mirror of
https://github.com/vercel-labs/scriptc.git
synced 2026-10-29 07:04:09 +08:00
Chris Tate
8a02468073
scr_dyn_release returned the last reference of a number or string box to the free list without scr_cyc_dead, because the release paths never buffer those boxes. A collector pass can: capture boxes trace their payload, and scr_xg_release, which settles the cross-generation edges a restricted pass skipped, calls scr_cyc_on_release on the target whatever its kind. The pooled block then stayed in its candidate buffer, and the next box that reused it carried the stale buffer position. Its death swapped another object into that slot, which corrupted the buffers and crashed a later scr_cyc_on_dead. The fast path now takes a buffered box out of its buffer first. The sanitized runtime does not pool boxes, so only plain builds were affected.