fix(runtime): bind a 'static method name on the timer and TextDecoder/TextEncoder handle paths (#8133) - #8177

Closes #8133.

js_class_method_bind(instance, name_ptr, name_len) stores the method-name
pointer in the bound closure (capture 1) and dispatch_bound_method
re-reads it at call time. Its doc requires the pointer to stay valid for the
closure's lifetime, which codegen satisfies with per-module rodata. Runtime
callers on the timer and TextDecoder/TextEncoder paths did not: each derived
key_ptr = (key as *const u8).add(size_of::<StringHeader>()) — the interior of
a movable GC heap string that is unreachable the moment the read returns —
and handed that pointer straight to the bind.

#7747 fixed exactly this on the Buffer path, and its commit message states the
consequence: "whether the stale bytes still spell the method is an allocator
property, not a program property", which is why it passed locally and took a
SIGSEGV on conformance-smoke shards 7 and 8.

Sites fixed

The issue names four. There are six — two more of the identical timer block
that the issue did not list, both found while confirming its four:

Shape of the fix

The same one #7747 used, tightened one notch.

• is_timer_handle_method_key (a bool predicate) is replaced by
  timer_handle_method_name_static(key) -> Option<&'static [u8]>. Returning the
  literal rather than answering bool is the point: with no predicate left, a
  caller has nothing to pair with its own pointer, so the obvious code no longer
  reintroduces the bug. Same shape as set_method_value_name two functions above
  it, and as Fix a crash when reading a method off a Buffer without calling it #7747's buffer_method_name_static.
• text.rs grows text_decoder_method_name_static /
  text_encoder_method_name_static, and text_handle_property no longer takes
  key_ptr/key_len at all — it cannot bind the caller's pointer because it
  no longer has it. Its four callers are updated.

Reproduction — it does reproduce, and here is how

This is a GC lifetime bug, so a test that merely calls the path passes. I built a
fixture that actually moves the string.

The key insight is that a literal dec.decode lowers the property name to
rodata and never reaches these arms. A computed key does not:

const dec = new TextDecoder();
const kDecode = "dec" + "ode";        // runtime heap string, not constant-folded
const boundDecode = (dec as any)[kDecode];
for (let i = 0; i < 400000; i++) { /* churn */ }
console.log(boundDecode.call(dec, new Uint8Array([104, 105])));

On a pre-fix binary (the fix reverted to echo the caller's pointer):

• Plain run, no instruments: prints decode=undefined, then
  TypeError: Cannot read properties of undefined. Node prints decode=hi.
  A silent wrong answer, deterministic on this host.

• PERRY_GC_ZEAL=1 PERRY_GC_ZEAL_ALLOC_KB=0 PERRY_GC_PROTECT_FROMSPACE=1 PERRY_GC_PROTECT_FROMSPACE_DEPTH=800: SIGBUS, reported precisely:

  [gc-fromspace-protect] FAULT: signal 10 at 0x3a23c610254
    This address is RETIRED FROM-SPACE. The evacuating minor moved or
    freed the object here and the holder kept the pre-collection address.
    block=0x3a23c610000 +596 retired_bytes=1048568 retired_by_minor=#0
    last-known object: user_ptr=0x3a23c610240 obj_type=3 size=40
  

On the fixed binary the same fixture exits 0 and matches node byte-for-byte
(sink=true / decode=hi / encode=2 / done), with the protector armed —
retired_set=#0 blocks=18 bytes_protected=18874368 — so the green run means the
detector was live, not that nothing was tried.

The fixture is a reproduction, not a committed test: it needs a full compile plus
two GC env knobs, so it belongs in the writeup rather than in cargo-test.

Tests

Six in crates/perry-runtime/src/gc/tests/handle_bound_method_name.rs, mirroring
buffer_bound_method_name.rs. They assert pointer identity with the 'static
literal, per #7747's note that the issue repeats: an inequality against the key
could pass with the bug present, and comparing the BYTES only fails on a host
where the freed memory has already been reused — the lucky-allocator problem
these tests exist to avoid. Identity cannot be lucky.

Each test also asserts its gate is live (is_known_timer_id /
is_known_text_decoder_id) before measuring, so a green run cannot mean the arm
never ran.

Sabotage — each mutation applied, tests re-run, then reverted:

One measurement of mine was vacuous and I fixed it. The tests first failed
with the fix applied, because assert_names_the_literal compared against a
b"ref" literal written in the test file — two occurrences of the same byte
string in different modules are two &'static [u8]s the linker is free to leave
at different addresses, and it did. The expected pointer now comes from the
lookup under test, which is what buffer_bound_method_name.rs does and why it
was right. The helper carries a comment saying so.

Deliberately out of scope

The sweep for other js_class_method_bind callers turned up the same mistake in
two places this PR does not touch, because they are different surfaces with
their own name lists and deserve their own issue:

• field_get_set/get_field_by_name.rs:1555 — the primitive-receiver arm
  (is_primitive_proto_method: toString/valueOf/hasOwnProperty/…), reached
  by e.g. const f = (5).toString. Same heap-string-interior bind.
• perry-stdlib's handle-property dispatch layer.
  js_handle_property_dispatch is handed the same key_ptr by the runtime and
  forwards it; eight sub-dispatchers then capture property_name.as_ptr() /
  property.as_bytes() directly instead of remapping to a literal —
  sqlite/dispatch.rs (×4), tls/dispatch.rs (×2),
  common/dispatch/emitter_als.rs (×2). So const f = db.run,
  const f = tlsServer.listen, const f = emitter.on and const f = als.getStore
  have the same hazard. Sibling dispatchers in the very same files
  (crypto/ecdh.rs, fetch/dispatch.rs, streams/subclass.rs) already return
  &'static [u8] and show the pattern to copy.

Also noted, unconfirmed: js_class_method_bind_by_id's legacy
SHORT_STRING_TAG fallback forwards a pointer into a stack-local scratch
array, dead on return. Current codegen uses the STATIC_DISPATCH_TAG path, so I
could not show the legacy branch is live.

Verification

• cargo test -p perry-runtime --lib — 2424 passed, 0 failed, 4 ignored
  (2418 on main + 6 new).
• Repro fixture byte-compared against node v26.5.1 (.node-version).
• Runtime-only change — no codegen touched.
• All lint-job gates generated from .github/workflows/test.yml (32 commands)
  plus scripts/check_gc_env_knobs.py: all pass.

Summary by CodeRabbit

• Bug Fixes
  • Fixed timer-handle methods so callbacks remain reliable during garbage collection and object movement.
  • Fixed TextDecoder and TextEncoder method access to prevent intermittent failures when methods are bound or cached.
  • Improved consistency for timer methods, including direct lookups and inline-cache scenarios.
  • Preserved existing method names and behavior while improving runtime stability.