class field-init closure mutating a captured outer local gets a split cell (class captures are value-based; need boxed-capture mode)

[proggeramlug]

Summary

A class field-initializer closure that MUTATES a captured outer local operates on its own cell, split from the declaring function's binding — both directions of visibility are broken.

Repro (vs node --experimental-strip-types)

function fac() {
  let count = 0;
  class T {
    bump = () => {
      count += 1;
      return count;
    };
  }
  const t = new T();
  t.bump();
  t.bump();
  console.log("count:", count, t.bump());
}
fac();

node: count: 2 3 — perry (v0.5.1229-era main): count: 0 3.

The closure's own view is internally consistent (bump() returns 1, 2, 3 — it boxed its copy), but fac's direct read of count sees the stale 0: two cells.

Mechanism

Classes are lifted out of their declaring function, and field-init closures capture outer locals through the class-capture machinery (__perry_cap_* stash/snapshot — the #5437/W6 system), which is value-based by design: the snapshot system converges values at registration/refresh points but cannot express a shared mutable cell. Meanwhile the boxing analyses are per-container: the declaring function's walk can't see the closure (it lives in the lifted class), so count stays unboxed in fac; the closure's own mutable_captures analysis boxes its private copy.

Two fix shapes considered and rejected as insufficient during the 2026-07-04 audit run:

• extending collect_module_boxed_vars with class-container fragments (declaration-scoped analysis can't pair decl+closure across containers);
• a cross-container union pass (boxes fac's slot, but the field closure still receives the capture through the snapshot cap-param, not the box — verified still 0 3).

The real fix needs the class-capture machinery to pass a box pointer through the cap param when the captured local is mutated on either side (i.e., a boxed-capture mode for __perry_cap_*), with the stash/rebind/refresh paths box-aware.

Related

• fix(codegen): #5869 — boxing analysis must descend into labeled blocks #5871 / fix(codegen): #5869 residual — boxed locals must not feed the typed-ABI closure specializations #5949 (labeled-block + typed-ABI boxing fixes from the same audit thread)
• The audit's §5 notes on snapshot-vs-live semantics (insert_class_capture_refresh_after_assignments converges values, but only for same-body statement-level assignments — closure-side mutation is exactly the case it cannot cover).

[proggeramlug]

Design material salvaged from the #5869-residual branch (deliberately dropped from PR #5949 as unverified): a hunk extending collect_module_boxed_vars to walk class field initializers (instance + static), computed-member key expressions, and the extends expression — today those are compiled but invisible to the module-wide boxing union, so a captured+mutated local there is never boxed.

// in collect_module_boxed_vars, per class c:
let mut extra_stmts: Vec<perry_hir::Stmt> = Vec::new();
for f in c.fields.iter().chain(c.static_fields.iter()) {
    if let Some(init) = &f.init { extra_stmts.push(perry_hir::Stmt::Expr(init.clone())); }
    if let Some(k) = &f.key_expr { extra_stmts.push(perry_hir::Stmt::Expr(k.clone())); }
}
for member in &c.computed_members {
    extra_stmts.push(perry_hir::Stmt::Expr(member.key_expr.clone()));
}
if let Some(ext) = &c.extends_expr {
    extra_stmts.push(perry_hir::Stmt::Expr((**ext).clone()));
}
if !extra_stmts.is_empty() { module_boxed_vars.extend(collect_boxed_vars(&extra_stmts)); }

Empirical result on the fieldbox.ts repro: does not fix the split cell (count: 0 3 unchanged) — because the closure receives the outer local through the value-based __perry_cap_* snapshot, not through a box; boxing the declaring scope alone doesn't re-unify the cells. It is likely a necessary piece of the eventual fix (the declaring scope must store a box for the closure to share), but only in combination with the capture machinery passing the box pointer through the cap param and the closure body reading it via js_box_get. Parking it here so the boxed-capture-mode design starts from a tested-in-CI baseline (the hunk built green and regressed nothing when it rode on #5949's CI).

[proggeramlug]

Concrete design: boxed-capture mode for __perry_cap_*

Grounding the "real fix" from the issue body in the exact code sites, after reproducing on current main (count: 0 3 vs node count: 2 3) and tracing the HIR/codegen.

Why every existing approach can't work

The whole __perry_cap_* path is value-typed end to end (all DOUBLE):

• Stash — Expr::RegisterClassCaptures lowers each capture to a NaN-boxed value, packs them into a [N x double] buffer, and calls js_class_register_capture_values(cid, ptr, len) (crates/perry-codegen/src/expr/static_field_meta.rs:134-169). Static new T(count) sites additionally pass the value inline as a synthesized __perry_cap_0 ctor arg.
• Read — Expr::ClassCaptureValue returns a value, via js_param_or_class_capture_value(fallback, cid, idx) (param-first, Next.js standalone: deferred-require binding captured by-value (as unresolved thunk) by a class constructor → 'undefined is not a constructor' #5437) or the table (static_field_meta.rs:174+).

A value snapshot fundamentally cannot alias fac's count slot. The two rejected attempts fail precisely here: boxing fac's slot (union pass) leaves the closure still reading js_param_or_class_capture_value → a copy.

The fix: a second capture mode that carries the box pointer

Introduce a per-capture mode (Value | Box) so a shared-mutable capture threads a heap cell pointer instead of a snapshot.

1. Analysis — who needs Box mode. A local L needs boxed capture iff it is (a) an argument of a RegisterClassCaptures for a lifted class, AND (b) mutated on either side — by a field-init/method closure of that class, or by the declaring function after the class decl. Detection must be a cross-container walk (the decl function + the lifted class bodies together), which is exactly what the two rejected single-container passes lacked. Natural home: a new pass seeded from collect_module_boxed_vars (crates/perry-codegen/src/codegen/boxed_locals.rs:33) that also descends lifted-class field initializers and methods, unioning mutation sites by outer-local id. Output: boxed_class_captures: HashSet<u32>.

2. Box the local in the declaring function using the existing mutable-capture boxing (widen_mutable_captures_*, crates/perry-hir/src/lower/closure_analysis.rs) so fac's reads/writes already go through the cell. This half is proven (rejected approach linux compilation and README #2 did it).

3. Stash the pointer, not the value. For a Box-mode capture, RegisterClassCaptures/the synthesized new T(...) cap-arg must pass the box pointer (a new Expr::LocalBoxRef(id) that yields the cell address rather than LocalGet(id) which loads the value). js_class_register_capture_values stays but the slot holds a POINTER_TAG'd box handle; this.__perry_cap_0 then holds the shared cell.

4. Deref on read/write in the lifted body. ClassCaptureValue in Box mode returns the box pointer; the closure's LocalGet(count) becomes load *cell and LocalSet(count, v) becomes store *cell — i.e. route the lifted body's reads/writes of a boxed capture through the same box-access lowering normal boxed closures use, keyed on the __perry_cap_0 cell instead of a lexical environment slot.

5. Refresh/rebind must be box-aware. insert_class_capture_refresh_after_assignments and the decl-site/re-register snapshot logic (crates/perry-hir/src/lower/expr_function.rs:1135+,1487+, lower_decl/class_captures.rs) currently converge values. For Box-mode captures they must be no-ops — the cell is already shared, so re-snapshotting a value would re-split it. This is the subtle inversion: the Next.js standalone: deferred-require binding captured by-value (as unresolved thunk) by a class constructor → 'undefined is not a constructor' #5437/destructuring-var forward capture into a class method reads undefined (semver Comparator shape) — regressed on main, CI change-scoping missed it #6037 refresh machinery exists to fix value-snapshot staleness, and it must be disabled per-capture when the capture is a box.

Scope / blast radius

The change is safe to gate strictly on boxed_class_captures membership: every existing capture stays Value mode byte-for-byte, so the W6 / #5640 / #5957 / #6037 / Next.js-wall corpus is unaffected by construction. Only mutated-and-cross-container-captured locals switch to Box.

Test plan (required before landing)

This touches the subsystem with the highest regression rate in the compiler, so it must run the full class-capture corpus green, not a direct-compile subset — the Next.js-wall and webpack/zod dynamic-construct cases are multi-file and exercise the param-first / dynamic-table paths a single-file battery can't. Concretely: the crates/perry capture suites (issue_5640/5957/6037/806, the W6 set) under a coherent release build + the Next.js SSR walls, plus new guard cases for: field-init closure mutating an outer local (this issue), method (non-field) closure doing the same, two closures sharing one mutated capture, and a boxed capture that is ALSO passed to a same-module new (must not double-box / must stay param-first-correct).

Status

Design is implementation-ready and grounded in the sites above. Deferring the implementation to a session with the class-capture corpus runnable (the local perry-dev cargo-test link is currently broken on unrelated js_response_* ext symbols, so the corpus can't gate a change here right now — landing an ABI change to this core without that gate would risk re-breaking the shipped #5437/W6 fixes).

[proggeramlug]

Implementation spec (root-caused to the IR + the exact blocker)

Followed up the design with a full trace. The mechanism, the safety boundary, and the one architectural blocker are now pinned.

Root cause at the IR level

Compare the working normal closure vs the broken class-lifted field closure for () => { count += 1; return count; }:

Normal closure (correct — count: 2 3) — count is boxed; the closure's capture slot holds the box POINTER; both sides deref:

; declaring fn:  %box = js_box_alloc_bits(count); closure capture slot 0 = %box
; closure body:  %b = js_closure_get_capture_bits(self, 0)
;                js_box_set_bits(%b, js_box_get_bits(%b) + 1)   ; deref read + write

Class-lifted field closure (wrong — count: 0 3) — the capture slot holds the VALUE; no box, no deref:

; T::constructor:  closure capture slot 0 = arg1   ; = count's VALUE (0), not a box
; closure body:    %v = js_closure_get_capture_bits(self, 0)   ; raw value
;                  js_closure_set_capture_bits(self, 0, %v + 1) ; writes its OWN slot

So the closure mutates a private copy; the declaring function's count slot is never touched.

Safety boundary (guard suite in the linked PR)

10 single-file patterns, all vs node. 7 must stay green (value-based path): read-only field closure, immutable const, ctor capture, method capture, two read-only closures, two captures, nested-fn-returns-instance. 3 fail (the bug): closure-writes/fn-reads, fn-writes/closure-reads (even a read-only closure needs sharing when the fn mutates after capture), interleaved. The fix must alter ONLY the mutated-capture path.

The machinery to change

crates/perry-hir/src/lower_decl/class_captures.rs :: synthesize_class_captures threads captures as VALUE snapshots: each method/closure body gets a prologue let __perry_cap_<id> = ClassCaptureValue{ index, fallback: this.__perry_cap_<id>, prefer_fallback }, and writes propagate to the instance field via field_propagation (which its own comment notes is partial — only top-level assignment positions). Codegen: RegisterClassCaptures packs values into CLASS_CAPTURE_VALUES; ClassCaptureValue reads a value (both in expr/static_field_meta.rs).

The blocker (why the two prior attempts failed)

widen_mutable_captures_stmts (the boxing pass) runs POST-lifting — lower/lower_module_fn.rs:1049-1067 walks the declaring fn body and each lifted class method separately, so it structurally cannot see that the fn's count and the class closure's count are the same binding. And synthesize_class_captures sees the class's closures but NOT the declaring fn's later statements (the c = 99 in the fn-writes case). Neither vantage point sees both sides — which is exactly why "extend collect_module_boxed_vars" and "cross-container union pass" both failed.

Concrete plan

1. New cross-container signal boxed_class_captures: HashSet<LocalId>, computed where both sides are visible — either a pre-lifting pass over each fn body (class still inline), or in collect_module_boxed_vars (codegen) which sees the whole module: a capture L (appears in a RegisterClassCaptures) that is assigned in the class's field-init closures/methods OR in the declaring fn after the RegisterClassCaptures.
2. Box L in the declaring fn (add to its boxed set → js_box_alloc_bits + deref reads/writes; proven half).
3. Thread the box POINTER through RegisterClassCaptures / the synthesized ctor cap-arg (pass js_box-ref, not the value) so this.__perry_cap_L holds the shared cell.
4. Deref in the lifted body: for L in boxed_class_captures, ClassCaptureValue yields the box pointer and the prologue rebind reads/writes through js_box_get_bits/js_box_set_bits — i.e. exactly the normal-closure boxed path, keyed on this.__perry_cap_L instead of a lexical slot. Refresh/rebind become no-ops for boxed captures (re-snapshotting would re-split).

Validation requirement

Because steps 3-4 sit on the code path EVERY class capture flows through (the whole Next.js/zod/W6 corpus), this must run the full class-capture integration corpus green under a coherent release build — not just the single-file guard suite — before landing. Gating on boxed_class_captures membership keeps non-mutated captures byte-identical, so the blast radius is the detection precision (covered by the 7 value-based guards) plus the shared threading (covered by the corpus).