fix(runtime): root constructor receivers across a later ToString coercion (#6949 shape b)

Author: Ralph Küpper

crates/perry-runtime/src/builtins/formatting/boxed_primitives.rs

@@ -299,6 +299,15 @@ pub extern "C" fn js_boxed_number_new(value: f64) -> f64 {
 #[no_mangle]
 pub extern "C" fn js_boxed_string_new(value: f64, has_arg: i32) -> f64 {
     let obj = crate::object::js_object_alloc(CLASS_ID_BOXED_STRING, 0);
+    // #6949(b): both branches below allocate — `js_string_from_bytes` for the
+    // empty-string case and `js_string_coerce` otherwise, the latter running a
+    // user `toString`/`valueOf` for a POINTER_TAG value — so either can collect
+    // and EVACUATE while `obj` sits in a raw Rust local. Every use below
+    // (`register_boxed_primitive_payload`, the two `install_string_wrapper_*`
+    // calls, `attach_boxed_primitive_prototype`, and the returned NaN-box)
+    // dereferences or keys on it.
+    let scope = crate::gc::RuntimeHandleScope::new();
+    let obj_handle = scope.root_raw_mut_ptr(obj);
     // `new String()` (no args) is spec'd to box "", not "undefined".
     let ptr = if has_arg == 0 {
         crate::string::js_string_from_bytes(std::ptr::null(), 0)
@@ -309,6 +318,7 @@ pub extern "C" fn js_boxed_string_new(value: f64, has_arg: i32) -> f64 {
         }
         js_string_coerce(value)
     };
+    let obj = obj_handle.get_raw_mut_ptr::<crate::object::ObjectHeader>();
     let boxed = f64::from_bits(crate::value::JSValue::string_ptr(ptr).bits());
     register_boxed_primitive_payload(obj, boxed);
     install_string_wrapper_indices(obj, ptr);

crates/perry-runtime/src/disposable.rs

@@ -461,8 +461,25 @@ pub extern "C" fn js_suppressed_error_new(error: f64, suppressed: f64, message:
     // properties { writable:true, enumerable:false, configurable:true }. The
     // `name` default ("SuppressedError") lives on `SuppressedError.prototype`,
     // so it is *not* set as an own property here.
+    // #6949(b): `obj` is a raw Rust local — neither a GC root nor a shadow slot
+    // — and everything below it allocates: `js_string_from_bytes` per key,
+    // `js_object_set_field_by_name` when the object grows, and
+    // `js_string_coerce` on the message. Any of those can collect and EVACUATE.
+    //
+    // A single rebind after the coercion would not be enough here for two
+    // reasons: the closure captures `obj` BY VALUE, so every `set_nonenum` call
+    // would keep using the address captured at definition time; and
+    // `object_set_static_prototype` at the end keys a SIDE TABLE on
+    // `obj as usize`, so a stale address does not fault — it files the
+    // prototype under an address nothing will look up, and `instanceof
+    // SuppressedError` quietly stops resolving.
+    //
+    // So root once and re-read at every use, which is what the handle gives.
+    let scope = crate::gc::RuntimeHandleScope::new();
+    let obj_handle = scope.root_raw_mut_ptr(obj);
     let set_nonenum = |key: &str, value: f64| {
         let key_ptr = js_string_from_bytes(key.as_ptr(), key.len() as u32);
+        let obj = obj_handle.get_raw_mut_ptr::<crate::object::ObjectHeader>();
         js_object_set_field_by_name(obj, key_ptr, value);
         crate::object::set_property_attrs(
             obj as usize,
@@ -484,11 +501,13 @@ pub extern "C" fn js_suppressed_error_new(error: f64, suppressed: f64, message:
         };
         set_nonenum("message", message_val);
     }
+    let obj = obj_handle.get_raw_mut_ptr::<crate::object::ObjectHeader>();
     let result = js_nanbox_pointer(obj as i64);
     // Link the instance to `SuppressedError.prototype` so `name`/`message`
     // defaults and `instanceof SuppressedError` resolve through the chain.
     let proto = crate::object::builtin_prototype_value("SuppressedError");
     if proto.to_bits() != TAG_UNDEFINED && js_nanbox_get_pointer(proto) != 0 {
+        let obj = obj_handle.get_raw_mut_ptr::<crate::object::ObjectHeader>();
         crate::object::prototype_chain::object_set_static_prototype(obj as usize, proto.to_bits());
     }
     result

crates/perry-runtime/src/messaging.rs

@@ -606,7 +606,15 @@ pub extern "C" fn js_broadcast_channel_new(name: f64) -> f64 {
         "constructor",
         get_global_constructor("BroadcastChannel"),
     );
+    // #6949(b): `js_string_coerce` allocates for every shape except an
+    // already-heap STRING_TAG value, so it can collect and EVACUATE — and
+    // `obj`, allocated a few lines up, is a raw Rust local: neither a GC root
+    // nor a shadow slot. Every `set_field`/`install_method` below writes
+    // through it. Root it across the coercion and re-read.
+    let scope = crate::gc::RuntimeHandleScope::new();
+    let obj_handle = scope.root_raw_mut_ptr(obj);
     let name_ptr = crate::builtins::js_string_coerce(name);
+    let obj = obj_handle.get_raw_mut_ptr::<object::ObjectHeader>();
     let name_value = f64::from_bits(JSValue::string_ptr(name_ptr).bits());
     set_field(obj, "name", name_value);
     install_method(obj, "close", noop0 as *const u8, 0);