Backport: the process-wide Intl culture cache and Temporal zone cache are read-only and bounded, and a rejected zone is not remembered

[lahma]

Backports three merged main fixes to 4.x, in the order they landed there. All three are about the same shape: a process-wide cache keyed on a string a script chose, shared by every engine, never evicted — and in one case handed out writable.

Backported	main squash	4.x commit
#3448 Intl: the culture every engine shares is handed out read-only	d6dbcfe8c	c5e2f4a4d
#3462 Intl: the shared culture cache is bounded	1676c9c15	a129ea72d
#3471 Temporal: a rejected time zone identifier is not remembered	0867d36e8	9161ec51a

Together they close #3438 and #3439 on the maintenance branch.

What each one changes

#3448 — IntlUtilities cached one CultureInfo per locale tag under a comment claiming useUserOverride: false made it immutable. It does not; that flag only suppresses the Windows user regional overrides. The instance was writable and handed straight out to eleven call sites, so one future culture.NumberFormat.CurrencySymbol = … would have been one engine's write becoming another engine's formatting, on state outliving every engine that touched it. CultureInfo.ReadOnly marks the instance it is given rather than re-resolving the culture, so the reason new CultureInfo(...) is used instead of CultureInfo.GetCultureInfo(...) stands untouched, and a clone of a read-only culture or format is writable — which is what keeps DateTimeFormatConstructor and NumberFormatConstructor working unchanged.

#3462 — the same cache had no bound, and its key is a tag a script chose: ECMA-402 requires CanonicalizeLocaleList to accept a structurally valid but unknown tag rather than reject it, and 'x'.toLocaleLowerCase('en-abcd' + i) is core String.prototype on an engine that opted into nothing. It is now bounded at 256 distinct tags, cleared and refilled on overflow — the rule RegExpParseCache already uses here. A hit costs exactly what it cost before: one ConcurrentDictionary.TryGetValue, no recency list, no allocation.

#3471 — DefaultTimeZoneProvider.Instance is the provider every unconfigured engine gets, and IsValidTimeZone ended in the same ResolveTimeZone the working paths use, so every rejected identifier became a permanent entry. Rejections are no longer cached at all, which is defensible only because a miss is now cheap: the IANA naming screen checks that every /-separated component could be a TZDB name (so A/0, Europe/, Europe//London and a megabyte of text are answered from the string), the direct lookup uses TimeZoneInfo.TryFindSystemTimeZoneById instead of FindSystemTimeZoneById in a catch, and the case-insensitive fallback reads a dictionary built once instead of re-scanning every system zone. The successes are bounded at 256 too, because getTimeZoneTransition on a ZonedDateTime built from +HH:MM reaches the resolver with 1440 distinct valid spellings.

Evidence: the tests run against unfixed 4.x

Ported onto e556d274 with only the two count accessors added (no bound, no read-only, no screen), the same set fails on both legs — 9 failed / 24, identical on net10.0 and on net472, which is the leg that consumes the net462 asset:

	net472 (net462 asset)	net10.0
#3448
IntlTests.ACachedCultureIsReadOnly ×3 (en-US, de-DE, ar-SA)	Expected culture!.IsReadOnly to be True, but found False.
#3462
ScriptSuppliedLocaleTagsDoNotGrowTheProcessWideCultureCache	found 4004 (bound 256)	found 4003 (bound 256)
RequestedLocalesOfAnIntlFormatterDoNotGrowTheProcessWideCultureCache	found 4004	found 4003
AnEvictedTagResolvesToTheSameCultureItDidBefore	fails on the read-only half it inherits from #3448
#3471
RejectedTimeZoneIdentifiersDoNotGrowTheProcessWideCache	found 501	found 1942
OffsetTimeZoneIdentifiersDoNotGrowTheProcessWideCache	found 1948	found 1948
ARejectedIdentifierIsNotRemembered	one rejection, +1 entry

(The two rejected-identifier counts differ only because the class shares one process-wide cache with the offset test and the runner orders them differently per leg; both are far over 256.)

With the three fixes: 46 / 46 passed on net10.0 and on net472. The four #3471 tests that cannot exist against unfixed code — they call IsPlausibleIanaName, which is the fix — are EverySystemTimeZoneIdentifierSurvivesTheSyntacticScreen (walks every zone this machine has, plus the IANA name .NET gives for each Windows id, with a counter so it can never pass vacuously), TheSyntacticScreenAcceptsEveryTzdbNameShape, TheSyntacticScreenDeclinesWhatCannotNameAZone and TheSyntacticScreenDeclinesAnAbsurdlyLongIdentifier.

Full suite, dotnet build -c Release + dotnet test -c Release, 0 warnings from the compiler

Jint.Tests               6794 / 6794 (net472)     6879 / 6879 (net10.0)
Jint.Tests.PublicInterface  1493 / 1493 (net472)     1500 / 1500 (net10.0)
Jint.Tests.CommonScripts      28 / 28   (net472)       28 / 28   (net10.0)
Jint.Tests.SourceGenerators                             52 / 52   (net10.0)
Jint.Tests.Test262        102495 passed / 0 failed / 189 skipped

The test262 figure is the branch's control figure exactly.

Divergences from main

Every source hunk applied verbatim (git apply -3, clean, all three), with two adaptations:

• The tests are xUnit. 4.x's Jint.Tests has not taken the NUnit move, so [Test] → [Fact], [TestCase] → [InlineData], and [NonParallelizable] → [CollectionDefinition(..., DisableParallelization = true)] + [Collection(...)], which is how GarbageCollectionTests and SharedObjectShapeTests already say it here. Every assertion is unchanged.
• net462, not net472. One comment in the TryFindSystemTimeZoneById polyfill names the target frameworks that need it; on this branch the floor is net462, matching how DefaultTimeZoneProvider.IsWindowsPlatform already words it.

Two smaller notes. ACachedCultureIsReadOnly is appended at the end of IntlTests rather than inserted where main has it — the neighbouring test there does not exist on 4.x — and IntlTests gains using System.Globalization; and using Jint.Native.Intl;, which main's copy already had. Jint/Native/Intl/IntlUtilities.cs, Jint/Native/Temporal/DefaultTimeZoneProvider.cs and Jint/Extensions/Polyfills.cs needed no other adaptation: 4.x's DefaultTimeZoneProvider is sealed where main's is extensible, but nothing in this change touches that, and 4.x's Polyfills.cs already carries the C# extension-member blocks and the char.IsAscii* backfills the screen needs.

No public API change

IntlUtilities is internal. DefaultTimeZoneProvider is public, but everything added to it — TimeZoneCacheCount, TimeZoneCacheBound, IsPlausibleIanaName — is internal, and no existing member changes its signature or its answer. What changes is what is retained and what a miss costs. The Jint.Tests.PublicInterface baselines are untouched and green on both legs.

🤖 Generated with Claude Code

https://claude.ai/code/session_014W5mbjGhyvgAS4pivXoc4S