Unmasked by the #6982 fix (PR from fix/6982-collector-pointer-validation).
Symptom
test_gap_repsel_proven_this_frozen no longer crashes on the evacuating precise-roots arm — it now fails correctly-shaped but wrong:
$ PERRY_GC_HEAP_LIMIT=8 PERRY_GC_INCREMENTAL=0 PERRY_CONSERVATIVE_STACK_SCAN=off \
./test_gap_repsel_proven_this_frozen
TypeError: bump is not a function
at <anonymous>
exit 1 (copied_objects=4614)
Before the #6982 fix it was a SIGSEGV at 0x434c4f5300000010 inside descriptor_state::get_accessor_descriptor, reached from populate_global_this_builtins. (The faulting address's high half is ASCII "CLOS" — relocated string payload read as a pointer, which was the #6982 signature.)
It passes on every other arm, including the same pressure with the conservative stack scan left on, and precise roots with no pressure. So a relocating minor is losing the bump method value specifically.
Reading
The file exercises Phase 5a proven-this (PERRY_PTR_SHAPE_LOCALS, #6925: Ptr<Shape> proven this in methods). A method value resolving to undefined/non-callable after a move points at a prototype- or class-registry-side table that is marked but not rewritten, or a method lookup cached against the pre-move receiver address.
Note CLAUDE.md's standing warning that there are two prototype-resolution paths (CLASS_PROTOTYPE_OBJECTS vs CLASS_DECL_PROTOTYPE_OBJECTS) which have disagreed about the same chain before — worth checking whether both are rewritten on evacuation, not just marked.
This is a mismatch-class failure, not a crash, so it is lower severity than #6991 but it is a real miscompile/mis-collection under a moving GC.
Reproduce
PERRY_NO_AUTO_OPTIMIZE=1 ./target/release/perry \
test-files/test_gap_repsel_proven_this_frozen.ts -o /tmp/pf
PERRY_GC_HEAP_LIMIT=8 PERRY_GC_INCREMENTAL=0 PERRY_CONSERVATIVE_STACK_SCAN=off /tmp/pf
Related: #6982, #6981, #6925, #6968.
Unmasked by the #6982 fix (PR from
fix/6982-collector-pointer-validation).Symptom
test_gap_repsel_proven_this_frozenno longer crashes on the evacuating precise-roots arm — it now fails correctly-shaped but wrong:Before the #6982 fix it was a SIGSEGV at
0x434c4f5300000010insidedescriptor_state::get_accessor_descriptor, reached frompopulate_global_this_builtins. (The faulting address's high half is ASCII"CLOS"— relocated string payload read as a pointer, which was the #6982 signature.)It passes on every other arm, including the same pressure with the conservative stack scan left on, and precise roots with no pressure. So a relocating minor is losing the
bumpmethod value specifically.Reading
The file exercises Phase 5a proven-
this(PERRY_PTR_SHAPE_LOCALS, #6925:Ptr<Shape>proventhisin methods). A method value resolving toundefined/non-callable after a move points at a prototype- or class-registry-side table that is marked but not rewritten, or a method lookup cached against the pre-move receiver address.Note CLAUDE.md's standing warning that there are two prototype-resolution paths (
CLASS_PROTOTYPE_OBJECTSvsCLASS_DECL_PROTOTYPE_OBJECTS) which have disagreed about the same chain before — worth checking whether both are rewritten on evacuation, not just marked.This is a mismatch-class failure, not a crash, so it is lower severity than #6991 but it is a real miscompile/mis-collection under a moving GC.
Reproduce
Related: #6982, #6981, #6925, #6968.