fix(runtime): release closure-visible async boxes

changelog.d/8213-next-async-box-closure-lifetime.md

@@ -0,0 +1,12 @@
+## Fix completed async frames retaining closure-visible box cells
+
+Plain async functions now hand their complete boxed activation frame to the
+release/reuse path. Closure capture counts follow GC moves, and authoritative
+death pruning drops them. Full collections trace drained box payloads from
+their live closures instead of rooting every pending box, so self-referential
+box/closure cycles can die. After queued/running steps drain, uncaptured cells
+publish immediately while each captured cell remains readable until its own
+final closure dies, so one escaped closure cannot retain the rest of the frame.
+
+This removes the closure-visible residue left by #8208 without weakening raw
+box-pointer rejection or returning box-cell memory to the allocator.

crates/perry-codegen/src/expr/closure.rs

@@ -186,27 +186,10 @@ pub(crate) fn lower(ctx: &mut FnCtx<'_>, expr: &Expr) -> Result<String> {
             // inner arrow `(eid, arch, compId) => ... changeset ...`
             // is created per-call but always with the same `this` (the
             // World) and same captures (`this._changeset`).
-            // Boxed captures still allow the cache path: the closure
-            // stores the BOX POINTER (a stable per-allocation address),
-            // and the box's contents are read dynamically inside the
-            // body via `js_box_get`. Two closure-literal sites that
-            // capture the same boxed local store identical box-pointer
-            // bits, so the cache (keyed on bit-equality of capture
-            // slots) still hits. The cache backing is a small LRU per
-            // func_ptr, which tolerates the parallel-instance pattern
-            // (50 concurrent unitOfWork calls each capturing a
-            // different `__async_step` box) by holding multiple
-            // captures rather than overwriting one slot per call.
-            //
-            // We previously bailed out when any captured local was
-            // boxed (`mutable_captures` non-empty). That made the
-            // async-to-generator transform's per-`await` `cb_v` /
-            // `cb_e` closures (which capture the boxed `__async_step`
-            // self-reference) miss the cache 100% of the time —
-            // 2 fresh closure allocs per await ≈ 300 ns of `gc_malloc`
-            // work even though the box pointers are stable across
-            // call sites. The relaxed gate plus the multi-slot LRU
-            // backing reclaims that overhead.
+            // Boxed captures may use the bulk cache helper, but codegen still
+            // follows it with `js_closure_set_box_capture_ptr` for only those
+            // slots. The idempotent write declares exact lifetime edges
+            // without guessing from arbitrary pointer-shaped values.
             //
             // IDENTITY CAVEAT (#4831 follow-up — Stripe `protoExtend`):
             // the singleton-sharing paths (`js_closure_alloc_singleton` /
@@ -231,25 +214,17 @@ pub(crate) fn lower(ctx: &mut FnCtx<'_>, expr: &Expr) -> Result<String> {
             // symptom.
             //
             // To preserve the hot-path optimizations while restoring identity,
-            // a closure is singleton-eligible only when sharing one instance is
-            // observationally safe:
-            //   - arrow functions: no own `.prototype`, not constructable, the
-            //     `.map`/ECS callbacks the cache targets; OR
-            //   - non-arrow closures all of whose captures are BOXED (mutable)
-            //     locals: the compiler-synthesized async-step `cb_v`/`cb_e`
-            //     per-await callbacks capture the boxed `__async_step` self-ref
-            //     and are never used as constructors — keeping them cached
-            //     avoids 2 `gc_malloc`s per `await`.
-            // A non-arrow closure capturing an UNBOXED value (Stripe's `Super`,
-            // or no captures at all) is treated as a potential constructor and
-            // always gets a fresh instance.
+            // arrow functions are singleton-eligible because they have no own
+            // `.prototype` and are not constructable. Compiler-synthesized
+            // non-arrow async callbacks whose captures are all boxes are also
+            // safe: they are never constructors and their cache key includes
+            // the box addresses. Other non-arrow closures are treated as
+            // potential constructors and always get a fresh instance.
             let mut write_ids = std::collections::HashSet::new();
             crate::boxed_vars::collect_write_ids_in_stmts(body, &mut write_ids);
             let writes_unboxed_capture = auto_captures
                 .iter()
                 .any(|cap_id| !ctx.boxed_vars.contains(cap_id) && write_ids.contains(cap_id));
-            // All captures boxed (and at least one), with no reserved `this` /
-            // `new.target` slot: the compiler-synthesized async-callback shape.
             let captures_all_boxed = !*captures_this
                 && !*captures_new_target
                 && !auto_captures.is_empty()
@@ -346,15 +321,25 @@ pub(crate) fn lower(ctx: &mut FnCtx<'_>, expr: &Expr) -> Result<String> {
                     .call_void("js_register_closure_async_function", &[(PTR, &func_ref)]);
             }
 
-            // The captured-singleton helper writes captures internally
-            // (so the cached layout matches a fresh allocation). The
-            // other paths still need explicit per-slot writes.
-            if !captured_singleton {
-                let blk = ctx.block();
-                for (idx, val_bits) in captured_value_bits.iter().enumerate() {
+            // The captured-singleton helper writes captures internally. Boxed
+            // slots still take the dedicated, idempotent setter afterward so
+            // their lifetime edges are declared; fresh closures need every
+            // slot initialized here.
+            let boxed_capture_slots = auto_captures
+                .iter()
+                .map(|cap_id| ctx.boxed_vars.contains(cap_id))
+                .collect::<Vec<_>>();
+            let blk = ctx.block();
+            for (idx, val_bits) in captured_value_bits.iter().enumerate() {
+                if !captured_singleton || boxed_capture_slots[idx] {
                     let idx_str = idx.to_string();
+                    let setter = if boxed_capture_slots[idx] {
+                        "js_closure_set_box_capture_ptr"
+                    } else {
+                        "js_closure_set_capture_bits"
+                    };
                     blk.call_void(
-                        "js_closure_set_capture_bits",
+                        setter,
                         &[(I64, &closure_handle), (I32, &idx_str), (I64, val_bits)],
                     );
                 }

crates/perry-codegen/src/expr/literals_vars.rs

@@ -724,15 +724,14 @@ pub(crate) fn lower(ctx: &mut FnCtx<'_>, expr: &Expr) -> Result<String> {
                 //
                 // #8208 added a release/reuse path for completed async
                 // activations, so "never freed" is no longer literally true and
-                // the argument is now stated on the two properties that ARE:
+                // the argument is now stated on the properties that ARE:
                 // (1) cell memory is never returned to the allocator, so the
                 // address never stops naming 8 bytes of box cell; (2) the
-                // release transform excludes closure-visible locals while a
-                // capture can remain reachable; and (3) a released cell stays
-                // PARKED until its owning activation has no queued or running
-                // async step. A capture from an enclosing activation therefore
-                // cannot become reusable inside the nested user frame
-                // `coerce_old`/`step_new` may enter.
+                // runtime counts each raw box capture; and (3) a
+                // terminal cell stays live until both queued/running steps and
+                // capturing closures are gone. A capture from an enclosing
+                // activation therefore cannot become reusable inside the
+                // nested user frame `coerce_old`/`step_new` may enter.
                 if ctx.boxed_vars.contains(id) {
                     let blk = ctx.block();
                     let box_ptr = blk.call(

crates/perry-codegen/src/gc_call_effects.rs

@@ -131,6 +131,7 @@ pub(crate) fn classify_direct_callee(name: &str) -> GcCallEffect {
         // module factory these were 1,495 of 5,537 statepoints.
         | "js_closure_get_capture_bits"
         | "js_closure_set_capture_bits"
+        | "js_closure_set_box_capture_ptr"
         | "js_closure_get_capture_ptr"
         | "js_closure_set_capture_ptr"
         // Variable-box accessors and allocators (#8132), `box.rs`. Boxes are
@@ -435,6 +436,7 @@ mod tests {
         for name in [
             "js_closure_get_capture_bits",
             "js_closure_set_capture_bits",
+            "js_closure_set_box_capture_ptr",
             "js_closure_get_capture_ptr",
             "js_closure_set_capture_ptr",
             "js_box_alloc_bits",

crates/perry-codegen/src/root_reload.rs

@@ -218,6 +218,7 @@ const NON_COLLECTING: &[&str] = &[
     "js_typed_feedback_closure_direct_call_guard",
     // verified non-allocating bookkeeping stores/reads
     "js_closure_set_capture_bits",
+    "js_closure_set_box_capture_ptr",
     "js_closure_get_capture_bits",
     "js_closure_set_capture_ptr",
     "js_closure_get_capture_ptr",
@@ -274,14 +275,19 @@ const TRANSPARENT_CAST: &[&str] = &["bitcast", "ptrtoint", "inttoptr", "trunc",
 /// Re-CALLING it below a collection point is sound under the same argument #7664's string-handle
 /// reload uses: the closure struct is a first-class root (rooted at `current_closure_slot`,
 /// relocated/rewritten on evacuation), so re-reading its capture array returns the
-/// post-relocation value — UNLESS a `js_closure_set_capture_bits` to the same index ran in the
-/// window, which is the store side-condition below.
+/// post-relocation value — UNLESS a generic or declared-box capture setter to
+/// the same index ran in the window, which is the store side-condition below.
 const CAPTURE_GET_CALLEE: &str = "js_closure_get_capture_bits";
 /// The write half. Not itself collecting (`NON_COLLECTING` above), but its side effect on the
 /// closure's capture slot must invalidate a [`CAPTURE_GET_CALLEE`] reload the same way a `store`
 /// invalidates a shadow-slot one — `stores_to` carries a synthetic per-index key for exactly
 /// that (#7725).
-const CAPTURE_SET_CALLEE: &str = "js_closure_set_capture_bits";
+fn is_capture_set_callee(callee: &str) -> bool {
+    matches!(
+        callee,
+        "js_closure_set_capture_bits" | "js_closure_set_box_capture_ptr"
+    )
+}
 
 /// A synthetic "location" key for capture-slot index `idx` — never a real pointer token (no `%`
 /// / `@` sigil), so it cannot collide with an actual shadow-slot register or handle-global name.
@@ -935,7 +941,7 @@ fn facts_of(inst: &LlInst, slots: &HashSet<String>) -> Facts {
                     transparent = true;
                     capture_get_key = Some(capture_slot_key(idx));
                 }
-            } else if callee == CAPTURE_SET_CALLEE {
+            } else if is_capture_set_callee(callee) {
                 if let Some(idx) = literal_capture_idx(args) {
                     stores_to = Some(capture_slot_key(idx));
                 }
@@ -1109,7 +1115,7 @@ fn raw_facts(text: &str, slots: &HashSet<String>) -> Facts {
                         transparent = true;
                         capture_get_key = Some(capture_slot_key(&idx));
                     }
-                } else if name == CAPTURE_SET_CALLEE {
+                } else if is_capture_set_callee(&name) {
                     if let Some(idx) = raw_call_literal_arg(rhs, &name, 1) {
                         stores_to = Some(capture_slot_key(&idx));
                     }

crates/perry-codegen/src/runtime_decls/strings.rs

@@ -197,6 +197,7 @@ pub fn declare_phase_b_strings(module: &mut LlModule) {
         &[PTR, I32, PTR],
     );
     module.declare_function("js_closure_set_capture_bits", VOID, &[I64, I32, I64]);
+    module.declare_function("js_closure_set_box_capture_ptr", VOID, &[I64, I32, I64]);
     module.declare_function("js_closure_get_capture_bits", I64, &[I64, I32]);
     module.declare_function("js_closure_set_capture_f64", VOID, &[I64, I32, DOUBLE]);
     module.declare_function("js_closure_get_capture_f64", DOUBLE, &[I64, I32]);

crates/perry-codegen/src/stmt/mod.rs

@@ -595,10 +595,9 @@ pub(crate) fn lower_stmt(ctx: &mut FnCtx<'_>, stmt: &Stmt) -> Result<()> {
         Stmt::PreallocateTdzBoxes(ids) => emit_preallocate_boxes(ctx, ids, true),
 
         // #7933 follow-up (async-state RSS accumulation): a plain-async
-        // activation's terminal states release the box cells the escape
-        // analysis proved unobservable — clear + de-register + park for
-        // reuse, so completed activations stop accumulating malloc-side
-        // memory (cell + registry entry) for the life of the process.
+        // activation's terminal states hand its complete frame to runtime
+        // lifetime tracking. Uncaptured cells publish after queued/running
+        // steps drain; captured cells wait for their last GC closure.
         Stmt::ReleaseBoxes(ids) => emit_release_boxes(ctx, ids),
 
         // #853: every current `perry_hir::Stmt` variant is matched above.

crates/perry-codegen/tests/native_proof_regressions.rs

@@ -7081,9 +7081,8 @@ fn boxed_local_slot_uses_i64_js_value_bits_until_helper_edges() {
     );
     assert!(
         ir.contains("call i64 @js_closure_get_capture_bits")
-            && (ir.contains("call void @js_closure_set_capture_bits")
-                || ir.contains("call i64 @js_closure_alloc_with_captures_singleton")),
-        "generated boxed capture traffic should use exact i64 closure capture slots:\n{ir}"
+            && ir.contains("call void @js_closure_set_box_capture_ptr"),
+        "generated boxed capture traffic should declare exact i64 box capture slots:\n{ir}"
     );
     for old_helper in [
         "call void @js_closure_set_capture_f64",

crates/perry-hir/src/ir/stmt.rs

@@ -73,11 +73,11 @@ pub enum Stmt {
     /// ReferenceError; the `Stmt::Let` (or `let x;` with no init) overwrites
     /// the sentinel with the real value / `undefined`, ending the dead zone.
     PreallocateTdzBoxes(Vec<LocalId>),
-    /// Release the heap box cells behind a set of boxed LocalIds: clear each
-    /// cell to `undefined`, de-register it, and park it for reuse by a later
-    /// `js_box_alloc*` (#7933 / async-state RSS accumulation). Emitted by the
-    /// async-to-generator transform at a plain-async activation's terminal
-    /// states, ONLY for ids proven unobservable (`generator/box_release.rs`).
+    /// Hand the heap box cells behind a set of boxed LocalIds to the async
+    /// activation lifetime tracker (#7933 / #8213). A cell no closure captures
+    /// is cleared, de-registered, and parked when the activation's queued and
+    /// running steps drain. A closure-captured cell remains live until the GC
+    /// proves the final capturing closure dead.
     ///
     /// Semantics are a *reclamation hint*: dropping this statement is always
     /// correct (the cells just stay live, as before #7933). Carrying it