Parent: #493 Related: #473, #760, #770, #855, #856
Problem
Four interpreter-local tables remain default-seeded pointer maps whose populations are controlled by JavaScript source/runtime activity:
- invocation-local Annex B eligible declaration-node identity;
- tree-walker string-literal AST-site cache;
- cross-tier tagged-template AST-site cache;
- compiled-RegExp to mutable matcher-state cache.
A realm can create many distinct sites/RegExp instances in attacker-chosen order. Arena placement and ASLR are not an explicit collision defense. Linear scans, cache bypass, or forced VM/tree-walker fallback would either recover superlinear work or change observable identity/state semantics.
Implementation
- Add one lazy interpreter-owned exact-identity hash context sourced through the existing per-interpreter secure seed stream.
- Convert the four maps to keyed
usizeidentity indexes while preserving exact pointer equality and values. - Share the context across nested calls and all four tables; do not request entropy per table or site.
- Publish the context only after the first successful identity insertion; empty lookups remain allocation- and entropy-free.
- Preserve scratch/arena ownership, RegExp matcher mutability, tagged-template cross-tier identity, literal GC rooting/relocation, and Annex B eligibility lifetime.
- Keep the Context-owned debugger registry out of scope because it has a distinct shared-lock/publication contract.
Acceptance
- All four interpreter-local maps use the keyed context; their default pointer maps are gone.
- A deterministic legacy-collision family disperses under an installed seed with exact get/contains semantics.
- Failed first insertion leaves the identity context and table unpublished; retry succeeds.
- String literal, tagged template (tree-walker and VM), RegExp matcher reuse, and Annex B node eligibility remain exact.
- Precise-GC tracing and moving relocation preserve cached values and map membership.
- Focused interpreter/VM/GC Debug and TSan, full units, exact-parent Test262, threadfuzz, and ABI gates pass.
No-workaround rules
No source blacklist, site count cap, linear scan, cache disablement, forced tier fallback, address-secrecy assumption, predictable seed, per-table entropy request, third-party map, or weakened identity semantics.