fix(gc): close computed access rooting windows

changelog.d/8013-computed-access-rooting.md

@@ -0,0 +1,26 @@
+**Fixed: remaining computed reads and writes could reuse GC-stale receivers, keys, and backing pointers (#7640).**
+
+Several typed-array, numeric-array, and generic computed-access paths evaluated
+a receiver, then evaluated a key or value that could run user code and trigger
+a moving collection, and finally consumed the receiver from its original LLVM
+register. The same audit found typed-array stores deriving raw backing pointers
+before an allocating RHS, and the array-growth path issuing its write barrier
+against the pre-growth handle even when the helper returned a replacement.
+
+The remaining read/write operands now use selective rooting and are re-read
+after collecting expressions. Masked-window and `Ptr<NumArray>` native paths
+use the custom-lowering form of the same scope; raw backing pointers are loaded
+only after the RHS; and reallocating array stores shade through the returned
+live head. Literal keys, loop counters, and other proven non-collecting windows
+still emit no temporary-root traffic.
+
+Class-field stores now distinguish their two receiver shapes explicitly. Bare
+locals and `this` retain the existing zero-cost `root_reload` repair, while a
+compound receiver such as `this.target.x` is conditionally rooted across an
+allocating RHS because its phi result cannot be re-derived from a local root.
+
+IR regressions assert the typed-array read/write groups, the erased-receiver
+store, and the realloc-path barrier operand. Both end-to-end fixtures remain
+byte-identical with Node 26.5.1. The 143-source shadow and native/statepoint GC
+corpora report zero dominance, unrooted-allocation, or statepoint hazards and
+catch all 40 seeded violations in each lowering.

crates/perry-codegen/src/expr/buffer_access.rs

@@ -460,6 +460,9 @@ pub(crate) fn lower_buffer_store(
     let Some(proof) = lower_buffer_access_proof(ctx, buffer_expr, index_expr, spec)? else {
         return Ok(None);
     };
+    // #7640 section E audit: `proof` contains stable slot metadata and the
+    // lowered native index, not a receiver JSValue or raw backing-store
+    // pointer. Lower the RHS before `emit_buffer_access_pointer` loads either.
     let val_i32 = lower_value_i32(ctx, value_expr)?;
     let emission = emit_buffer_access_pointer(ctx, &proof, spec);
     let byte_val = ctx.block().trunc(I32, &val_i32, I8);
@@ -696,58 +699,67 @@ pub(crate) fn lower_typed_array_store(
     let Some(proof) = lower_buffer_access_proof(ctx, array_expr, index_expr, spec)? else {
         return Ok(None);
     };
+    let expected = match proof.view.elem {
+        BufferElem::I8 | BufferElem::U8 | BufferElem::I16 | BufferElem::U16 | BufferElem::I32 => {
+            ExpectedNativeRep::I32
+        }
+        BufferElem::U32 => ExpectedNativeRep::U32,
+        BufferElem::F32 | BufferElem::F64 => ExpectedNativeRep::F64,
+        BufferElem::U8Clamped => return Ok(None),
+    };
+    // #7640 section E: do not derive `data_ptr` / `elem_ptr` until after the
+    // RHS has been evaluated. A numeric RHS can still be a call, and a raw
+    // backing-store pointer cannot be repaired by the JSValue rooting API.
+    // The view proof guarantees this binding/data slot is stable, so loading it
+    // here preserves the already-selected receiver without holding a raw pointer
+    // across the call.
+    let result = lower_expr_native(ctx, value_expr, expected)?;
     let emission = emit_buffer_access_pointer(ctx, &proof, spec);
-    let (stored, result) = match proof.view.elem {
+    let stored = match proof.view.elem {
         BufferElem::I8 | BufferElem::U8 => {
-            let value = lower_expr_native(ctx, value_expr, ExpectedNativeRep::I32)?;
-            let byte = ctx.block().trunc(I32, &value.value, I8);
+            let byte = ctx.block().trunc(I32, &result.value, I8);
             ctx.block().emit_raw(format!(
                 "store i8 {}, ptr {}{}",
                 byte, emission.elem_ptr, emission.alias_metadata
             ));
-            (LoweredValue::u8(byte), value)
+            LoweredValue::u8(byte)
         }
         BufferElem::I16 | BufferElem::U16 => {
-            let value = lower_expr_native(ctx, value_expr, ExpectedNativeRep::I32)?;
-            let half = ctx.block().trunc(I32, &value.value, I16);
+            let half = ctx.block().trunc(I32, &result.value, I16);
             ctx.block().emit_raw(format!(
                 "store i16 {}, ptr {}{}",
                 half, emission.elem_ptr, emission.alias_metadata
             ));
-            (LoweredValue::i32(value.value.clone()), value)
+            LoweredValue::i32(result.value.clone())
         }
         BufferElem::I32 => {
-            let value = lower_expr_native(ctx, value_expr, ExpectedNativeRep::I32)?;
             ctx.block().emit_raw(format!(
                 "store i32 {}, ptr {}{}",
-                value.value, emission.elem_ptr, emission.alias_metadata
+                result.value, emission.elem_ptr, emission.alias_metadata
             ));
-            (LoweredValue::i32(value.value.clone()), value)
+            LoweredValue::i32(result.value.clone())
         }
         BufferElem::U32 => {
-            let value = lower_expr_native(ctx, value_expr, ExpectedNativeRep::U32)?;
             ctx.block().emit_raw(format!(
                 "store i32 {}, ptr {}{}",
-                value.value, emission.elem_ptr, emission.alias_metadata
+                result.value, emission.elem_ptr, emission.alias_metadata
             ));
-            (LoweredValue::u32(value.value.clone()), value)
+            LoweredValue::u32(result.value.clone())
         }
         BufferElem::F32 => {
-            let value = lower_expr_native(ctx, value_expr, ExpectedNativeRep::F64)?;
-            let narrow = ctx.block().fptrunc(DOUBLE, &value.value, F32);
+            let narrow = ctx.block().fptrunc(DOUBLE, &result.value, F32);
             ctx.block().emit_raw(format!(
                 "store float {}, ptr {}{}",
                 narrow, emission.elem_ptr, emission.alias_metadata
             ));
-            (LoweredValue::f32(narrow), value)
+            LoweredValue::f32(narrow)
         }
         BufferElem::F64 => {
-            let value = lower_expr_native(ctx, value_expr, ExpectedNativeRep::F64)?;
             ctx.block().emit_raw(format!(
                 "store double {}, ptr {}{}",
-                value.value, emission.elem_ptr, emission.alias_metadata
+                result.value, emission.elem_ptr, emission.alias_metadata
             ));
-            (LoweredValue::f64(value.value.clone()), value)
+            LoweredValue::f64(result.value.clone())
         }
         BufferElem::U8Clamped => return Ok(None),
     };

crates/perry-codegen/src/expr/computed_store_rooting_tests.rs

@@ -1,5 +1,6 @@
-//! Rooting coverage for the three computed-store arms slice 4 repaired
-//! (#7637, #7638, #7639), built from HIR rather than from TypeScript.
+//! Rooting coverage for the computed-store arms repaired in slice 4 (#7637,
+//! #7638, #7639) and the remaining #7640 read/write windows, built from HIR
+//! rather than from TypeScript.
 //!
 //! # Why these are unit tests and not gap tests
 //!
@@ -23,9 +24,10 @@
 //!
 //! # What each test asserts, and why it cannot pass vacuously
 //!
-//! Each builds the SAME store twice, changing one thing: the right-hand side is
-//! either an allocating `Expr::Object` or an inert `Expr::Number`. Then it
-//! compares the shadow-frame width the function reserves.
+//! Each differential test builds the SAME access twice, changing one thing:
+//! a later operand is either allocating or inert. Then it compares the
+//! shadow-frame width the function reserves. The realloc-barrier regression at
+//! the end instead names the exact SSA head consumed by its barrier.
 //!
 //! - `Expr::Number` ⇒ `expr_may_trigger_gc` is false ⇒ `operand_protection`
 //!   returns `Reuse` ⇒ the combinator emits nothing at all, which is the
@@ -39,16 +41,20 @@
 //! width measured over a store that never got emitted would be hazard 4.
 
 use perry_hir::types::Type;
-use perry_hir::{Expr, Function, Module as HirModule, Stmt};
+use perry_hir::{Expr, Function, Module as HirModule, Param, Stmt};
 
 /// Compile a one-function module and return its LLVM IR.
 fn compile_body(name: &str, body: Vec<Stmt>) -> String {
+    compile_body_with_params(name, Vec::new(), body)
+}
+
+fn compile_body_with_params(name: &str, params: Vec<Param>, body: Vec<Stmt>) -> String {
     let mut hir = HirModule::new(name);
     hir.functions.push(Function {
         id: 0,
         name: "build".to_string(),
         type_params: Vec::new(),
-        params: Vec::new(),
+        params,
         return_type: Type::Any,
         body,
         is_async: false,
@@ -68,6 +74,18 @@ fn compile_body(name: &str, body: Vec<Stmt>) -> String {
     String::from_utf8(bytes).expect("LLVM IR is UTF-8")
 }
 
+fn param(id: u32, name: &str, ty: Type) -> Param {
+    Param {
+        id,
+        name: name.to_string(),
+        ty,
+        default: None,
+        decorators: Vec::new(),
+        is_rest: false,
+        arguments_object: None,
+    }
+}
+
 /// How many root slots the module's code reserves.
 ///
 /// Counted under BOTH root lowerings on purpose, because which one runs is an
@@ -220,3 +238,142 @@ fn polymorphic_index_store_roots_both_operands_across_an_allocating_rhs() {
         },
     );
 }
+
+/// #7640 B tail — declared typed-array dispatch still accepts an arbitrary
+/// property key. Evaluating that key may collect before the runtime helper
+/// consumes the receiver.
+#[test]
+fn typed_array_runtime_key_read_roots_receiver_only_when_key_collects() {
+    let compile = |label: &str, key: Expr| {
+        compile_body_with_params(
+            label,
+            vec![param(1, "ta", Type::Named("Int32Array".to_string()))],
+            vec![Stmt::Return(Some(Expr::IndexGet {
+                object: Box::new(Expr::LocalGet(1)),
+                index: Box::new(key),
+            }))],
+        )
+    };
+    let collecting = compile("ta_runtime_key_collecting", allocating_value());
+    let inert = compile("ta_runtime_key_inert", Expr::Undefined);
+    let callee = "@js_typed_array_index_get_dynamic(";
+    assert!(
+        collecting.contains(callee) && inert.contains(callee),
+        "both fixtures must reach the typed-array runtime-key arm:\n{collecting}\n{inert}"
+    );
+    assert!(
+        root_slots(&collecting) > root_slots(&inert),
+        "an allocating runtime key must protect the typed-array receiver"
+    );
+}
+
+/// #7640 A tail — the runtime-key store consumes receiver, key, and value only
+/// after all three JavaScript operands have been evaluated.
+#[test]
+fn typed_array_runtime_key_store_roots_operands_only_when_rhs_collects() {
+    let compile = |label: &str, value: Expr| {
+        compile_body_with_params(
+            label,
+            vec![
+                param(1, "ta", Type::Named("Int32Array".to_string())),
+                param(2, "key", Type::Any),
+            ],
+            vec![Stmt::Expr(Expr::IndexSet {
+                object: Box::new(Expr::LocalGet(1)),
+                index: Box::new(Expr::LocalGet(2)),
+                value: Box::new(value),
+            })],
+        )
+    };
+    let collecting = compile("ta_runtime_store_collecting", allocating_value());
+    let inert = compile("ta_runtime_store_inert", inert_value());
+    let callee = "@js_typed_array_index_set_dynamic(";
+    assert!(
+        collecting.contains(callee) && inert.contains(callee),
+        "both fixtures must reach the typed-array runtime-key store arm:\n{collecting}\n{inert}"
+    );
+    assert!(
+        root_slots(&collecting) > root_slots(&inert),
+        "an allocating RHS must protect the typed-array receiver and key"
+    );
+}
+
+/// #7640 A tail — the #5525 inline dynamic typed-array route accepts erased
+/// receiver/key types, then lowers a custom-representation RHS before either
+/// is consumed by the guard diamond.
+#[test]
+fn erased_receiver_inline_store_roots_receiver_and_key_across_rhs() {
+    let compile = |label: &str, value: Expr| {
+        compile_body_with_params(
+            label,
+            vec![param(1, "receiver", Type::Any), param(2, "key", Type::Any)],
+            vec![Stmt::Expr(Expr::IndexSet {
+                object: Box::new(Expr::LocalGet(1)),
+                index: Box::new(Expr::LocalGet(2)),
+                value: Box::new(value),
+            })],
+        )
+    };
+    let collecting = compile("erased_store_collecting", allocating_value());
+    let inert = compile("erased_store_inert", inert_value());
+    let callee = "@js_dyn_index_set(";
+    assert!(
+        collecting.contains(callee) && inert.contains(callee),
+        "both fixtures must reach the #5525 inline dynamic-store arm:\n{collecting}\n{inert}"
+    );
+    let extra_slots = root_slots(&collecting).saturating_sub(root_slots(&inert));
+    assert!(
+        extra_slots >= 2,
+        "an allocating RHS must protect both erased operands; expected at least two extra slots, got {extra_slots}"
+    );
+}
+
+/// #7640 E — the array-grow helper may return a replacement allocation. The
+/// write barrier on that path must therefore shade through the returned head,
+/// not the raw receiver handle computed before the call.
+#[test]
+fn growing_array_store_uses_the_reallocated_head_for_its_barrier() {
+    let ir = compile_body(
+        "array_grow_barrier_head",
+        vec![
+            Stmt::Let {
+                id: 1,
+                name: "arr".to_string(),
+                ty: Type::Array(Box::new(Type::Any)),
+                mutable: false,
+                init: Some(Expr::Array(vec![Expr::Undefined])),
+            },
+            Stmt::Expr(Expr::IndexSet {
+                object: Box::new(Expr::LocalGet(1)),
+                index: Box::new(Expr::Integer(8)),
+                value: Box::new(allocating_value()),
+            }),
+        ],
+    );
+    let realloc_call = ir
+        .lines()
+        .find(|line| line.contains(" = call i64 @js_array_set_f64_extend"))
+        .unwrap_or_else(|| panic!("fixture never emitted the realloc path:\n{ir}"));
+    let new_head = realloc_call
+        .split_once(" = ")
+        .map(|(result, _)| result.trim())
+        .expect("realloc call has an SSA result");
+    let realloc_label = ir
+        .lines()
+        .position(|line| line.starts_with("idxset.realloc."))
+        .unwrap_or_else(|| panic!("fixture never emitted an idxset.realloc block:\n{ir}"));
+    let realloc_body = ir
+        .lines()
+        .skip(realloc_label + 1)
+        .take_while(|line| line.starts_with(char::is_whitespace) || line.is_empty())
+        .collect::<Vec<_>>()
+        .join("\n");
+    let barrier = realloc_body
+        .lines()
+        .find(|line| line.contains("@js_write_barrier_slot("))
+        .unwrap_or_else(|| panic!("realloc path lost its write barrier:\n{realloc_body}"));
+    assert!(
+        barrier.contains(&format!("i64 {new_head}")),
+        "the realloc-path barrier must use {new_head}, returned by the grow helper; got `{barrier}`"
+    );
+}

crates/perry-codegen/src/expr/index.rs

@@ -666,7 +666,10 @@ pub(crate) fn lower_index_set_fast(
         let new_box = nanbox_pointer_inline(blk, &new_handle);
         blk.store(DOUBLE, &new_box, &slot);
         let val_bits = blk.bitcast_double_to_i64(val_double);
-        emit_write_barrier_slot_on_block(blk, &arr_handle, "0", &val_bits);
+        // #7640 section E: the grow helper can return a replacement allocation.
+        // The pre-call raw handle then names the forwarding source, not the array
+        // that received the value. Use the returned live head for the barrier.
+        emit_write_barrier_slot_on_block(blk, &new_handle, "0", &val_bits);
         blk.br(&merge_label);
     }