fix: 5 more instances of the stale-write clone bug in string/regexp splitting

Continuing the sweep from bbd1ddb (grepped for the "publish empty, grow
visible" idiom and its variants across every file that calls
vmAllocManagedSlice, not just the ones with an explanatory comment
already attached). Found the identical shape in:

- string.zig: nativeStrSplit (both the empty-separator/rune and
  separator-based branches), nativeStrFields, and the split-with-limit
  function — each grows a published array_managed length by one
  element per split/field while writing through a captured local, in a
  loop whose body (substring/makeDynString) can allocate.
- regexp.zig: nativeReFindAll and the split function that follows it —
  same shape, one array_managed element written per regex match.

All five: pre-fill the destination with .null and publish the full
length immediately instead of growing it visible incrementally, then
read/write through the owning Object's own field per iteration rather
than the captured local — same fix as core.clone (6e4b81c), host_abi's
wire decoding (10837a5), and template's path splitting (bbd1ddb).

Also checked and ruled out as non-instances: core.zig's nativeGcStats/
nativeGcStatsExt (superficially similar "publish empty then fill"
shape, but every value written is a scalar .int or a ctx.cs.internStr
string — internStr allocates from the chunk's own permanent bump
region, never the collectible managed heap, so nothing in either loop
can trigger compactManagedHeap at all).

Verified: zig build compiler-test (native Debug, -Dgc_stress=true, and
-Dheap_paranoia=true) all 993/993. Manually verified via the rebuilt
CLI: std.string.split (both separator forms), std.string.fields,
regexp find_all, and regexp split all produce correct output.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C3pMYWS2xy8zitUkpJaiZU

Author: ganehag

src/lang/native/regexp.zig

@@ -560,13 +560,22 @@ pub fn nativeReFindAll(ctx: VMContext, pattern_val: Value, s_val: Value) !Value
     const obj = try vmgc.allocTempRooted(ctx, .{ .array_managed = &[_]Value{} });
     defer ctx.vs.popTempRoot();
     const result = try vmgc.vmAllocManagedSlice(ctx, Value, matches.len);
-    obj.* = .{ .array_managed = result[0..0] };
+    // GC-audit 2026-09 (project_gc_rooting_hardening): pre-fill and
+    // publish the full length immediately, then write through
+    // obj.array_managed (re-derived each time) rather than the captured
+    // `result` local — makeDynString can allocate and, rarely, trigger
+    // compactManagedHeap, which would relocate obj's backing (a write
+    // through the stale `result` afterward lands in freed/reused memory)
+    // and, separately, size any mid-loop relocation from the length
+    // visible at that point, losing the reserved-but-unwritten tail.
+    for (result) |*slot| slot.* = .null;
+    obj.* = .{ .array_managed = result[0..matches.len] };
     for (matches, 0..) |m, j| {
         // Re-derive s_val's bytes on every iteration: makeDynString's own
         // allocation can compact and relocate s_val's backing between calls.
         const s_now = try vms.asStringValue(s_val);
-        result[j] = try vmgc.makeDynString(ctx, s_now[m[0]..m[1]]);
-        obj.* = .{ .array_managed = result[0 .. j + 1] };
+        const piece = try vmgc.makeDynString(ctx, s_now[m[0]..m[1]]);
+        obj.array_managed[j] = piece;
     }
     return .{ .object = obj };
 }
@@ -629,13 +638,18 @@ pub fn nativeReSplit(ctx: VMContext, pattern_val: Value, s_val: Value) !Value {
     const obj = try vmgc.allocTempRooted(ctx, .{ .array_managed = &[_]Value{} });
     defer ctx.vs.popTempRoot();
     const result = try vmgc.vmAllocManagedSlice(ctx, Value, parts.items.len);
-    obj.* = .{ .array_managed = result[0..0] };
+    // GC-audit 2026-09 (project_gc_rooting_hardening): pre-fill and
+    // publish the full length immediately, then write through
+    // obj.array_managed (re-derived each time) rather than the captured
+    // `result` local — see nativeReFindAll above for why.
+    for (result) |*slot| slot.* = .null;
+    obj.* = .{ .array_managed = result[0..parts.items.len] };
     for (parts.items, 0..) |part, j| {
         // Re-derive s_val's bytes on every iteration: makeDynString's own
         // allocation can compact and relocate s_val's backing between calls.
         const s_now = try vms.asStringValue(s_val);
-        result[j] = try vmgc.makeDynString(ctx, s_now[part[0]..part[1]]);
-        obj.* = .{ .array_managed = result[0 .. j + 1] };
+        const piece = try vmgc.makeDynString(ctx, s_now[part[0]..part[1]]);
+        obj.array_managed[j] = piece;
     }
     return .{ .object = obj };
 }

src/lang/native/string.zig

@@ -36,9 +36,21 @@ pub fn nativeStrSplit(ctx: VMContext, s_val: Value, sep_val: Value, managed: boo
     defer ctx.vs.popTempRoot();
     if (count > 0) {
         const pieces = try vmgc.vmAllocManagedSlice(ctx, Value, count);
-        // Attach the slice as it fills: substring() can trigger GC, and
-        // already-filled elements must be traced or they get reclaimed.
-        arr_obj.* = .{ .array_managed = pieces[0..0] };
+        // GC-audit 2026-09 (project_gc_rooting_hardening): pre-fill and
+        // publish the full length immediately rather than growing it
+        // visible by one element per iteration while writing through the
+        // captured `pieces` local — substring()/makeDynString() can
+        // allocate and, rarely, trigger compactManagedHeap, which would
+        // relocate arr_obj's backing (a write through the stale `pieces`
+        // afterward lands in whatever now occupies that freed memory)
+        // and, separately, size any mid-loop relocation from the length
+        // visible at that point, permanently losing the
+        // reserved-but-unwritten tail of this allocation. Every slot is a
+        // valid, traceable .null from the start, so no incremental
+        // visibility is needed; write through arr_obj.array_managed
+        // (re-derived each time) instead of `pieces`.
+        for (pieces) |*slot| slot.* = .null;
+        arr_obj.* = .{ .array_managed = pieces[0..count] };
         if (sep.len == 0) {
             var i: usize = 0;
             var pi: usize = 0;
@@ -48,26 +60,26 @@ pub fn nativeStrSplit(ctx: VMContext, s_val: Value, sep_val: Value, managed: boo
                 // compact, relocating s_val's backing.
                 const s = try vms.asStringValue(s_val);
                 const w = try vmstr.utf8NextRuneByteLen(s, i);
-                pieces[pi] = try substring(ctx, s[i .. i + w], managed);
+                const piece = try substring(ctx, s[i .. i + w], managed);
+                arr_obj.array_managed[pi] = piece;
                 i += w;
                 pi += 1;
-                arr_obj.* = .{ .array_managed = pieces[0..pi] };
             }
         } else {
             var i: usize = 0;
             var pi: usize = 0;
             while (true) {
                 const s = try vms.asStringValue(s_val);
                 const pos = std.mem.indexOfPos(u8, s, i, sep) orelse break;
-                pieces[pi] = try substring(ctx, s[i..pos], managed);
+                const piece = try substring(ctx, s[i..pos], managed);
+                arr_obj.array_managed[pi] = piece;
                 pi += 1;
-                arr_obj.* = .{ .array_managed = pieces[0..pi] };
                 i = pos + sep.len;
             }
             const s = try vms.asStringValue(s_val);
-            pieces[pi] = try substring(ctx, s[i..], managed);
+            const piece = try substring(ctx, s[i..], managed);
+            arr_obj.array_managed[pi] = piece;
         }
-        arr_obj.* = .{ .array_managed = pieces[0..count] };
     }
     return .{ .object = arr_obj };
 }
@@ -270,9 +282,12 @@ pub fn nativeStrFields(ctx: VMContext, s_val: Value) !Value {
     defer ctx.vs.popTempRoot();
     if (count > 0) {
         const pieces = try vmgc.vmAllocManagedSlice(ctx, Value, count);
-        // Attach as it fills: makeDynString can trigger GC and earlier
-        // elements must be traced.
-        arr_obj.* = .{ .array_managed = pieces[0..0] };
+        // GC-audit 2026-09 (project_gc_rooting_hardening): pre-fill and
+        // publish the full length immediately, then write through
+        // arr_obj.array_managed (re-derived each time) rather than the
+        // captured `pieces` local — see nativeStrSplit above for why.
+        for (pieces) |*slot| slot.* = .null;
+        arr_obj.* = .{ .array_managed = pieces[0..count] };
         var pi: usize = 0;
         i = 0;
         while (i < s0.len) {
@@ -285,11 +300,9 @@ pub fn nativeStrFields(ctx: VMContext, s_val: Value) !Value {
             const start = i;
             while (i < s.len and !isFieldSep(s[i])) i += 1;
             const piece = try vmgc.makeDynString(ctx, s[start..i]);
-            pieces[pi] = piece;
+            arr_obj.array_managed[pi] = piece;
             pi += 1;
-            arr_obj.* = .{ .array_managed = pieces[0..pi] };
         }
-        arr_obj.* = .{ .array_managed = pieces[0..count] };
     }
     return .{ .object = arr_obj };
 }
@@ -426,9 +439,12 @@ pub fn nativeStrSplitN(ctx: VMContext, s_val: Value, sep_val: Value, n_v: Value)
     const arr_obj = try vmgc.allocTempRooted(ctx, .{ .array = &[_]Value{} });
     defer ctx.vs.popTempRoot();
     const pieces = try vmgc.vmAllocManagedSlice(ctx, Value, count);
-    // Attach as it fills: makeDynString can trigger GC and earlier elements
-    // must be traced.
-    arr_obj.* = .{ .array_managed = pieces[0..0] };
+    // GC-audit 2026-09 (project_gc_rooting_hardening): pre-fill and
+    // publish the full length immediately, then write through
+    // arr_obj.array_managed (re-derived each time) rather than the
+    // captured `pieces` local — see nativeStrSplit above for why.
+    for (pieces) |*slot| slot.* = .null;
+    arr_obj.* = .{ .array_managed = pieces[0..count] };
     if (sep0.len == 0) {
         // Split at UTF-8 codepoint boundaries (not byte boundaries).
         // Track byte_pos across iterations; re-derive s each time since
@@ -437,17 +453,18 @@ pub fn nativeStrSplitN(ctx: VMContext, s_val: Value, sep_val: Value, n_v: Value)
         var pi: usize = 0;
         while (pi < count) {
             const s = try vms.asStringValue(s_val);
-            if (pi + 1 == count) {
+            const piece = if (pi + 1 == count)
                 // Last piece: remainder of the string (either the last
                 // single rune when no limit hit, or the remaining suffix
                 // when the max cap truncated the split).
-                pieces[pi] = try vmgc.makeDynString(ctx, s[byte_pos..]);
-            } else {
+                try vmgc.makeDynString(ctx, s[byte_pos..])
+            else blk: {
                 const w = try vmstr.utf8NextRuneByteLen(s, byte_pos);
-                pieces[pi] = try vmgc.makeDynString(ctx, s[byte_pos .. byte_pos + w]);
+                const p = try vmgc.makeDynString(ctx, s[byte_pos .. byte_pos + w]);
                 byte_pos += w;
-            }
-            arr_obj.* = .{ .array_managed = pieces[0 .. pi + 1] };
+                break :blk p;
+            };
+            arr_obj.array_managed[pi] = piece;
             pi += 1;
         }
     } else {
@@ -457,15 +474,15 @@ pub fn nativeStrSplitN(ctx: VMContext, s_val: Value, sep_val: Value, n_v: Value)
             const s = try vms.asStringValue(s_val);
             const sep = try vms.asStringValue(sep_val);
             const idx = std.mem.indexOf(u8, s[pos..], sep).?;
-            pieces[pi] = try vmgc.makeDynString(ctx, s[pos .. pos + idx]);
+            const piece = try vmgc.makeDynString(ctx, s[pos .. pos + idx]);
+            arr_obj.array_managed[pi] = piece;
             pos += idx + sep.len;
             pi += 1;
-            arr_obj.* = .{ .array_managed = pieces[0..pi] };
         }
         const s = try vms.asStringValue(s_val);
-        pieces[pi] = try vmgc.makeDynString(ctx, s[pos..]);
+        const piece = try vmgc.makeDynString(ctx, s[pos..]);
+        arr_obj.array_managed[pi] = piece;
     }
-    arr_obj.* = .{ .array_managed = pieces[0..count] };
     return .{ .object = arr_obj };
 }