fix(gc): a RegExp's flags string was stored into the header already stale

[proggeramlug]

Closes the lookup_fancy_regex cluster in #7341 — 5 of 31 catches, four different callers reaching one read.

The bug

js_regexp_new allocates the canonical flags string, then calls gc_malloc for the header — a collection point — and then writes the pre-collection pointer:

let canonical_flags_ptr = js_string_from_str(flags_str);   // allocates a string
let raw = gc::gc_malloc(header_size, GC_TYPE_OBJECT);      // CAN COLLECT
let pattern = pattern_root.get_raw_const_ptr::<StringHeader>();  // pattern re-read ✅
(*ptr).flags_ptr = canonical_flags_ptr;                    // flags stored STALE ✗

A live RegExpHeader then holds a retired from-space address permanently, and every later string_as_str((*re).flags_ptr) reads it.

The pattern string was already rooted and re-read across that exact allocation, with a ★-marked comment explaining the hazard. The flags string, created three lines later and stored beside it, was not.

Two wrong fixes, recorded so nobody repeats them

Both looked obvious and both measured exactly zero:

• A no-move window inside lookup_fancy_regex — the faulting helper. 0/5.
• Rooting the search-value operand in codegen's replace lowering. 0/5, even after confirming in the IR that the root landed and moving the re-read to the point of use.

The helper was innocent. The call site was innocent. The header had been carrying a dead pointer since construction.

Verification

4/5 cluster tests clean, 5/5 byte-identical to Node, 43/43 regex unit tests. A 6-line reproducer goes 6/6 → 0/6.

Summary by CodeRabbit

Release Notes

• Bug Fixes
  • Fixed a memory-related issue affecting regular expression flags that could cause failures in certain scenarios. Regular expressions now function reliably across all use cases.

[coderabbitai]

📝 Walkthrough

Walkthrough

js_regexp_new now roots the canonical RegExp.flags string before header allocation and re-reads its pointer afterward. A changelog entry documents the moving-GC bug, fix, and validation results.

Changes

RegExp flags GC fix

Layer / File(s)	Summary
Root flags across header allocation crates/perry-runtime/src/regex.rs, changelog.d/7374-regexp-flags-stale-store.md	js_regexp_new roots the canonical flags string before allocating the header and retrieves its relocated pointer afterward. The changelog records the fix and related test results.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• GC: js_regexp_new holds &str borrows into movable StringHeaders across its whole body (residual #7217 allocation-point witness) #7247 — Both issues address GC-stale string references in js_regexp_new, including rooting values across allocation points.

Possibly related PRs

• PerryTS/perry#7116 — Both changes root or re-derive string pointers across moving-GC points.
• PerryTS/perry#7227 — Both changes fix RegExp-related stale pointers under moving GC.

Suggested reviewers: thehypnoo

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the garbage-collection bug that left a RegExp flags string pointer stale.
Description check	✅ Passed	The description clearly explains the root cause, fix scope, related issue, failed alternatives, and verification results, but it omits several template headings.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/7341-regexp-flags-stale-store

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@changelog.d/7374-regexp-flags-stale-store.md`:
- Line 20: Correct the reproducer result in the changelog text by changing the
reported direction from “6/6 → 0/6” to “0/6 → 6/6”, preserving the surrounding
wording.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 90f9a4fc-5a7e-41f8-b92c-dc1724c51d05

📥 Commits

Reviewing files that changed from the base of the PR and between 148f97b and 1fc365a.

📒 Files selected for processing (2)

• changelog.d/7374-regexp-flags-stale-store.md
• crates/perry-runtime/src/regex.rs

[coderabbitai]

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Correct the reproducer result direction.

Line 20 reports 6/6 → 0/6, but the PR objective states that the reproducer improved from 0/6 to 6/6. The current text reports a regression. Change the arrow to 0/6 → 6/6.

Proposed fix

-  4 of the 5 cluster tests are now clean and a 6-line reproducer goes 6/6 → 0/6.
+  4 of the 5 cluster tests are now clean and a 6-line reproducer goes 0/6 → 6/6.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	4 of the 5 cluster tests are now clean and a 6-line reproducer goes 6/6 → 0/6.
	4 of the 5 cluster tests are now clean and a 6-line reproducer goes 0/6 → 6/6.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@changelog.d/7374-regexp-flags-stale-store.md` at line 20, Correct the
reproducer result in the changelog text by changing the reported direction from
“6/6 → 0/6” to “0/6 → 6/6”, preserving the surrounding wording.