gc: pin latch aborts relocating a PINNED young Map on a preflight-skipped cycle (zod dep-corpus, exit 134) — and gc_pin_sites.py says OK #7990

Activity

1. proggeramlug

   added

   bugConfirmed defect or regressionConfirmed defect or regression

   on Aug 12, 2026
2. proggeramlug

   added 2 commits that reference this issue on Aug 12, 2026

   docs(gc-handoff): final sweep counts and the #7990 cross-reference

   1fe5f12

   docs(gc-handoff): triage #7803 on a corpus that links again (#7989)

   ...

   55fd197
3. proggeramlug commented on Aug 13, 2026

   

   proggeramlug

   on Aug 13, 2026

   ContributorAuthor

   More actions

   The FATAL text is rewritten in PR #7999. The underlying fault is still open — this makes
   the abort point at the right investigation, and the header itself says which one.

   The message's own remediation is refuted, and #7999 stops it asserting a cause

   gc_pin_sites.py reports OK, and both of its allowlisted exceptions are test-only
   (gc/malloc.rs's push_test_object, and the latch sabotage test in
   gc/tests/copying/latch.rs), so neither can be reached from a user program. The only
   production writers of GC_FLAG_PINNED are pin_object and pin_object_non_young. The
   stated cause is therefore refuted for any real run, exactly as this issue says.

   Two things in the reported header decode differently than assumed

   obj_type=8 size=731 flags=0x37   (MARKED|ARENA|PINNED|INTERNED|TENURED)
   

   TENURED on a "young" object is not an anomaly. gc/types.rs on GC_FLAG_TENURED:
   "Non-moving generational: tenured objects stay physically in nursery (no copying /
   forwarding-pointer machinery), but the trace pretends they're old-gen." TENURED +
   nursery-resident is the ordinary state, so that half of the issue's "worth a second look"
   resolves to "expected".

   INTERNED on a GC_TYPE_MAP is a contradiction, and that is the useful signal.
   GC_FLAG_INTERNED is written in exactly one file — string/intern.rs, two sites — and
   only on strings. Every other occurrence in the tree reads it, or preserves it across a
   move (copying.rs:748, oldgen.rs:1932). Nothing sets it on a Map.

   So the reported header is not a coherent live Map. It reads like memory that once held
   an interned string. That points at the #7154 unrooted-slot class — the same class the rest
   of the sweep produces on other seeds — reaching the collector rather than surfacing later in
   JS, and not at pin bookkeeping. It also fits the ~1-in-16 rate: an unrooted register only
   goes bad when a collection lands in its window, so it is intermittent, whereas an unrooted
   cache would be reproducible.

   Worth noting alongside it: the latch check in move_young runs before the size /
   plausibility guard a few lines below it, so a garbage header is attributed to the pin latch
   before anything asks whether it is a plausible object at all.

   What changed

   gc/pin.rs grows header_incoherence() and pinned_young_move_report(). The abort now:

   • decodes the flags byte by name, so nobody hand-decodes 0x37 against gc/types.rs;
   • prints a coherence verdict computed from the header at the instant of the abort — the
     only moment that evidence exists;
   • explains TENURED-on-young instead of leaving it looking suspicious;
   • ranks five candidates by that evidence, with the pin-site scan last and a note saying
     why it used to lead;
   • points the incoherent case at PERRY_GC_ZEAL=1 PERRY_GC_PROTECT_FROMSPACE=1 PERRY_GC_PROTECT_FROMSPACE_DEPTH=800, because the default depth of 4 misses a window
     hundreds of collections wide.

   Six unit tests in pin.rs pin it, including one built from this issue's exact header bytes
   and one proving the verdict can come out consistent (a verdict that can only say one thing
   is decoration).

   Not done

   The underlying fault. Also deliberately no CI gate: at ~6% of runs a gate would go red on
   a healthy tree often enough to teach people to ignore it — the same reasoning that declined
   to gate #7803's 19%. The next step is a sweep under the quarantine at raised depth, sized so
   6% → 0% is distinguishable from luck.
4. proggeramlug

   added 3 commits that reference this issue on Aug 13, 2026

   fix(link): refuse a link whose ext wrappers bundle a different tokio (#…

   ...

   df2c428

   docs(changelog): record the PerryTS#7990 regression

   13c1c1c

   test(gc): correct the PerryTS#7990 assertion diagnostic

   55c63b0
5. proggeramlug

   closed this as completedin #8021on Aug 13, 2026
6. proggeramlug

   added a commit that references this issue on Aug 13, 2026

   test(gc): pin the #7990 Map comparison regression (#8021)

   ...

   410dadd