ReviewOS

zig-utils/zig-js

Function: own inferred diagnostic-name bytes across moving GC

#817
Closed chris opened this 10 days ago ·
10 days ago

Parent: #465. Related: #815 and #816.

Interpreter.nameAnonValue copies the public name property into a String Value but assigns the original borrowed byte slice directly to Function.name. That internal name is used by stack traces/debug frames and is neither traced nor relocated (traceFunction / relocateFunction treat metadata bytes as arena-owned). A computed string key can therefore leave a live function's diagnostic name pointing into a released or evacuated String cell.

Confirmed on main 61310f6 plus pending #815 metadata lowering:

  • A focused direct ownership witness passes mutable "inferred" bytes into nameAnonValue, overwrites the source with U, and observes a correct public name but internal Function.name == "UUUUUUUU".
  • A real moving-nursery witness names an anonymous function from the computed key 'method'+37, releases that key, then invokes the function after a native checkpoint. The public name survives but the error stack loses method37. Forced tree-walker fails, independently of #815's new VM flags.

Fix the shared naming ownership boundary, not the stack renderer. Retain immutable diagnostic bytes in the function owner's stable arena before publishing metadata. Preserve existing-name controls, allocation failure cleanup, and shared no-GIL metadata immutability.

Acceptance:

  • Own Function.name bytes at NamedEvaluation / nameAnonValue.
  • Direct borrowed-storage and actual moving stack-trace regressions pass, with forced VM/tree paths and allocation replay.
  • Complete #815's native/no-GIL/TSan, conformance, sharded-unit and fuzz gates with explicit revision scope.

Exact failed Debug log: /Users/chris/.cache/zig-js-vm-naming.7Wj8Ri/name-before-debug.log (0/2 passed, no leaks). No native stack/queue/job redesign or GC pinning workaround.

10 days ago

The shared naming-boundary fix now passes both witnesses. The complete focused Debug metadata suite is 13/13 passing, zero failures/leaks, on main 61310f6 plus #815/#817. That includes the direct borrowed-buffer test, a verified moving-nursery stack-name test in each forced tier, the earlier Symbol/string key and HomeObject cases, native operation execution, shared no-GIL lanes and compiler/runtime allocation replay.

Function.name now receives its own immutable arena copy before metadata publication. The public name remains a separate String Value, so deleting or replacing that public property cannot release the internal diagnostic name's bytes. Existing meaningful names are still left unchanged. No stack renderer, native activation, GC pinning or suppression change.

Final ReleaseSafe+TSan and corpus/fuzzer builds are running in parallel. Full sharded units and pushed CI remain pending; no completion claim yet. Exact patch and hashes: name-fixed.patch and name-fixed-source.sha256 under /Users/chris/.cache/zig-js-vm-naming.7Wj8Ri.

10 days ago

Implemented in fix(vm): preserve literal function metadata and ownership (#815). Both direct borrowed-name and real moving-stack-name regressions pass in the 13/13 Debug and 13/13 unsuppressed ReleaseSafe+TSan metadata suites. Exact candidate coverage, the eight VM-only conformance gains, 700 seeded fuzz cases, and revision scope are recorded in #815. The native full sharded suite and combined-main CI remain pending, so this issue stays open.

10 days ago

The saved #815/#817 candidate completed its native full Debug suite: 2,131 passed, one platform skip, no failures/leaks, 2,132 linked tests in 744.0 seconds across four shards. Exact provenance remains 61310f6 plus name-fixed.patch, prior to the independent error-message commits rebased into 6bb4. The combined successor CI currently has no failures but is not complete; the formerly red JSON focused gate is fixed by #818 and now passes. Evidence under /Users/chris/.cache/zig-js-vm-naming.7Wj8Ri; inactive Debug/TSan images are now compressed with hashes retained.

10 days ago

Closing with terminal combined-main integration evidence: CI 33211154123 at e24c4fa completed successfully: 53 successful checks, one skipped nightly-only check, zero failed/cancelled checks. The implementation fix(vm): preserve literal function metadata and ownership (#815) is in that revision. This completes the pending integration condition alongside the scoped local/conformance evidence recorded above. Separately discovered Error-intrinsic, Array-realm, prototype-type and restriction-path defects remain open in #823, #824, #825 and #826; this closure does not claim those are fixed.

Sign in to comment on this issue.