Parent: #493 Related: #37, #490, #861
Problem
src/agent.zig stores the process-wide typed-array/Wasm waiter domains in
std.AutoHashMapUnmanaged(WaitKey, *WaiterList). Zig hashes the public
{ SharedBufferStorage pointer, byte offset } bytes with fixed-seed
Wyhash(0, ...).
JavaScript controls the number of live SharedArrayBuffer instances and the
aligned byte offsets submitted through Atomics.wait, Atomics.waitAsync, and
Atomics.notify. waitAsync can retain many domains without one OS thread per
entry. A chosen collision family therefore amplifies lookup/insertion/removal
inside the single process-wide waiters_mutex, delaying unrelated realms and
Wasm wait/notify users as well as the attacker.
The mutex prevents engine data races but does not bound adversarial hash-table probe complexity.
Required design
- Replace the auto-hash table with an exact
WaitKeyindex whose bucket placement is keyed by process entropy. - Hash the storage identity and byte offset explicitly; never hash struct padding or weaken exact key equality.
- Install the context lazily under the existing
waiters_mutex, and publish no seed or partial index when the first table allocation fails. - Route insertion, lookup, removal, and test cleanup through the same installed context; no fixed fallback context is allowed after publication.
- Preserve one FIFO list per exact domain, synchronous stack-ticket lifetimes, async ticket ownership/IDs, notify counts, teardown/interruption, and the shared typed-array/Wasm waiter domain exactly.
- Do not add caps, sleeps, polling, input filtering, or semantic shortcuts.
Acceptance
- A deterministic family colliding under the removed auto hash disperses under the keyed context while exact lookups/removals remain correct.
- First-allocation failure leaves context, count, and capacity unpublished; retry succeeds exactly.
- Existing waiter-table sync/async/FIFO/interruption/teardown tests pass in Debug, ReleaseSafe, and TSan.
- Relevant Test262 Atomics wait/notify/waitAsync and Wasm atomic-wait gates show no regressions with a nonzero denominator.
- Full sharded units, threadfuzz/no-GIL witnesses, and ABI boundaries pass.
- Commit and closure evidence link exact commands/results.