GC decodes a Number whose bits equal an 8-aligned heap address as a pointer (raw-or-tagged word ambiguity)
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 12/100
Research direction
Start with the test descriptor_snapshot_public_raw_and_tagged_operands_move_during_key_conversion and the GC scanning of Any lanes and array elements, where a raw-or-tagged word can be misread as a pointer. Read the object model step 4 notes to see how overflow entries store Numbers without F64 lanes. Done means every scanned word has one unambiguous NaN-boxed encoding and a subnormal Number equal to an aligned heap address survives a copying collection unchanged. This is a design change to the GC word layout, so check with maintainers before starting.
Written by the indexing model from the issue text.
Description
The GC treats some JSValue-holding words as either raw pointers or tagged values. A Number whose bit pattern equals an 8-aligned heap address (a subnormal double) can be rewritten as a pointer when the GC moves objects.
This already applies on main to Any lanes and array elements. Object model step 4 makes it more reachable: overflow table entries have no F64 lanes, so more Numbers live in such words.
Found by the step 4 triage: descriptor_snapshot_public_raw_and_tagged_operands_move_during_key_conversion rewrote a numeric descriptor field during a copying collection. The test was ported to keep its subject (the define path); the hazard itself is not fixed.
Fix direction: every word the GC scans must have one unambiguous encoding (tagged NaN-box), not a raw-pointer-or-value guess.
- Dominant language
- Rust
- Stars
- 4.9k
- Forks
- 166
- Avg merge
- 1h 26m
- Merged PRs (30d)
- 912
Getting set up
- Ships a Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from PerryTS/perry
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 1 day
-
perf(regex): capture-heavy exec is 15.9x Node — GC accounting is as large a share as the matcherOpen
Difficulty 4/5 1-2 days Newbie friendliness 48/100
PerryTS/perry#13139 · 2 comments ·
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 70/100
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 73/100
Maintainers usually reply within 1 day
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
DayuanJiang/PecoFence#139 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
nearai/compose-manager#73 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
akitaonrails/ai-memory#1664 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day