Unmasked by the #6982 fix (PR from fix/6982-collector-pointer-validation), which removed the shared populate_global_this_builtins staleness that all five #6982 crashers hit first.
Symptom
test_gap_repsel_ptr_shape_locals still SIGSEGVs on the evacuating precise-roots arm, but at a completely different site and with a much shorter stack.
PERRY_GC_HEAP_LIMIT=8 PERRY_GC_INCREMENTAL=0 PERRY_CONSERVATIVE_STACK_SCAN=off
Before the #6982 fix (5 frames of globalThis population above it):
6 test_gap_repsel_ptr_shape_locals_ts__Pt_constructor + 236
5 js_object_set_field_by_name + 708
4 js_get_global_this_builtin_value + 72
3 js_get_global_this + 156
2 populate_global_this_builtins + 45592
1 js_object_set_field_by_name + 5964
0 js_array_length + 488 SIGBUS 0x18400001fc
After (population now succeeds, so we get further):
1 test_gap_repsel_ptr_shape_locals_ts__Pt_constructor + 236
0 js_object_set_field_by_name + 3044 SIGSEGV 0x000003a0dd400000
copied_objects=4640 on the crashing cycle, so relocation genuinely happened.
Reading
A compiled constructor calls js_object_set_field_by_name. That call is what lazily allocates and populates globalThis on first use, i.e. it allocates thousands of objects and can trigger a relocating minor. The constructor's receiver (this) is held in the compiled frame across that call, and with PERRY_CONSERVATIVE_STACK_SCAN=off the GC diagnostics show compiled_shadow / shadow_roots entirely zero and native_stack_fallback.decision = "skip_disabled" — nothing keeps it current.
This looks like the ctor-receiver rooting class that #6983 is already addressing (ctor args / native-method args / string-method receiver), so it was deliberately left untouched by the #6982 fix. Worth confirming whether #6983 as written covers the receiver in this shape, or only the arguments.
Reproduce
cargo build --release -p perry -p perry-runtime -p perry-stdlib \
-p perry-runtime-static -p perry-stdlib-static
PERRY_NO_AUTO_OPTIMIZE=1 PERRY_DEBUG_SYMBOLS=1 \
./target/release/perry test-files/test_gap_repsel_ptr_shape_locals.ts -o /tmp/pl
PERRY_GC_HEAP_LIMIT=8 PERRY_GC_INCREMENTAL=0 PERRY_CONSERVATIVE_STACK_SCAN=off /tmp/pl
PERRY_DEBUG_SYMBOLS=1 makes post_link.rs skip strip, so the macOS crash report symbolizes without any special build.
Related: #6982, #6981, #6983, #6968.
Unmasked by the #6982 fix (PR from
fix/6982-collector-pointer-validation), which removed the sharedpopulate_global_this_builtinsstaleness that all five #6982 crashers hit first.Symptom
test_gap_repsel_ptr_shape_localsstill SIGSEGVs on the evacuating precise-roots arm, but at a completely different site and with a much shorter stack.Before the #6982 fix (5 frames of globalThis population above it):
After (population now succeeds, so we get further):
copied_objects=4640on the crashing cycle, so relocation genuinely happened.Reading
A compiled constructor calls
js_object_set_field_by_name. That call is what lazily allocates and populatesglobalThison first use, i.e. it allocates thousands of objects and can trigger a relocating minor. The constructor's receiver (this) is held in the compiled frame across that call, and withPERRY_CONSERVATIVE_STACK_SCAN=offthe GC diagnostics showcompiled_shadow/shadow_rootsentirely zero andnative_stack_fallback.decision = "skip_disabled"— nothing keeps it current.This looks like the ctor-receiver rooting class that #6983 is already addressing (ctor args / native-method args / string-method receiver), so it was deliberately left untouched by the #6982 fix. Worth confirming whether #6983 as written covers the receiver in this shape, or only the arguments.
Reproduce
PERRY_DEBUG_SYMBOLS=1makespost_link.rsskipstrip, so the macOS crash report symbolizes without any special build.Related: #6982, #6981, #6983, #6968.