feat(gc): make native roots (statepoints) the default by proggeramlug · Pull Request #7370 · PerryTS/perry

proggeramlug · 2026-08-04T11:25:54Z

Native GC roots are now the default. PERRY_RS4GC=1 is no longer needed; PERRY_RS4GC=0 reverts to the shadow stack for bisection.

This is the fork docs/engine-plan.md called "the plan's next real fork, and it is the owner's — but it should be made on a schedule, not left to drift." Every blocker it listed is now closed.

Evidence

Full 479-test gap suite, no env set, diffed against the pinned Node oracle:

	statepoints default	shadow baseline
pass	447	447
diff	19	19 (pre-existing)
node_fail	13	13
new regressions	0	—
compile failures	0	—

All 128 try-carrying tests compiled — the class the deleted bridge (#7348) could never handle at all. All 10 gc_ratchet probes byte-identical to Node. Runtime −1–2%; binary size +1.86% measured on a real dependency (zod, 81 native modules) rather than a synthetic.

The part that made this non-trivial

A blanket flip would have been wrong. gc_map deliberately refuses to emit a map for a target whose frame bases the runtime cannot resolve — a map nothing reads loses roots silently, which is the exact failure this backend exists to prevent. So flipping globally turns every watchOS arm64_32 and ARM64-Windows compile into a hard error.

The default is therefore native roots where the runtime can walk, shadow stack where it cannot. Falling back is not "no roots" — it is the other lowering of the same root-set analysis, which is only expressible because #7340 split analysis from lowering. Wired per module beside set_jscvt_for_target, which already had this exact shape.

PERRY_RS4GC=1 still reaches gc_map's refusal rather than being quietly downgraded to a fallback, because an A/B arm must measure what it asked for.

A test pins the support matrix in both directions. The one way this change breaks a platform is if my predicate is looser than gc_map's refusals — then the compile hard-fails instead of falling back — so that is what is under test.

Eight tests had to name their lowering

They assert on shadow-stack IR (js_shadow_slot_bind, frame pushes) and broke when the default moved. They were correct about what they assert; they had simply never had to say which lowering, because there was only one default. Each now pins it through a thread-local guard, mirroring arena::quarantine's ProtectionModeGuard — thread-local and restoring, so one test's pin cannot change another's.

That guard is deliberately separate from the per-target cell: compile_module sets the target decision per module, so a pin that wrote that cell would be erased the moment the test invoked codegen.

What this unlocks

With native roots as the default, the shadow stack's lowering becomes removable — the analysis stays, since both mechanisms consume it. That is the "delete the shadow stack" goal, now a mechanical follow-up rather than an open question.

Caveat

My sweep is aarch64-macOS. Linux and Windows correctness rests on gc-native-roots' ELF and PE arms, which are queued behind a deep runner backlog and have not reported yet.

Summary by CodeRabbit

New Features
- Native garbage-collection roots are now enabled by default on supported targets.
- Unsupported targets automatically fall back to shadow-stack handling.
- Added configuration options to explicitly select native roots or shadow stacks.
Documentation
- Documented defaults, fallback behavior, configuration options, compatibility details, performance, and binary-size measurements.

PERRY_RS4GC=1 is no longer needed. PERRY_RS4GC=0 reverts to the shadow stack for bisection. TARGET-AWARE, not blanket. gc_map REFUSES to emit a map for a target whose frame bases the runtime cannot resolve, because a map nothing reads loses roots silently -- so a global flip would turn every watchOS arm64_32 and ARM64-Windows compile into a hard error. The default is therefore native roots where the runtime can walk, shadow stack where it cannot. That is only expressible because #7340 split the root-set analysis from its lowering: falling back is not 'no roots', it is the other lowering of the same analysis. A test pins the support matrix in both directions, because the one way this breaks a platform is if the predicate is LOOSER than gc_map's refusals. An explicit PERRY_RS4GC=1 still reaches that refusal rather than being silently downgraded, so an A/B arm measures what it asked for. Evidence, full 479-test gap suite with no env set: pass 447 (shadow baseline: 447) diff 19 (pre-existing, unchanged) node_fail 13 regressions 0 compile failures 0 All 128 try-carrying tests compiled -- the class the deleted bridge (#7348) could never handle. All 10 gc_ratchet probes byte-identical to Node. Runtime -1-2%; binary size +1.86% measured on zod's 81 modules. Eight codegen tests assert on shadow-stack IR and now pin that lowering through a thread-local guard, mirroring arena::quarantine's ProtectionModeGuard. They were right about what they asserted -- they had just never needed to name a lowering, because there was only one.

coderabbitai · 2026-08-04T11:26:38Z

📝 Walkthrough

Walkthrough

Changes

Native root lowering

Layer / File(s)	Summary
Target capability and override policy `crates/perry-codegen/src/codegen/helpers.rs`, `changelog.d/7366-statepoints-default.md`	`PERRY_RS4GC` now supports explicit overrides. Without an override, native roots are enabled only for supported targets. Tests cover target defaults and fallback behavior.
Per-module lowering configuration `crates/perry-codegen/src/codegen/mod.rs`	`compile_module` applies the target-specific native-root decision.
Explicit shadow-stack test coverage `crates/perry-codegen/src/codegen/closure.rs`, `crates/perry-codegen/src/collectors/proven_this_routing_tests.rs`, `crates/perry-codegen/src/expr/shadow_inline.rs`	IR-focused tests explicitly pin shadow-stack lowering before compilation.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant compile_module
  participant codegen_helpers
  participant target_runtime_support
  compile_module->>codegen_helpers: set_native_roots_for_target(target)
  codegen_helpers->>target_runtime_support: check frame-walker support
  target_runtime_support-->>codegen_helpers: supported or unsupported
  codegen_helpers-->>compile_module: select native roots or shadow stack

Possibly related issues

Windows: native-root stack walker so PERRY_RS4GC=1 works there (#7173) #7354 — Both address ARM64 Windows as an unsupported target for native GC roots.
GC backlog re-verification sweep, 2026-08-02 #7262 — Both cover native-root selection and explicit shadow-stack verification.

Possibly related PRs

PerryTS/perry#7314 — Adds the statepoint codegen behavior that this PR makes target-aware.
PerryTS/perry#7318 — Defines the RS4GC adoption and PERRY_RS4GC behavior implemented here.
PerryTS/perry#7349 — Implements runtime native-root support used by the target selection.

Suggested reviewers: thehypnoo, andrewtdiz

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the main change: making native GC roots the default.
Description check	✅ Passed	The description thoroughly explains the change, implementation, evidence, limitations, and test results, despite omitting several template headings and checkboxes.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/statepoints-default

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/perry-codegen/src/codegen/helpers.rs`:
- Around line 1577-1632: Refactor the target-default decision used by
rs4gc_enabled() into a pure helper that accepts an explicit optional PERRY_RS4GC
override and the target capability result, preserving override precedence.
Update native_roots_default_matches_the_targets_gc_map_will_emit_for() to
evaluate defaults with None so the process environment cannot affect assertions,
and replace the current tautological override check in
the_target_default_is_a_default_not_a_veto() with assertions that explicit
Some(false) and Some(true) override the target default.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 65e79afd-d78e-46ec-ba62-7255f3b703eb

📥 Commits

Reviewing files that changed from the base of the PR and between 3056986 and 02aadbf.

📒 Files selected for processing (6)

changelog.d/7366-statepoints-default.md
crates/perry-codegen/src/codegen/closure.rs
crates/perry-codegen/src/codegen/helpers.rs
crates/perry-codegen/src/codegen/mod.rs
crates/perry-codegen/src/collectors/proven_this_routing_tests.rs
crates/perry-codegen/src/expr/shadow_inline.rs

coderabbitai · 2026-08-04T11:35:53Z

+    #[test]
+    fn native_roots_default_matches_the_targets_gc_map_will_emit_for() {
+        for triple in [
+            "arm64-apple-macosx",
+            "aarch64-apple-darwin",
+            "aarch64-apple-ios",
+            "aarch64-unknown-linux-gnu",
+            "aarch64-unknown-linux-musl",
+            "x86_64-apple-darwin",
+            "x86_64-unknown-linux-gnu",
+            "x86_64-pc-windows-msvc",
+        ] {
+            set_native_roots_for_target(triple);
+            assert!(
+                rs4gc_enabled(),
+                "{triple} has a working walker — native roots should be the default"
+            );
+        }
+
+        for triple in [
+            // ILP32: 32-bit pointers, and the runtime's map loader is gated to
+            // 64-bit Apple, so a map here would be read by nothing.
+            "arm64_32-apple-watchos",
+            // COFF + ARM64: no Windows walker for that register model, so no
+            // frame would ever be visited.
+            "aarch64-pc-windows-msvc",
+            // Architectures with no walker at all.
+            "riscv64gc-unknown-linux-gnu",
+            "wasm32-unknown-unknown",
+        ] {
+            set_native_roots_for_target(triple);
+            assert!(
+                !rs4gc_enabled(),
+                "{triple} has no walker — must fall back to the shadow stack, \
+                 not hard-fail in gc_map"
+            );
+        }
+    }
+
+    /// An explicit `PERRY_RS4GC=1` must still reach `gc_map`'s refusal for an
+    /// unsupported target. Turning that into a silent shadow-stack fallback
+    /// would hide exactly what the arm was set to measure.
+    #[test]
+    fn the_target_default_is_a_default_not_a_veto() {
+        set_native_roots_for_target("riscv64gc-unknown-linux-gnu");
+        assert!(
+            !rs4gc_enabled(),
+            "unset env + unsupported target = fall back"
+        );
+        // The override path is env-driven and process-cached, so it is asserted
+        // by the CI arms rather than re-read here; this pins the shape that the
+        // target decision is consulted ONLY when there is no explicit answer.
+        assert!(
+            rs4gc_env_override().is_none() || rs4gc_env_override().is_some(),
+            "override is a tri-state"
+        );


🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash set -uo pipefail cargo check -p perry --profile perry-dev || exit 1 status=0 for override in 0 1; do if ! env PERRY_RS4GC="$override" \ cargo test -p perry-codegen --profile perry-dev \ native_roots_target_tests -- --test-threads=1; then status=1 fi done exit "$status"

Repository: PerryTS/perry

Length of output: 143

🏁 Script executed:

#!/usr/bin/env bash set -uo pipefail printf 'Repository files around helpers.rs:\n' fd -a 'helpers.rs$' . | sed 's#^\./##' printf '\nTarget symbols in crates/perry-codegen/src/codegen/helpers.rs:\n' rg -n "rs4gc_(enabled|env_override|policy)|NATIVE_ROOTS_TARGET_OK|NATIVE_ROOTS_OVERRIDE|set_native_roots_for_target" crates/perry-codegen/src/codegen/helpers.rs || true printf '\nRelevant source section:\n' sed -n '1520,1645p' crates/perry-codegen/src/codegen/helpers.rs printf '\nRelevant section above definitions:\n' rg -n -C 8 "pub.*rs4gc|NATIVE_ROOTS_TARGET_OK|NATIVE_ROOTS_OVERRIDE|set_native_roots_for_target" crates/perry-codegen/src/codegen/helpers.rs

Repository: PerryTS/perry

Length of output: 15193

Isolate the native-roots target tests from PERRY_RS4GC.

rs4gc_enabled() uses cached PERRY_RS4GC before reading NATIVE_ROOTS_TARGET_OK, so PERRY_RS4GC=0 fails the walking-target assertions and PERRY_RS4GC=1 fails the unsupported-target assertions. Move the precedence decision into a pure helper, then test target defaults with explicit None and assert explicit overrides separately.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/perry-codegen/src/codegen/helpers.rs` around lines 1577 - 1632, Refactor the target-default decision used by rs4gc_enabled() into a pure helper that accepts an explicit optional PERRY_RS4GC override and the target capability result, preserving override precedence. Update native_roots_default_matches_the_targets_gc_map_will_emit_for() to evaluate defaults with None so the process environment cannot affect assertions, and replace the current tautological override check in the_target_default_is_a_default_not_a_veto() with assertions that explicit Some(false) and Some(true) override the target default.

Source: Coding guidelines

799,604,736 -> 245,055,488 bytes across the 8 gc_ratchet probes at +2% wall, all 8 byte-identical to Node. Measured as a 2x2, because the one-armed version of this measurement is misleading: no scavenge scavenge no cap baseline +0% RSS cap 16 MB -33%/+23% -69%/+3% Scavenge alone moves nothing; the cap alone trades a third of the footprint for a quarter of the wall time. Together the cap makes collections frequent and scavenge makes them evacuating (O(live) copying) instead of O(heap) sweeps, so the frequency is cheap. #7056 measured the cap and recommended decoupling it -- but it was gated behind two knobs that both defaulted OFF, so it had never been active in a shipped build, and following that recommendation literally ships the bad arm. Enabling scavenge also defers alloc-point collections to a precise safepoint instead of collecting behind a forced conservative scan, which became reasonable only when #7370 made native roots the default. TEST WORK, which was the real cost: this first produced 23 gc:: failures. 10 of them were one bug -- force_legacy_gc_pacing() pinned only the moving-loop-polls flag, which used to be enough because the cap and the deferral branch both hung off it. With the cap unconditional and scavenge default-on the guard silently stopped pinning anything, so tests that correctly declared their pacing mode were running in the wrong one. It now pins all three. The other 13 drive the budgeted/incremental stepper without any guard; they pin it explicitly now, since the shipped default bypasses that path by design. Remaining suite variance (3-4 failures) is the pre-existing flake in #7365 -- clean main gives 1/2/2/3/4 on the same runs.

* prototype(gc): nursery cap + scavenge on by default — NOT landable as-is Measured -69% RSS at +3% wall over the 8 gc_ratchet probes, 11/11 probes byte-identical to Node, gap suite tracking the 447/19/13 baseline. See #7372 for the full 2x2 and why neither half is worth shipping alone. Blocked on 26 gc::tests failures (baseline flake is 1-4, #7365), concentrated in the budgeted/incremental path that scavenge's deferral bypasses. Includes the one cause already understood: force_legacy_gc_pacing un-capped the trigger by pinning the polls flag, which stops working once the cap is unconditional -- the guard now suppresses the cap directly. Mechanically pinning legacy pacing across incremental_sweep_reclaim fixed only 3 of 10, so the rest need individual judgement. Pushed as a reference for #7372, not for merge. * perf(gc): nursery cap + scavenge on by default — peak RSS -69% 799,604,736 -> 245,055,488 bytes across the 8 gc_ratchet probes at +2% wall, all 8 byte-identical to Node. Measured as a 2x2, because the one-armed version of this measurement is misleading: no scavenge scavenge no cap baseline +0% RSS cap 16 MB -33%/+23% -69%/+3% Scavenge alone moves nothing; the cap alone trades a third of the footprint for a quarter of the wall time. Together the cap makes collections frequent and scavenge makes them evacuating (O(live) copying) instead of O(heap) sweeps, so the frequency is cheap. #7056 measured the cap and recommended decoupling it -- but it was gated behind two knobs that both defaulted OFF, so it had never been active in a shipped build, and following that recommendation literally ships the bad arm. Enabling scavenge also defers alloc-point collections to a precise safepoint instead of collecting behind a forced conservative scan, which became reasonable only when #7370 made native roots the default. TEST WORK, which was the real cost: this first produced 23 gc:: failures. 10 of them were one bug -- force_legacy_gc_pacing() pinned only the moving-loop-polls flag, which used to be enough because the cap and the deferral branch both hung off it. With the cap unconditional and scavenge default-on the guard silently stopped pinning anything, so tests that correctly declared their pacing mode were running in the wrong one. It now pins all three. The other 13 drive the budgeted/incremental stepper without any guard; they pin it explicitly now, since the shipped default bypasses that path by design. Remaining suite variance (3-4 failures) is the pre-existing flake in #7365 -- clean main gives 1/2/2/3/4 on the same runs. --------- Co-authored-by: Ralph Küpper <ralph@skelpo.com>

…fork (#7371) Three corrections, one of which is a number the plan explicitly warns against quoting and was carrying anyway. 1. THE SIZE FIGURE. Only +18.95% appears on main -- a synthetic worst case with three heap values live across an allocation in EVERY one of 2000 functions. The dependency-scale measurement is +1.86% (zod, 81 native modules, 29 MB binary), an order of magnitude lower. The correction was written when the synthetic was retracted but never reached main: #7345 squash-merged as 24 insertions, the first commit only, so the follow-up correction commit was dropped. That is the same failure mode this document records for #7321 -- a wrong explanation outliving its own disproof -- so the real number now leads and the worst case is explicitly marked do-not-quote. 2. SEQUENCING STEP 2 said root density was a PREREQUISITE for adoption, reasoning from that retracted figure. Adoption shipped in #7370 without it. Still worth doing, and still the same lever #7296 proved worth 9.9x, but it gates nothing. 3. THE ADOPTION FORK IS CLOSED. Every gate shut: llvm-inprocess default (#7353), x86-64 (#7349), Windows (#7355), bridge deleted (#7348), and the 479-test suite with no env matching the shadow baseline exactly. The target-aware shape is recorded because it is the part that generalises: native roots where the runtime can walk, shadow stack where it cannot. Also: layer 2 now reads THE DEFAULT rather than landed opt-in, layer 3's count is 41 rather than 54 after #7363, and the 2026-08-03 status header no longer says 'not yet adopted'. Co-authored-by: Ralph Küpper <ralph@skelpo.com>

…7415) * fix(ci): pin the root-dominance corpus to the shadow-stack lowering The GC Root Dominance gate has been unable to return a verdict since #7370 made statepoints the default. The checker's entire vocabulary is `call void @js_shadow_slot_bind(...)`. Under the stack-map lowering the final IR pass resolves those indices to native allocas and REMOVES the calls (FunctionCodegen::stack_map_slot_count), so the corpus compiled 144 modules containing zero root stores. The gate reported violations: 0 and then refused to pass, because its --min-binds floor caught that its own subject never ran. That is CLAUDE.md's fourth hazard working exactly as designed. Pinning PERRY_RS4GC=0 is sound rather than a dodge: #7340 split the root-set analysis from its lowering, this gate is about the analysis, and both backends share it. The shadow stack is also still the production lowering wherever the runtime cannot walk frames. Measured, same binary and source, only the knob differing: arm=default js_shadow_slot_bind calls = 0 arm=rs4gc0 js_shadow_slot_bind calls = 9 #7370 already fixed this for the unit tests -- helpers.rs records that eight broke when the default flipped and were given NativeRootsPin::shadow(). The corpus shell scripts were the same breakage in another idiom, missed. * docs: name the fragment for its real PR (#7415) --------- Co-authored-by: Ralph Küpper <ralph@skelpo.com>

…ject to the statepoint default (#7452) * fix(ci): gc-root-dominance corpus emits statepoint IR, not shadow-slot binds The checker anchors on `@js_shadow_slot_bind` call sites. Statepoints became the default root lowering in #7370 and express roots as `gc.statepoint` relocation bundles instead, so the corpus has carried 1251 statepoints and ZERO binds ever since. The checker's own vacuity floor then fails the job: error: 0 root store(s) in the corpus, need at least 1500. The subject of this check never ran. Selecting the shadow-stack lowering for the corpus restores the subject: 0 -> 3151 root stores, both gated arms exit 0, and the adversarial arm reports 40 planted / 40 caught / 0 missed. This gates the shadow-stack lowering only. The statepoint lowering now has no equivalent static check; that gap is real and is named in the script rather than hidden by lowering the floor. * docs: changelog fragment for #7452 --------- Co-authored-by: Ralph Küpper <ralph@skelpo.com>

* fix(ci): the dependency-scale dominance corpus was vacuous too #7452 fixed the curated corpus and missed this one. Same cause: the checker anchors on @js_shadow_slot_bind call sites, statepoints became the default root lowering in #7370 and express roots as gc.statepoint relocation bundles instead, so the corpus carried 81 modules with ZERO of the checker's subject. before: 81 modules, 0 bind call sites after: 81 modules, 7719 bind call sites CI's own floors say what the corpus is supposed to look like -- the step comment reads '81 modules, ~12900 functions, ~7700 root stores' and sets --min-binds 4000. The fixed corpus measures 81 / 12899 / 7719, i.e. the floors were written against the shadow-stack lowering and this restores exactly the state they were set from. Both gated arms exit 0 with 40/40 seeded violations caught. This is the corpus #7280 created BECAUSE the curated one reads zero while twenty lines of stock zod fault, so leaving it measuring nothing defeats the reason it exists. * docs: changelog fragment for #7460 --------- Co-authored-by: Ralph Küpper <ralph@skelpo.com>

@main

…ed one failure into five (#7490) (#7492) * fix(test): isolate typed_feedback failures — poisoned ENV_LOCK cascaded one failure into five (#7490) `cargo test -p perry-codegen --test typed_feedback` reported five failures as a suite and a wobbling set under default parallelism. The suspected cause was process-global codegen state leaking between in-process compiles. It was not. Two assertions had genuinely drifted from intentional codegen changes, and both fail when run ALONE (contrary to the issue's premise): * `typed_feedback_guards_direct_class_field_specialization` matched the numeric coercion in the textual window between the `class_field_get_number.fallback` and `.merge` labels. #7430 split that arm: `.fallback` now holds only the nullish-receiver check, and the by-name load plus coercion moved to `.fallback_lookup` — a block RENDERED AFTER `.merge`. The window could never match again. * `typed_feedback_trace_dump_runs_before_entry_return` cut `main`'s body at the literal header `define i32 @main() {`. Since #7370 made native roots the default every emitted function carries `"frame-pointer"="non-leaf"`, so that header never matches. The first of those panics while holding `ENV_LOCK`, which poisons the mutex for the rest of the process; every later `ENV_LOCK.lock().unwrap()` then dies with `PoisonError` regardless of its own subject. That is the whole of the "order dependence": under `--test-threads=1` the alphabetically-early poisoner takes three healthy tests down with it, and under default parallelism the victim set shifts with the scheduler. Fix, in three parts: * `env_lock()` recovers a poisoned guard. Sound because each test declares its `EnvVarGuard` after the lock guard, so the env var is restored during unwind before the mutex is released — the protected state is already consistent at poison time. One test's failure must fail that test alone. * Both drifted assertions are re-pointed at the current IR and made STRONGER, not looser. The class-field one now proves the data flow the positional window stood in for, end to end: `.fallback_lookup` records the fallback, loads by name and coerces; its terminator branches to the numeric merge; and the merge phi's fallback incoming IS the coerced register. `entry_fn_body` matches the exact signature and cuts at that line's opening brace, so unrelated attribute changes can no longer fail the test. * A sabotage test plants the exact #7490 shape — an unwind out of a lock-holding test — asserts it really poisoned the mutex, and demands the accessor still hands out a guard. It fails against the pre-fix `.lock().unwrap()` (9 of 16 red), so a green run is evidence, not decoration. No production codegen state leaks between compiles: `PERRY_TYPED_FEEDBACK` is read live at each call site and `PERRY_FULL_OUTLINE_IC`'s decision is a thread-local set once per `compile_module` — both already correct. * docs(changelog): add fragment for #7490 typed_feedback test isolation * docs(changelog): point the #7490 fragment at the split follow-ups with measured sweep data * chore: bump version to 0.5.1285 --------- Co-authored-by: Ralph Küpper <ralph@skelpo.com>

…es (#7493) #7370 made native roots (RS4GC statepoints) the default lowering. `NativeRootsPin` was added so a test asserting on shadow-stack IR could say so, the in-crate unit tests were repaired with it — and the five integration suites that assert the same mechanics had no pin to reach for, because `NativeRootsPin` is `#[cfg(test)]` and `tests/*.rs` link this crate as an external consumer. They run nightly/at-tag only, so nothing went red at merge time and `shadow_slot_hygiene` sat at 0/12 on `main`. The pin is now reachable as `perry_codegen::testing::NativeRootsPin`, behind a `testing` cargo feature that only this crate's own `[dev-dependencies]` entry enables. With the feature off the pin, its thread-local and the branch it adds to `rs4gc_enabled()` are `#[cfg]`-ed out of the artifact — not merely private, absent — and cargo builds dev-dependencies for test/bench targets only, so no production profile can reach it. `NativeRootsPin::native()` joins `shadow()`, because a pin also outranks `PERRY_RS4GC` and that is what keeps an assertion meaning the same thing during a `PERRY_RS4GC=0` sweep. Per-test classification (not per file — the files disagree internally): * `shadow_slot_hygiene` — 12/12 shadow. The file's subject IS the shadow frame; 0/12 -> 11/12. * `scalar_replaced_slot_roots` — 11/11 shadow (every test counts `js_shadow_slot_bind` sites). 2/11 -> 5/11. * `temp_root_operand_temporaries` — 2 shadow, the rest unpinned and lowering-independent. 12/19 -> 13/19. * `temp_root_argument_temporaries` — none. `PERRY_RS4GC=0` moves it not at all; its failures are #7487's, not #7370's. * `native_proof_regressions` — 2 shadow, 15 native in `invalidation`. 249/253 -> 253/255 single-threaded, 198/253 -> 253/255 in parallel. * `native_proof_buffer_views` — 1 native. 28/30 -> 30/32. Two tests were pinned though they were PASSING: `numeric_only_scalar_replaced_{object,array}_emits_no_rooting` and `a_collection_free_construction_emits_no_this_slot_root` assert `bind_calls(&ir) == 0` / `!contains("@js_shadow_slot_bind")`, which under the native default is true of every program. They were green without their subject running (CLAUDE.md hazard 4). Pinned, the first two now fail for a real reason (#7497). Also fixed here because it hid this suite's real signal: `native_proof_ regressions` reported 55 failures under default parallelism and 4 under `--test-threads=1`. 51 of the 55 were `PoisonError` — #7490's shape again. The `PERRY_NATIVE_REPS*` env vars are process-global and the restore was hand-written after the compile, so a panic inside `compile_module` left them installed and every later unlocked compile wrote artifact JSON into a directory another test was reading; the torn read panicked inside the lock and poisoned it. The harness is now one shared `tests/native_proof_support/mod.rs`: a poison-tolerant accessor, an RAII env guard, and an artifact reader that treats a foreign or half-written neighbour as noise. Two sabotage tests plant each failure shape and assert the fix is what prevents it. Finally, a tripwire in `src/` — so it runs in the REQUIRED `cargo-test` job, which is the tier this whole issue is about not being in: `host_target_lowering_default_is_native_roots` fails the moment the default flips again, naming the suites that then need re-pinning. It asserts its subject is live (both pins must give different answers; the unsupported-target arm must give the opposite default), so a constant-folded `rs4gc_enabled()` fails it rather than passing it. A second gate scans every workspace manifest and fails if a non-dev dependency edge ever enables the `testing` feature. Refs #7493.

…es, and say which lowering each asserts (#7493) (#7509) * fix(test): make the root-lowering pin reachable from integration suites (#7493) #7370 made native roots (RS4GC statepoints) the default lowering. `NativeRootsPin` was added so a test asserting on shadow-stack IR could say so, the in-crate unit tests were repaired with it — and the five integration suites that assert the same mechanics had no pin to reach for, because `NativeRootsPin` is `#[cfg(test)]` and `tests/*.rs` link this crate as an external consumer. They run nightly/at-tag only, so nothing went red at merge time and `shadow_slot_hygiene` sat at 0/12 on `main`. The pin is now reachable as `perry_codegen::testing::NativeRootsPin`, behind a `testing` cargo feature that only this crate's own `[dev-dependencies]` entry enables. With the feature off the pin, its thread-local and the branch it adds to `rs4gc_enabled()` are `#[cfg]`-ed out of the artifact — not merely private, absent — and cargo builds dev-dependencies for test/bench targets only, so no production profile can reach it. `NativeRootsPin::native()` joins `shadow()`, because a pin also outranks `PERRY_RS4GC` and that is what keeps an assertion meaning the same thing during a `PERRY_RS4GC=0` sweep. Per-test classification (not per file — the files disagree internally): * `shadow_slot_hygiene` — 12/12 shadow. The file's subject IS the shadow frame; 0/12 -> 11/12. * `scalar_replaced_slot_roots` — 11/11 shadow (every test counts `js_shadow_slot_bind` sites). 2/11 -> 5/11. * `temp_root_operand_temporaries` — 2 shadow, the rest unpinned and lowering-independent. 12/19 -> 13/19. * `temp_root_argument_temporaries` — none. `PERRY_RS4GC=0` moves it not at all; its failures are #7487's, not #7370's. * `native_proof_regressions` — 2 shadow, 15 native in `invalidation`. 249/253 -> 253/255 single-threaded, 198/253 -> 253/255 in parallel. * `native_proof_buffer_views` — 1 native. 28/30 -> 30/32. Two tests were pinned though they were PASSING: `numeric_only_scalar_replaced_{object,array}_emits_no_rooting` and `a_collection_free_construction_emits_no_this_slot_root` assert `bind_calls(&ir) == 0` / `!contains("@js_shadow_slot_bind")`, which under the native default is true of every program. They were green without their subject running (CLAUDE.md hazard 4). Pinned, the first two now fail for a real reason (#7497). Also fixed here because it hid this suite's real signal: `native_proof_ regressions` reported 55 failures under default parallelism and 4 under `--test-threads=1`. 51 of the 55 were `PoisonError` — #7490's shape again. The `PERRY_NATIVE_REPS*` env vars are process-global and the restore was hand-written after the compile, so a panic inside `compile_module` left them installed and every later unlocked compile wrote artifact JSON into a directory another test was reading; the torn read panicked inside the lock and poisoned it. The harness is now one shared `tests/native_proof_support/mod.rs`: a poison-tolerant accessor, an RAII env guard, and an artifact reader that treats a foreign or half-written neighbour as noise. Two sabotage tests plant each failure shape and assert the fix is what prevents it. Finally, a tripwire in `src/` — so it runs in the REQUIRED `cargo-test` job, which is the tier this whole issue is about not being in: `host_target_lowering_default_is_native_roots` fails the moment the default flips again, naming the suites that then need re-pinning. It asserts its subject is live (both pins must give different answers; the unsupported-target arm must give the opposite default), so a constant-folded `rs4gc_enabled()` fails it rather than passing it. A second gate scans every workspace manifest and fails if a non-dev dependency edge ever enables the `testing` feature. Refs #7493. * docs(test): point the lowering notes at the filed follow-ups (#7502, #7503, #7504, #7505, #7506) * docs(changelog): fragment for the root-lowering pin and the poison cascade (#7509) * chore: bump version to 0.5.1291 --------- Co-authored-by: Ralph Küpper <ralph@skelpo.com>

… lowering that does not ship scripts/gc_root_dominance_corpus.sh has said so inline since #7370 flipped the default (it compiles under PERRY_RS4GC=0 because the checker anchors on @js_shadow_slot_bind calls the native lowering never emits). The invariant page did not, and that page is what a reader is told to read end to end — so a green gc-root-dominance read as evidence about the shipped lowering. Names the gap and points at the unit tests that now cover the native side.

Native roots (RS4GC statepoints) have been the default on every target the runtime can walk since #7370, and had no assertions anywhere. The two suites that read as this area's coverage are pinned to the shadow stack (#7493) and stay that way — both lowerings are supported — but that left nine root-lowering mechanics untested against the lowering Perry emits, and three tests passing vacuously because they counted `js_shadow_slot_bind` calls the native lowering never emits. Adds `perry-codegen/src/native_root_coverage`, eight mechanic tests plus five harness self-tests, asserting at three vantages: the `ptr addrspace(1)` allocas codegen asks for, the `"gc-live"` bundle of each `gc.statepoint` after the production pass string, and the per-safepoint root lists decoded out of the compact `__perry_gcmap` blob the collector reads at run time. In-crate `#[cfg(test)]` so it runs in the per-PR `cargo-test` gate rather than the nightly-only tier. Every test is sabotage-verified — ten sabotages, each one confirmed to compile and to reach the test binary before its verdict was believed. Details per test in the doc comments. Two findings worth naming: * #7502's table calls row 9 (#7184's out-of-range slot index) `n/a` under native roots. It is not. `lower_precise_roots_to_native_stack` collects roots with `roots.get_mut(idx)` over a `slot_count`-sized vector, so an out-of-range index still drops a root silently — the same failure one layer up from the runtime bounds check. Sizing that vector one short removes a root from the emitted map with no diagnostic, and now fails a test. * `mem2reg` promoting every root alloca is a load-bearing precondition with no shadow-stack counterpart: RS4GC relocates `addrspace(1)` SSA values and does not scan allocas, so a root slot that escapes promotion is never rewritten. Asserted directly, and sabotage-verified by making the alloca's address escape. Production changes are confined to two test seams and one named constant: `gc_map::decode_stack_map_roots` and `inprocess::statepoint_rewritten_ir` are `#[cfg(test)]`, and `STATEPOINT_REWRITE_PASSES` replaces an inline string literal with the identical value so the suite cannot drift onto a pipeline production stopped using. Emitted IR is unchanged.

… lowering that does not ship scripts/gc_root_dominance_corpus.sh has said so inline since #7370 flipped the default (it compiles under PERRY_RS4GC=0 because the checker anchors on @js_shadow_slot_bind calls the native lowering never emits). The invariant page did not, and that page is what a reader is told to read end to end — so a green gc-root-dominance read as evidence about the shipped lowering. Names the gap and points at the unit tests that now cover the native side.

…assertions for #7502 (#7653) * test(gc): cover the root lowering that actually ships (#7502) Native roots (RS4GC statepoints) have been the default on every target the runtime can walk since #7370, and had no assertions anywhere. The two suites that read as this area's coverage are pinned to the shadow stack (#7493) and stay that way — both lowerings are supported — but that left nine root-lowering mechanics untested against the lowering Perry emits, and three tests passing vacuously because they counted `js_shadow_slot_bind` calls the native lowering never emits. Adds `perry-codegen/src/native_root_coverage`, eight mechanic tests plus five harness self-tests, asserting at three vantages: the `ptr addrspace(1)` allocas codegen asks for, the `"gc-live"` bundle of each `gc.statepoint` after the production pass string, and the per-safepoint root lists decoded out of the compact `__perry_gcmap` blob the collector reads at run time. In-crate `#[cfg(test)]` so it runs in the per-PR `cargo-test` gate rather than the nightly-only tier. Every test is sabotage-verified — ten sabotages, each one confirmed to compile and to reach the test binary before its verdict was believed. Details per test in the doc comments. Two findings worth naming: * #7502's table calls row 9 (#7184's out-of-range slot index) `n/a` under native roots. It is not. `lower_precise_roots_to_native_stack` collects roots with `roots.get_mut(idx)` over a `slot_count`-sized vector, so an out-of-range index still drops a root silently — the same failure one layer up from the runtime bounds check. Sizing that vector one short removes a root from the emitted map with no diagnostic, and now fails a test. * `mem2reg` promoting every root alloca is a load-bearing precondition with no shadow-stack counterpart: RS4GC relocates `addrspace(1)` SSA values and does not scan allocas, so a root slot that escapes promotion is never rewritten. Asserted directly, and sabotage-verified by making the alloca's address escape. Production changes are confined to two test seams and one named constant: `gc_map::decode_stack_map_roots` and `inprocess::statepoint_rewritten_ir` are `#[cfg(test)]`, and `STATEPOINT_REWRITE_PASSES` replaces an inline string literal with the identical value so the suite cannot drift onto a pipeline production stopped using. Emitted IR is unchanged. * docs(changelog): fragment for #7653 * docs: correct a sabotage note to the post-mechanic-9 count (10 of 14 tests) * refactor: drop an unused Statepoints helper (new dead_code warning) * build: gate the coverage module on llvm-inprocess as well as test Two of its three vantages run the statepoint rewrite and emit assembly through that pipeline, so `cargo test -p perry-codegen --no-default-features` (the text path, kept for bisection) had nothing for them to assert against. Verified: that build now compiles clean with no new dead-code warnings. * docs(changelog): note the llvm-inprocess feature gate * docs(gc): name the fourth blind spot — the dominance corpus gates the lowering that does not ship scripts/gc_root_dominance_corpus.sh has said so inline since #7370 flipped the default (it compiles under PERRY_RS4GC=0 because the checker anchors on @js_shadow_slot_bind calls the native lowering never emits). The invariant page did not, and that page is what a reader is told to read end to end — so a green gc-root-dominance read as evidence about the shipped lowering. Names the gap and points at the unit tests that now cover the native side. * chore: bump version to 0.5.1372 Claude-Session: https://claude.ai/code/session_01Y1QZ5wUP9gRSwpiweT4Wix --------- Co-authored-by: Ralph Küpper <ralph@skelpo.com>

…#7664) `gc-root-dominance-statepoints`' `--max-unrooted` ratchet goes 21 -> 7. #7663 pointed the root-dominance rule at the NATIVE root lowering -- the one that ships since #7370 -- and reported 21 `unrooted` hazards. Fourteen were shapes `root_reload.rs` looked straight through, because its rule is stated over the load's own register and in both shapes the value at risk lives somewhere else. 1. The root is a GLOBAL, not an alloca (10 hits). A string literal lowers to `load double, ptr @<mod>_.str.N.handle`; the handle global is a registered root, so the string is never swept, and an evacuating cycle REWRITES the global while a register loaded beforehand keeps the pre-move address. #7240's shape, whose fix covered call operands only. 2. The stale register is DERIVED from the load (3 of 7 unmasked receivers). `this.count++` holds the unmasked receiver across the property GET; the load's only use is the bitcast ABOVE the collecting call, so the window was empty and the function took zero reloads. 3. `new.target`'s saved previous value (1 hit). `new.rs` saved `js_new_target_get()` in a bare register across the whole constructor body; the cell is a registered mutable root, so the restore publishes a pre-move address back INTO a root the collector scans. #7226's `prev_this` bug for `new.target`. The reload rule is restated over the value's derivation rather than its register: for a value read out of a collector-rewritten location -- a shadow slot or a string-handle global -- and any value derived from it by pure bit ops, every use a collection point can reach re-materialises the whole derivation. A recipe is extended only through ops that are pure functions of their operands and whose every register operand is already in the same single root's recipe, which makes it self-contained and materialisable anywhere. Each value's window is anchored at its own defining instruction, not at the root load. `new.target` gets `new_target_save`/`new_target_restore` in `crate::rooting`, structurally `implicit_this_save`/`implicit_this_restore`. Re-reading the cell would be the wrong repair: `js_new_target_set` has already overwritten it. Measured on `Counter__increment`: before, all three statepoints carried an EMPTY live set, so the receiver was marked by nothing; after, each carries a "gc-live" bundle and a `gc.relocate`, and the SET reads a mask re-derived from the relocated pointer plus a fresh load of the handle global. Remaining 7, each its own slice: 4 unmasked are phi-mediated (the reload has to go in the predecessor, on the edge); 2 `@perry_global_*` are module-level variables the program assigns, so they need rooting rather than reloading (pinned by `a_module_global_is_not_a_reload_source`); 1 capture read. #7664 stays open as the budget's referent. Claude-Session: https://claude.ai/code/session_01Y1QZ5wUP9gRSwpiweT4Wix

…d re-derive the #7056 RSS numbers under statepoints Two halves of the same job: they share the pinned quiet host and the same harness. #7481 named coverage this matrix did not have — "a live copying-minor correctness signal at exactly the cadence the ratchet probes never exercise". All twelve probes ran the shipped 16 MB nursery cap, so every copying minor they had ever exercised was small and frequent. `13_large_eden_survivors` closes that, via a per-probe `// gc-ratchet-env:` declaration that `check` compares like a metric: delete the directive and every band is still satisfied, so the arm itself has to be gated or it is not an arm. The finding that shaped the probe: a large Eden on a *small* retained set runs ZERO copying minors, because `arena_growth_full_escalation_due` escalates every minor to a full mark-sweep once arena in-use clears 32 MB and exceeds twice the post-full baseline. The first draft did exactly that and would have been pinned on a collector it never reached. #7056's RSS numbers were taken under the shadow stack, which stopped being the default in #7370. Re-derived as a 2x2 (root lowering x nursery cap) over 12 probes, 7 repeats, 3 interleaved rotations: the root lowering is not an RSS lever (peak RSS 1.002x, retention 1.000x, 104 of 108 deterministic cells bit-identical), and the nursery cap still is (1.911x peak RSS at 128 MB). Claude-Session: https://claude.ai/code/session_01Y1QZ5wUP9gRSwpiweT4Wix

…d re-derive the #7056 RSS numbers under statepoints (#7666) * test(gc-ratchet): pin the large-Eden copying-minor cadence (#7481) and re-derive the #7056 RSS numbers under statepoints Two halves of the same job: they share the pinned quiet host and the same harness. #7481 named coverage this matrix did not have — "a live copying-minor correctness signal at exactly the cadence the ratchet probes never exercise". All twelve probes ran the shipped 16 MB nursery cap, so every copying minor they had ever exercised was small and frequent. `13_large_eden_survivors` closes that, via a per-probe `// gc-ratchet-env:` declaration that `check` compares like a metric: delete the directive and every band is still satisfied, so the arm itself has to be gated or it is not an arm. The finding that shaped the probe: a large Eden on a *small* retained set runs ZERO copying minors, because `arena_growth_full_escalation_due` escalates every minor to a full mark-sweep once arena in-use clears 32 MB and exceeds twice the post-full baseline. The first draft did exactly that and would have been pinned on a collector it never reached. #7056's RSS numbers were taken under the shadow stack, which stopped being the default in #7370. Re-derived as a 2x2 (root lowering x nursery cap) over 12 probes, 7 repeats, 3 interleaved rotations: the root lowering is not an RSS lever (peak RSS 1.002x, retention 1.000x, 104 of 108 deterministic cells bit-identical), and the nursery cap still is (1.911x peak RSS at 128 MB). Claude-Session: https://claude.ai/code/session_01Y1QZ5wUP9gRSwpiweT4Wix * test(gc-ratchet): re-pin the baseline with the large-Eden arm, on the pinned quiet host Thirteen probes at a8f7312, `perry-macos`, driver-gated (clean tree, AC power, CPU-active <= 25% for 60 s before each phase), node oracle v26.5.1. CONTROL, taken with the same binary before the pin: `--check` against the previous artifact (59d5220, #7657) reported every one of its 144 cells `ok` and failed on exactly one line — "probes present now but absent from the baseline: 13_large_eden_survivors". So nothing here is drift; the only new rows are the new probe's, and `wt-scavtenure`'s re-pin is subsumed. Every deterministic cell in the new artifact has spread 0, including all twelve of the new probe's; peak RSS spread 0.169%, wall 4.69% against a 10% band (the suite's widest, and its median reproduces to +0.5% on an independent session). Also records the measurement-context trap this found: a probe compiled with a `package.json` in scope retains one more 1 MiB arena block at `gc()`, which makes an ad-hoc `measure --probes-dir <copy outside the repo>` report 09_try_catch_roots at -17.98% against the pin. Not a collector change; the driver and CI always compile from the repo. Claude-Session: https://claude.ai/code/session_01Y1QZ5wUP9gRSwpiweT4Wix * chore(gc-ratchet): keep the diag regexes together, and say how a declared arm layers over the shell Cosmetic move of PROBE_ENV_RE/RESERVED_PROBE_ENV below the diag-parsing regexes they were splitting, plus a docstring line stating the layering an ad-hoc knob sweep depends on: os.environ applies to every probe that does not declare the knob, and the declaring probe wins for itself. Claude-Session: https://claude.ai/code/session_01Y1QZ5wUP9gRSwpiweT4Wix * docs(gc-ratchet): state the per-minor comparison exactly rather than approximately "~16 MB per minor for every default-cap probe" understated 12_large_live_set, which runs 21.8 MB because its tenured-proportional cap term already raises its Eden without any knob. The real spread is 14.6-16.6 MB on eleven of twelve and 21.8 on the twelfth, against 49.7 MB per minor for the new probe -- and the 12_large_live_set row is worth naming, because it is the shipped path to a larger Eden and shows where that path tops out. Claude-Session: https://claude.ai/code/session_01Y1QZ5wUP9gRSwpiweT4Wix * docs(gc-ratchet): correct the probe's own comment to the shipped numbers Its inline sizing note carried figures from a pre-final tuning run (3 minors, 36/36/68 MB) and said the survivor reads fold into the checksum when they fold into five separately-diffed lines. A stale number in the comment beside the constant it justifies is exactly the shape this campaign keeps paying for. Claude-Session: https://claude.ai/code/session_01Y1QZ5wUP9gRSwpiweT4Wix * chore: bump version to 0.5.1379 Claude-Session: https://claude.ai/code/session_01Y1QZ5wUP9gRSwpiweT4Wix --------- Co-authored-by: Ralph Küpper <ralph@skelpo.com>

…#7664) `gc-root-dominance-statepoints`' `--max-unrooted` ratchet goes 21 -> 7. #7663 pointed the root-dominance rule at the NATIVE root lowering -- the one that ships since #7370 -- and reported 21 `unrooted` hazards. Fourteen were shapes `root_reload.rs` looked straight through, because its rule is stated over the load's own register and in both shapes the value at risk lives somewhere else. 1. The root is a GLOBAL, not an alloca (10 hits). A string literal lowers to `load double, ptr @<mod>_.str.N.handle`; the handle global is a registered root, so the string is never swept, and an evacuating cycle REWRITES the global while a register loaded beforehand keeps the pre-move address. #7240's shape, whose fix covered call operands only. 2. The stale register is DERIVED from the load (3 of 7 unmasked receivers). `this.count++` holds the unmasked receiver across the property GET; the load's only use is the bitcast ABOVE the collecting call, so the window was empty and the function took zero reloads. 3. `new.target`'s saved previous value (1 hit). `new.rs` saved `js_new_target_get()` in a bare register across the whole constructor body; the cell is a registered mutable root, so the restore publishes a pre-move address back INTO a root the collector scans. #7226's `prev_this` bug for `new.target`. The window is anchored at the ROOT LOAD, not at the derived value. Anchoring at the derivation looks more precise and is wrong: `main`'s class-object read has the scope-end shadow-slot clear landing between the load and the mask, so a walk starting at the mask never sees it and re-read a slot the program had just nulled -- `(makeAnon(77) as any).v` became `undefined`. Caught by an A/B against the branch point on `test_gap_class_expr_identity`, not by the dominance checker, which cannot see a value-correctness bug. The reload rule is restated over the value's derivation rather than its register: for a value read out of a collector-rewritten location -- a shadow slot or a string-handle global -- and any value derived from it by pure bit ops, every use a collection point can reach re-materialises the whole derivation. A recipe is extended only through ops that are pure functions of their operands and whose every register operand is already in the same single root's recipe, which makes it self-contained and materialisable anywhere. Grouping by root load also puts the cost back at O(blocks x loads). `new.target` gets `new_target_save`/`new_target_restore` in `crate::rooting`, structurally `implicit_this_save`/`implicit_this_restore`. Re-reading the cell would be the wrong repair: `js_new_target_set` has already overwritten it. Measured on `Counter__increment`: before, all three statepoints carried an EMPTY live set, so the receiver was marked by nothing; after, each carries a "gc-live" bundle and a `gc.relocate`, and the SET reads a mask re-derived from the relocated pointer plus a fresh load of the handle global. Remaining 7, each its own slice: 4 unmasked are phi-mediated (the reload has to go in the predecessor, on the edge); 2 `@perry_global_*` are module-level variables the program assigns, so they need rooting rather than reloading (pinned by `a_module_global_is_not_a_reload_source`); 1 capture read. #7664 stays open as the budget's referent. Claude-Session: https://claude.ai/code/session_01Y1QZ5wUP9gRSwpiweT4Wix

… in the native lowering (#7664) (#7667) * gc: close the strhandle, derived-mask and new.target unrooted hazards (#7664) `gc-root-dominance-statepoints`' `--max-unrooted` ratchet goes 21 -> 7. #7663 pointed the root-dominance rule at the NATIVE root lowering -- the one that ships since #7370 -- and reported 21 `unrooted` hazards. Fourteen were shapes `root_reload.rs` looked straight through, because its rule is stated over the load's own register and in both shapes the value at risk lives somewhere else. 1. The root is a GLOBAL, not an alloca (10 hits). A string literal lowers to `load double, ptr @<mod>_.str.N.handle`; the handle global is a registered root, so the string is never swept, and an evacuating cycle REWRITES the global while a register loaded beforehand keeps the pre-move address. #7240's shape, whose fix covered call operands only. 2. The stale register is DERIVED from the load (3 of 7 unmasked receivers). `this.count++` holds the unmasked receiver across the property GET; the load's only use is the bitcast ABOVE the collecting call, so the window was empty and the function took zero reloads. 3. `new.target`'s saved previous value (1 hit). `new.rs` saved `js_new_target_get()` in a bare register across the whole constructor body; the cell is a registered mutable root, so the restore publishes a pre-move address back INTO a root the collector scans. #7226's `prev_this` bug for `new.target`. The window is anchored at the ROOT LOAD, not at the derived value. Anchoring at the derivation looks more precise and is wrong: `main`'s class-object read has the scope-end shadow-slot clear landing between the load and the mask, so a walk starting at the mask never sees it and re-read a slot the program had just nulled -- `(makeAnon(77) as any).v` became `undefined`. Caught by an A/B against the branch point on `test_gap_class_expr_identity`, not by the dominance checker, which cannot see a value-correctness bug. The reload rule is restated over the value's derivation rather than its register: for a value read out of a collector-rewritten location -- a shadow slot or a string-handle global -- and any value derived from it by pure bit ops, every use a collection point can reach re-materialises the whole derivation. A recipe is extended only through ops that are pure functions of their operands and whose every register operand is already in the same single root's recipe, which makes it self-contained and materialisable anywhere. Grouping by root load also puts the cost back at O(blocks x loads). `new.target` gets `new_target_save`/`new_target_restore` in `crate::rooting`, structurally `implicit_this_save`/`implicit_this_restore`. Re-reading the cell would be the wrong repair: `js_new_target_set` has already overwritten it. Measured on `Counter__increment`: before, all three statepoints carried an EMPTY live set, so the receiver was marked by nothing; after, each carries a "gc-live" bundle and a `gc.relocate`, and the SET reads a mask re-derived from the relocated pointer plus a fresh load of the handle global. Remaining 7, each its own slice: 4 unmasked are phi-mediated (the reload has to go in the predecessor, on the edge); 2 `@perry_global_*` are module-level variables the program assigns, so they need rooting rather than reloading (pinned by `a_module_global_is_not_a_reload_source`); 1 capture read. #7664 stays open as the budget's referent. Claude-Session: https://claude.ai/code/session_01Y1QZ5wUP9gRSwpiweT4Wix * chore: bump version to 0.5.1382 Claude-Session: https://claude.ai/code/session_01Y1QZ5wUP9gRSwpiweT4Wix --------- Co-authored-by: Ralph Küpper <ralph@skelpo.com>

…p v4 (#7803) THE #7803 root cause. The compact GC map was built on the premise that 'Perry has no interior pointers' and collapsed every statepoint (base, derived) pair to one slot. The premise is false: the RS4GC prelude (mem2reg,sccp) hoists for-of element GEPs into values that live across the poll, and LLVM records them as DERIVED pointers. With the pairing discarded, the runtime walker treated &elements[i] as an object start: it read array element bytes as a 'header' (the pin-latch's INTERNED-on-map / 0x7FFF-size aborts — the latch-side identification dump showed the victim slot holding a boxed address +176 into a live 52-element string array, i.e. element 21's slot, and the implicit-this cell holding a one-past-end cursor), and on a moving cycle it never rewrote the slot as base'+delta — the dangling cursor whose next deref is zod's parse.ts:65 TypeError. The shadow-stack era re-derived cursors per iteration, which is why #7370's statepoint default is where this class was born, and why --debug-symbols (different regalloc) suppresses. Format v4: the record header word gains a has-derived bit; records carry (base_index, reg, offset) derived entries after their roots, sharing the repeat flag. The runtime decoder keeps derived slots OUT of the visited-root set and rewrites each as new_base + (old_derived - old_base) after its base is visited, preserving the slot's stored form (boxed tag or bare), bounded by a 64 MiB delta guard, in all three walkers (Itanium unwind, aarch64 fp-chain, Windows RtlVirtualUnwind). Version mismatch still fails closed on both sides. Tests: v4 decode (pairing, repeat carries deriveds, fail-closed on an out-of-range base index), emitter round-trip incl. repeat-flag sharing and the corruption checks re-aimed at the v4 header.

…ell (#7803 investigation) (#8084) * feat(gc): two diagnostics for localizing an uncaught-throw rooting bug PERRY_UNCAUGHT_BACKTRACE=1 emits a symbolicated native backtrace on the uncaught-throw path, reusing the libc backtrace pair arena::quarantine already uses. A #7154-class rooting bug surfaces in a function nowhere near the code that lost the value, and the JS-level stack this path prints reads 'at <anonymous>'. PERRY_KEEP_SYMBOLS=1 skips ONLY the final strip. PERRY_DEBUG_SYMBOLS does that too, but every consumer reads it with is_some(), so it also turns on -g -- and on the #7803 corpus the symbolized build passed 13 seeds that the plain build fails at 44%. Asking for symbols changed the subject. This knob leaves codegen byte-identical to the build that reproduces. Both default off and are parsed BY VALUE, not by presence (#7993). * fix(codegen): root the callee across argument evaluation in three call arms rooting/temp_root.rs already decides 'root, re-derive or reuse?' correctly and in one place, and already says module globals and locals must be ROOTED rather than reloaded. The gap is the POSITION it is asked about: that machinery protects call OPERANDS. Three arms lower the CALLEE into a bare register, lower the arguments after it -- each of which can allocate -- and then pass the original register: new_dynamic.rs (both js_new_function_construct arms) call_spread.rs (cb_box, across js_array_like_to_array and the concat) early_branches.rs (recv_box, unmasked into closure_handle after the args) Under the shipping statepoint lowering that register is in no live bundle, so nothing marks it and nothing relocates it. A root and not a reload: JS resolves the callee BEFORE the arguments, so re-reading below them would hand the call whatever an argument assigned. Measured on the dependency-scale corpus under the native lowering: 66 -> 26 hazards, sink=js_new_function_construct 24 -> 0, sink=js_closure_call_apply_with_spread 16 -> 0, live bundles 39073 -> 39140. This does NOT close #7803: the failure rate is unmoved (3/8 -> 5/16 -> 8/16 across the three binaries, all noise at this sample size). Landing it on the static ratchet alone. NOT YET gap-suite tested. * docs(gc-handoff): #7803 session 2 -- localized, and the fix that did not fix it * docs(gc-handoff): #7803 is on the new-Function/dyn_eval path (0/16 vs 8/16) zod compiles a fastpass parser with new Function for every object schema (core/schemas.ts:2028), which on Perry runs through the dyn_eval interpreter -- the frames under #7803's throw. Taking that path out of the workload with zod's own jitless switch takes the failure with it: 0/16 against 8/16 on the same compiler, runtime and zod pin, with the instrument hot (5054-5434 forced collections, ~765k objects moved per run) and the answer byte-identical. Not a clean single-variable A/B and recorded as such: jitless also drops the workload from 6840 to 5056 safepoints. What makes it persuasive is the conjunction with the captured stack, not the sweep alone. Two traps on the way, both recorded: the config must run BEFORE any schema is constructed (jit is captured in the ctor, and the schema modules run at import), and the first attempt still entered interp_thunk through the identical stack -- a clean sweep of it would have been quoted as evidence while the interpreter was still running the parse. * feat(gc): give the dyn_eval interpreter cooperative GC safepoints (#7803) The interpreter offered the collector NO safepoints. Compiled code polls at loop back-edges; interpreted code polled nowhere, so a collection could only reach it at an allocation point -- and that arm forces a conservative stack scan, which makes the copying minor ineligible. The consequence is not that the interpreter is safe, it is that it is untestable: PERRY_GC_ZEAL forces collection at safepoints and there were none, PERRY_GC_SCHEDULE_SEED selects safepoints and there were none, and gc_root_dominance_check.py reads emitted LLVM IR of which the interpreter has none. The one rooting domain with no static checker also had no dynamic one, so mod.rs's claim that interpreter frames hold EVERY live JSValue in a rooted stack was unfalsifiable by anything in the tree. PERRY_GC_INTERP_SAFEPOINTS=1 calls js_gc_loop_safepoint at every eval_expr node and exec_stmt -- through the shared entry point deliberately, so the entry guards and the seeded-schedule ordinal apply exactly as they do to a compiled back-edge. An interpreter safepoint is the same safepoint, not a second kind. Subject asserted live (seed 2, rate 1, one binary): loop_polls 24029 -> 93210, safepoints 2725 -> 6973, moved 369076 -> 866480. Output byte-identical. Opt-in, not on: if the interpreter's rooting is complete, default-on is strictly better; if it is not, the flip turns a latent hole into a live crash for ajv / fast-json-stringify / find-my-way. Same sequencing PERRY_GC_MOVING_LOOP_POLLS had between #7161 and #7721. * ci(gc): gate the fourth corpus/lowering cell — dependency-scale, native roots gc-root-dominance.yml emitted three of four corpus x lowering combinations. #7280 fixed the POPULATION (curated files lack the shapes a real library produces) and added the dependency corpus; #7452 fixed the LOWERING (statepoints ship; a PERRY_RS4GC=0 corpus contains none of that root form) and added the native corpus. Neither reached the other's cell, so the zod corpus compiled the way shipped binaries are compiled had never been checked. First measurement: 66 unrooted hazards, against a curated arm calibrated to ZERO -- 24 sinking into js_new_function_construct and 39 into the js_closure_call family, which are #7803's two observed messages. 40 of those were the callee-outlives-arguments defect fixed in 95d9fbb9d, leaving 26. Lands as a budget that can only go down, not an allowlist: the residual is a population under triage (19 are the js_box_get_bits mutable-capture-box shape), not a list anyone has adjudicated entry by entry -- the same reasoning the --stale-registers budget records. Carries the same liveness floors and the --seeded-violations 40 arm as its curated sibling, so a corpus that did not exercise the subject cannot read as clean. NOT yet promoted to a required check: a new gate has never been green, so it runs once before anyone depends on it (CLAUDE.md, hazard-4 corollary). * ci(gc): tighten the dep-native budget 26 -> 3, the clean-build number The third fixed arm (early_branches.rs) was never measured statically: the 26 came from a corpus emitted before that fix existed. A from-scratch rebuild reads 3 -- js_new_function_construct 24->0, js_closure_call_apply_with_spread 16->0, js_closure_call1/2 23->0, leaving one each of js_array_concat, js_rel_ge and js_get_string_pointer_unified. The lesson is about the 26. It came from an incremental build and went into a committed ratchet; a ratchet's number has to come from a tree someone else can reproduce. Caught only because the box swept the worktree and forced a clean rebuild. * docs(gc-handoff): the interp-safepoint A/B points away from the interpreter's own frames Same binary, one variable: safepoints off 6/8 fail, on 2/8. Collecting MORE often inside the interpreter made it fail LESS -- the opposite of what 'interpreted frames hold the unrooted value' predicts. n=8, p~0.13, so it settles nothing alone, but with the jitless result it narrows the position: the failure needs the new-Function PATH, and the interpreter's own locals are not obviously the holder. Next look is the BOUNDARY (bridge.rs, dispatch_with_arity, the interpreted-dispatch caches), not dyn_eval's locals, which §21 audited and found sound. * docs(gc-handoff): state what #7803 verified, what it did not, and the gap-suite block The three call arms change the lowering of every new-expression, spread call and closure-typed-local call in the language, and the gap suite has NOT run against them. This box could not give a trustworthy run -- load average 60 with 47 sibling worktrees building, the suite slowing from 25 tests in 3 minutes to 30 in 19 -- so it was stopped rather than finished badly. Partial 30/554 with 0 failures is evidence of nothing except that the first 30 do not crash. run_gap_tests.sh + cargo test -p perry-codegen on a quiet host before that change goes into a PR. * fix(gc): refresh the argument buffer in two dispatch arms that collect first (#7803) js_native_call_method roots its receiver and arguments in a RuntimeHandleScope and #7528 added refreshed_args() so a use below a collection point re-reads them. That fix reached ten sites; several dispatch arms still pass the CALLER's raw args_ptr, which is the caller's memory -- arg_handles is what the collector rewrites, the buffer is not. Two arms verified to have a collection point between entry and dispatch: the dynamic-prop-on-a-closure arm (clone_closure_rebind_this allocates) and the accessor-getter arm (js_closure_call0 runs user code, then the rebind allocates). Both now refresh. Fits #7803's symptom: zod's generated fastpass calls shape[k]._zod.run({ value, issues: [] }, ctx) -- a freshly allocated object literal, the youngest thing on the heap, handed to the callee at its pre-move address -- and _zod is an accessor, which is the second arm. Not yet proven: the rate A/B has not run. The remaining raw-args_ptr arms are deliberately untouched; each needs its own 'can anything above me collect?' argument rather than a uniform guess. * docs(gc-handoff): close out session 2 -- what landed, what is blocked on host load * docs(gc-handoff): §25 refuted too — four rooting fixes, bug survives all four Seed 4 still fails on the argument-buffer fix, so that is a real defect found and fixed and a cause refuted, not a cause established. Adds a scorecard: four separate rooting defects, all real, none of them this bug -- the corpus under a rate-1 unprotected schedule is not a one-defect workload. Notes the pattern worth pulling on next: the two interventions that make it vanish (--debug-symbols, the from-space quarantine) both change memory LAYOUT, while all four that change ROOTING leave it untouched. That fits a stale raw pointer in a runtime-side cache keyed on an address rather than a value on a stack -- the class CLAUDE.md says the static checker cannot see. * docs(gc-handoff): §25 final rate 6/16 — mid-baseline, no effect * docs(gc-handoff): gap suite partial — no regressions, and a gap test that can never pass Through 68/554 on a quiet host: two known failures and test_gap_4510_enum_ forward_ref, which is NOT a regression -- Perry prints the correct answer and NODE cannot run the file (--experimental-strip-types rejects enum, which is not erasable syntax). It is red rather than skipped because run_parity_tests.sh records node_fail only for an ABNORMAL exit; a clean exit 1 falls through to the output comparison against Node's crash text. So the test can never pass under the pinned Node. That is the mirror of the hazard CLAUDE.md documents for this suite (node-unrunnable tests silently DROPPED); this one is silently RED. Needs an expected-output file or a widened node_fail predicate. Unrelated to #7803. * docs(gc-handoff): gap suite 554/554 — no regressions from this branch The two flagged regressions are both cleared: test_gap_specabi_reassign fails byte-identically with the three codegen files reverted to 410dadd (so it is pre-existing on main, and is #6906/#7052's own regression test failing unnoticed because parity is tag-gated), and test_gap_zlib_4917_level's compile_fail was spurious -- I ran a cargo build concurrently with the suite and swapped the perry binary mid-run; recompiled by hand it is clean and byte-matches node. The ten node_fail -> parity_fail flips are all oracle-side: six need npm packages this worktree lacks, four are TypeScript node cannot strip (enum, parameter properties). They read RED rather than skipped because node_fail is recorded only for an abnormal exit. The codegen PR's blocker is cleared, with the caveats stated. * feat(gc): layout-neutral from-space poisoning, PERRY_GC_POISON_FROMSPACE (#7803) Establishes WHY every existing instrument suppresses this bug. reset_region_to_zero is misleadingly named: it resets block.offset, it does NOT zero the bytes. Retired from-space therefore keeps its dead objects intact until new allocations bump over them, so: unprotected pages recycle into Eden, new objects overwrite the dead ones, and a stale pointer reads A DIFFERENT OBJECT -> property miss -> undefined. The failure. quarantined pages are held out of Eden, nothing overwrites them, a stale pointer reads its own dead object still intact, and the program is CORRECT. The suppression. So the quarantine does not miss #7803 by luck, it hides it by construction -- and --debug-symbols hides it for the same family of reasons. Both interventions that make the bug vanish are LAYOUT interventions; four separate rooting fixes left it untouched. This mode changes no layout: same pages, same order, same addresses, recycled at the same moment, with the retired bytes scribbled first. Only [0, offset) is touched, so pages the allocator has not faulted in stay untouched. A stale read then finds the poison word instead of a plausible object. Control: the unscheduled corpus run is byte-identical with it on, i.e. nothing in a healthy run reads retired from-space. * docs(gc-handoff): poison A/B is inconclusive — and the session's real blocker is experiment power 0/6 vs 3/6 looks like a fifth suppression and is not supportable: the two arms' schedules differ by ±0.7%, the same magnitude as the fixed-seed run-to-run drift §1 measured, and Fisher gives p~0.09. States the design problem plainly. A ~40% failure rate, ~1-4% schedule drift, and every intervention perturbing the schedule by about that much means no 6-16 run sweep can attribute anything; ~40 runs per arm would be needed, at 3-20 min each. Four of this session's rate comparisons are under-powered; only the jitless result (0/16 vs 8/16) clears the bar. The fix is a deterministic reproducer, not more runs, and the lever has been unused since the first task list: PERRY_GC_SCHEDULE_ALLOC_KB=0 removes the allocation-pacing feedback, leaving the candidate set equal to loop_polls -- which §1 already measured as STABLE at 63,936 across runs. Run in flight. * docs(gc-handoff): unpaced schedule works — and more collections make the bug LESS likely PERRY_GC_SCHEDULE_ALLOC_KB=0 gives polls_paced=0 and safepoints=63941 (= loop_polls + 5 event-loop boundaries), i.e. the candidate set is now the one quantity §1 measured as stable across runs. 63,941 collections, 9.4x the paced run -- and it passed. That is the third independent observation of the same shape (paced ~40% fail; interpreter safepoints on 2/8 vs 6/8; unpaced passed). More collection pressure makes this bug LESS likely, which is backwards for a value held unrooted across a collection point, and fits four rooting fixes changing nothing. Hypothesis that predicts all of it: moved_objects barely changed (892k vs 862k) despite 9.4x the cycles, so denser collections promote survivors out of the evacuating nursery sooner (two-bit aging tenures after 2 minors, and old-gen objects do not move on a minor). Fewer relocations per object -> safer. The quarantine and --debug-symbols are explained by the same 'the object was not relocated into reused memory' mechanism, and rooting fixes are explained by not changing promotion at all. Next experiment is the promotion boundary itself, not the schedule: force promotion on the first minor (predicts the failure vanishes) and suppress tenuring entirely (predicts it becomes reliable -- which would be the deterministic reproducer this session lacked). * docs(gc-handoff): the unpaced schedule REPLAYS exactly — the missing experimental control Two seed-1 runs: safepoints / scheduled_collections / copying_minors all 63941 exactly, polls_paced 0, moved_objects 892662 vs 892062 (0.07%). Against ~4% schedule drift in the paced config. That fixes the design problem §30 named. With the schedule pinned, an intervention that changes the outcome at a fixed seed has changed something real, and one run per arm can say so instead of forty. Use ALLOC_KB=0 for every A/B from here; the paced config is a rate-survey tool only. Cost is ~9.4x the collections, 30-60 min per run, which is cheap next to forty paced runs that still could not attribute anything. * feat(gc): PERRY_GC_TENURING_SURVIVALS pins the promotion age (#7803 diagnostic) Overrides the adaptive threshold (#7432) so the promotion hypothesis can be tested directly rather than through the schedule. Three independent measurements say #7803 gets LESS likely as collections get denser (paced ~30-50%; interpreter safepoints on 2/8 vs 6/8; unpaced, 9.4x the cycles, passing). That is backwards for a value held unrooted across a collection point, and it is what four rooting fixes failing to move the rate looks like. moved_objects explains it: 892k unpaced vs 862k paced despite 9.4x the cycles, so the extra collections promote the same objects SOONER, and an old-gen object is not moved by a minor -- denser collections mean FEWER relocations per object. =1 promote on the first minor -> predicts the failure disappears =255 never promote by age -> every survivor re-evacuated every cycle -> predicts the failure becomes reliable, i.e. the deterministic reproducer this bug has never had Pairs with PERRY_GC_SCHEDULE_ALLOC_KB=0, which pins the schedule exactly (63,941 safepoints, reproduced to the digit), so an outcome change at a fixed seed is attributable to this knob alone. Unset = adaptive, unchanged. * docs(gc-handoff): promotion hypothesis not supported — and why the sampling route is exhausted PERRY_GC_TENURING_SURVIVALS pinned: =255 (most relocations) 0/5, =1 (fewest) 1/5, adaptive ~40%. §31 predicted =255 becomes reliable and =1 disappears; neither happened. The follow-on 'it is the adaptive transitions' story dies with =1's failure -- a pinned threshold has no transitions. The result is non-monotonic and no relocation-count story fits it; at n=5 no cell is significant anyway. Five hypotheses tested, two real defects fixed, bug still standing. Stopping the sampling route deliberately: a ~40% base rate with ~1-4% schedule drift and five-run arms cannot attribute anything, and a sixth hypothesis would be pattern-matching on noise. Next person: either search seeds under the PINNED schedule (ALLOC_KB=0, 63941 safepoints reproduced to the digit) until one fails -- after which every A/B is one run per arm -- or attack the interpreted/compiled boundary statically, where a hazard can be found by reading rather than sampling. * docs(gc-handoff): the dispatch tower's stale-argument population is 36 sites, not 10 Let the compiler count instead of eyeballing: shadow args_ptr/args_len to () right after arg_handles is built, and cargo check reports 36 errors -- 36 arms that reach past the rooted handles for the caller's memory. #7528 converted ten; the other 26 were never distinguished from those ten by anything but an author's per-arm judgement. The file's own #7528 rationale is what makes it a defect: the receiver is re-read at every use because 'this function then runs ~1160 more lines across a dozen probes that allocate'. arg_handles is the slot, args_ptr is the copy, and the argument that forces one forces the other. Reverted rather than landed: doing it right needs a per-site refreshed_args() (a single refresh at the top is the exact mistake #7528 documents), i.e. 36 individually-checked edits plus a gap run -- a focused change for a clean host, with the shadowing landed alongside so the population cannot regrow. The hot path is unaffected: try_class_vtable_fast_dispatch returns above the scope, so all 36 are already slow paths. * docs(gc-handoff): self-contained brief for closing #7803 * docs(changelog): fragment for PR #8084 * docs(gc-handoff): RATE=1 unpaced seed search cannot distinguish seeds (#7803) schedule_hit short-circuits to true at rate 1, so ALLOC_KB=0 + RATE=1 makes every seed the same 63,941-collection run. Seed 1 already passed that twice. The seed only selects when RATE < 1; pair that with ALLOC_KB=0 so the candidate set stays pinned. * feat(gc): name the copying walk in the pin-latch abort (#7803) RATE=0.1 + ALLOC_KB=0 makes the seed select. Seed 1 passes the pinned candidate set; seeds 2 and 3 abort the pin-latch on incoherent headers (INTERNED Map, 2 GiB native_pod_view). That is a stale slot, not a real pin. The latch used to print only the garbage; it now prints which walk followed it. * docs(gc-handoff): seed 3 fails 2/2 under RATE=0.1 ALLOC_KB=0 (#7803) Same class both times (incoherent pinned header), not the same safepoint. Seed 1 still the passing control. * docs(gc-handoff): seed 3 is the #7803 reproducer (3/3 fail) Two of three aborts land on safepoint 21547. Seed 2 is 1/2. Seed 1 passes. The latch is a layout lottery on a pinned schedule. * feat(gc): split the pin-latch walk phase by root-slot kind (#7803) Seed 3 on the walk-phase binary aborted in mutable_root_slots (safepoints=52836). That walk is three populations. Label each slot shadow_stack / native_stack / global_root so the next abort names which one held the stale pointer. * feat(gc): dump the mutator backtrace on the pin-latch abort (#7803) Seed 3's stale pointer is in a native stack-map root — an RS4GC live bundle. The collection is at a safepoint; the frames below the copier name the compiled function that held the slot. * docs(gc-handoff): #7803 slot is a native stack map in Doc.write / generateFastpass Seed 3 backtrace: js_gc_loop_safepoint in Doc.write, called from generateFastpass (schemas 135), called from $ZodObjectJIT.parse (schemas 138). parse.ts:65 is the victim. jitless 0/16 follows. * fix(ci): read STATEPOINT_REWRITE_PASSES across rustfmt-wrapped lines #8068's edit to inprocess.rs made rustfmt wrap the const initializer onto its own line, and both corpus scripts' single-line sed then read nothing: gc-root-dominance has failed every scheduled run on main since (three in a row on 2026-08-14, all '::error::could not read STATEPOINT_REWRITE_PASSES'). Join the declaration with continuation lines up to the terminating semicolon before extracting the quoted string, so either formatting reads. Still single-sourced from the Rust const, never retyped. * feat(gc): name the owning frame and slot in the pin-latch abort (#7803) The native stack-map walker resolves the owning function, statepoint record and slot address for every root it visits, then discarded all of it one call before the pin-latch abort printed 'mutable_root_slots/native_stack' with no owner. Publish the ResolvedRoot provenance through a thread-local around each visit and print it in the latch report, dladdr-symbolicated. Two Cell stores per slot visit. A latch abort now names (function, base register, frame offset, slot address) — the exact bundle slot that held the stale pointer — instead of leaving every frame in the mutator backtrace a suspect. * fix(codegen): root the spread-new bundle accumulator and callee (#7803) THE #7803 heap corruption. Expr::NewDynamicSpread bundled its arguments with the accumulator in a bare i64 register: every regular argument's lowering and every spread part's js_array_like_to_array can run a moving minor, after which js_array_push_f64 / js_array_concat wrote through the accumulator's PRE-MOVE address — into from-space pages that same cycle had already recycled into Eden. The element written is typically a NaN-boxed string, and every garbage header the pin-latch ever recorded on this bug is the high half of one (sizes 0x7FFF02AB / 0x7FFF03AF / 0x7FFF03FF / 0x7FFF0543, their low bits tracking each run's ASLR heap base). zod's Doc.compile — new F(...args, lines.join('\n')), run at the end of every generateFastpass — is the corridor that hit it, which is why the failure needed the new-Function path (jitless: 0/16) and why parse.ts:65 read .issues off garbage. The callee had the same defect: this spread arm was not among the three 8842a0b fixed. Both now go through call_spread's bundle_args_rooted (now pub(crate) — no private copies of that loop), with the callee in a RootedGroup, re-read below the bundle. The dynamic super.m(...spread) arm carried an identical private copy; same fix, and its 'this' load moves below the bundle (a slot re-read; 'this' is immutable). Tests: IR-ordering assertions in call_spread_rooting_tests.rs — the accumulator each fold reads and the callee the dispatch reads must be defined BELOW the last collection point of the bundle. Verified to FAIL against the pre-fix lowering (both new tests red under a stash of the two files) and pass with it. * docs(gc-handoff): §37 — #7803 named: spread-new bundle wrote through a moved accumulator * fix(gc): rebuild the promoted remembered set AFTER the drain, not before (#7803) THE #7803 root cause. rebuild_evacuated_old_to_young_remembered_set ran above collector.drain(), so it walked moved_headers while the list held only root-phase promotions; every object the drain promoted — i.e. every transitively-reachable object — was appended after the rebuild had already run. A parent promoted to Old mid-drain whose child stays young therefore had no remembered-set entry: the collector's own drain rewrote its slots (collector writes fire no mutator barrier, so its page was never dirty), the next minor moved the child again without tracing the parent, and the parent kept the previous survivor-space address. zod's schema metadata — built at module init, promoted after two survivals, never written again — is exactly that shape. The whole-heap from-space scan (PERRY_GC_FROMSPACE_SCAN_ABORT=1, seed 3 pinned schedule) catches it at scheduled collection #2 of every run: owner space=Old +120 bare -> Survivor1 MISSING-REWRITE [dirty_now=false ever_dirty=false] never_dirty=1 not_in_snapshot=1 Under production pacing a child promotes ~2 cycles after its parent, so the stale window is short and rare (the original 1-in-60); the seeded schedule multiplies exposed edges, which is the corpus's 30-50%. Downstream reads through the stale slot resurrect recycled bytes as objects — the parse.ts:65 TypeErrors and every incoherent-header pin-latch abort (the '0x7FFF-high-half sizes' were NaN-boxed words of whatever now lives at the old address). The rebuild now runs below the post-drain runtime-scanner walks — the last phase that can move an object — where moved_headers is complete and every slot already holds its final address, making the young-pointer classification exact. Headers still carry GC_FLAG_MARKED there, which the per-object gate requires. The old-young edge verifier moves with it. * docs(gc-handoff): §38 — the real #7803 cause: remembered-set rebuild ran before the drain * feat(gc): fromspace-scan abort dumps the owner object; drain-promotion regression test (#7803) The abort names owner type/offset, which for an array does not say WHICH array. Dump header words and the first 24 payload words with per-word heap classification so one run identifies the structure. Plus the drain-promoted-parent remembered-set test (its sabotage arm is currently absorbed by page-granular dirty coverage in this staging — kept for the fix-behavior half it does pin, see test comments). * fix(gc): fromspace scan skips array capacity slack; pin-latch identifies its target (#7803) The scan's cycle-2 'missing rewrite' was a FALSE POSITIVE: the owner dump showed a live 8-element array whose unused capacity (a hole-reused old block) still held a dead StringHeader ('StringDecoder') and a stale-looking survivor word at element 14 — past length, invisible to every collector walk BY DESIGN, and therefore un-rewritable. Bound the scan at ArrayHeader + length like the collector's own element range, with the exclusion counted (array_slack_skipped=) so the shrink is visible. The pin-latch abort now also prints the victim slot's raw word (boxed tag vs bare), a 20-word neighborhood dump around the reported header, and — decisively — the census-backed ENCLOSING live object of the followed address: an interior pointer into live data and a stale pointer into recycled memory print differently, and every hypothesis burned on #7803 so far has died on exactly that ambiguity. * docs(gc-handoff): §38 second amendment — scan cycle-2 finding retracted (array slack) * fix(gc): carry RS4GC derived pointers through the compact map — gc_map v4 (#7803) THE #7803 root cause. The compact GC map was built on the premise that 'Perry has no interior pointers' and collapsed every statepoint (base, derived) pair to one slot. The premise is false: the RS4GC prelude (mem2reg,sccp) hoists for-of element GEPs into values that live across the poll, and LLVM records them as DERIVED pointers. With the pairing discarded, the runtime walker treated &elements[i] as an object start: it read array element bytes as a 'header' (the pin-latch's INTERNED-on-map / 0x7FFF-size aborts — the latch-side identification dump showed the victim slot holding a boxed address +176 into a live 52-element string array, i.e. element 21's slot, and the implicit-this cell holding a one-past-end cursor), and on a moving cycle it never rewrote the slot as base'+delta — the dangling cursor whose next deref is zod's parse.ts:65 TypeError. The shadow-stack era re-derived cursors per iteration, which is why #7370's statepoint default is where this class was born, and why --debug-symbols (different regalloc) suppresses. Format v4: the record header word gains a has-derived bit; records carry (base_index, reg, offset) derived entries after their roots, sharing the repeat flag. The runtime decoder keeps derived slots OUT of the visited-root set and rewrites each as new_base + (old_derived - old_base) after its base is visited, preserving the slot's stored form (boxed tag or bare), bounded by a 64 MiB delta guard, in all three walkers (Itanium unwind, aarch64 fp-chain, Windows RtlVirtualUnwind). Version mismatch still fails closed on both sides. Tests: v4 decode (pairing, repeat carries deriveds, fail-closed on an out-of-range base index), emitter round-trip incl. repeat-flag sharing and the corruption checks re-aimed at the v4 header. * docs(gc-handoff): §39 — #7803 named and fixed: v3 map collapsed derived pointers * feat(gc): PERRY_GC_THIS_SET_CHECK — trap the producer of an incoherent implicit this (#7803) * feat(gc): this-set trap grades both directions (slot vs cell corruption) (#7803) * feat(gc): PERRY_GC_NATIVE_SLOT_VERIFY — abort on the cycle that creates a stale native slot (#7803) * feat(gc): native-slot verifier reports cycle kind and target space (#7803) * feat(gc): native-slot verifier compares against the rewrite walk's stats (#7803) * feat(gc): native-slot verifier prints the collector's own classification (#7803) * feat(gc): native-slot verifier dumps the target's raw header (#7803) * docs(gc-handoff): §40 — v4 flips seeds 1/2/5; seed-3 residual pinned to slot and cycle * docs(changelog): gc_map v4 + second root cause for PR #8084 * docs(gc-handoff): rewrite the front door — v4 landed, seed-3 residual is the remaining work * feat(gc): native-slot verifier dumps every matched record and slot value (#7803) * docs(gc-handoff): §41 — gap suite green on the v4 tree; chatter is host noise * docs(gc-handoff): §42 — seed-3 victim target is a constant arena offset invisible to the snapshot * style: rustfmt reflow * docs(gc-handoff): §43 — widened poll set keeps the dep-native arm at 2/3 (40/40 seeded) * fix(gc): unbreak cargo-test and clear the lint gates for #7803 Three merge blockers, none touching the rooting fixes themselves. cargo-test (a REQUIRED context) never reached a summary: the branch's neighborhood dump in `pinned_young_move_report` dereferences `header_addr - 64 .. +88` with no mapping check, and four pre-existing tests call it with fabricated addresses (`0x1000 - 64` is guaranteed unmapped). The binary died with SIGSEGV at test 452 of 2390. A report printed on the way to an abort must not SIGSEGV and destroy itself, so both this dump and the native root-slot read now classify against the arena's page metadata — a real mapping check, not a magnitude guess — and print a placeholder instead. A stale from-space address, the #7803 case the dump exists for, still classifies into a live space, so the diagnostic is unchanged where it matters. 2000-line cap: `stack_maps.rs` 2284 -> 1676 and `copying.rs` 2004 -> 1764, by pure code motion. The decode primitives and the object-file section loaders move to `stack_maps_decode.rs` and `stack_maps_sections.rs`; the pointer-classification unit moves to `copying_pointer_set.rs` as a SIBLING of `copying.rs` rather than a child, because its bodies name `super::gc_moving_loop_polls_enabled` and `super::malloc::ensure_set_built` — under `gc` those still resolve, so the move is zero-diff. addr-class ratchet: `this_binding.rs` used a hand-rolled GcHeader cast. `addr_class::try_read_gc_header` already exists and is behaviorally identical here, so route through it rather than take an allowlist exemption. Also drops a leftover `// TEMP PROBE` eprintln from the #7803 regression test. perry-runtime --lib: 2386 passed, 0 failed, 4 ignored. --------- Co-authored-by: Ralph Küpper <ralph@skelpo.com>

proggeramlug merged commit 148f97b into main Aug 4, 2026
21 of 45 checks passed

proggeramlug deleted the feat/statepoints-default branch August 4, 2026 11:33

proggeramlug mentioned this pull request Aug 4, 2026

docs(plan): restore the corrected size figure and close the adoption fork #7371

Merged

coderabbitai Bot reviewed Aug 4, 2026

View reviewed changes

proggeramlug mentioned this pull request Aug 4, 2026

gc: shipped Perry runs at ~3x the RSS it needs — the nursery cap has never been on by default #7372

Closed

proggeramlug mentioned this pull request Aug 4, 2026

perf(gc): nursery cap + scavenge on by default — peak RSS -69% #7377

Merged

coderabbitai Bot mentioned this pull request Aug 4, 2026

docs(plan): fold in the 2026-08-04 findings #7397

Merged

proggeramlug mentioned this pull request Aug 5, 2026

fix(ci): pin the root-dominance corpus to the shadow-stack lowering #7415

Merged

This was referenced Aug 5, 2026

Stack maps vs the codegen shadow stack: viability experiment (Q1 passes; 0.44 MB text saved for 4.5-16.6 MB metadata) #7108

Closed

fix(ci): restore the gc-root-dominance gate — its corpus lost its subject to the statepoint default #7452

Merged

proggeramlug mentioned this pull request Aug 5, 2026

fix(ci): the dependency-scale dominance corpus was vacuous too #7460

Merged

proggeramlug mentioned this pull request Aug 8, 2026

test(gc): cover the root lowering that actually ships — native-roots assertions for #7502 #7653

Merged

This was referenced Aug 12, 2026

test(codegen): pin the GC strategy onto the define line, in BOTH root lowerings #8000

Merged

Propagate native-root decisions to codegen-unit workers #8071

Merged

proggeramlug mentioned this pull request Aug 15, 2026

gc: diagnostics, two rooting fixes, and the ungated corpus/lowering cell (#7803 investigation) #8084

Merged

coderabbitai Bot mentioned this pull request Aug 16, 2026

codegen: give the oversized-unit per-function arm its own cap (measured: do not retune it) #8144

Merged

Navigation Menu

Uh oh!

Uh oh!

feat(gc): make native roots (statepoints) the default - #7370

feat(gc): make native roots (statepoints) the default#7370
proggeramlug merged 1 commit into
mainfrom
feat/statepoints-default

proggeramlug commented Aug 4, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 4, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot Aug 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

proggeramlug commented Aug 4, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Evidence

The part that made this non-trivial

Eight tests had to name their lowering

What this unlocks

Caveat

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Aug 4, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

proggeramlug commented Aug 4, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 4, 2026 •

edited

Loading