fix(gc): root the iterator drain's live values across .next() (#7475)

.github/workflows/auto-opt-app-patterns.yml

@@ -0,0 +1,171 @@
+name: Auto-Optimize App Patterns
+
+# Runs the `benchmarks/app-patterns` kernels through the AUTO-OPTIMIZE link —
+# the default path, and the one no other gate in this repo covers.
+#
+# WHY THIS EXISTS (#7475)
+#
+# `perry file.ts -o out` rebuilds perry-runtime + perry-stdlib with a per-app
+# Cargo feature set into `target/perry-auto-<hash>/` and links those archives
+# OVER whatever `PERRY_RUNTIME_DIR` points at. Almost every other gate sets
+# `PERRY_NO_AUTO_OPTIMIZE=1` for a deterministic link — gc-ratchet says so
+# inline, and so do a dozen `crates/perry/tests` cases — so the binary users
+# actually get was, until this job, tested by nothing.
+#
+# #7475 is what that cost. `object_deep_clone` threw `TypeError: next is not a
+# function` under auto-optimize and printed the correct checksum under
+# `PERRY_NO_AUTO_OPTIMIZE=1`. The bug was in neither the kernel nor the feature
+# set: the iterator drain held live values in bare Rust locals across an
+# allocating `.next()`. BOTH links had the defect —
+# `PERRY_GC_PROTECT_FROMSPACE=1` faults on both — but only the feature-stripped
+# one allocated in the order that made the stale read observable. That is the
+# general shape: a latent stale-root read is invisible until something perturbs
+# allocation timing, and the auto-optimize link perturbs it per app.
+#
+# CHECKED AGAINST CLAUDE.md's FOUR WAYS A GATE CAN BE UNABLE TO FAIL
+#
+#   1. no `continue-on-error`, no `|| true`, no pipe swallowing the script's
+#      exit status;
+#   2. NOT in branch protection's required contexts yet, deliberately — a new
+#      gate has never been green, so promoting it on day one blocks every open
+#      PR. Promote after the first green run on `main`; leaving that undone is
+#      itself hazard 2 (see `gc-root-dominance`);
+#   3. `concurrency` cancels pull-request runs only; push runs are keyed on the
+#      commit so queued `main` runs cannot cancel each other (#7205);
+#   4. the subject is ASSERTED live. `scripts/auto_opt_app_patterns.sh` reads
+#      the linker command line out of `perry -v` and requires it to name a
+#      `perry-auto-*/…/libperry_runtime.a` that exists on disk. A run in which
+#      the auto-optimizer quietly fell back to the prebuilt archives — which it
+#      does, by design, whenever the cargo rebuild fails — would otherwise pass
+#      every output comparison while testing the exact configuration this job
+#      does not care about.
+#
+# The one skip (`promise_all_chains`) is named with a reason inside the script,
+# and a skip entry that matches no kernel FAILS, so it cannot outlive its fix.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: auto-opt-app-patterns-${{ github.event_name }}-${{ github.event_name == 'push' && github.sha || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  auto-opt-app-patterns:
+    runs-on: ubuntu-latest
+    # The auto-optimize rebuild is a second full release build of
+    # perry-runtime + perry-stdlib on top of the workspace build, so this is a
+    # long job even with a warm cargo cache.
+    timeout-minutes: 90
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Decide whether this change can affect a compiled app
+        id: relevance
+        env:
+          GH_TOKEN: ${{ github.token }}
+          EVENT_NAME: ${{ github.event_name }}
+          REPOSITORY: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          if [[ "$EVENT_NAME" != "pull_request" ]]; then
+            echo "run=true" >> "$GITHUB_OUTPUT"
+            echo "Not a pull request; running the kernels."
+            exit 0
+          fi
+          gh api "repos/$REPOSITORY/pulls/$PR_NUMBER/files" --paginate --jq '.[].filename' > changed.txt
+          # Deliberately broad: anything under crates/ changes the compiled
+          # binary, and the auto-optimize feature selection reads the manifests.
+          # The filter only spares docs-only PRs a compiler build; `set -e`
+          # already aborted if the listing failed, so this cannot silently fall
+          # through to "not relevant".
+          # `.github/actions/setup-llvm22/` is in the list because it configures
+          # the LLVM the gate's compiler is built against — a change there can
+          # move the generated code without touching a single line under crates/.
+          if grep -qE '^(crates/|benchmarks/app-patterns/|scripts/auto_opt_app_patterns\.sh$|Cargo\.(toml|lock)$|\.node-version$|\.github/actions/setup-llvm22/|\.github/workflows/auto-opt-app-patterns\.yml$)' changed.txt; then
+            echo "run=true" >> "$GITHUB_OUTPUT"
+            echo "Change can affect a compiled app; running the kernels."
+          else
+            echo "run=false" >> "$GITHUB_OUTPUT"
+            echo "No app-affecting paths changed."
+          fi
+
+      - name: Install Rust toolchain
+        if: steps.relevance.outputs.run == 'true'
+        uses: dtolnay/rust-toolchain@stable
+      - uses: ./.github/actions/setup-llvm22
+
+      - uses: Swatinem/rust-cache@v2
+        if: steps.relevance.outputs.run == 'true'
+        with:
+          shared-key: "${{ runner.os }}-perry"
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+
+      - name: Install clang
+        if: steps.relevance.outputs.run == 'true'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y clang
+
+      - name: Setup Node oracle
+        if: steps.relevance.outputs.run == 'true'
+        uses: actions/setup-node@v7
+        with:
+          # Single source of truth: .node-version. Every kernel's stdout is
+          # diffed against this node, so the pin is a correctness input.
+          node-version-file: .node-version
+
+      - name: Build perry and the prebuilt runtime archives
+        if: steps.relevance.outputs.run == 'true'
+        env:
+          CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUSTFLAGS: "-C linker-features=-lld"
+        run: |
+          set -euo pipefail
+          # The auto-optimize path builds its OWN archives, but the driver still
+          # needs the prebuilt ones on disk for its fallback probe — and they are
+          # what the failure mode under test silently substitutes, so a run
+          # without them could not distinguish the two. perry-runtime and
+          # perry-stdlib are rlib-only; the `.a`s come from the -static wrappers.
+          cargo build --release \
+            -p perry -p perry-runtime -p perry-stdlib \
+            -p perry-runtime-static -p perry-stdlib-static
+          for artifact in perry libperry_runtime.a libperry_stdlib.a; do
+            test -s "target/release/$artifact" \
+              || { echo "::error::target/release/$artifact was not produced"; exit 1; }
+          done
+
+      # GATING, and the reason hazard 4 is actually closed rather than asserted.
+      # The liveness check is a text matcher over the linker command line; a
+      # matcher that stops matching reports "no archive" (loud), but one that
+      # matches too much reports a PASS for a fallback run (silent). `--self-test`
+      # feeds it a canned log of exactly that shape — the `auto-optimize: built …`
+      # message followed by a link line naming the PREBUILT archive — and fails
+      # if it is accepted. It caught a real over-match while this gate was being
+      # written.
+      - name: Prove the liveness matcher can still fail
+        if: steps.relevance.outputs.run == 'true'
+        run: ./scripts/auto_opt_app_patterns.sh --self-test
+
+      # GATING. No pipe, no `|| true`: this step's exit status IS the gate. The
+      # liveness assertion (the link line must name a perry-auto archive) lives
+      # inside the script so a local run gets it too.
+      - name: Run the app-pattern kernels through the auto-optimize link
+        if: steps.relevance.outputs.run == 'true'
+        env:
+          PERRY_RUNTIME_DIR: ${{ github.workspace }}/target/release
+        run: ./scripts/auto_opt_app_patterns.sh

CLAUDE.md

@@ -8,7 +8,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 Perry is a native TypeScript compiler written in Rust that compiles TypeScript source code directly to native executables. It uses SWC for TypeScript parsing and LLVM for code generation.
 
-**Current Version:** 0.5.1286
+**Current Version:** 0.5.1287
 
 
 ## TypeScript Parity Status