fix(gc): root heap values held across JS-running calls in runtime and ext-http

changelog.d/8131-moving-gc-rooting-sweep.md

@@ -0,0 +1,56 @@
+### Fixed
+
+- Root heap values held in Rust locals across calls that can run JS and
+  therefore collect. Each was caught by a fault at the exact instruction
+  under `PERRY_GC_PROTECT_FROMSPACE=1`, not by inspection:
+  - the generic array-like callback helpers (`forEach`, `map`, `filter`,
+    `some`, `every`, `find`/`findIndex`/`findLast`/`findLastIndex`,
+    `reduce`/`reduceRight`) held the receiver, callback, result under
+    construction, and current element across `js_closure_call*`; `map`
+    wrote every mapped element through a pre-collection element pointer,
+    landing in retired from-space;
+  - `Function.prototype.call`/`.apply` held the callee, the explicit
+    `this`, and the saved implicit-`this` across the invocation, then read
+    the stale callee's header in the native-this alias check;
+  - `js_put_value_set` held the receiver and property key across
+    `ordinary_set_with_receiver` (which runs user setters) before the
+    array-subclass `length` note dereferenced them.
+
+- Keep perry-ext-http's listener dispatch on values the collector can see.
+  Ext handle-struct side tables are rewritten by registered scanners, but a
+  SNAPSHOT of one in a Rust local is a copy no scanner reaches: a drained
+  listener vec went stale after the first callback's collection, and the
+  pending-request struct parked in an mpsc channel went stale across the
+  microtask-pump safepoint minors that run while the request waits. The
+  emit helpers, deferred-listen drain and close callback now root their
+  snapshots, and both request dispatchers re-read handler and listener
+  lists from the scanner-maintained server handle at dispatch time. The
+  orphaned `HttpPendingRequest::check_continue_listeners` field is removed;
+  only the routing bit crosses the channel.
+
+- Repair two GC scanner tests that were failing on `main`: they assert a
+  root was rewritten, which is only observable if the collection actually
+  moved the object, and evacuation is a C4b policy decision that
+  legitimately declines under unit-test conditions. Their guards now force
+  evacuation for their mutex-serialized lifetime.
+
+### Added
+
+- `perry_ffi::TransientRootScope` — a safe wrapper over a new extern
+  surface onto the runtime's transient-handle stack, so ext crates can root
+  the table snapshots they hold across JS callbacks.
+
+- Instruments: the whole-heap from-space scan appends a classified payload
+  preview to each offender, so the owner identifies itself instead of being
+  an anonymous address; `PERRY_GC_STACKMAP_TRACE=1` prints every frame the
+  native stack-map walk visits; `PERRY_EH_TRACE=1` prints per-frame
+  personality decisions.
+
+### Testing
+
+- A deterministic moving-GC regression for `js_arraylike_map` (a callback
+  that runs a copying minor on every invocation), sabotage-verified.
+- `action_zero_pad_is_still_a_handler` pins that a zero call-site action is
+  still Perry's catch — the shape of every JS `try` under native roots
+  (#7982) — so reading the action as "handler vs cleanup" can no longer
+  silently disable every statepoint-built catch. Sabotage-verified.

crates/perry-ext-http/src/server/http2_server/pump.rs

@@ -123,7 +123,6 @@ pub(crate) async fn handle_h2_request(
         h2_stream_headers,
         request_listeners,
         handler,
-        check_continue_listeners: Vec::new(),
         is_check_continue: false,
     };
     if request_tx.send(pending).await.is_err() {

crates/perry-ext-http/src/server/https_server.rs

@@ -405,7 +405,6 @@ async fn handle_https_request(
         h2_stream_headers: Vec::new(),
         request_listeners,
         handler,
-        check_continue_listeners,
         is_check_continue,
     };
     if request_tx.send(pending).await.is_err() {
@@ -459,15 +458,38 @@ pub(crate) fn process_pending_https(pending: HttpPendingRequest) {
     // #4903 — Node invokes `'request'` listeners (and the `createServer`
     // handler, which is one) with `this` bound to the server.
     let server_this = handle_to_pointer_f64(pending.server_handle);
+    // #8082 (same as the HTTP path): the channel-parked snapshot's closure
+    // addresses are copies no scanner rewrites — re-read them from the
+    // scanner-maintained server handle at dispatch, then root the refreshed
+    // values across the callbacks (each can run a moving collection). The
+    // routing decision keeps the arrival-time `is_check_continue` snapshot.
+    let (fresh_request_listeners, fresh_check_continue_listeners, fresh_handler) =
+        match get_handle::<HttpsServer>(pending.server_handle) {
+            Some(s) => (
+                s.base.listeners.get("request").cloned().unwrap_or_default(),
+                s.base
+                    .listeners
+                    .get("checkContinue")
+                    .cloned()
+                    .unwrap_or_default(),
+                s.base.handler,
+            ),
+            None => (Vec::new(), Vec::new(), 0),
+        };
+    let scope = perry_ffi::TransientRootScope::enter();
+    let check_continue_rooted = scope.root_addrs(&fresh_check_continue_listeners);
+    let request_rooted = scope.root_addrs(&fresh_request_listeners);
+    let handler_rooted = scope.root_addr(fresh_handler);
     // #5080 — an `Expect: 100-continue` request with a `'checkContinue'`
     // listener fires that listener instead of the `'request'` path.
     if pending.is_check_continue {
-        for cb in &pending.check_continue_listeners {
-            if *cb == 0 {
+        for cb in &check_continue_rooted {
+            let addr = cb.get();
+            if addr == 0 {
                 continue;
             }
             unsafe {
-                let raw = *cb as *const RawClosureHeader;
+                let raw = addr as *const RawClosureHeader;
                 let closure = JsClosure::from_raw(raw);
                 if !closure.is_null() {
                     with_implicit_this(server_this, || {
@@ -480,12 +502,13 @@ pub(crate) fn process_pending_https(pending: HttpPendingRequest) {
         crate::server::server::finalize_or_park_request(&pending);
         return;
     }
-    for cb in &pending.request_listeners {
-        if *cb == 0 {
+    for cb in &request_rooted {
+        let addr = cb.get();
+        if addr == 0 {
             continue;
         }
         unsafe {
-            let raw = *cb as *const RawClosureHeader;
+            let raw = addr as *const RawClosureHeader;
             let closure = JsClosure::from_raw(raw);
             if !closure.is_null() {
                 with_implicit_this(server_this, || {
@@ -495,9 +518,9 @@ pub(crate) fn process_pending_https(pending: HttpPendingRequest) {
             js_promise_run_microtasks();
         }
     }
-    if pending.handler != 0 {
+    if handler_rooted.get() != 0 {
         unsafe {
-            let raw = pending.handler as *const RawClosureHeader;
+            let raw = handler_rooted.get() as *const RawClosureHeader;
             let closure = JsClosure::from_raw(raw);
             if !closure.is_null() {
                 with_implicit_this(server_this, || {

crates/perry-ext-http/src/server/mod.rs

@@ -194,6 +194,16 @@ mod tests {
             let lock = GC_TEST_LOCK
                 .lock()
                 .unwrap_or_else(|poisoned| poisoned.into_inner());
+            // Force evacuation for the guard's lifetime: these tests assert a
+            // root was REWRITTEN, which is only observable if the object
+            // actually moved, and whether a minor evacuates is a C4b policy
+            // decision that legitimately declines under unit-test conditions
+            // (at which point the assertions fail with nothing wrong in the
+            // code under test). See the twin guard in `crate::tests`.
+            //
+            // SAFETY: `GC_TEST_LOCK` is held for the guard's whole lifetime,
+            // so no other GC test in this binary observes the mutation window.
+            unsafe { std::env::set_var("PERRY_GC_FORCE_EVACUATE", "1") };
             perry_runtime::gc::js_gc_write_barriers_emitted(1);
             let frame = perry_runtime::gc::js_shadow_frame_push(slot_count);
             Self { frame, _lock: lock }
@@ -204,6 +214,8 @@ mod tests {
         fn drop(&mut self) {
             perry_runtime::gc::js_shadow_frame_pop(self.frame);
             perry_runtime::gc::js_gc_write_barriers_emitted(0);
+            // SAFETY: still under `GC_TEST_LOCK` (dropped after this body).
+            unsafe { std::env::remove_var("PERRY_GC_FORCE_EVACUATE") };
         }
     }
 

crates/perry-ext-http/src/server/request.rs

@@ -761,29 +761,37 @@ pub(crate) fn emit_data_to_listeners(listeners: &[i64], body: &[u8], encoding: O
     if listeners.is_empty() || body.is_empty() {
         return;
     }
-    let chunk_f64 = match encoding {
+    // #8082: the listener snapshot AND the chunk cross every callback, and a
+    // callback can trigger a moving collection — park both in transient
+    // roots and re-read per use.
+    let scope = perry_ffi::TransientRootScope::enter();
+    let rooted = scope.root_addrs(listeners);
+    let chunk = match encoding {
         Some(_) => {
             let s = String::from_utf8_lossy(body).into_owned();
             let header = alloc_string(&s);
-            f64::from_bits(STRING_TAG | (header.as_raw() as u64 & PTR_MASK))
+            scope.root_nanbox(f64::from_bits(
+                STRING_TAG | (header.as_raw() as u64 & PTR_MASK),
+            ))
         }
         None => {
             let buf = alloc_buffer(body);
             if buf.is_null() {
                 return;
             }
-            f64::from_bits(POINTER_TAG | (buf as u64 & PTR_MASK))
+            scope.root_nanbox(f64::from_bits(POINTER_TAG | (buf as u64 & PTR_MASK)))
         }
     };
-    for cb in listeners {
-        if *cb == 0 {
+    for cb in &rooted {
+        let addr = cb.get();
+        if addr == 0 {
             continue;
         }
         unsafe {
-            let raw = *cb as *const RawClosureHeader;
+            let raw = addr as *const RawClosureHeader;
             let closure = JsClosure::from_raw(raw);
             if !closure.is_null() {
-                let _ = closure.call1(chunk_f64);
+                let _ = closure.call1(chunk.get());
             }
         }
     }
@@ -795,12 +803,16 @@ pub(crate) fn emit_end_to_listeners(listeners: &[i64]) {
 }
 
 pub(crate) fn emit_no_arg_to_listeners(listeners: &[i64]) {
-    for cb in listeners {
-        if *cb == 0 {
+    // #8082: the snapshot crosses every callback — root it, re-read per use.
+    let scope = perry_ffi::TransientRootScope::enter();
+    let rooted = scope.root_addrs(listeners);
+    for cb in &rooted {
+        let addr = cb.get();
+        if addr == 0 {
             continue;
         }
         unsafe {
-            let raw = *cb as *const RawClosureHeader;
+            let raw = addr as *const RawClosureHeader;
             let closure = JsClosure::from_raw(raw);
             if !closure.is_null() {
                 let _ = closure.call0();

crates/perry-ext-http/src/server/server.rs

@@ -196,12 +196,13 @@ pub struct HttpPendingRequest {
     /// dispatch loop doesn't need to re-borrow the server handle.
     pub request_listeners: Vec<i64>,
     pub handler: i64,
-    /// #5080 — `'checkContinue'` listeners snapshotted at request time.
-    /// When `is_check_continue` is set these fire *instead of* the
-    /// `'request'` listeners + handler (Node dispatches an
+    /// #5080 — routing only: when set, the `'checkContinue'` listeners fire
+    /// *instead of* the `'request'` listeners + handler (Node dispatches an
     /// `Expect: 100-continue` request to `'checkContinue'` when a listener
-    /// exists, and only emits `'request'` otherwise).
-    pub check_continue_listeners: Vec<i64>,
+    /// exists, and only emits `'request'` otherwise). The listener ADDRESSES
+    /// are deliberately not carried here: a snapshot parked in the channel
+    /// goes stale across a moving collection, so the dispatcher re-reads them
+    /// from the server handle (#8082).
     /// #5080 — route this request to `'checkContinue'` rather than the
     /// normal `'request'` path.
     pub is_check_continue: bool,
@@ -983,9 +984,12 @@ pub unsafe extern "C" fn js_node_http_server_close(server_handle: i64, callback:
     // Node 19+: `server.close()` destroys idle keep-alive connections
     // (active requests are allowed to finish) (#4905).
     signal_connections_close(server_handle, true);
+    // #8082: `callback` crosses the close-listener emits, which run JS.
+    let scope = perry_ffi::TransientRootScope::enter();
+    let callback_rooted = scope.root_addr(callback);
     emit_no_arg_to_listeners(&close_listeners);
-    if callback != 0 {
-        let raw = callback as *const RawClosureHeader;
+    if callback_rooted.get() != 0 {
+        let raw = callback_rooted.get() as *const RawClosureHeader;
         let closure = JsClosure::from_raw(raw);
         if !closure.is_null() {
             let _ = closure.call0();
@@ -1271,7 +1275,6 @@ async fn handle_request(
         h2_stream_headers: Vec::new(),
         request_listeners,
         handler,
-        check_continue_listeners,
         is_check_continue,
     };
 
@@ -1527,11 +1530,15 @@ where
     };
     let this_val = handle_to_pointer_f64(server_handle);
     let mut fired = 0i32;
-    for cb in cbs {
-        if cb == 0 {
+    // #8082: the drained snapshot crosses each callback — root it.
+    let scope = perry_ffi::TransientRootScope::enter();
+    let rooted = scope.root_addrs(&cbs);
+    for cb in &rooted {
+        let addr = cb.get();
+        if addr == 0 {
             continue;
         }
-        let raw = cb as *const RawClosureHeader;
+        let raw = addr as *const RawClosureHeader;
         let closure = unsafe { JsClosure::from_raw(raw) };
         if !closure.is_null() {
             with_implicit_this(this_val, || {
@@ -1782,13 +1789,42 @@ fn process_pending(pending: HttpPendingRequest) {
     // listener fires that listener *instead of* `'request'` + the handler
     // (Node's dispatch). The listener calls `res.writeContinue()` and then
     // drives the exchange itself.
+    // #8082: `pending` is a snapshot built at REQUEST time on the hyper task
+    // and parked in an mpsc channel until this tick — the handler and
+    // listener addresses inside it are copies no scanner rewrites, so any
+    // moving collection between arrival and dispatch leaves them stale (the
+    // forced gate faulted on them at the microtask-pump safepoint minors).
+    // Re-read them from the server handle, whose side tables the registered
+    // scanner DOES rewrite; the routing decision (`is_check_continue`) keeps
+    // the arrival-time snapshot semantics. Then root the refreshed values,
+    // because each callback below can itself run a moving collection.
+    // (`req_f64`/`res_f64`/`server_this` are small handle ids — no move.)
+    let (fresh_request_listeners, fresh_check_continue_listeners, fresh_handler) =
+        match get_handle::<HttpServer>(pending.server_handle) {
+            Some(s) => (
+                s.listeners.get("request").cloned().unwrap_or_default(),
+                s.listeners
+                    .get("checkContinue")
+                    .cloned()
+                    .unwrap_or_default(),
+                s.handler,
+            ),
+            // Server gone: nothing safe to dispatch to.
+            None => (Vec::new(), Vec::new(), 0),
+        };
+    let scope = perry_ffi::TransientRootScope::enter();
+    let check_continue_rooted = scope.root_addrs(&fresh_check_continue_listeners);
+    let request_rooted = scope.root_addrs(&fresh_request_listeners);
+    let handler_rooted = scope.root_addr(fresh_handler);
+
     if pending.is_check_continue {
-        for cb in &pending.check_continue_listeners {
-            if *cb == 0 {
+        for cb in &check_continue_rooted {
+            let addr = cb.get();
+            if addr == 0 {
                 continue;
             }
             unsafe {
-                let raw = *cb as *const RawClosureHeader;
+                let raw = addr as *const RawClosureHeader;
                 let closure = JsClosure::from_raw(raw);
                 if !closure.is_null() {
                     with_implicit_this(server_this, || {
@@ -1802,12 +1838,13 @@ fn process_pending(pending: HttpPendingRequest) {
         return;
     }
 
-    for cb in &pending.request_listeners {
-        if *cb == 0 {
+    for cb in &request_rooted {
+        let addr = cb.get();
+        if addr == 0 {
             continue;
         }
         unsafe {
-            let raw = *cb as *const RawClosureHeader;
+            let raw = addr as *const RawClosureHeader;
             let closure = JsClosure::from_raw(raw);
             if !closure.is_null() {
                 with_implicit_this(server_this, || {
@@ -1827,9 +1864,9 @@ fn process_pending(pending: HttpPendingRequest) {
     // tick of the codegen-emitted main loop. The
     // `synthesize_default_response_if_needed` safety net below
     // catches the case where neither path completed in time.
-    if pending.handler != 0 {
+    if handler_rooted.get() != 0 {
         unsafe {
-            let raw = pending.handler as *const RawClosureHeader;
+            let raw = handler_rooted.get() as *const RawClosureHeader;
             let closure = JsClosure::from_raw(raw);
             if !closure.is_null() {
                 // `createServer(handler)` registers `handler` as a