Residual from #7472 (now closed — its headline stringify_object_inner crash was fixed by #7473). At a non-default nursery cap, a different site still faults:
cd <repo>
cargo build --release -p perry -p perry-runtime-static -p perry-stdlib-static
PERRY_RUNTIME_DIR=$PWD/target/release PERRY_NO_AUTO_OPTIMIZE=1 \
./target/release/perry benchmarks/json_polyglot/bench_field_access.ts --debug-symbols -o /tmp/fa
PERRY_GC_SCAVENGE_NURSERY_MB=64 /tmp/fa
EXC_BAD_ACCESS (code=1, address=0x33038393663)
frame #0: perry_runtime::object::field_get_set::enumeration::instance_private_key_hidden + 60
Observed on main @ 351742d (2026-08-06), deterministic at cap=64, absent at the default 16 MB and at 1/4/32 MB post-#7473. The fault address is a garbage pointer (not a NaN-box immediate this time), in the enumeration path's private-key check — likely the same family as #7472's mechanism (a value surviving a large, infrequent copying minor without its slot being rewritten), but at a different consumer.
Not release-blocking (non-default knob), but it is a live copying-minor correctness signal at exactly the cadence #7472 showed the ratchet probes never exercise — a large-Eden probe arm would catch both. Recording it so it does not vanish inside the closed ticket.
Residual from #7472 (now closed — its headline
stringify_object_innercrash was fixed by #7473). At a non-default nursery cap, a different site still faults:Observed on
main@ 351742d (2026-08-06), deterministic at cap=64, absent at the default 16 MB and at 1/4/32 MB post-#7473. The fault address is a garbage pointer (not a NaN-box immediate this time), in the enumeration path's private-key check — likely the same family as #7472's mechanism (a value surviving a large, infrequent copying minor without its slot being rewritten), but at a different consumer.Not release-blocking (non-default knob), but it is a live copying-minor correctness signal at exactly the cadence #7472 showed the ratchet probes never exercise — a large-Eden probe arm would catch both. Recording it so it does not vanish inside the closed ticket.