fix(release): clear full-suite regressions

.github/workflows/test.yml

@@ -3424,7 +3424,11 @@ jobs:
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Build compiler + UI backend + harness
-        run: cargo build --release -p perry -p perry-runtime -p perry-stdlib -p perry-runtime-static -p perry-stdlib-static -p ${{ matrix.ui_backend }} -p perry-doc-tests
+        # The database/mail examples route through async wrapper staticlibs.
+        # Build them in this SAME Cargo graph as perry-stdlib: otherwise each
+        # no-auto fallback build bundles a distinct tokio TLS/runtime and the
+        # linker rejects the unsafe pair (#507, #7629).
+        run: cargo build --release -p perry -p perry-runtime -p perry-stdlib -p perry-runtime-static -p perry-stdlib-static -p ${{ matrix.ui_backend }} -p perry-doc-tests -p perry-ext-ioredis -p perry-ext-mongodb -p perry-ext-mysql2 -p perry-ext-pg -p perry-ext-nodemailer
 
       - name: Pre-build Apple UI libs for cross-compile (macOS only)
         if: matrix.os == 'macos-14'

changelog.d/8789-release-sweep-regressions.md

@@ -0,0 +1 @@
+Fix release-sweep regressions in primitive and Error prototype lookup, callable Proxy coercion, cross-function aggregates, typed-array inlining, symbol-root scanning, Ring archive reduction, and doc-test wrapper builds.

crates/perry-runtime/src/gc/tests/runtime_roots/side_table_scanners.rs

@@ -328,6 +328,59 @@ fn test_symbol_side_table_registered_scanner_rewrites_roots_and_metadata() {
     crate::symbol::test_clear_symbol_side_table_roots();
 }
 
+#[test]
+fn test_symbol_side_table_budgeted_scanner_heals_entries_after_owner_rekey() {
+    let _guard = GcTestIsolationGuard::new();
+    let _trigger_guard = GcTriggerThresholdTestGuard::suppress_automatic_triggers();
+    crate::symbol::test_clear_symbol_side_table_roots();
+
+    let owner = crate::object::js_object_alloc(0, 0) as usize;
+    let sym_key = unsafe { alloc_nursery_test_symbol() };
+    let value = young_leaf();
+    let valid_ptrs = build_valid_pointer_set();
+    let owner_old = crate::arena::arena_alloc_gc_old(64, 8, GC_TYPE_OBJECT) as usize;
+    let sym_key_old = unsafe { alloc_old_test_symbol() };
+    let value_old = crate::arena::arena_alloc_gc_old(64, 8, GC_TYPE_STRING) as usize;
+    unsafe {
+        set_forwarding_address(
+            header_from_user_ptr(owner as *const u8) as *mut GcHeader,
+            owner_old as *mut u8,
+        );
+        set_forwarding_address(
+            header_from_user_ptr(sym_key as *const u8) as *mut GcHeader,
+            sym_key_old as *mut u8,
+        );
+        set_forwarding_address(
+            header_from_user_ptr(value as *const u8) as *mut GcHeader,
+            value_old as *mut u8,
+        );
+    }
+    crate::symbol::test_seed_symbol_property_root(owner, sym_key, string_bits(value));
+
+    // One slot per step forces the owner-rekey and entry-rewrite slots into
+    // separate budget slices. The later slice must still find and rewrite the
+    // entry after its owner key moved in the earlier slice.
+    let mut state = crate::symbol::new_symbol_side_table_root_scan_state();
+    let mut visitor = RuntimeRootVisitor::for_rewrite(&valid_ptrs);
+    loop {
+        let mut remaining = 1;
+        if crate::symbol::scan_symbol_side_table_roots_mut_step(
+            &mut visitor,
+            state.as_mut(),
+            &mut remaining,
+        ) {
+            break;
+        }
+    }
+
+    assert!(!crate::symbol::test_symbol_property_owner_exists(owner));
+    assert_eq!(
+        crate::symbol::test_symbol_property_root_bits(owner_old, sym_key_old),
+        Some(string_bits(value_old))
+    );
+    crate::symbol::test_clear_symbol_side_table_roots();
+}
+
 #[test]
 fn test_runtime_root_visitor_rewrites_raw_pointer_slots() {
     // `nursery_user` is live across the `arena_alloc_gc_old` call below.

crates/perry-runtime/src/object/field_get_set/accessors.rs

@@ -163,6 +163,22 @@ unsafe fn default_object_prototype_property_value(
     key: *const crate::StringHeader,
 ) -> Option<JSValue> {
     let _guard = object_prototype_lookup_guard()?;
+    let proto_addr = crate::array::object_prototype_addr();
+    if proto_addr == 0 {
+        return None;
+    }
+    prototype_property_value_with_guard(proto_addr, receiver_addr, key)
+}
+
+/// Read an inherited property while the caller holds
+/// [`ObjectPrototypeLookupGuard`]. Keeping guard acquisition outside this
+/// helper lets Error-family lookup resolve a lazy builtin prototype without a
+/// recursive ordinary-object fallback.
+unsafe fn prototype_property_value_with_guard(
+    proto_addr: usize,
+    receiver_addr: usize,
+    key: *const crate::StringHeader,
+) -> Option<JSValue> {
     // #7498: THIS IS THE FRAME `PERRY_GC_PROTECT_FROMSPACE=1` FAULTS IN on the
     // `[...obj.arr]` path — a 56-byte from-space `GC_TYPE_STRING`, i.e. `key`.
     // Both arguments are GC-managed and both are live across the call below
@@ -173,12 +189,15 @@ unsafe fn default_object_prototype_property_value(
     // (#7795 removed the two resolution calls that used to allocate here as
     // well — the rooting is still required for the prototype read itself.)
     //
-    // Root both before the first of those calls and read each back at its
+    // Root all three before the first of those calls and read each back at its
     // point of use. NaN-boxed handles only, so this module adds no bare
     // `get_raw_*_ptr` to `scripts/raw_handle_debt.py`.
     let scope = crate::gc::RuntimeHandleScope::new();
+    let proto_h = scope.root_nanbox_f64(crate::value::js_nanbox_pointer(proto_addr as i64));
     let key_h = scope.root_nanbox_f64(crate::value::nanbox_string_key(key));
     let receiver_h = scope.root_nanbox_f64(crate::value::js_nanbox_pointer(receiver_addr as i64));
+    let proto_ptr =
+        || crate::value::js_nanbox_get_pointer(proto_h.get_nanbox_f64()) as *mut ObjectHeader;
     let key = || {
         crate::value::js_nanbox_get_pointer(key_h.get_nanbox_f64()) as *const crate::StringHeader
     };
@@ -194,12 +213,7 @@ unsafe fn default_object_prototype_property_value(
     // (`scan_prototype_addr_cache_roots_mut`) — the array index-read fast path
     // already depends on it. `Object.prototype` is non-writable and
     // non-configurable per spec, so the memo cannot go stale.
-    let proto_addr = crate::array::object_prototype_addr();
-    if proto_addr == 0 {
-        return None;
-    }
-    let proto_ptr = proto_addr as *mut ObjectHeader;
-    if proto_ptr as usize == receiver_addr() {
+    if proto_ptr() as usize == receiver_addr() {
         return None;
     }
     let receiver = crate::value::js_nanbox_pointer(receiver_addr() as i64);
@@ -212,7 +226,7 @@ unsafe fn default_object_prototype_property_value(
     let previous_this_h = scope.root_nanbox_f64(previous_this);
     let prev_override = accessor_receiver_override_begin(receiver);
     let prev_override_h = prev_override.map(|v| scope.root_nanbox_f64(v));
-    let property = js_object_get_field_by_name(proto_ptr, key());
+    let property = js_object_get_field_by_name(proto_ptr(), key());
     accessor_receiver_override_end(prev_override_h.map(|h| h.get_nanbox_f64()));
     super::super::js_implicit_this_set(previous_this_h.get_nanbox_f64());
     if property.is_undefined() {
@@ -246,11 +260,78 @@ pub(crate) unsafe fn ordinary_object_prototype_property_value(
     // a miss must remain eligible for Object.prototype (including user-added
     // properties).  Keep excluding unregistered native/synthetic class ids:
     // those object kinds resolve their own intrinsic prototype chains.
-    if class_id != 0
-        && !is_anon_shape_class_id(class_id)
-        && !super::super::class_registry::is_class_id_registered(class_id)
-    {
-        return None;
+    if class_id != 0 && !is_anon_shape_class_id(class_id) {
+        if !super::super::class_registry::is_class_id_registered(class_id) {
+            return None;
+        }
+        if super::super::extends_builtin_error(class_id) {
+            // Error subclasses end at an Error-family prototype before
+            // Object.prototype. Hold the recursion guard while resolving the
+            // lazy builtin: constructor/prototype lookup itself may miss an
+            // ordinary property, and must not re-enter this same fallback.
+            let scope = crate::gc::RuntimeHandleScope::new();
+            let receiver_h =
+                scope.root_nanbox_f64(crate::value::js_nanbox_pointer(obj as usize as i64));
+            let key_h = scope.root_nanbox_f64(crate::value::nanbox_string_key(key));
+            let _guard = object_prototype_lookup_guard()?;
+            let mut current = class_id;
+            let mut prototype_name = "Error";
+            for _ in 0..32 {
+                match current {
+                    crate::error::CLASS_ID_TYPE_ERROR => {
+                        prototype_name = "TypeError";
+                        break;
+                    }
+                    crate::error::CLASS_ID_RANGE_ERROR => {
+                        prototype_name = "RangeError";
+                        break;
+                    }
+                    crate::error::CLASS_ID_REFERENCE_ERROR => {
+                        prototype_name = "ReferenceError";
+                        break;
+                    }
+                    crate::error::CLASS_ID_SYNTAX_ERROR => {
+                        prototype_name = "SyntaxError";
+                        break;
+                    }
+                    crate::error::CLASS_ID_EVAL_ERROR => {
+                        prototype_name = "EvalError";
+                        break;
+                    }
+                    crate::error::CLASS_ID_URI_ERROR => {
+                        prototype_name = "URIError";
+                        break;
+                    }
+                    crate::error::CLASS_ID_AGGREGATE_ERROR => {
+                        prototype_name = "AggregateError";
+                        break;
+                    }
+                    crate::error::CLASS_ID_ERROR => break,
+                    _ => match super::super::get_parent_class_id(current) {
+                        Some(parent) if parent != 0 && parent != current => current = parent,
+                        _ => break,
+                    },
+                }
+            }
+            let prototype = super::super::builtin_prototype_value(prototype_name);
+            let prototype_value = JSValue::from_bits(prototype.to_bits());
+            if prototype_value.is_pointer() {
+                let prototype_addr = prototype_value.as_pointer::<ObjectHeader>() as usize;
+                if prototype_addr != 0 {
+                    let receiver_addr =
+                        crate::value::js_nanbox_get_pointer(receiver_h.get_nanbox_f64()) as usize;
+                    let key = crate::value::js_nanbox_get_pointer(key_h.get_nanbox_f64())
+                        as *const crate::StringHeader;
+                    if let Some(value) =
+                        prototype_property_value_with_guard(prototype_addr, receiver_addr, key)
+                    {
+                        return Some(value);
+                    }
+                }
+            }
+            // The guard drops with this branch; let the ordinary final
+            // fallback consult Object.prototype on a genuine Error miss.
+        }
     }
     default_object_prototype_property_value(obj as usize, key)
 }

crates/perry-runtime/src/object/native_call_method/common_methods.rs

@@ -472,6 +472,16 @@ pub(super) unsafe fn dispatch_common(
             ) {
                 return Some(result);
             }
+            // A direct primitive-wrapper call resolves through
+            // Number/Boolean/BigInt.prototype and returns the primitive's
+            // internal value. The explicit Object.prototype.valueOf.call(x)
+            // form uses object_prototype_value_of_thunk instead, where ToObject
+            // intentionally produces a wrapper.
+            let object = object_handle.get_nanbox_f64();
+            let jsval = JSValue::from_bits(object.to_bits());
+            if !jsval.is_pointer() {
+                return Some(object);
+            }
             return Some(js_object_default_value_of(object));
         }
 

crates/perry-runtime/src/symbol/gc_roots.rs

@@ -227,10 +227,23 @@ fn scan_symbol_side_table_root_slot(
             rewrite_symbol_property_owner_if_forwarded(visitor, owner);
         }
         SymbolSideTableRootSlot::SymbolPropertyEntry { owner, sym_key } => {
+            // The preceding budget slice may already have rekeyed this
+            // owner's map entry. Heal the snapshot's owner before looking up
+            // the entry, otherwise every later slice searches the stale key
+            // and skips both the symbol key and its value.
+            let mut healed_owner = owner;
+            visitor.visit_metadata_usize_slot(&mut healed_owner);
             let mut guard = crate::gc::lock_gc_root_registry(&SYMBOL_PROPERTIES);
-            let Some((entry_sym, value_bits)) = guard
-                .as_mut()
-                .and_then(|map| map.get_mut(&owner))
+            let Some(map) = guard.as_mut() else {
+                return;
+            };
+            let lookup_owner = if map.contains_key(&healed_owner) {
+                healed_owner
+            } else {
+                owner
+            };
+            let Some((entry_sym, value_bits)) = map
+                .get_mut(&lookup_owner)
                 .and_then(|entries| entries.iter_mut().find(|entry| entry.0 == sym_key))
             else {
                 return;

crates/perry-runtime/src/value/to_string.rs

@@ -524,11 +524,6 @@ unsafe fn custom_to_primitive_number(value: f64) -> CustomToPrimitiveOutcome {
     if (method_bits & 0xFFFF_0000_0000_0000) != POINTER_TAG {
         return CustomToPrimitiveOutcome::TypeError;
     }
-    let method_ptr = (method_bits & POINTER_MASK) as usize;
-    if !crate::closure::is_closure_ptr(method_ptr) {
-        return CustomToPrimitiveOutcome::TypeError;
-    }
-
     let method_handle = scope.root_nanbox_f64(method);
     let hint_ptr = crate::string::js_string_from_bytes(b"number".as_ptr(), 6);
     let hint_handle = scope.root_string_ptr(hint_ptr);
@@ -538,9 +533,22 @@ unsafe fn custom_to_primitive_number(value: f64) -> CustomToPrimitiveOutcome {
                 & POINTER_MASK),
     );
     let receiver = value_handle.get_nanbox_f64();
-    let prev_this = crate::object::js_implicit_this_set(receiver);
-    let result = crate::closure::js_native_call_value(method_handle.get_nanbox_f64(), &hint, 1);
-    crate::object::js_implicit_this_set(prev_this);
+    let method = method_handle.get_nanbox_f64();
+    let result = if crate::proxy::js_proxy_is_proxy(method) == 1 {
+        if !crate::proxy::proxy_wraps_callable(method) {
+            return CustomToPrimitiveOutcome::TypeError;
+        }
+        crate::proxy::call_proxy_value_with_this(method, receiver, &[hint])
+    } else {
+        let method_ptr = (method.to_bits() & POINTER_MASK) as usize;
+        if !crate::closure::is_closure_ptr(method_ptr) {
+            return CustomToPrimitiveOutcome::TypeError;
+        }
+        let prev_this = crate::object::js_implicit_this_set(receiver);
+        let result = crate::closure::js_native_call_value(method, &hint, 1);
+        crate::object::js_implicit_this_set(prev_this);
+        result
+    };
 
     if is_primitive_value(result) {
         CustomToPrimitiveOutcome::Primitive(result)