fix(gc): root raw pointers in dynamic-object get, add a PROCESS_EMITTER scanner

changelog.d/8282-dynamic-object-rooting-process-emitter.md

@@ -0,0 +1,20 @@
+**GC: two #8220-class rooting fixes, and a native-stack diagnostic.**
+
+`js_dynamic_object_get_property` held the receiver as a raw pointer across
+`js_string_from_bytes`, which allocates. It now opens a `RuntimeHandleScope` and
+takes the key through `across_const`, so the receiver is re-read after the
+allocation rather than naming from-space if a copying minor lands in the window.
+
+Process `EventEmitter` listener closures are held as raw `*const ClosureHeader`
+in a TLS `HashMap`, which the precise root map cannot see — a copying minor that
+evacuated one left the table pointing at from-space. `PROCESS_EMITTER` now has a
+registered mutable root scanner.
+
+Adds `PERRY_GC_SCAN_NATIVE_STACK=1`, a debug-only scan for stale from-space
+pointers on the native stack after a copying minor, with
+`PERRY_GC_SCAN_NATIVE_STACK_ABORT=1` to stop at the first offender. **Abort
+implies scan**, matching `fromspace_scan::resolve_scan_knobs`: the abort switch
+alone would otherwise return at the enabled-gate, never run, and report success.
+
+Neither fix resolves the seeded rooting crash — seeds 8, 11 and 22 still fail.
+They are landed as correct fixes in their own right, not as a resolution.

crates/perry-runtime/src/gc/copying.rs

@@ -1523,6 +1523,12 @@ pub(super) fn run_copied_minor_attempt(
     // the root enumeration the rewrite pass and the evacuation verifier share.
     super::fromspace_scan::run_fromspace_scan(&snapshot);
 
+    // #8220 diagnostic: scan the native (Rust) stack for stale from-space
+    // pointers — raw pointers held in Rust frame locals that the precise root
+    // map can't see and the conservative scan is disabled in production. MUST
+    // run here, same window as fromspace_scan (after rewrite, before reset).
+    super::native_stack_scan::run_native_stack_scan();
+
     crate::promise::cleanup_copied_minor_promise_contexts_for_gc();
     finalize_dead_copied_minor_from_space_side_allocations();
     // #7742: on a promoting cycle the young blocks are handed to old-gen

crates/perry-runtime/src/gc/mod.rs

@@ -172,6 +172,9 @@ mod verify;
 /// the rewrite pass own root enumeration. Debug-only
 /// (`PERRY_GC_FROMSPACE_SCAN=1`).
 mod fromspace_scan;
+/// #8220 diagnostic: native-stack scan for stale from-space pointers after a
+/// copying minor. Debug-only (`PERRY_GC_SCAN_NATIVE_STACK=1`).
+mod native_stack_scan;
 /// #7742: the measured policy behind whole-block in-place promotion. The
 /// mechanism is `arena/promote.rs`; this decides when to use it.
 mod promote_in_place;
@@ -1015,6 +1018,11 @@ pub fn gc_init() {
     reg_scanner!(crate::process::scan_process_env_cache_roots_mut);
     reg_scanner!(crate::process::scan_permission_cache_roots_mut);
     reg_scanner!(crate::process::scan_report_cache_roots_mut);
+    // #8220: process EventEmitter listener closures are held as raw
+    // `*const ClosureHeader` in a TLS `HashMap` — invisible to the precise
+    // root map. Without this scanner a copying minor that evacuates a
+    // listener closure leaves the raw pointer stale.
+    reg_scanner!(crate::os::process_emitter_root_scanner);
     // #7231: the raw `Error` constructor address behind
     // `Error.prepareStackTrace`. The closure is reachable through `globalThis`
     // so it is not swept, but this duplicate lives outside the object graph