookup throws ReferenceError.$262.evalScript saves raw env, this_value, and global_object; a moving callback during the evaluated script can leave those restore values stale. This currently reaches a managed-cell write-barrier assertion with a cross-realm constructor witness.
Audit scope should include every synchronous native wrapper that enters another defining realm and later restores raw interpreter realm state. Use the existing precise environment/value roots and reload on restore; do not disable moving GC, pin cells, or add lifecycle machinery.
Acceptance:
- Deterministic forced tree-walker and required-bytecode moving witnesses for direct invocation,
Function.prototype.call/apply, and realm evalScript.
- Correct abrupt-completion restoration as well as normal return.
- Unsuppressed TSan and allocator-clean focused coverage.
- Full native suite and nonzero relevant test262 census before landing.
Related: #827 and parent #465.
Discovered while isolating #827.
A managed child-realm function that calls a foreign native and triggers moving collection inside nested user code exposes raw caller-realm restores. The direct Array.from case is fixed under #827, but the same exact operation still reproduces through adjacent wrappers:
Function.prototype.callrestores the rawsaved_envinfuncProtoMethodafter the nested moving callback, so the child function resumes in a stale/wrong environment and its next global lookup throwsReferenceError.$262.evalScriptsaves rawenv,this_value, andglobal_object; a moving callback during the evaluated script can leave those restore values stale. This currently reaches a managed-cell write-barrier assertion with a cross-realm constructor witness.Audit scope should include every synchronous native wrapper that enters another defining realm and later restores raw interpreter realm state. Use the existing precise environment/value roots and reload on restore; do not disable moving GC, pin cells, or add lifecycle machinery.
Acceptance:
Function.prototype.call/apply, and realmevalScript.Related: #827 and parent #465.