Copy the message string when constructing Error/AggregateError from a ZigString

src/jsc/bindings/bindings.cpp

@@ -3459,7 +3459,10 @@
     auto& vm = JSC::getVM(globalObject);
     auto scope = DECLARE_THROW_SCOPE(vm);
 
-    WTF::String message = Zig::toString(*arg3);
+    // toStringCopy, not toString: the AggregateError (and its message string)
+    // outlives this call, while an untagged ZigString message would alias the
+    // caller's buffer without owning it. See Zig::getErrorInstance.
+    WTF::String message = Zig::toStringCopy(*arg3);
     JSC::JSValue cause = JSC::jsUndefined();
     JSC::JSArray* array = nullptr;
     {

src/jsc/bindings/helpers.h

@@ -393,7 +393,12 @@ static const WTF::String toStringStatic(ZigString str)
 
 static JSC::JSValue getErrorInstance(const ZigString* str, JSC::JSGlobalObject* globalObject)
 {
-    WTF::String message = toString(*str);
+    // toStringCopy, not toString: an untagged ZigString would otherwise become
+    // a JSString that aliases the caller's bytes with no ownership, and several
+    // callers (AsyncModule's resolve/download error paths) pass stack-local
+    // buffers that are freed before JS can ever read error.message. The
+    // TypeError/SyntaxError/RangeError siblings below already copy.
+    WTF::String message = toStringCopy(*str);
     if (message.isNull() && str->len > 0) [[unlikely]] {
         // pending exception while creating an error.
         return {};