Parent: #473
Executed evidence
On exact main 200b87f, the pinned ReleaseFast representative_json workload completed at 2,200 jobs with checksum 324,952,086 using real zig-gc 0285ef8. The scored invocation added 1,595,005 backing allocations and 630,859,230 requested backing bytes; context backing remained 474,745,441 bytes higher at the invocation checkpoint and process peak RSS reached 454,983,680 bytes. The anti-specialization variant reproduces the same mechanism and checksum.
The executed path is JSON.stringify SerializeJSONObject -> Interpreter.objectOwnKeysList. For ordinary objects, the returned key vectors and their intermediate insertion/index/string/symbol vectors use the long-lived Interpreter arena. They are invocation-temporary snapshots but are not reclaimed at the end of serialization.
These are attribution counters, not a wall-time or JavaScriptCore performance claim; an unrelated crashed process prevents publishing timing evidence from this machine state.
Required change
- Give ordinary-object stringify key snapshots an invocation-bounded, freeable lifetime.
- Preserve exact OrdinaryOwnPropertyKeys order, integer indices, deletion/re-add order, accessors, non-enumerables, Symbols/private filtering, Proxies, host objects, module namespaces, typed arrays, boxed strings and abrupt completion ordering.
- Do not substitute a library JSON implementation or omit observable exotic paths.
Definition of done
- Exact-parent production attribution proves lower retained backing and peak RSS on base and anti-specialization rows, with frozen checksums unchanged.
- Focused OOM rollback and nested/alias/cycle coverage pass.
- test/built-ins/JSON remains 165/165; tree/required-VM agreement remains exact.
- Real-GC, no-GIL and unsuppressed TSan probes cover the shared path.
- Seven-sample direct-JSC evidence is published only from a clean benchmark state; controls must show no hidden regression.