Merge train: #9543 #9541 (+census baseline refresh) - #9546
Merged
Conversation
added 6 commits
September 2, 2026 16:30
…t brackets (#9445) Every `let prev = js_implicit_this_set(receiver); …user code…; js_implicit_this_set(prev)` in the runtime held the caller's receiver in a bare Rust local across a call that allocates. An evacuating young-gen minor inside the window moves that object; the restore then installed a retired from-space address as the caller's `this`, which reads as `undefined` on the next member access (the #9417 shape). Root the saved value in a RuntimeHandleScope and re-read it at the restore — the idiom PR #9444 used for the accessor sites — at all 121 remaining sites, plus the receivers that three of those sites consume again after the call. Claude-Session: https://claude.ai/code/session_01L11XMMWrR9Wz11dHpq4gXS
…el toJSON/replacer calls (#9445) Found by the #9445 fixture: with the saved implicit-`this` rooted, an allocating replacer still SIGSEGV'd in js_closure_call2. js_json_stringify_full and js_json_stringify_with_replacer run the root toJSON and the root replacer call — both user code — and then handed the walk the raw closure pointer and the "" key. Root both and re-read at each use.
…se existing handle scopes (#9445) Callback loops (Map/Set/URLSearchParams forEach, EventTarget dispatch, the emitters, fs.watch fan-out, the timer batch, TypedArray.from's map callback) root the caller's receiver once before the loop and restore from that handle each iteration, instead of opening a scope per callback. Single-call sites that already own a RuntimeHandleScope push onto it. Three bare-name callers of js_implicit_this_get are fully qualified.
…ss a moving minor, plus changelog
…s replacer closure reads via with_const_ptr
This was referenced Sep 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lands the validated train: #9543 (class member source text + ICU-localized default date patterns, #9468/#9451) and #9541 (root every saved implicit-
thisacross the user code it brackets — the 122-site #9445 sweep).Train resolutions: in
os_process_streams.rsthe four #9445 sites are merged with thewith_const_ptrconversions that landed with train70 — rooting + re-read from #9541, closure call through the combinator; #9541's four rooted-replacer reads injson/replacer.rsrouted throughwith_const_ptr(the raw accessor form would re-trip the debt ratchet); shape-census baseline refreshed for theproperty_set.rssplit that landed with #9544 (two callsite paths moved toproperty_set/sloppy_class_field.rs— this also cures the census red on current main).Validation: release build green; RUST_TEST_THREADS=1 perry-runtime green; perry-codegen + perry-hir green; perry-stdlib green single-threaded; all 12 lint gates green; 4/4 train fixtures byte-identical to node.
Rebase-merge to preserve per-commit authorship.