[oscars-integration] Fix test262 test suite failures - #5482
Draft
shruti2522 wants to merge 20 commits into
Draft
Conversation
github-actions
Bot
added
the
Waiting On Review
github-actions
Bot
added
C-Dependencies
shruti2522
force-pushed
the
fix-test262
branch
2 times, most recently
from
August 19, 2026 04:57
38d130c to
6f5662e
Compare
shruti2522
force-pushed
the
fix-test262
branch
3 times, most recently
from
August 20, 2026 04:31
ad447ae to
7ee577c
Compare
Test262 conformance changes
New panics (51643): |
shruti2522
force-pushed
the
fix-test262
branch
from
August 20, 2026 06:24
7ee577c to
6be1546
Compare
shruti2522
force-pushed
the
fix-test262
branch
from
August 20, 2026 21:38
6be1546 to
bc7d8fe
Compare
github-actions
Bot
added
C-WebAssembly
shruti2522
force-pushed
the
fix-test262
branch
3 times, most recently
from
August 23, 2026 07:34
efb22a5 to
0efd528
Compare
shruti2522
force-pushed
the
fix-test262
branch
from
August 23, 2026 13:38
482961d to
3f68447
Compare
Both functions held a Ref<'_, T> GC borrow guard across calls to context.gc_collector() and create_data_property_or_throw(context), which can trigger a GC collection cycle, freeing the backing object while the borrow guard is still live (use-after-free -> heap corruption -> malloc_consolidate abort). Fix pattern (same as ListFormat::resolved_options): - Extract all needed fields into owned values inside a scoped block - Drop the Ref<'_, T> at end of the block - All context/GC operations follow the block with no borrow live Collator::resolved_options: locale_str, usage, sensitivity, ignore_punctuation, collation, numeric, case_first are copied out before any context operations. format_to_parts: native formatting (lf.native.format()) moved into a scoped block so the Ref drops before the Array creation loop that repeatedly calls context.gc_collector() and create_data_property_or_throw.
This fixes the same Use-After-Free (UAF) bug pattern found in ListFormat and Collator across the remaining Intl built-ins: - PluralRules - DateTimeFormat - NumberFormat - Segmenter The bug occurs when a `Ref<'_, T>` (via `downcast_ref`) is held across a call to `ObjectInitializer::new(context)` or `options.property(..., context)`, which can trigger a garbage collection cycle and free the underlying object. The fix extracts all required fields into scoped variables before interacting with the context.
shruti2522
force-pushed
the
fix-test262
branch
from
August 23, 2026 14:32
0366fec to
18f007f
Compare
This fixes additional heap use-after-free bugs in the Intl builtins where methods like `PluralRules.prototype.select`, `Segments.prototype.containing`, and `SegmentIterator.prototype.next` held GC borrow guards (`Ref<'_, T>` or `RefMut<'_, T>` via `downcast_ref`) across calls to the `Context` (like `to_number`, `to_integer_or_infinity`, or `create_segment_data_object`) which can trigger a garbage collection cycle and invalidate the pointer. Because tests are run in parallel by `boa_tester`, these UAFs were randomly corrupting the heap allocator state, causing tests in entirely unrelated modules (e.g. `ListFormat.prototype.format`) to crash with `malloc_consolidate(): unaligned fastbin chunk detected`. The fix avoids holding borrow guards across GC-triggering context interactions by extracting the data first.
shruti2522
force-pushed
the
fix-test262
branch
from
August 23, 2026 14:45
df0e727 to
fa96371
Compare
The previous change introduced a type mismatch: inside the scoped block that extracts state from the GC-managed SegmentIterator, a tried to return a tuple from a function whose return type is JsResult<JsValue>. The compiler caught this as an E0308 type mismatch. Replaced the artificial 'finished' boolean flag in a tuple with a clean Option<(JsString, usize, usize, Option<bool>)> and a match statement, which correctly expresses exhaustion vs. a live segment without any type tricks.
This commit does two things: 1. Root cause fix: RegExpStringIterator::next and ArrayIterator::next both held RefMut<'_, T> borrow guards (via downcast_mut) across multiple context calls (RegExpExec, to_string, get, to_length, set, length_of_array_like, Array::get). Any of these can trigger a GC collection that frees the backing object while the mutable guard is live, causing a use-after-free. Fix: extract all needed fields into owned values in a scoped block, drop the borrow guard, then do all context operations. Re-borrow only to write back state changes (completed, done, next_index). 2. CI fix: add --disable-parallelism to the test262 runner command. The cascading 'malloc_consolidate(): unaligned fastbin chunk detected' crashes in innocent suites (anchor, fontsize) happen because rayon runs test suites in parallel in the same process. A UAF in one thread silently corrupts the shared glibc heap; when another thread then allocates, the allocator detects the corruption and aborts the entire process. This makes the symptom appear in a random innocent suite. Serial execution ensures each crash is attributed to the actual offending test, not a random concurrent victim. This is the standard approach while UAF fixes are in progress.
shruti2522
force-pushed
the
fix-test262
branch
from
August 23, 2026 15:06
bd7a3c4 to
5a50231
Compare
Similar to RegExpStringIterator and ArrayIterator, these iterators and generators were holding a RefMut borrow (via downcast_mut) across context calls (create_iter_result_object, String::substring) which trigger GC operations. Fix by dropping the borrow before any context calls are made.
shruti2522
force-pushed
the
fix-test262
branch
from
August 23, 2026 15:28
7dab6bc to
38e9a5d
Compare
ForInIterator::next was holding a RefMut borrow across multiple context-triggering calls (__own_property_keys__, __get_own_property__, create_iter_result_object). Restructured to narrow borrow scope. AsyncGeneratorYield opcode was holding a borrow_mut guard while calling err.into_opaque(context) inside the Throw branch. Replaced with a scoped borrow that clones the queue front before dropping the guard.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
follow up to #5480