Parent: #493 Related: #491, #755, #757
Problem
Proxy.[[OwnPropertyKeys]] accepts an arbitrary trap result and validates duplicate String/Symbol keys with std.StringHashMapUnmanaged. The default string context is process-predictable, so an adversarial trap can precompute collision-heavy key lists and force avoidable worst-case duplicate/invariant validation cost before ordinary Proxy semantics reject or return the list.
Scope
- Replace only the Proxy ownKeys trap-result membership index with an exact-byte custom hash context.
- Lazily draw one secure seed per trap validation when the first returned key is indexed; an empty result must not allocate the table or request entropy.
- Reuse the interpreter-owned cryptographic seed stream and fail closed if its initial entropy request fails.
- Preserve String/Symbol identity encodings, duplicate rejection, non-configurable and non-extensible target invariants, trap/result observation order, encoded NUL strings, moving-GC lifetimes, and OOM behavior.
No-workaround rules
- No key-count cap, input blacklist, deterministic fallback seed, hash-only equality, skipped duplicate/invariant validation, reordered trap observation, or reduced Proxy semantics.
- No stack, queue, job, Promise, Worker, or Map/Set iterator implementation changes.
Acceptance
- Proxy ownKeys trap membership uses a non-default per-validation secure hash context.
- Empty trap results remain lazy and allocate no membership table or entropy.
- Duplicate String/Symbol, NUL-bearing, adversarial-width, non-configurable, and non-extensible cases retain exact errors/order.
- Focused normal and TSan tests pass without leaks or races.
- Exact-parent Proxy ownKeys Test262 inventory has zero regressions.
Implemented by 9906d22f.
Evidence: focused native tests 2/2; complete ownKeys filter 4/4; existing sparse-array/Proxy invariant suite 1/1; focused TSan tests 2/2, all with zero failures/leaks/races; exact-parent test/built-ins/Proxy/ownKeys remains 27 pass, 0 fail (0 flips, 0 regressions).