ci: native-abi-proof workload native_abi_packet_control lost its hot-loop native region (hot_loops_no_runtime_calls red on main since the 2026-07-28→29 merge window)

[proggeramlug]

Summary

compiler-output-regression → suite native-abi-proof → workload native_abi_packet_control fails its hot_loops_no_runtime_calls contract:

hot_loops_no_runtime_calls: hot loop runtime calls: {"for.body.2": [
  "js_array_length", "js_array_push_f64", "js_boxed_number_new",
  "js_native_arena_alloc", "js_native_aren…"
]}

The hot loop lost its native-region lowering and fell back to generic runtime calls. native-region-proof (the sibling suite in the same job) still reports "status": "pass" — only native-abi-proof is red, and only this one workload.

When it appeared

compiler-output-regression on scheduled main runs:

run	main SHA	result
30428100984 (2026-07-29)	760db2fd8	failure
30334470716 (2026-07-28)	95960e0df	success
30244372354 (2026-07-27)	b5727f305	success
30191162880 (2026-07-26)	497f64e43	success

So it was introduced somewhere in 95960e0df..760db2fd8 — 28 commits, since the scheduled run is daily and that window holds a full day of merges. I have not bisected it, and I am deliberately not guessing: several commits in that range are plausible on priors (the rooting series #6934/#6941/#6948/#6972 emits new calls; the code-shape/table-izing series #6937/#6938/#6940/#6959 changes lowering; #6893/#6939 changed typed layouts), and "plausible on priors" is how two wrong attributions already got made this week.

The window is git log --oneline 95960e0df..760db2fd8.

Why it matters now

compiler-output-regression is a required check, so this blocks every open PR that reaches it — currently #6990, and #6983/#6994 once they get that far. Those PRs are unrelated to the defect: #6990's diff is two comment rewrites plus a runtime-side RuntimeHandleScope, none of which can add calls to generated IR.

This is also the second repo-wide gate red at the same time; the other is the stale public benchmark baseline failing lint. Both need clearing before the GC work can land.

Suggested next step

Bisect the 28-commit window against this one workload. It should be cheap to script:

python3 scripts/compiler_output_regression.py suite --suite native-abi-proof   # (see the workflow for exact args)

Then decide whether the regression is a genuine lowering loss to fix, or an intentional consequence of new rooting emission — in which case the contract needs updating deliberately, with the cost written down, rather than left red.

[proggeramlug]

Bisected. Culprit: 760db2fd8 — #6972, "make argument temporaries precise roots" (one of the GC rooting series, as suspected on priors but this time measured). Fix in #6997.

Evidence

The truncated CI message hid the offending name. It is a single call:

"unexpected": {"for.body.2": ["js_gc_temp_root_push"], "for.body.2.i": ["js_gc_temp_root_push"]}

Everything else in those loops is on the workload's allowlist, so this is not a lost native region — the control packet keeps its dynamic calls by design. One new call entered the hot loop.

Compiler rebuilt from source at each endpoint (cargo build -p perry, debug, same package set, dedicated worktree + target dir; no prebuilt binary from anywhere), the good endpoint verified green before any hop was trusted:

commit	hot-loop probe
95960e0df (#6911 — the last green scheduled run)	pass
1a533a3a8 (#6925 — parent of the suspect)	pass
760db2fd8 (#6972)	fail
aa1c15028 (current main)	fail

git log -S js_gc_temp_root_push 95960e0df..760db2fd8 names only 760db2fd8, and the after-opt IR delta across that boundary is exactly that one call — nothing else in the workload's IR changes. Reproduced identically by the full harness (native-abi-proof, compile + link + run) and by a lightweight IR-only probe, on arm64 macOS, matching the CI message byte for byte.

Why

The fixture's kernel is (buf[i] + packet.tag + i) & 255. packet is any, so the add lowers through js_dynamic_string_or_number_add, and #6972 roots the operand pair across the property get. That is correct in general — a heap operand held only in an SSA register while its sibling allocates is exactly the #6951 use-after-free.

But the left operand is a byte. #6972 anticipated this and gated emission on expr_is_known_non_pointer_shadow_value; that predicate simply has no arm for typed-array / Buffer element reads. So the hottest loop in the workload (4096 × 64 = 262 144 iterations) paid a push + re-read + truncate per iteration to root a value that can never be collected.

Verdict: over-emission, not an accepted cost

So the contract is not relaxed. #6997 teaches the predicate the element-read family instead, with the soundness argument resting on the lowering rather than the declared type (annotations are unenforced; js_uint8array_index_get_value / js_buffer_index_get_value answer undefined for a receiver that is not a Uint8Array/Buffer, and the inline arm reads a raw byte). The two lowerings of Uint8ArrayGet that can return a heap value — a symbol key, and a key without the integer-array-index proof — stay rooted and have tests holding them from the other side.

Cost to #6972: none of its protection. Emitted push count in this fixture goes 5 → 4; the console.log accumulator pair and the two js_dynamic_string_or_number_add results in the return expression (which really can be strings) all stay rooted. The hot loop returns to its pre-#6972 IR.

Two things found on the way

1. main's lint is red for more than the stale benchmark baseline. On a pristine origin/main checkout, ./scripts/check_file_size.sh fails with 9 files over the 2000-line cap (typed_abi.rs, index_get.rs, array/generic.rs, gc/tests/layout_trace.rs, object/mod.rs, callable_export_check.rs, callable_exports.rs, native_module/constants.rs, readline.rs) and scripts/addr_class_inventory.py fails on native_module/constants.rs:2088 ([band-literal] ("O_SYMLINK", (0x200000) as f64)). Byte-identical output with and without fix(codegen): don't root typed-array element reads as GC temporaries (#6996) #6997's diff. The benchmark-freshness step runs first and masks both, so clearing the baseline will expose them.

2. cargo test -p perry-codegen has 3 pre-existing failures on main (mutable_string_key_rejects_static_write_pic, nested_same_shape_object_writes_version_one_through_four_fields, static_put_value_rejects_write_pic_when_rhs_can_allocate in native_proof_regressions), reproduced identically on a pristine main checkout on the same machine. Unrelated to this defect, but they are in a suite that only runs when a diff scopes it in.

3. A latent hazard adjacent to this one: collectors/pointer_locals.rs classifies Expr::Uint8ArrayGet as Type::Number unconditionally — including the symbol-key and unproven-key lowerings fix(codegen): don't root typed-array element reads as GC temporaries (#6996) #6997 deliberately excludes. That decides shadow-slot reservation, so const x = u8[Symbol.iterator] binds a heap value into a local with no GC root. Same class of hazard as gc: console.log argument temporaries are not precise roots — a precise-roots-only collection drops string-literal args (minimal repro, no evacuation needed) #6951, rarer shape. fix(codegen): don't root typed-array element reads as GC temporaries (#6996) #6997 does not widen it; it declines to copy it. Worth its own issue.