fix(gc): a Symbol's description was stored into the header already stale

[proggeramlug]

Closes 6 of 31 catches in #7341 — two apparent clusters, one root cause.

The bug

alloc_symbol calls gc_malloc — a collection point — and then writes the description pointer its caller computed before that call:

let raw = gc_malloc(size_of::<SymbolHeader>(), GC_TYPE_STRING);  // CAN COLLECT
(*ptr).description = description;                                 // pre-collection pointer

An evacuating minor moves the description string, so a live SymbolHeader holds a retired from-space address. Same shape and same fix as RegExpHeader::flags_ptr (#7374): root across the allocation, re-read after.

Two readers, two apparent clusters

js_symbol_to_string reaches the stale field directly. infer_symbol_function_name reaches it through js_object_literal_infer_computed_function_name, which had been triaged as a separate cluster because its backtrace names a different frame — and which this fix closes too (3/3 verified).

Worth stating as method: grouping catches by frame #0 is the right first cut, but it over-counts clusters whenever one bad field has several readers.

A related gap left open deliberately

The header is allocated GC_TYPE_STRING, whose payload the collector treats as opaque — so a fresh (non-registered) symbol's description is never marked or rewritten after construction. The existing comment says so:

"kept alive through the SYMBOL_REGISTRY (for registered symbols) or not at all (for fresh symbols — in practice they live for the duration of the program, which is fine for test workloads)"

This change makes the stored value correct. It does not make the description live. That is a latent use-after-free and it is called out in the changelog and commit rather than left for the green tests to imply otherwise. Tracked in #7341.

Verification

6/6 affected tests clean, byte-identical to Node.

The 2 symbol-filtered unit-test failures seen on this branch are pre-existing flake (#7365), confirmed by running the same filter 4× on each side: clean main gives 1/3/2/2 failures, this branch gives 1/0/0/1.

Summary by CodeRabbit

• Bug Fixes
  • Fixed stale symbol descriptions after garbage collection during allocation.
  • Improved symbol stringification and inferred symbol function names by ensuring descriptions remain valid when memory is relocated.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: eea4a4fa-ea2c-4cde-a73f-3db1d1fb728f

📥 Commits

Reviewing files that changed from the base of the PR and between 148f97b and af99970.

📒 Files selected for processing (2)

• changelog.d/7376-symbol-description-stale.md
• crates/perry-runtime/src/symbol.rs

---

📝 Walkthrough

Walkthrough

alloc_symbol now roots the description pointer across garbage collection, reloads its relocated address, and stores it in the new symbol header. A changelog entry documents the fix and an unresolved lifetime issue for fresh, unregistered symbols.

Changes

Symbol description GC safety

Layer / File(s)	Summary
Root description during symbol allocation crates/perry-runtime/src/symbol.rs, changelog.d/7376-symbol-description-stale.md	alloc_symbol roots and reloads the description pointer across gc_malloc. The changelog documents the affected paths and the remaining lifetime issue.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• PerryTS/perry issue 7246 — Directly addresses the alloc_symbol description-pointer relocation defect.

Possibly related PRs

• PerryTS/perry#7243 — Addresses GC rooting for Symbol objects through shadow slots.
• PerryTS/perry#7196 — Adds diagnostics for stale references caused by moving GC.
• PerryTS/perry#7116 — Roots and reloads values across allocation points in another runtime path.

Suggested reviewers: andrewtdiz, thehypnoo

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the primary fix for stale Symbol description pointers during garbage collection.
Description check	✅ Passed	The description explains the bug, fix, affected readers, related issue, known limitation, and verification results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/7341-symbol-description-stale

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}