fix: size dict elements buffer to HashMap capacity, not len (#1646)

When materializing a Felt252Dict value, the elements buffer was
arena-allocated with room for `map.len()` slots. The runtime's
`dict_get` only grows the buffer once the backing HashMap is full, so a
runtime insert of a new key could write one slot past the end of the
buffer and corrupt the arena.

Allocate the buffer using the HashMap's capacity (read after `reserve`,
which usually over-allocates) so there is always room for the runtime to
fill every slot the HashMap can hold.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: TomerStarkware

src/values.rs

@@ -370,24 +370,26 @@ impl Value {
                         let elem_ty = registry.get_type(&info.ty)?;
                         let elem_layout = elem_ty.layout(registry)?;
 
-                        // Arena-allocate the elements buffer.
+                        // Arena-allocate the FeltDict struct and register it.
+                        let dict_ptr = crate::runtime::cairo_native__dict_new(
+                            elem_layout.size() as u64,
+                            elem_layout.align() as u64,
+                        );
+                        let dict = &mut *dict_ptr;
+                        dict.mappings.reserve(map.len());
+
+                        // Arena-allocate the elements buffer. It must be sized to the
+                        // HashMap's capacity (read *after* `reserve`).
+                        let capacity = dict.mappings.capacity();
                         let elements = if map.is_empty() {
                             null_mut()
                         } else {
                             crate::runtime::cairo_native__arena_alloc(
-                                (elem_layout.pad_to_align().size() * map.len()) as u64,
+                                (elem_layout.pad_to_align().size() * capacity) as u64,
                                 elem_layout.align() as u64,
                             )
                             .cast()
                         };
-
-                        // Arena-allocate the FeltDict struct and register it.
-                        let dict_ptr = crate::runtime::cairo_native__dict_new(
-                            elem_layout.size() as u64,
-                            elem_layout.align() as u64,
-                        );
-                        let dict = &mut *dict_ptr;
-                        dict.mappings.reserve(map.len());
                         dict.elements = elements;
 
                         for (key, value) in map.iter() {