fix(gc): close #7210's two remaining unrooted-alloca sites + #7640 A/C findings - #7736
Open
proggeramlug wants to merge 3 commits into
Open
fix(gc): close #7210's two remaining unrooted-alloca sites + #7640 A/C findings#7736proggeramlug wants to merge 3 commits into
proggeramlug wants to merge 3 commits into
Conversation
proggeramlug
pushed a commit
that referenced
this pull request
Aug 9, 2026
📝 WalkthroughWalkthroughThe changes root and reread operands across namespace construction, index stores, and computed-key dispatch. They document class-field receiver limits, add moving-GC regression tests, and update release metadata. ChangesGC rooting coverage
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related issues
Possibly related PRs
Sequence Diagram(s)sequenceDiagram
participant GeneratedCode
participant RootedGroup
participant Runtime
participant MovingGC
GeneratedCode->>RootedGroup: lower receiver, key, value, or arguments
GeneratedCode->>MovingGC: execute allocation-capable operation
MovingGC->>RootedGroup: relocate managed values
RootedGroup->>GeneratedCode: reread relocated values
GeneratedCode->>Runtime: perform namespace creation, store, or dispatch
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
test-files/fixtures/gc_namespace_rooting_pkg/lib.ts (1)
20-22: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winConsider adding a nested-namespace export to cover the fifth entry kind.
The fixture covers
LocalVar,LocalFunction,LocalClass,ForeignVar, andForeignFunction.NamespaceEntryKind::NestedNamespaceloads@__perry_ns_<prefix>and is also rooted by this change, but no export here produces it. Addexport * as other from "./other.ts";to exercise that arm.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test-files/fixtures/gc_namespace_rooting_pkg/lib.ts` around lines 20 - 22, Add a namespace alias export alongside the existing re-exports in the fixture module, using the nested namespace form that exposes the other module as `other` (for example, `export * as other from "./other.ts"`), so `NamespaceEntryKind::NestedNamespace` is exercised while preserving the existing `churnFromOther` and `CHURN_TAG` exports.test-files/test_gap_gc_index_set_bounded_globalthis_ta_rooting.ts (1)
49-52: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd a read-back assertion for the typed-array symbol-key store.
The other two cases compare the stored value against the expected value and increment
bad. The typed-array symbol case only performs the store. A stale key after relocation stores the value under a different symbol, and this fixture still prints0. Read the symbol property back and compare it.🧪 Proposed assertion
-function widthTrackedTaSymbolStore(ta: Int32Array, n: number): void { +function widthTrackedTaSymbolStore(ta: Int32Array, n: number): number { const sym = Symbol.for("gc7640a_" + n); (ta as unknown as Record<symbol, number>)[sym] = churn(n); + return (ta as unknown as Record<symbol, number>)[sym]; }const ta = new Int32Array(8); for (let r = 0; r < 200; r++) { - widthTrackedTaSymbolStore(ta, r); + if (widthTrackedTaSymbolStore(ta, r) !== r) bad++; }Also applies to: 72-75
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test-files/test_gap_gc_index_set_bounded_globalthis_ta_rooting.ts` around lines 49 - 52, Update widthTrackedTaSymbolStore and the corresponding second typed-array symbol case to read back the value at the same symbol key after storing it, compare it with churn(n), and increment bad when it differs, matching the assertions used by the other cases.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@crates/perry-codegen/src/expr/property_set.rs`:
- Around line 196-202: Update the stale changelog reference in the comment near
the property-set emitted IR discussion to point from 7640-abc-rooting-residue.md
to 7736-rooting-residue.md, without changing the surrounding explanation.
In `@test-files/test_gap_gc_class_field_receiver_rooting.ts`:
- Around line 92-99: Update the gc-moving-witnesses corpus handling for
test_gap_gc_class_field_receiver_rooting.ts so the Runner.run case is treated as
unprotected. Restrict assertions to safe arms or encode the expected failure for
Runner.run, preventing its relocated-witness mismatch from blocking the
loop_polls suite.
---
Nitpick comments:
In `@test-files/fixtures/gc_namespace_rooting_pkg/lib.ts`:
- Around line 20-22: Add a namespace alias export alongside the existing
re-exports in the fixture module, using the nested namespace form that exposes
the other module as `other` (for example, `export * as other from
"./other.ts"`), so `NamespaceEntryKind::NestedNamespace` is exercised while
preserving the existing `churnFromOther` and `CHURN_TAG` exports.
In `@test-files/test_gap_gc_index_set_bounded_globalthis_ta_rooting.ts`:
- Around line 49-52: Update widthTrackedTaSymbolStore and the corresponding
second typed-array symbol case to read back the value at the same symbol key
after storing it, compare it with churn(n), and increment bad when it differs,
matching the assertions used by the other cases.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 50c57554-6978-4f6d-83e8-d2967d05b9ef
📒 Files selected for processing (10)
changelog.d/7736-rooting-residue.mdcrates/perry-codegen/src/codegen/helpers.rscrates/perry-codegen/src/expr/index_set.rscrates/perry-codegen/src/expr/property_set.rscrates/perry-codegen/src/lower_call/early_branches.rstest-files/fixtures/gc_namespace_rooting_pkg/lib.tstest-files/fixtures/gc_namespace_rooting_pkg/other.tstest-files/test_gap_gc_class_field_receiver_rooting.tstest-files/test_gap_gc_index_set_bounded_globalthis_ta_rooting.tstest-files/test_gap_gc_namespace_and_computed_dispatch_rooting.ts
Comment on lines
+196
to
+202
| // emitted IR. Left unfixed here: rooting it unconditionally would add | ||
| // a real store+bind+reread to the common `LocalGet`/`This` case this | ||
| // comment just proved needs none, on what the issue that tracks this | ||
| // (#7640) calls "the hottest store path in the compiler" — a | ||
| // measured-cost change, not a rooting-API mechanical one, and | ||
| // deliberately left for a follow-up that can benchmark it. See | ||
| // changelog.d/7640-abc-rooting-residue.md. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: List changelog fragments and check the referenced file.
set -euo pipefail
fd . changelog.d -t f
rg -n '7640-abc-rooting-residue' crates changelog.d test-files || echo "no other references"Repository: PerryTS/perry
Length of output: 25645
Update the stale changelog pathname.
changelog.d/7640-abc-rooting-residue.md is not present; the relevant changelog fragment is changelog.d/7736-rooting-residue.md. Update this comment so readers find the right note.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@crates/perry-codegen/src/expr/property_set.rs` around lines 196 - 202, Update
the stale changelog reference in the comment near the property-set emitted IR
discussion to point from 7640-abc-rooting-residue.md to 7736-rooting-residue.md,
without changing the surrounding explanation.
Comment on lines
+92
to
+99
| class Runner { | ||
| run(p: Point, n: number): void { | ||
| const h = new Holder(); | ||
| h.target = p; | ||
| h.target.x = allocPoint(churn(n)).x; | ||
| h.target.next = allocPoint(churn(n + 1)); | ||
| } | ||
| } |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check how this fixture is executed and whether output is compared.
set -euo pipefail
rg -n 'test_gap_gc_class_field_receiver_rooting' -g '!**/target/**' .
rg -n 'PERRY_GC_MOVING_LOOP_POLLS' -g '!**/target/**' . | head -30Repository: PerryTS/perry
Length of output: 9891
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## candidate files"
git ls-files | rg '(^|/)test_gap_gc_class_field_receiver_rooting\.ts$|property_set\.rs$|gc_repsel_corpus\.txt$|memory-model\.md$|CLAUDE\.md$' || true
echo
echo "## fixture excerpts"
if [ -f test-files/test_gap_gc_class_field_receiver_rooting.ts ]; then
wc -l test-files/test_gap_gc_class_field_receiver_rooting.ts
sed -n '1,180p' test-files/test_gap_gc_class_field_receiver_rooting.ts | cat -n
fi
echo
echo "## property_set.rs relevant excerpt"
if [ -f crates/perry-codegen/src/expr/property_set.rs ]; then
wc -l crates/perry-codegen/src/expr/property_set.rs
sed -n '150,220p' crates/perry-codegen/src/expr/property_set.rs | cat -n
fiRepository: PerryTS/perry
Length of output: 10639
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## gc_repsel_corpus text"
if [ -f test-parity/gc_repsel_corpus.txt ]; then
rg -n '7640|class_field|receiver|gap_gc|PERRY_GC_MOVING_LOOP_POLLS|test_gap_gc_class_field_receiver_rooting' test-parity/gc_repsel_corpus.txt -C 2 || true
fi
echo
echo "## root/repsel script excerpts"
for f in scripts.gc_repsel_matrix.sh scripts/gc_root_dominance_check.py docs/src/internals/memory-model.md changelog.d/7640*; do
if [ -f "$f" ]; then
echo "### $f"
wc -l "$f"
rg -n 'test_gap_gc_class_field_receiver_rooting|7640|receiver|PERRY_GC_MOVING_LOOP_POLLS|PERRY_GC_ZEAL|moving|assert|bad' "$f" -C 3 || true
fi
doneRepository: PerryTS/perry
Length of output: 50369
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## workflow files referencing gc-moving-witnesses or test_gap_gc_class_field_receiver_rooting"
git ls-files .github test-parity scripts | paste -sd'\n' | rg '(^\.github/workflows/|test-parity/gc_repsel_corpus\.txt|scripts/)' || true
for f in $(git ls-files .github/workflows | sort); do
if rg -q 'gc-moving-witnesses|test-gap-gc|PERRY_GC_MOVING_LOOP_POLLS|PERRY_GC_ZEAL|PERRY_GC_PROTECT_FROMSPACE|PERRY_GC_HEAP_LIMIT|loop_polls|force_evac|evac_minor' "$f"; then
echo "### $f"
rg -n 'gc-moving-witnesses|test-gap-gc|PERRY_GC_MOVING_LOOP_POLLS|PERRY_GC_ZEAL|PERRY_GC_PROTECT_FROMSPACE|PERRY_GC_HEAP_LIMIT|loop_polls|force_evac|evac_minor|test_gap_gc_class_field_receiver_rooting|PERRY_GC_DIAG|PERRY_GC_MOVING' "$f" -C 2
fi
done
echo
echo "## corpus entry context exactly"
perl -ne 'print "$. $_" if $. >= 723 && $. <= 732' test-parity/gc_repsel_corpus.txt | cat -n
echo
echo "## targeted policy/collector references only"
rg -n 'evacuation_policy_allowed|move|copying|PERRY_GC_ZEAL|PERRY_GC_PROTECT_FROMSPACE|PERRY_GC_HEAP_LIMIT|PERRY_GC_MOVING_LOOP_POLLS|gc_check_trigger|js_gc_loop_safepoint' crates -g '*.rs' -C 1 | head -240Repository: PerryTS/perry
Length of output: 31188
Mark the Runner.run branch as unprotected in the corpus flow.
test_gap_gc_class_field_receiver_rooting.ts documents h.target.x = … and h.target.next = … as genuinely unprotected compound receivers, and crates/perry-codegen/src/expr/property_set.rs states the same. The gc-moving-witnesses circuit runs this file on --arms loop_polls and gates on relocated witnesses matching oracle output; assert only the safe arms, or carry the failure expectation for Runner.run so this open case does not block the moving-witness suite.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@test-files/test_gap_gc_class_field_receiver_rooting.ts` around lines 92 - 99,
Update the gc-moving-witnesses corpus handling for
test_gap_gc_class_field_receiver_rooting.ts so the Runner.run case is treated as
unprotected. Restrict assertions to safe arms or encode the expected failure for
Runner.run, preventing its relocated-witness mismatch from blocking the
loop_polls suite.
added 3 commits
August 9, 2026 23:53
…C findings #7210: root the two flagship interleaved-staging sites the earlier alloca enumeration left open. `codegen/helpers.rs`'s `emit_namespace_populator` staged every re-exported binding's value into a plain stack alloca while the per-entry loop called allocating helpers (closure singleton alloc, arbitrary cross-module getters); an already-staged entry had no root and could go stale before `js_create_namespace` read the whole buffer. Fixed by rooting each value in a RootedGroup as it's produced and deferring every store to a second, call-free pass that runs immediately before the consuming call. `lower_call/early_branches.rs`'s `obj[strKey](args)` computed-key dispatch lowered receiver/key/args into bare registers in sequence, and `unbox_str_handle` (an allocating SSO materialisation) ran between the args buffer's stores and the call in the static-key arm. Fixed the same way: root `[object, index, ...args]` in one RootedGroup, build the args buffer last in each branch. #7640 section A: three more index_set.rs arms with no rooting decision at all, now fixed — the bounded-index-pair array store (the issue's sharpest repro), `globalThis[k] = v`, and the width-tracked typed-array non-numeric-index store. Not reached: the #5525 recv_unknown inline dyn-TA store, and the TA runtime-key / TA final-fallback / Uint8Array runtime-key arms. #7640 section C: resolved, not mechanically fixed. Two property_set.rs comments claimed a class-field store's receiver survives an allocating RHS via "the same statepoint re-read" a sibling arm relies on. That mechanism doesn't exist. Traced to ground: for a bare LocalGet/This receiver the claim is true, via root_reload.rs (#7280) — a front-end pass independent of RS4GC that re-materialises a value derived from a shadow-slot or handle-global load below any collection point it doesn't dominate; verified with the checker on both lowerings against a new fixture. For a compound receiver (`this.target.x = allocPoint(n).x`, the receiver itself a class-field READ) the claim is false, and the gap is invisible to both root_reload (no shadow slot to re-derive from — the value is a phi over two field-get paths) and the stale-register checker (its pattern match only anchors on a direct `load double, ptr <root>` source). Left unfixed deliberately: rooting the receiver unconditionally would tax the dominant plain-local case this investigation just proved needs nothing, on what the issue calls the hottest store path in the compiler — a measured-cost tradeoff for a follow-up, not a mechanical gap. All four sites that made or relied on the original claim now say this precisely. #7640 section E: triaged, not fixed. All seven named callees were read, not skipped — each looks like a hazard that is not one (single already-rooted caller, address derived after the allocating step rather than before, or typed-array immovability per CLAUDE.md's own GC section). Static triage only, not checker-verified per-callee; a lead for a follow-up. New corpus fixtures: test_gap_gc_namespace_and_computed_dispatch_rooting.ts (+ fixtures/gc_namespace_rooting_pkg/), test_gap_gc_index_set_bounded_globalthis_ta_rooting.ts, and an expanded test_gap_gc_class_field_receiver_rooting.ts covering both halves of the section C finding. Verified: scripts/gc_root_dominance_check.py's gated invocations (--unrooted-allocas --moving-only; --statepoints --moving-only) read clean on the full corpus, both lowerings, with an empty allowlist. cargo test -p perry-codegen has pre-existing failures unrelated to this change (see PR description for the exact set against the current main baseline).
proggeramlug
force-pushed
the
gc/7210-7640-rooting-residue
branch
from
August 9, 2026 21:55
a0be89f to
2e868d7
Compare
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
CLAUDE.md (1)
143-145: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick winMove release-history detail out of
CLAUDE.md.Lines 143-145 and 147 add issue history, former behavior, and performance history to
CLAUDE.md. Keep only current GC behavior and operator guidance here. Move the historical detail tochangelog.d/7736-rooting-residue.md.As per coding guidelines,
CLAUDE.mdmust stay concise and detailed change history belongs inchangelog.d/. The PR objectives identifychangelog.d/7736-rooting-residue.mdas this change’s fragment.Also applies to: 147-147
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@CLAUDE.md` around lines 143 - 145, Trim the GC guidance rows for PERRY_GC_ZEAL, PERRY_GC_ZEAL_ALLOC_KB, and PERRY_GC_FROMSPACE_SCAN_ABORT in CLAUDE.md to retain only current behavior and operator usage. Move issue references, former behavior, performance measurements, and release-history details into changelog.d/7736-rooting-residue.md, preserving the current operational instructions in CLAUDE.md.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@CLAUDE.md`:
- Around line 143-145: Trim the GC guidance rows for PERRY_GC_ZEAL,
PERRY_GC_ZEAL_ALLOC_KB, and PERRY_GC_FROMSPACE_SCAN_ABORT in CLAUDE.md to retain
only current behavior and operator usage. Move issue references, former
behavior, performance measurements, and release-history details into
changelog.d/7736-rooting-residue.md, preserving the current operational
instructions in CLAUDE.md.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 5748e015-dee4-44c0-b3a3-3e4ea1de75c0
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (2)
CLAUDE.mdCargo.toml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes out #7210's two named remaining sites, plus part of #7640's sections
A and C. Full accounting below, including what was not reached — several
things turned out not to be hazards, reported as findings rather than
shortfalls.
#7210 — both named sites, fixed
crates/perry-codegen/src/codegen/helpers.rs'semit_namespace_populator(§2's flagship site):
vals_bufstaged every exported binding's NaN-boxedvalue in a plain stack alloca while the per-entry loop called allocating
helpers (
js_closure_alloc_singleton, arbitrary cross-module getters). Analready-staged entry had no root and could go stale before
js_create_namespaceread the whole buffer. Fixed by rooting each value ina
RootedGroupas it's produced and deferring everyvals_bufstore to asecond, call-free pass that runs immediately before the consuming call.
crates/perry-codegen/src/lower_call/early_branches.rs'sobj[strKey](args)computed-key dispatch (§3's flagship site): receiver,key and every argument were lowered into bare registers in sequence, and in
the static-string-key arm
unbox_str_handle(an allocating SSOmaterialisation) ran between the args buffer's stores and the consuming
call. Fixed by rooting
[object, index, ...args]in oneRootedGroupandbuilding the args buffer last, in each branch, after
unbox_str_handle.#7640 section A — 3 of ~7 arms fixed
the twin arm gc(layer 3): from-space quarantine catches 55 stale dereferences across the gap suite — the instrument is in CI but aimed at one synthetic fixture #7341 already closed.
globalThis[k] = v— key and the globalThis singleton copy both rooted.Not reached: the
#5525 recv_unknowninline dyn-TA store, and the TAruntime-key / TA final-fallback / Uint8Array runtime-key arms.
#7640 section C — resolved (not a mechanical fix)
Two
property_set.rscomments claimed a class-field store's receiversurvives an allocating RHS via "the same statepoint re-read" a sibling arm
relies on. That mechanism doesn't exist (RS4GC only relocates values still
ptr addrspace(1)-typed and live across the safepoint; the receiver crossesit as a plain
double, perfunction/precise_roots.rs). What's actuallygoing on:
Expr::LocalGet/Expr::Thisreceiver: the claim is TRUE, viaroot_reload.rs(GC: #7154's residual is NOT fixed — the loop-polls config is red 0/30, and stock zod alone fails 5/40 #7280) — a front-end pass, independent of RS4GC, thatre-materialises a value derived from a shadow-slot or handle-global load
below any collection point it doesn't dominate. Verified with
scripts/gc_root_dominance_check.py --stale-registers/--statepointsonboth lowerings against a new fixture — zero hazards.
this.target.x = allocPoint(n).x, receiver itself aclass-field READ: the claim is FALSE, and invisible to both
root_reload(the receiver is a
phiover two field-get paths, not a direct shadow-slotload) and the
--stale-registerschecker (its pattern match only anchorson a direct
load double, ptr <root>source). Confirmed by hand in theemitted IR for exactly this shape.
Left unfixed on purpose: rooting the receiver unconditionally would tax the
dominant
LocalGet/Thiscase this investigation just proved needsnothing, on what #7640 itself calls "the hottest store path in the
compiler" — a measured-cost tradeoff the issue explicitly deferred to a
follow-up that can benchmark it. All four
property_set.rssites that madeor relied on the original claim now say this precisely.
New fixture:
test-files/test_gap_gc_class_field_receiver_rooting.ts—exercises both halves under
PERRY_GC_MOVING_LOOP_POLLS=1allocationpressure, and is also a real Node-comparison functional-correctness check
independent of either checker.
#7640 section E — triaged, not fixed
All seven named callees
(
ptr_numarray_access::try_lower_num_array_guard_free_{set,get},try_lower_proven_view_checked_store,lower_typed_array_store,lower_buffer_store,lower_index_set_fast,masked_window::lower_masked_window_index_get,property_get/generic_dispatch.rs::lower_generic_property_get) were read,not skipped. Each looks like a hazard that is not one:
lower_index_set_fast's only callsite is inside the
with_operands_rootedgroup gc(layer 3): from-space quarantine catches 55 stale dereferences across the gap suite — the instrument is in CI but aimed at one synthetic fixture #7341 alreadyestablished;
try_lower_num_array_guard_free_{get,set}'sobjectisstructurally constrained to
Expr::LocalGetand its one caller eachdoesn't interleave any other lowering around it.
try_lower_proven_view_checked_storelowersvaluefirst, then derivesthe data pointer.
lower_typed_array_store/lower_buffer_storecache a data pointer acrossan allocating RHS, but into a
GC_FLAG_TENURED, non-movable backingstore (same category GC: the remaining unrooted-alloca hazards after #7207 — class-keys pointer caches, interleaved staging arrays, inlined-callee param slots #7210 section 5 already flagged, not a new finding).
lower_generic_property_get/lower_masked_window_index_gethave nosecond allocating operand in their own window at all.
This triage is static, not checker-verified per callee — treat it as a
lead for whoever picks up the rest of E, not a closed finding.
What I verified, and against which commit
The branch is rebased onto
origin/main@f28657da0(v0.5.1426 — post #7724'sphi-false-positive fix, post #7732's native-lowering-to-0-unrooted,
--max-unrooteddeleted from the gate). A prior verification pass (bothgated checker modes,
PERRY_RUNTIME_DIRpinned, full corpus, emptyallowlist) was clean on an earlier commit of this branch, but that was
measured against v0.5.1420 — before #7732, so it is not the number this
PR should be judged on. Re-running now on the current HEAD and will post
the fresh before/after (both lowerings, gated invocations) as a PR comment
as soon as the release rebuild finishes — opening the PR itself rather
than holding it for that run to land, per the standing guidance that an
unpushed/unopened branch is worth nothing.
Codegen test baseline
cargo test -p perry-codegen --no-fail-fastwill be re-run against the sameHEAD and posted as a comment. The last full run (also pre-#7732, pre-#7730)
showed 4 failing integration-test targets matching #7708's pre-existing set;
#7730 ("resolve #7494's four lowering-independent proof-test failures",
merged since) looks likely to have fixed exactly those, which the fresh run
will confirm or correct.
Test plan
cargo check -p perry-codegencargo fmt --all -- --checkcargo test -p perry-codegen --no-fail-fast, diffed against thecurrent
origin/mainbaseline (see above)scripts/gc_root_dominance_check.py, gated invocations(
--unrooted-allocas --moving-only,--statepoints --moving-only),both lowerings,
PERRY_RUNTIME_DIRpinnednode --experimental-strip-typesoutput
Summary by CodeRabbit
Bug Fixes
Tests