[JSC] Nested using blocks lose outer disposals

https://bugs.webkit.org/show_bug.cgi?id=310116

Reviewed by Yusuke Suzuki.

emitUsingBodyScope holds a reference into m_usingScopeStack across the
emitBody call that may recursively append. Once nesting exceeds the
initial Vector capacity, the append reallocates and the stale reference
reads a moved-from UsingScope whose slots vector is empty, so the
finally emits no dispose calls for those outer blocks. ASAN catches the
freed read directly.

Test: JSTests/stress/nested-using-blocks.js

* JSTests/stress/nested-using-blocks.js: Added.
(shouldBe):
(eval.string_appeared_here.string_appeared_here.repeat.depth.1.string_appeared_here.string_appeared_here.repeat):
(shouldBe.async then):
* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h:

Canonical link: https://commits.webkit.org/309457@main

Author: sosukesuzuki

JSTests/stress/nested-using-blocks.js

@@ -0,0 +1,62 @@
+//@ requireOptions("--useExplicitResourceManagement=1")
+
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error(`Expected ${expected} but got ${actual}`);
+}
+
+for (let depth of [5, 8, 9, 16, 17, 20, 32, 64, 128]) {
+    eval(
+        "{using a=null;" +
+        "{using a=null;".repeat(depth - 1) +
+        "0;" +
+        "}".repeat(depth)
+    );
+}
+
+{
+    let n = 0;
+    eval(
+        "{using a={[Symbol.dispose](){n++}};" +
+        "{using a={[Symbol.dispose](){n++}};".repeat(19) +
+        "0;" +
+        "}".repeat(20)
+    );
+    shouldBe(n, 20);
+}
+
+{
+    let order = [];
+    eval(
+        "{using a={[Symbol.dispose](){order.push(0)}};" +
+        Array.from({length: 15}, (_, i) =>
+            `{using a={[Symbol.dispose](){order.push(${i + 1})}};`
+        ).join("") +
+        "0;" +
+        "}".repeat(16)
+    );
+    shouldBe(order.join(","), "15,14,13,12,11,10,9,8,7,6,5,4,3,2,1,0");
+}
+
+for (let depth = 1; depth <= 20; depth++) {
+    let n = 0;
+    let code = "";
+    for (let i = 0; i < depth; i++)
+        code += `{using a${i}={[Symbol.dispose](){n++}};using b${i}={[Symbol.dispose](){n++}};`;
+    code += "0;" + "}".repeat(depth);
+    eval(code);
+    shouldBe(n, depth * 2);
+}
+
+(async () => {
+    for (let depth of [8, 9, 16, 20]) {
+        let n = 0;
+        let code = "(async()=>{";
+        for (let i = 0; i < depth; i++)
+            code += `{await using a${i}={[Symbol.asyncDispose](){n++}};`;
+        code += "0;" + "}".repeat(depth) + "})()";
+        await eval(code);
+        shouldBe(n, depth);
+    }
+})().then(() => {}, e => { print(e); throw e; });
+drainMicrotasks();

Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h

@@ -1375,7 +1375,7 @@ namespace JSC {
         Vector<SwitchInfo> m_switchContextStack;
         Vector<Ref<ForInContext>> m_forInContextStack;
         Vector<TryContext> m_tryContextStack;
-        Vector<UsingScope> m_usingScopeStack;
+        SegmentedVector<UsingScope, 8> m_usingScopeStack;
         unsigned m_yieldPoints { 0 };
         bool m_needsGeneratorification { false };