[oscars-integration] Fix test262 test suite failures

.github/workflows/test262.yml

@@ -46,7 +46,7 @@ jobs:
         run: |
           cd boa
           mkdir -p ../results/test262
-          cargo run --release --bin boa_tester -- run -v -o ../results/test262
+          cargo run --release --bin boa_tester -- run -v --disable-parallelism -o ../results/test262
           cd ..
 
       - name: Compare results

Cargo.toml

@@ -118,7 +118,7 @@ rand = "0.10.2"
 num-integer = "0.1.47"
 ryu-js = "1.0.3"
 tap = "1.0.1"
-thiserror = { version = "2.0.20", default-features = false }
+thiserror = { version = "2.0.18", default-features = false }
 typeid = "1.0.3"
 dashmap = "6.2.1"
 num_enum = "0.7.6"

core/engine/benches/full.rs

@@ -18,13 +18,11 @@ static ALLOC: jemallocator::Jemalloc = jemallocator::Jemalloc;
 
 fn create_realm(c: &mut Criterion) {
     c.bench_function("Create Realm", move |b| {
-        let root_shape = RootShape::new(&boa_gc::MutationContext::global());
+        let root_shape = RootShape::new(&unsafe { boa_gc::MutationContext::global() });
         b.iter(|| {
-            Realm::create(
-                &DefaultHooks,
-                &root_shape,
-                &boa_gc::MutationContext::global(),
-            )
+            Realm::create(&DefaultHooks, &root_shape, &unsafe {
+                boa_gc::MutationContext::global()
+            })
         });
     });
 }

core/engine/src/builtins/array/array_iterator.rs

@@ -95,21 +95,36 @@ impl ArrayIterator {
     ///
     /// [spec]: https://tc39.es/ecma262/#sec-%arrayiteratorprototype%.next
     pub(crate) fn next(this: &JsValue, _: &[JsValue], context: &mut Context) -> JsResult<JsValue> {
-        let object = this.as_object();
-        let mut array_iterator = object
-            .as_ref()
-            .and_then(JsObject::downcast_mut::<Self>)
+        let object = this
+            .as_object()
+            .filter(|o| o.is::<Self>())
             .ok_or_else(|| JsNativeError::typ().with_message("`this` is not an ArrayIterator"))?;
-        let index = array_iterator.next_index;
-        if array_iterator.done {
+
+        // Extract needed fields into a scoped block so the RefMut borrow is dropped
+        // before any context call. Holding a RefMut<'_, T> across context operations
+        // is a use-after-free: GC can collect the backing object while the guard is live.
+        let (index, done, array, kind) = {
+            let array_iterator = object
+                .downcast_ref::<Self>()
+                .expect("already checked that it is an ArrayIterator");
+            (
+                array_iterator.next_index,
+                array_iterator.done,
+                array_iterator.array.clone(),
+                array_iterator.kind,
+            )
+        };
+        // RefMut dropped here — safe to use context below.
+
+        if done {
             return Ok(create_iter_result_object(
                 JsValue::undefined(),
                 true,
                 context,
             ));
         }
 
-        let len = if let Some(f) = array_iterator.array.downcast_ref::<TypedArray>() {
+        let len = if let Some(f) = array.downcast_ref::<TypedArray>() {
             let buf = f.viewed_array_buffer().as_buffer();
             let Some(buf) = buf
                 .bytes(std::sync::atomic::Ordering::SeqCst)
@@ -122,26 +137,32 @@ impl ArrayIterator {
 
             f.array_length(buf.len())
         } else {
-            array_iterator.array.length_of_array_like(context)?
+            array.length_of_array_like(context)?
         };
 
         if index >= len {
-            array_iterator.done = true;
+            object.downcast_mut::<Self>().expect("already checked").done = true;
             return Ok(create_iter_result_object(
                 JsValue::undefined(),
                 true,
                 context,
             ));
         }
-        array_iterator.next_index = index + 1;
-        match array_iterator.kind {
+
+        // Write back the incremented index (no borrow held during context calls above).
+        object
+            .downcast_mut::<Self>()
+            .expect("already checked")
+            .next_index = index + 1;
+
+        match kind {
             PropertyNameKind::Key => Ok(create_iter_result_object(index.into(), false, context)),
             PropertyNameKind::Value => {
-                let element_value = array_iterator.array.get(index, context)?;
+                let element_value = array.get(index, context)?;
                 Ok(create_iter_result_object(element_value, false, context))
             }
             PropertyNameKind::KeyAndValue => {
-                let element_value = array_iterator.array.get(index, context)?;
+                let element_value = array.get(index, context)?;
                 let result = Array::create_array_from_list([index.into(), element_value], context);
                 Ok(create_iter_result_object(result.into(), false, context))
             }

core/engine/src/builtins/array/from_async.rs

@@ -124,6 +124,7 @@ impl Array {
                         // Coroutine yielded. We need to allocate it for a future execution.
                         JsPromise::resolve(value, context)?.await_native(
                             NativeCoroutine::from_copy_closure_with_captures(
+                                context.gc_collector(),
                                 from_array_like,
                                 coroutine_state,
                             ),
@@ -174,6 +175,7 @@ impl Array {
                 CoroutineState::Continue(value) => {
                     JsPromise::resolve(value, context)?.await_native(
                         NativeCoroutine::from_copy_closure_with_captures(
+                            context.gc_collector(),
                             from_async_iterator,
                             coroutine_state,
                         ),

core/engine/src/builtins/async_generator/mod.rs

@@ -582,6 +582,7 @@ impl AsyncGenerator {
             context.realm(),
             context.gc_collector(),
             NativeFunction::from_copy_closure_with_captures(
+                context.gc_collector(),
                 |_this, args, generator, context| {
                     // a. Assert: generator.[[AsyncGeneratorState]] is draining-queue.
                     assert_eq!(
@@ -614,6 +615,7 @@ impl AsyncGenerator {
             context.realm(),
             context.gc_collector(),
             NativeFunction::from_copy_closure_with_captures(
+                context.gc_collector(),
                 |_this, args, generator, context| {
                     // a. Assert: generator.[[AsyncGeneratorState]] is draining-queue.
                     assert_eq!(

core/engine/src/builtins/eval/mod.rs

@@ -283,7 +283,7 @@ impl Eval {
             false,
             false,
             context.interner_mut(),
-            mc,
+            &mc,
             in_with,
             spanned_source_text,
             // TODO: Could give more information from previous shadow stack.
@@ -351,7 +351,7 @@ impl Eval {
             let global = frame.realm.environment();
             frame
                 .environments
-                .push_lexical(lexical_scope.num_bindings_non_local(), global, mc);
+                .push_lexical(lexical_scope.num_bindings_non_local(), &global, mc);
         }
 
         context

core/engine/src/builtins/finalization_registry/tests.rs

@@ -1,5 +1,3 @@
-// oscars_backend currently implements `boa_gc::force_collect()` as a no-op, which prevents
-// the FinalizationRegistry callbacks from being triggered during these tests.
 #[cfg(not(feature = "oscars_backend"))]
 mod miri {
 

core/engine/src/builtins/function/mod.rs

@@ -677,7 +677,7 @@ impl BuiltInFunctionObject {
                 function.scopes(),
                 function.contains_direct_eval(),
                 context.interner_mut(),
-                mc,
+                &mc,
             );
 
         let saved = context.vm.frame_mut().environments.pop_to_global();
@@ -1079,7 +1079,7 @@ pub(crate) fn function_call(
         let mc = context.gc_collector();
         let frame = context.vm.frame_mut();
         let global = frame.realm.environment();
-        let index = frame.environments.push_lexical(1, global, mc);
+        let index = frame.environments.push_lexical(1, &global, mc);
         frame.environments.put_lexical_value(
             BindingLocatorScope::Stack(index),
             0,
@@ -1097,7 +1097,7 @@ pub(crate) fn function_call(
         frame.environments.push_function(
             scope,
             FunctionSlots::new(this, function_object.clone(), None),
-            global,
+            &global,
             mc,
         );
     }
@@ -1191,7 +1191,7 @@ fn function_construct(
         let mc = context.gc_collector();
         let frame = context.vm.frame_mut();
         let global = frame.realm.environment();
-        let index = frame.environments.push_lexical(1, global, mc);
+        let index = frame.environments.push_lexical(1, &global, mc);
         frame.environments.put_lexical_value(
             BindingLocatorScope::Stack(index),
             0,
@@ -1220,7 +1220,7 @@ fn function_construct(
                         .clone(),
                 ),
             ),
-            global,
+            &global,
             mc,
         );
     }

core/engine/src/builtins/function/tests.rs

@@ -150,6 +150,7 @@ fn closure_capture_clone() {
                 ctx.realm(),
                 ctx.gc_collector(),
                 NativeFunction::from_copy_closure_with_captures(
+                    ctx.gc_collector(),
                     |_, _, captures, context| {
                         let (string, object) = &captures;
 

core/engine/src/builtins/generator/mod.rs

@@ -287,6 +287,7 @@ impl Generator {
                 // 2. If state is completed, return CreateIterResultObject(undefined, true).
                 GeneratorState::Completed => {
                     r#gen.state = GeneratorState::Completed;
+                    drop(r#gen);
                     return Ok(create_iter_result_object(
                         JsValue::undefined(),
                         true,
@@ -323,6 +324,7 @@ impl Generator {
             }
             CompletionRecord::Return(value) => {
                 r#gen.state = GeneratorState::Completed;
+                drop(r#gen);
                 Ok(create_iter_result_object(value, true, context))
             }
             CompletionRecord::Throw(err) => {
@@ -374,6 +376,7 @@ impl Generator {
                     // b. Once a generator enters the completed state it never leaves it and its
                     // associated execution context is never resumed. Any execution state associated
                     // with generator can be discarded at this point.
+                    drop(r#gen);
 
                     // a. If abruptCompletion.[[Type]] is return, then
                     if let Ok(value) = abrupt_completion {
@@ -414,6 +417,7 @@ impl Generator {
             }
             CompletionRecord::Return(value) => {
                 r#gen.state = GeneratorState::Completed;
+                drop(r#gen);
                 Ok(create_iter_result_object(value, true, context))
             }
             CompletionRecord::Throw(err) => {