deno

2a9b192e - fix(ext/node): keep node:vm ContextifyContext wrapper alive with its context (#35090)

fix(ext/node): keep node:vm ContextifyContext wrapper alive with its context (#35090) A function extracted from a contextified node:vm sandbox keeps the underlying v8::Context alive, but the native ContextifyContext wrapper was anchored only on the sandbox object via a private symbol. The context merely stored a raw pointer to the wrapper in its embedder data, which is not a GC root. Dropping every JavaScript reference to the sandbox and forcing garbage collection therefore freed the wrapper while the context stayed alive, so the global proxy interceptor and the wasm code-generation callback could dereference freed memory. This anchors the wrapper in a private symbol on the context's global object in both the contextified and vanilla paths, making the context a strong root for the wrapper for its entire lifetime. The wrapper in turn traces the sandbox reference, so the sandbox stays alive too, and the whole cycle is collected together once the context becomes unreachable. A regression test extracts a function from a contextified sandbox, drops the sandbox, forces GC, and then calls the function in a subprocess so a regression surfaces as a crash.