Parent: #493 Related: #496, #761
Problem
The parser's rest_trailing_comma_arrays, pending_cover_inits, pending_proto_dup, and paren_wrapped indexes use AutoHashMapUnmanaged's default fixed hash context. User source controls the number and insertion order of the arena-allocated AST nodes stored in these tables. Arena/ASLR address placement is incidental process state, not an explicit keyed defense against adversarial collision families.
These tables preserve cover-grammar facts by exact node identity, so replacing them with content keys or scans would either change semantics or introduce attacker-proportional repeated work.
Implementation
- Add an exact-identity hash context keyed from the parser's existing lazy parse-root secure seed.
- Keep exact pointer/integer equality; only the bucket hash changes.
- Share one seed across nested template-substitution parsers, matching declaration-name indexes.
- Publish a newly derived seed only after the first table insertion succeeds, so OOM remains failure-atomic.
- Keep empty lookup/removal paths allocation- and entropy-free.
- Preserve arena ownership and avoid adding per-node metadata or another parse pass.
Acceptance
- All four cover-grammar identity indexes use the keyed context.
- A deterministic adversarial witness proves keys colliding under the old fixed context disperse under an installed seed while exact identity remains correct.
- Failed first insertion leaves both the index and shared secure state empty; retry succeeds.
- Parentheses, array-rest trailing comma, CoverInitializedName, and duplicate
__proto__parse semantics remain exact. - Focused parser/OOM tests, full unit suite, exact-parent Test262 frontend evidence, threadfuzz, and public/private ABI gates pass.
No-workaround rules
No source blacklist, arbitrary grammar limit, linear membership scan, address secrecy assumption, third-party hash table, or weakened early error.