I forgot to keep a Promise alive in Boa, which broke the malloc.
When investigating a crash that occurred during Test262 execution of the Rust‑based JavaScript engine Boa due to an allocator error, I discovered that the cause was insufficient retention of the Promise during its resolution.