Repository navigation
gc: TRANSITION_CACHE_GLOBAL rekeys prev_keys and key_ptr with no dead-key prune #8192
Description
TRANSITION_CACHE_GLOBAL (crates/perry-runtime/src/object/mod.rs) has two rekeyed metadata keys per entry — entry.prev_keys (a dead ArrayHeader address) and entry.key_ptr (an interned StringHeader address) — both rewritten by scan_transition_cache_roots_mut (object/mod.rs:1005-1006, visit_metadata_usize_slot) and neither marked. Only entry.next_keys is a strong root (visit_usize_slot, object/mod.rs:1007).
No prune exists: the cache is not in gc::dead_owner's DEAD_KEY_PRUNES fan-out and not in gc_type_clear_dead_payload_side_tables.
Partial mitigation only: a rewrite sets invalidate and zeroes the entry (object/mod.rs:1008-1016), so a bogus follow clears the slot rather than binding it — but rewrite_raw_addr has already read the recycled header by then, which is the #8040 shape. #8174 narrowed what can be followed out of such a header; it did not remove the dead key.
Fix: prune entries whose prev_keys / key_ptr owner is dead, wired into DEAD_KEY_PRUNES (crates/perry-runtime/src/gc/dead_owner.rs).
Declared as open_gap in scripts/gc_rekeyed_key_tables.json; closing this must delete that entry, or the gate fails on the stale exemption.
Activity
fix(gc): give the six unpruned rekeyed tables a death story (#8190-#8195
proggeramlug commentedon Aug 16, 2026
Fixed in #8196.
The #8174 registry gate enumerated every
visit_metadata_*rekey site and required a written verdict for each; this table had none, and rather than declare it an exemption the prune is wired in. Its entry inscripts/gc_rekeyed_key_tables.jsonnow names a registeredDEAD_KEY_PRUNESmember, andMAX_OPEN_GAPSis 0 — the manifest ships with no declared gaps at all.Covered by a pair of cases in
gc/tests/dead_owner_side_tables.rs: the prune fires (dead owner, one collection, the table observably shrinks) and its inverse (a rooted owner's entry survives).Independent evidence that these were real stale keys and not a theoretical hazard: with only #8174's forwarding-target discriminators in place and none of these prunes, the production Next App Route forced-evacuation workload logged 988
[gc-forwarding] refused_sourcesevents — stale forwarding headers reaching a rewrite walk. With the six prunes in, the same workload logs 0 across 458 copying minors and 182,977 copied objects.fix(gc): give the six unpruned rekeyed tables a death story (#8190-#8195
fix(gc): refuse a forwarding walk out of, or into, a non-object, and …