Keep strict arguments descriptors in object slots (integrates #11711)

[proggeramlug]

Strict escaping arguments objects keep length and restricted callee attributes in the shared key layout, with the thrower accessor in the object's own slot. Construction no longer populates address-keyed property and accessor descriptor tables. This integrates #11711 while preserving its contributor history and leaving the fork untouched.

Current head 3d6e8395c26ade96f46842a66935c9f192eebde9 cleanly merges main 41c38ed36f9d60cd2883e7cab91c253cab2666da, including the landed Script-reflection fixture repair, coherent SWC/dependency updates, require-provider setup, and bounded GC diagnostic census. The actual merge tree equals the automatic merge tree. All Cargo manifests, lockfile and Cargo configuration match main; the remaining main-relative change contains only three strict-arguments runtime/test files and its changeset.

Validation at this refreshed head:

• All seven Script/global-code HIR integration tests passed.
• All eleven serial arguments-object GC tests passed, including restricted-callee preservation across actual evacuation.
• Locked release compiler/runtime-static/stdlib-static checks passed with LLVM 22.1.4.
• Root-holder, raw-handle, address inventory, lock downgrade (2,780 edges, zero changes), and whitespace gates passed.

The full current-head script lint replay finished: 110 of 111 executable commands passed; only the grandfathered Public benchmark evidence freshness check failed. The compile tier and two CI-only commands were explicitly skipped; the separate locked three-package check above passed. New-head product execution is not claimed; current hosted CI remains required.

The old head's CI cargo-test failure in reflected_script_var_gets_an_early_nonconfigurable_global_slot is addressed by main's process-isolated Script opt-in fixture repair. Its original assertions remain intact. Old-head whole GC successes do not approve this refreshed head: both successful current-head root-dominance jobs and remaining CI acceptance are required.

Historical validation at 9522505a26db2b13ff128275ea5071b0114a4e6d: coherent release compiler and both static libraries built; three compiled arguments integration tests and the strict-callee Node 26.5.1 comparison passed; all eleven serial arguments-object units passed. Full script lint completed 110/111 executable checks, failing only benchmark freshness; compile tier and two CI-only commands were explicitly skipped. These are historical results, not new-head product, full-lint or hosted CI approval.

Refs #10509. This lands the descriptor-storage portion; full performance acceptance remains unproven. Close original #11711 only after verified landing.

Current-head GC acceptance update at 3d6e8395c26ade96f46842a66935c9f192eebde9: both whole jobs succeeded: shadow root dominance and native statepoints root dominance. All executed steps succeeded. Other CI failures and pending jobs still require acceptance; this is not overall merge approval.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: f08f74ac-3948-4fee-93b3-d18b65b0adfb

📥 Commits

Reviewing files that changed from the base of the PR and between c436236 and 9522505.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• changelog.d/11735-strict-arguments-descriptors.md

🚧 Files skipped from review as they are similar to previous changes (1)

• changelog.d/11735-strict-arguments-descriptors.md

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

Restricted arguments-object construction stores the callee thrower in the existing accessor slot and records its descriptor state against the canonical key layout. Tests check descriptor-table entries and verify callee attributes after moving garbage collection. The changelog also records retained Windows Inkwell 0.9 lock entries.

Changes

Strict arguments descriptors

Layer / File(s)	Summary
Canonical descriptor layout crates/perry-runtime/src/object/descriptor_state.rs, crates/perry-runtime/src/object/arguments.rs, crates/perry-runtime/src/gc/tests/arguments_objects.rs, changelog.d/11735-strict-arguments-descriptors.md	The descriptor-state helper records accessors present in the key layout. Restricted arguments-object construction stores the callee thrower in its existing slot. Tests check for address-keyed descriptor entries and verify accessor attributes after moving GC. The changelog describes the layout and retained Windows Inkwell lock entries.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 95225

The strict arguments descriptor changes are consistent with accessor lookup and moving-GC preservation. Mergeable subject to normal build and test checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to c4362

No concrete new security weakness was identified. The inspected changes preserve the restricted property’s controls and object isolation, but complete validation of the memory-management change remains pending.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The demonstrated security-relevant scope is arguments-object property enforcement and heap-reference ownership within the executing runtime. The exact production delta does not add a caller, credential, or external service boundary.

Trust Boundaries and Controls

• inferred — Script-supplied arguments continue through the existing construction path. Restricted callee retains the existing thrower rather than accepting a script-supplied accessor, and the new bookkeeping explicitly enables accessor dispatch despite bypassing descriptor installation. No control bypass was identified in this path.

Resilience and Maintainability Implications

• inferred — Inspected construction, key-layout mutation, accessor clearing, and tracing paths support per-object ownership without requiring address-table cleanup for the restricted accessor. Shared layout edits preserve separate attribute and accessor state, reducing dependence on owner-address bookkeeping without establishing an exploitable defect in the base.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 87.50% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 3 files. (1 skipped: 1 u…
Linked Issues check	✅ Passed	The description references #10509 and #11711, and the referenced issues match the stated descriptor-storage integration objective.
Out of Scope Changes check	✅ Passed	The changes are limited to strict arguments descriptor storage, related runtime tests, descriptor bookkeeping, and the associated changelog entry.
Title check	✅ Passed	The title clearly summarizes the main change: storing strict arguments descriptors in object slots while integrating issue #11711.
Description check	✅ Passed	The description provides a detailed summary, change rationale, related issues, validation results, and test limitations. It does not use the template headings or include the checklist, but it contains…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}