fix(gc): await polled a promise the event-loop pump had already moved

[proggeramlug]

Closes 4 of 31 catches in #7341 — all obj_type=5 (GC_TYPE_PROMISE) with frame #1 in generated code.

The bug

The await loop's wait block calls js_promise_run_microtasks_await_loop, js_run_stdlib_pump and js_await_loop_tick_timers — all of which allocate and can drive an evacuating minor — then branches back to check, which re-unboxes the same SSA value:

check:  %handle = unbox(%promise_box)      ← same box every iteration
        js_promise_state(%handle)
wait:   js_promise_run_microtasks_await_loop()   ← allocates
        js_run_stdlib_pump()                     ← allocates
        br check

After one pump the loop polls retired from-space and js_promise_state dereferences it.

The comment that was already there solved a different problem

"Unbox the promise in each block that uses it — LLVM's SSA form requires every value definition to dominate its uses…"

That addresses dominance, not GC movement. The box names the pre-collection promise, so unboxing it again in each of the five blocks reproduced the stale address five times rather than fixing it.

The promise now takes one temp root, and every block re-reads the slot the collector rewrites instead of reusing the register.

Verification

4/4 cluster tests go from 6/6 faults to 0/6, byte-identical to Node. 614/614 codegen tests pass.

Summary by CodeRabbit

• Bug Fixes
  • Fixed a critical crash in await operations that occurred when promises became inaccessible during garbage collection events. Enhanced promise reference tracking ensures memory addresses remain valid across garbage collection cycles, significantly improving the stability and reliability of async/await code execution.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR fixes a garbage collection bug in the await expression lowering. The promise SSA value is now rooted once in a temporary slot before the polling loop starts. Each control-flow block (check, wait, settled, rejection, completion) reloads the promise from this root instead of reusing potentially stale register values, preventing dereferences of addresses invalidated by evacuating minor collections. A changelog entry documents the fix.

Changes

Await promise rooting fix

Layer / File(s)	Summary
Promise root creation and reload in await blocks crates/perry-codegen/src/expr/fs_await.rs	Roots the await promise in a temporary GC-aware slot before polling. Check, wait, settled, rejection, and completion blocks reload the promise from that root before unboxing and querying its state.
Changelog entry changelog.d/7375-await-promise-rooting.md	Documents the bug where re-unboxing the same SSA value across GC-triggering blocks caused stale-memory polling, and describes the temp root fix and its effect on quarantine catches.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• PerryTS/perry#6972: Extends the same temp-rooting mechanism applied here specifically to await promise SSA values across GC-capable polling-loop blocks.
• PerryTS/perry#6975: Establishes the rooting-gap fix pattern extended by this PR, using identical temp-root solutions to protect and reload stale SSA values.
• PerryTS/perry#7214: Fixes stale GC-moved references by rooting and reloading values across allocation-capable operations, targeting closure-call operands instead of await promises.

Suggested reviewers: thehypnoo

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the await promise garbage-collection bug that this pull request fixes.
Description check	✅ Passed	The description explains the bug, the fix, the related issue, and verification results, although it does not follow the template headings or checklist format.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/7341-await-promise-rooting

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

crates/perry-codegen/src/expr/fs_await.rs (1)

111-279: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Truncate the promise temp root before returning it.

temp_root_push_double requires an @js_gc_temp_root_truncate call after the last read/use contractually. The merge path must truncate promise_root before returning result_slot; the async rejection path can omit it because it returns after ret. Skip the throw/unreachable path.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/perry-codegen/src/expr/fs_await.rs` around lines 111 - 279, Truncate
the promise temporary root on the normal merge path after the final use of
promise_root and before loading and returning result_slot. Add the required
js_gc_temp_root_truncate call in the merge block, while leaving the async
rejection ret path and throw/unreachable path unchanged.

Source: Learnings

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@crates/perry-codegen/src/expr/fs_await.rs`:
- Around line 111-279: Truncate the promise temporary root on the normal merge
path after the final use of promise_root and before loading and returning
result_slot. Add the required js_gc_temp_root_truncate call in the merge block,
while leaving the async rejection ret path and throw/unreachable path unchanged.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8203c002-a576-42e6-946f-0171b97ae9da

📥 Commits

Reviewing files that changed from the base of the PR and between 148f97b and 540c32b.

📒 Files selected for processing (2)

• changelog.d/7375-await-promise-rooting.md
• crates/perry-codegen/src/expr/fs_await.rs