Fix stale-clone-after-compaction bug in std.sort.by/sort_asc/sort_desc

native/sort.zig cloned the input array via cloneArraySlice into a raw,
unrooted managed slice, then looped over it while calling arbitrary
user comparator code (sort_by) or comparison helpers that can allocate.
If that allocation pressure forced the allocator into its last-resort
compactManagedHeap path, the clone was invisible to the compaction
walk (no Object owned it yet), so its memory could be silently reused
while sort.zig kept reading/writing through the now-stale slice —
producing wrong sort results or a fatal VM integrity panic. This is
the same stale-slice-after-compaction bug class already swept and
fixed across the rest of the stdlib on 2026-07-25 (7a87570..20d2e91),
apparently missed for sort.zig at the time.

Fixed by allocating the working copy as a GC-visible, temp-rooted
array up front via allocTempRootedManagedValueArray (the pattern
array.zig already uses), re-deriving through the owning object on
every access in sort_by's loop since the comparator call can compact
mid-sort; sort_asc/sort_desc hold one local slice for their whole loop
since their comparisons are provably allocation-free.

Confirmed via git-stash A/B against the compiled CLI at --heap 128k,
reproducing the crash identically pre-fix (and its absence post-fix)
under plain, -Dgc_stress, and -Dheap_paranoia builds. Added a
correctness regression test in compiler_test.zig; the compaction-crash
itself could not be made to reproduce deterministically in-process
despite matching heap size/max_objects/allocator to the CLI, so this
is documented honestly in the test's comment rather than claimed as a
guaranteed catch.

Author: ganehag

src/compiler_test.zig

@@ -153,6 +153,86 @@ fn expectNoTempRoots() !void {
     try std.testing.expectEqual(@as(usize, 0), vms.tempRootDepth());
 }
 
+// std.sort.by (and sort_asc/sort_desc) used to clone the input array via
+// cloneArraySlice into a raw, unrooted managed slice, then loop over it
+// while calling arbitrary user comparator code (which allocates). If that
+// allocation pressure forced a heap compaction, the clone — invisible to
+// the compaction walk, since no Object owned it yet — could be silently
+// overwritten while native/sort.zig kept reading/writing through the now-
+// stale slice. Fixed by allocating the working copy as a GC-visible,
+// temp-rooted array up front (see native/sort.zig).
+//
+// This test is a basic correctness check for std.sort.by under GC pressure,
+// not a guaranteed reproduction of the compaction-corruption crash itself:
+// the crash was confirmed directly against the compiled CLI (`--heap 128k`,
+// verified via `git stash` of the fix, reproducing identically under plain,
+// -Dgc_stress, and -Dheap_paranoia builds — see the fix commit), but the
+// same script run in-process through api.Runtime here — with heap size,
+// max_objects, and allocator all matched to the CLI — did not reproduce it.
+// The corruption is apparently sensitive to something about process
+// environment/layout beyond these parameters; if this test class needs a
+// deterministic regression guard, it likely has to shell out to the actual
+// compiled binary rather than run in-process.
+test "std.sort.by does not corrupt array elements under heap pressure (compaction during a comparator call)" {
+    var rt = try setupApiRuntime(.{
+        .allow_io = false,
+        .heap_size_bytes = 128 * 1024,
+        .max_objects = 2048,
+    });
+    defer rt.deinit();
+
+    try std.testing.expect(rt.run(
+        \\std := import("std")
+        \\type Item struct { key int, tag string }
+        \\func check() bool {
+        \\    n := 20
+        \\    arr := []
+        \\    i := 0
+        \\    for i < n {
+        \\        idx := (n - i) * 37 mod 97
+        \\        arr = std.core.append(arr, Item{ key: idx, tag: "tag-" + std.conv.to_string(idx) })
+        \\        i = i + 1
+        \\    }
+        \\    pins := []
+        \\    calls := 0
+        \\    cmp := func(a Item, b Item) int {
+        \\        calls = calls + 1
+        \\        s1 := ""
+        \\        p := 0
+        \\        plen := 40 + (calls mod 7) * 30
+        \\        for p < plen {
+        \\            s1 = s1 + "m"
+        \\            p = p + 1
+        \\        }
+        \\        pins = std.core.append(pins, s1)
+        \\        if a.key < b.key { return -1 }
+        \\        if a.key > b.key { return 1 }
+        \\        return 0
+        \\    }
+        \\    sorted := std.sort.by(arr, cmp)
+        \\    ok := true
+        \\    k := 1
+        \\    for k < std.core.len(sorted) {
+        \\        if sorted[k - 1].key > sorted[k].key { ok = false }
+        \\        k = k + 1
+        \\    }
+        \\    k = 0
+        \\    for k < std.core.len(sorted) {
+        \\        want := "tag-" + std.conv.to_string(sorted[k].key)
+        \\        if sorted[k].tag != want { ok = false }
+        \\        k = k + 1
+        \\    }
+        \\    return ok
+        \\}
+    ) == .ok);
+
+    const result = rt.call("check", &.{});
+    switch (result) {
+        .ok => |v| try std.testing.expect(v == .boolean and v.boolean),
+        else => return error.TestUnexpectedResult,
+    }
+}
+
 test "api runtime leaves no temp roots after GC-heavy success and error churn" {
     var rt = try setupApiRuntime(.{
         .allow_io = false,

src/lang/native/sort.zig

@@ -17,8 +17,17 @@ pub fn dispatch(ctx: VMContext, nf: NativeFuncObj, argc: u8) !void {
             if (arr_val != .object) return error.TypeError;
             const arr_obj = arr_val.object;
             if (!vms.isArrayObject(arr_obj)) return error.TypeError;
-            var items = try vms.cloneArraySlice(ctx, arr_obj);
-            const n = items.len;
+            const n = (try vms.asArraySlice(arr_obj)).len;
+            // Allocate the working copy as a GC-visible, temp-rooted array
+            // right away (rather than an owner-less clone) so it survives
+            // any allocation below — cloneArraySlice's old unrooted slice
+            // went stale if a later allocation forced a heap compaction.
+            const out_arr = try vmgc.allocTempRootedManagedValueArray(ctx, n);
+            defer ctx.vs.popTempRoot();
+            out_arr.setAll(try vms.asArraySlice(arr_obj));
+            // Safe to hold as one slice across the whole loop: valueGreaterThan
+            // does no allocation, so nothing here can move out_arr's backing.
+            const items = out_arr.obj.array_managed;
             if (n > 1) {
                 var i: usize = 1;
                 while (i < n) : (i += 1) {
@@ -30,48 +39,57 @@ pub fn dispatch(ctx: VMContext, nf: NativeFuncObj, argc: u8) !void {
                     items[j] = key;
                 }
             }
-            const out_obj = try vmgc.vmAllocObject(ctx);
-            out_obj.* = .{ .array_managed = items[0..n] };
             ctx.vs.vmPopArgs(argc);
-            try ctx.vs.vmPush(.{ .object = out_obj });
+            try ctx.vs.vmPush(.{ .object = out_arr.obj });
         },
         .sort_by => {
             const fn_val = ctx.vs.vmTop(0);
             const arr_val = ctx.vs.vmTop(1);
             if (arr_val != .object) return error.TypeError;
             const arr_obj = arr_val.object;
             if (!vms.isArrayObject(arr_obj)) return error.TypeError;
-            var items = try vms.cloneArraySlice(ctx, arr_obj);
-            const n = items.len;
+            const n = (try vms.asArraySlice(arr_obj)).len;
+            const out_arr = try vmgc.allocTempRootedManagedValueArray(ctx, n);
+            defer ctx.vs.popTempRoot();
+            out_arr.setAll(try vms.asArraySlice(arr_obj));
             if (n > 1) {
                 var i: usize = 1;
                 while (i < n) : (i += 1) {
-                    const key = items[i];
+                    // Re-derive out_arr's slice after every callFunction: the
+                    // comparator is arbitrary user code and can allocate,
+                    // which can trigger a heap compaction that relocates
+                    // out_arr's backing storage. A slice captured before the
+                    // call would then point at stale/reused memory.
+                    const key = out_arr.obj.array_managed[i];
                     var j: usize = i;
                     while (j > 0) : (j -= 1) {
-                        const cmp = try vm.callFunction(ctx, fn_val, &.{ items[j - 1], key });
+                        const prev = out_arr.obj.array_managed[j - 1];
+                        const cmp = try vm.callFunction(ctx, fn_val, &.{ prev, key });
                         const less = if (cmp == .int) cmp.int < 0 else if (cmp == .float) cmp.float < 0 else cmp.asBool() catch {
                             ctx.vs.setRuntimeErr("comparator must return int, float, or bool, got {s}", .{vmtyp.runtimeTypeName(cmp)});
                             return error.TypeError;
                         };
                         if (less) break;
-                        items[j] = items[j - 1];
+                        out_arr.obj.array_managed[j] = out_arr.obj.array_managed[j - 1];
                     }
-                    items[j] = key;
+                    out_arr.obj.array_managed[j] = key;
                 }
             }
-            const out_obj = try vmgc.vmAllocObject(ctx);
-            out_obj.* = .{ .array_managed = items[0..n] };
             ctx.vs.vmPopArgs(argc);
-            try ctx.vs.vmPush(.{ .object = out_obj });
+            try ctx.vs.vmPush(.{ .object = out_arr.obj });
         },
         .sort_desc => {
             const arr_val = ctx.vs.vmTop(0);
             if (arr_val != .object) return error.TypeError;
             const arr_obj = arr_val.object;
             if (!vms.isArrayObject(arr_obj)) return error.TypeError;
-            var items = try vms.cloneArraySlice(ctx, arr_obj);
-            const n = items.len;
+            const n = (try vms.asArraySlice(arr_obj)).len;
+            const out_arr = try vmgc.allocTempRootedManagedValueArray(ctx, n);
+            defer ctx.vs.popTempRoot();
+            out_arr.setAll(try vms.asArraySlice(arr_obj));
+            // Safe to hold as one slice across the whole loop: valueLessThan
+            // does no allocation, so nothing here can move out_arr's backing.
+            const items = out_arr.obj.array_managed;
             if (n > 1) {
                 var i: usize = 1;
                 while (i < n) : (i += 1) {
@@ -83,10 +101,8 @@ pub fn dispatch(ctx: VMContext, nf: NativeFuncObj, argc: u8) !void {
                     items[j] = key;
                 }
             }
-            const out_obj = try vmgc.vmAllocObject(ctx);
-            out_obj.* = .{ .array_managed = items[0..n] };
             ctx.vs.vmPopArgs(argc);
-            try ctx.vs.vmPush(.{ .object = out_obj });
+            try ctx.vs.vmPush(.{ .object = out_arr.obj });
         },
         else => {},
     }