fix(gc): refresh obj before the class-static mirror on both own-data-write arms

[proggeramlug]

Another of the catches left open after #7373–#7376/#7380.

The bug

js_object_set_field_by_name's two own-data-write arms perform the write — an inline slot store, or overflow_set into the overflow map — and then call mirror_class_object_static_write.

Both writes can reach an allocator: overflow_set inserts into a Rust map, and a minor GC triggers on the malloc-count threshold as well as on arena-block allocation. The mirror's first instruction dereferences obj (ldr w8, [x0] at +24), so a collection inside that write leaves the hook reading from-space.

The function already carries a refresh_roots_after_alloc!() macro and calls it after every other allocating step. These two sites were simply missed.

Why it's scoped to two sites and not eight

There are eight mirror_class_object_static_write(obj, key, value) call sites. I patched all eight first — and the macro republishes value from its handle as well as obj, so arms that intentionally rebind value locally get clobbered. Only the two own-data-write arms are load-bearing for the fault, and only they are safe to refresh.

Verification

The fault moves out of mirror_class_object_static_write entirely, into a separate and unrelated catch in js_string_index_get → js_string_char_at which stays open for follow-up. A fault that moves is the signal that the patch is real; a fault that doesn't move by a byte means the value was already dead before you touched it.

Baselines were checked rather than assumed:

• test_gap_2159_defineproperty_class_prototype and test_gap_6301_event_target_subclass fail identically on pristine main — pre-existing, one is already in known_failures.json
• perry-runtime --lib fails 3 / 5 / 3 tests across three runs of pristine main (cargo-test: perry-runtime's suite fails a different number of tests on every run #7365 nondeterminism), so the failure count seen with this patch sits inside main's own noise band
• 58 object/assign/class/field/shape gap tests otherwise unchanged

Summary by CodeRabbit

• Bug Fixes
  • Fixed an issue that could cause static property writes to use outdated object references after memory allocation.
  • Improved reliability of property updates across both cached and initial write paths.
  • Confirmed existing baseline behavior remains unchanged.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 81b12469-905c-4c10-afb6-894f89a5da9f

📥 Commits

Reviewing files that changed from the base of the PR and between 9198f30 and 62b4803.

📒 Files selected for processing (2)

• changelog.d/7381-mirror-static-write-refresh.md
• crates/perry-runtime/src/object/field_set_by_name.rs

---

📝 Walkthrough

Walkthrough

This PR fixes a bug in js_object_set_field_by_name where object pointers could become stale after garbage collection during property writes. It adds refresh_roots_after_alloc!() calls in two code paths to refresh obj, key, value, and interned_key before calling mirror_class_object_static_write.

Changes

Static-write root refresh

Layer / File(s)	Summary
Root refresh before static-property mirroring crates/perry-runtime/src/object/field_set_by_name.rs, changelog.d/7381-mirror-static-write-refresh.md	Adds refresh_roots_after_alloc!() calls in the transition-cache hit path and the initial-key write path to re-read rooted pointers before calling mirror_class_object_static_write. A changelog entry documents the root cause, the fix, and the discovery method through from-space quarantine testing.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• gc(layer 3): from-space quarantine catches 55 stale dereferences across the gap suite — the instrument is in CI but aimed at one synthetic fixture #7341: Addresses stale pointers from GC during runtime operations, closely matching the root refresh fix in js_object_set_field_by_name.
• GC: enumerate the unrooted runtime-side caches — the population no static checker can see #7231: Shares the goal of preventing stale GC pointers, though in a different mechanism (runtime-side caches vs. local root refresh).
• GC: js_regexp_new holds &str borrows into movable StringHeaders across its whole body (residual #7217 allocation-point witness) #7247: Shares focus on stale movable-GC pointers, though in different functions and code paths.

Possibly related PRs

• PerryTS/perry#6811: Adds the same refresh_roots_after_alloc!() calls to the same transition-cache and initial-key write paths in js_object_set_field_by_name.
• PerryTS/perry#6941: Applies the same GC-root refresh strategy to js_object_set_field_by_name, covering the class static-property mirroring paths this PR addresses.
• PerryTS/perry#7179: Addresses GC safety in the same function and file by ensuring proper field-count publication and barriered setters for traced-field writes.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/7341-mirror-static-write-refresh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}