feat(gc): generated GC call-effects table + call-graph checker (RFC deferred collection S1)

.github/workflows/test.yml

@@ -289,6 +289,20 @@ jobs:
         if: ${{ !cancelled() }}
         run: cargo fmt --all -- --check
 
+      # RFC deferred collection S1: codegen's GC call effects come from the
+      # generated tables in crates/perry-codegen/src/gc_effects/. The self-test
+      # compiles a C fixture to ELF, Mach-O and COFF objects and runs the real
+      # classifier over them, including a planted js_proxy_get call in a Leaf
+      # helper that must come back Reenters and be reported as UNSAFE drift, so
+      # a green archive check means something. `lint` checks that the rules and
+      # the three committed tables parse. The archive comparison itself runs in
+      # gc-call-effects-linux and gc-call-effects (macOS aarch64, Windows).
+      - name: GC call-effects classifier self-test and table lint
+        if: ${{ !cancelled() }}
+        run: |
+          python3 scripts/gc_call_effects/callgraph.py --self-test
+          python3 scripts/gc_call_effects/callgraph.py lint
+
       # The CI tier policy (scripts/ci_plan.py) is code; its self-test asserts
       # the invariants CLAUDE.md cares about (gc-stress main-line reachable,
       # docs-only PRs skip the compile tier, an empty file listing is treated
@@ -3141,6 +3155,130 @@ jobs:
   # await-tests keys on. If a standing failure must not block a release,
   # triage it into test-parity/known_failures.json — do not soften the job.
   # ---------------------------------------------------------------------------
+  # RFC deferred collection S1 (owner decision 4). The committed table
+  # crates/perry-codegen/src/gc_effects/<target>.tsv must equal the table
+  # scripts/gc_call_effects/callgraph.py derives from THIS commit's release
+  # runtime archives, and no symbol may be committed weaker than the archives
+  # prove (UNSAFE drift: codegen would skip a statepoint the runtime needs).
+  # On failure the regenerated table is uploaded as `gc-effects-<target>`:
+  # commit it (or run scripts/gc_call_effects/regen.sh <target> locally).
+  # On a PR only UNSAFE drift fails (new symbols from main read as Unknown,
+  # which is safe); on main-line tiers any drift fails, so it gets regenerated.
+  #
+  # Linux reuses gap-suite-build's archives (same build command as regen.sh);
+  # in the full tier, where gap-suite-build does not run, it builds them.
+  gc-call-effects-linux:
+    needs: [plan, gap-suite-build]
+    if: >-
+      always() && needs.plan.result == 'success' &&
+      fromJSON(needs.plan.outputs.plan).jobs.gc_call_effects &&
+      (needs.gap-suite-build.result == 'success' || needs.gap-suite-build.result == 'skipped')
+    runs-on: ubuntu-latest
+    timeout-minutes: 75
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup-llvm22
+      - name: Download the shared fast-mode build
+        if: fromJSON(needs.plan.outputs.plan).gap.mode == 'fast'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: gap-suite-fast-build
+          path: target/release
+      - name: Install Rust toolchain
+        if: fromJSON(needs.plan.outputs.plan).gap.mode != 'fast'
+        run: rustup toolchain install nightly-2026-08-20 --profile minimal
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+        if: fromJSON(needs.plan.outputs.plan).gap.mode != 'fast'
+        with:
+          shared-key: "${{ runner.os }}-perry"
+          save-if: false
+      - name: Build runtime archives (no shared build in this tier)
+        if: fromJSON(needs.plan.outputs.plan).gap.mode != 'fast'
+        run: cargo build --release -p perry -p perry-runtime -p perry-stdlib -p perry-runtime-static -p perry-stdlib-static
+      - name: Committed table vs. the archives
+        env:
+          GC_EFFECTS_SKIP_BUILD: "1"
+          GC_EFFECTS_FRESH_OUT: gc-effects/linux-x86_64.tsv
+          # PRs are tested merged with a main that may have added runtime
+          # symbols since the PR last regenerated; those only read as Unknown
+          # (safe). UNSAFE drift always fails. Main-line tiers are strict.
+          GC_EFFECTS_ALLOW_SAFE_DRIFT: ${{ github.event_name == 'pull_request' && '1' || '' }}
+        run: |
+          mkdir -p gc-effects
+          scripts/gc_call_effects/regen.sh linux-x86_64 --check
+      - name: Upload the regenerated table
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: gc-effects-linux-x86_64
+          path: gc-effects/
+          if-no-files-found: warn
+          retention-days: 7
+
+  # macOS aarch64 builds its own archives; Windows x86-64 cross-builds them
+  # with cargo-xwin on Linux (the same toolchain lint's Windows type-check
+  # uses). Each leg compares only its own table.
+  gc-call-effects:
+    needs: plan
+    if: fromJSON(needs.plan.outputs.plan).jobs.gc_call_effects
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: macos-aarch64
+            os: macos-14
+          - target: windows-x86_64
+            os: ubuntu-latest
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 75
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Install Rust toolchain
+        run: rustup toolchain install nightly-2026-08-20 --profile minimal
+      - uses: ./.github/actions/setup-llvm22
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+        with:
+          shared-key: "${{ runner.os }}-gc-effects-${{ matrix.target }}"
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+      - name: Install cargo-xwin
+        if: matrix.target == 'windows-x86_64'
+        run: |
+          asset=cargo-xwin-v0.23.0.x86_64-unknown-linux-musl.tar.gz
+          url="https://github.com/rust-cross/cargo-xwin/releases/download/v0.23.0/$asset"
+          curl --fail --location --retry 3 "$url" --output "$RUNNER_TEMP/$asset"
+          echo "74a216f64f10ea81c909f02d6b1a84cd0fda8de4c87ee52fe63ba76ab2392b75  $RUNNER_TEMP/$asset" \
+            | sha256sum --check --strict
+          mkdir -p "$RUNNER_TEMP/cargo-xwin-bin"
+          tar -xzf "$RUNNER_TEMP/$asset" -C "$RUNNER_TEMP/cargo-xwin-bin"
+          echo "$RUNNER_TEMP/cargo-xwin-bin" >> "$GITHUB_PATH"
+          echo "$LLVM_SYS_221_PREFIX/bin" >> "$GITHUB_PATH"
+          rustup target add x86_64-pc-windows-msvc
+      - name: Restore cargo-xwin MSVC sysroot
+        if: matrix.target == 'windows-x86_64'
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        with:
+          path: ~/.cache/cargo-xwin
+          key: cargo-xwin-${{ runner.os }}-0.23.0
+      - name: Build the archives and compare the committed table
+        env:
+          GC_EFFECTS_FRESH_OUT: gc-effects/${{ matrix.target }}.tsv
+          GC_EFFECTS_ALLOW_SAFE_DRIFT: ${{ github.event_name == 'pull_request' && '1' || '' }}
+        run: |
+          mkdir -p gc-effects
+          scripts/gc_call_effects/regen.sh "${{ matrix.target }}" --check
+      - name: Upload the regenerated table
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: gc-effects-${{ matrix.target }}
+          path: gc-effects/
+          if-no-files-found: warn
+          retention-days: 7
+
   parity:
     # Sweep/full-tier only. Chained behind `check` so a sweep's fan-out does
     # not take every runner slot the moment a merge lands -- PR gates share
@@ -4380,6 +4518,8 @@ jobs:
       - repsel-census
       - native-abi-evidence-packet
       - gap-suite
+      - gc-call-effects-linux
+      - gc-call-effects
       - parity
       - parity-aggregate
       - compile-smoke

changelog.d/11565-generated-gc-call-effects.md

@@ -0,0 +1,9 @@
+**GC call effects now come from a generated, CI-checked table (RFC deferred collection, S1).** `classify_direct_callee` no longer uses the hand-kept allowlist. It reads `crates/perry-codegen/src/gc_effects/{linux-x86_64,macos-aarch64,windows-x86_64}.tsv` and takes the most conservative class of the three.
+
+- **Generator.** The tables are generated by `scripts/gc_call_effects/callgraph.py` from a symbol-level call graph of the linked runtime/stdlib archives. Every seed, cut and exemption, each with its reason, is in `seeds.txt`. `why.py` prints the witness path to the tainting seed.
+- **CI.** `gc-call-effects-linux` and `gc-call-effects` (macOS aarch64, Windows through `cargo xwin`) regenerate each table from freshly built archives and fail on any difference, with the witness path and the regenerated table as an artifact. `lint` runs a self-test that plants a `js_proxy_get` call in a leaf helper across ELF, Mach-O and COFF objects and requires the check to go red.
+- **Runtime.** The #11523 non-collecting root-registry guard is now a distinct type, `NonCollectingRootRegistryGuard`. Its drop has no path to `flush_deferred_gc_request`, so the graph can prove its callers leaf.
+- **`root_reload`.** Its `NON_COLLECTING` list must agree with the table.
+- **S2 fast paths.** The four GC-leaf IC hits S2 (#11554) hand-listed (`js_object_get_field_ic_fast`, `js_class_field_{get,set}_ic_fast`, `js_put_value_set_packed_fast`) now come out of the generated table as `Leaf` on all three targets, and their `_fast_miss` / `_packed_miss` continuations as collecting. No cut was needed for the two edges S2's census had to cut: the `Arena as Drop` TLS destructor is a `teardown` rule in `seeds.txt`, and `typed_feedback::invalidate_representation_change` takes the registry through `NonCollectingRootRegistryGuard`.
+- **Windows build.** `PERRY_AGENT_PTRS` is no longer `#[no_mangle]` on Windows: MSVC's thread-local shim takes the same symbol name, so every release build of `perry-runtime` for `x86_64-pc-windows-msvc` failed with "symbol already defined". Only ELF executables name the symbol.
+- **Measured against main**, on benchmarks/suite plus the 60 largest gap tests: −7.1 % statepoints and −3.4 % `gc.relocate`.

crates/perry-codegen/src/expr/slice8_rooting_tests.rs

@@ -129,6 +129,9 @@ pub(super) fn call_line_of(ir: &str, callee: &str) -> usize {
 pub(super) fn call_operand_of(ir: &str, callee: &str, n: usize) -> String {
     let idx = call_line_of(ir, callee);
     let line = ir.lines().nth(idx).expect("index came from this IR");
+    // Drop call-site attributes after the argument list (a callee the
+    // generated GC-effects table proves leaf carries ` "gc-leaf-function"`).
+    let line = line.rsplit_once(')').map_or(line, |(head, _)| head);
     let args = line
         .rsplit_once('(')
         .unwrap_or_else(|| panic!("{callee} call has no argument list: {line}"))

crates/perry-codegen/src/function/precise_roots.rs

@@ -397,7 +397,10 @@ mod tests {
         use crate::types::{I32, I64, PTR, VOID};
         module.declare_function("js_shadow_slot_bind", VOID, &[I32, PTR]);
         module.declare_function("js_closure_get_capture_bits", I64, &[I64, I32]);
-        module.declare_function("js_closure_set_capture_bits", VOID, &[I64, I32, I64]);
+        // `js_closure_set_capture_bits` used to be the setter here; the
+        // generated table proves it can flush a deferred collection (#11523),
+        // so the leaf setter probed is the i32 box store.
+        module.declare_function("js_i32_box_set", VOID, &[I64, I32]);
         module.declare_function("js_box_alloc_bits", I64, &[I64]);
         module.declare_function("js_box_set_bits", VOID, &[I64, I64]);
         module.declare_function("js_map_alloc", I64, &[I32]);
@@ -424,10 +427,7 @@ mod tests {
             "js_closure_get_capture_bits",
             &[(I64, "0"), (I32, "0")],
         );
-        entry.call_void(
-            "js_closure_set_capture_bits",
-            &[(I64, "0"), (I32, "0"), (I64, &cap)],
-        );
+        entry.call_void("js_i32_box_set", &[(I64, &box_ptr), (I32, "0")]);
         // Control: an unaudited callee stays a genuine safepoint.
         let unknown = entry.call(I64, "js_map_alloc", &[(I32, "1")]);
         let live = entry.load(I64, &root);
@@ -452,7 +452,7 @@ mod tests {
             "call i64 @js_box_alloc_bits(",
             "call void @js_box_set_bits(",
             "call i64 @js_closure_get_capture_bits(",
-            "call void @js_closure_set_capture_bits(",
+            "call void @js_i32_box_set(",
         ] {
             assert!(
                 rewritten.contains(direct),