fix(gc): refuse the knob combination that emits a rootless binary (#7326) - #7332
Merged
Conversation
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe codegen now rejects ChangesRootless backend validation
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This was referenced Aug 3, 2026
proggeramlug
added a commit
that referenced
this pull request
Aug 4, 2026
* fix(gc): split the precise-root analysis from its lowering One knob answered two questions. "Which locals hold GC pointers, and where must each stay live" is the analysis and is backend-independent. "Is that answer represented as a heap-backed shadow frame or a native stack map" is the lowering, and LlFunction already chose it independently -- enable_shadow_frame_inner and reserve_shadow_slot both take the native path first. But the eight sites that build the slot map all gated on shadow_stack_enabled(), so PERRY_SHADOW_STACK=0 switched the ANALYSIS off and left the statepoint lowering with nothing to lower. The result was a binary with no precise frame roots at all: no __perry_gcmap section, same size as a plain shadow-off build, correct output. Nothing distinguished it from a good build until a collection freed a live object. #7332 made the pair a hard error as a stopgap. Route those eight sites through precise_root_analysis_enabled() instead and the pair becomes expressible, which is what the stopgap was standing in for. Measured on 01_nursery_churn: PERRY_STATEPOINTS=1 with and without PERRY_SHADOW_STACK=0 now emit an identical 885-byte root map and an identical __text. The knob keeps its own meaning on its own -- no gcmap, and still observable against the default build. A mode nobody can select is a mode nobody can measure, so this is the prerequisite for the shadow-stack lowering ever being removed rather than merely being switched off in one configuration nobody tests. * docs: changelog fragment for #7340 * docs(gc): record the full-suite RS4GC result and correct the x86-64 mechanism Two corrections and one measurement. The gap suite re-run against RS4GC in-process, two arms per test (shadow-stack control + RS4GC), 479/479: 447 pass->pass, 19 pre-existing diffs unchanged, 13 node_fail, ZERO new regressions, ZERO refusals, ZERO compile failures. Zero refusals is the load-bearing number -- 128 of the 479 tests contain `try {}` and the bridge cannot compile any of them. The earlier soak's "13 regressions, do not flip" was measured against the bridge, before #7329/#7330, on a backend that structurally cannot compile a quarter of the suite. It should not be carried forward. And the x86-64 mechanism was wrong. The workflow comment claimed _Unwind_GetGR(ctx, 7) "does not reliably return the stack pointer". Measured on x86-64 Linux (glibc 2.39, gcc 13.3.0): it SEGFAULTS. RBX, RBP and RIP return correctly; RAX and RSP both SIGSEGV, because libgcc tracks only the columns CFI restores and RSP is derived from the CFA rather than tracked. The fault is in the call itself, so no address validation after it can help -- the previous wording pointed at the wrong fix. Details and a reproducer in #7333. * docs(gc): measure the statepoint binary-size axis — it is root density, not metadata The plan asserted 'closing that axis needs fewer roots, not a tighter encoding' on the strength of one app measurement. Measured directly with two 2000-function programs: root-free functions +0 bytes (no map emitted, text identical) root-dense functions +4,330,592 B (97% __text, 21% gcmap) So statepoints carry NO fixed cost -- a function with nothing live across a safepoint pays nothing -- and the growth is the per-root relocation sequence, not the map. #7314's compact map fully answered the metadata objection, but metadata was never the dominant term at scale. Runtime on the same probes, quiet host, median of 5: statepoints 1-2% faster, every probe neutral or faster. --------- Co-authored-by: Ralph Küpper <ralph@skelpo.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #7326.
PERRY_SHADOW_STACK=0+PERRY_STATEPOINTS=1produced a binary with no precise frame roots at all — no__perry_gcmapsection, same size as a plain shadow-off build, and it ran and printed the correct answer. Nothing distinguished it from a correct build until a collection moved something live.The cause is structural, not a missing check
The statepoint backends are an alternative lowering of the shadow stack's root-set analysis, not an independent mechanism.
reserve_shadow_slot()is the single entry point that, undernative_stack_roots_enabled(), allocates a stack-map slot instead — and the caller returns empty maps outright when the shadow stack is off. Switching one off switches the other off with it.The consequence for the adoption plan
Because they share this analysis, "delete the shadow stack and keep statepoints" is not currently expressible. Any plan treating them as two interchangeable mechanisms — including the one in
docs/engine-plan.md— needs that premise corrected before the swap can happen. That is a decoupling job, not a flag flip.Verified
cargo fmtclean.Summary by CodeRabbit
Bug Fixes
Documentation