fix(runtime): instanceof and inherited getters on function objects

.github/workflows/release-packages.yml

@@ -667,7 +667,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: macos-14
+          - os: macos-15
             target: aarch64-apple-darwin
             artifact: perry-macos-aarch64
             wasi: true
@@ -898,10 +898,16 @@ jobs:
         run: |
           ${{ runner.os == 'Windows' && 'cargo' || 'mbx' }} build --profile prod --target ${{ matrix.target }} -p perry-runtime -p perry-runtime-static
           ${{ runner.os == 'Windows' && 'cargo' || 'mbx' }} build --profile prod --target ${{ matrix.target }} -p perry-stdlib -p perry-stdlib-static
-          # The WebAssembly host archive, co-built with the archives it links
-          # beside: perry links it for a WebAssembly program and never builds
-          # it while compiling one.
-          ${{ runner.os == 'Windows' && 'cargo' || 'mbx' }} build --profile prod --target ${{ matrix.target }} -p perry -p perry-runtime-static -p perry-stdlib-static -p perry-wasm-host ${{ matrix.wasi && needs.build-wasi.outputs.enabled == 'true' && '--features perry/target-wasi' || '' }}
+
+      - name: Build WebAssembly host archive (Windows)
+        # The WebAssembly host archive, co-built with the archives it links
+        # beside: perry links it for a WebAssembly program and never builds
+        # it while compiling one. On Unix the native ext step below builds this
+        # same package set (plus every extension) in its one invocation, which
+        # is the build that ships; doing it here too cost a full second
+        # compile of perry + runtime + stdlib under a different feature union.
+        if: runner.os == 'Windows' && matrix.old_glibc_image == '' && matrix.musl_image == ''
+        run: cargo build --profile prod --target ${{ matrix.target }} -p perry -p perry-runtime-static -p perry-stdlib-static -p perry-wasm-host ${{ matrix.wasi && needs.build-wasi.outputs.enabled == 'true' && '--features perry/target-wasi' || '' }}
 
       - name: Build panic=abort runtime variant (Unix)
         # Out-of-tree installs can't rebuild the runtime, so ship the
@@ -926,24 +932,42 @@ jobs:
         # needs the prebuilt `libperry_ext_*.a` sitting next to
         # libperry_runtime.a so `perry compile` can link them without a
         # workspace checkout (see optimized_libs.rs::resolve_prebuilt_ext_libs).
-        # #7358: keep the compiler and both shipped wrapper archives in each
-        # Cargo invocation. Building an ext staticlib alone gives its bundled
-        # runtime/shared dependencies a different feature union from stdlib;
-        # the link deduper then cannot remove the whole second copy, and the
-        # HTTP accept loop reads a different async reactor from the one the JS
-        # event loop drives.
+        # #7358: build the compiler, both shipped wrapper archives and every
+        # extension in ONE Cargo invocation, so they all share one feature
+        # union. Building an ext staticlib with a different union from stdlib
+        # leaves its bundled runtime/shared dependencies a second copy the
+        # link deduper cannot remove, and the HTTP accept loop reads a
+        # different async reactor from the one the JS event loop drives.
+        # One invocation per extension (the former loop) gave every extension
+        # its own union, so each iteration recompiled perry, the runtime and
+        # stdlib (3+ h of the Intel leg) and the shipped archives came from
+        # whichever iteration wrote them last.
         # #5716: the governance inventory is the explicit shipping set; adding
         # a crate requires a recorded retain/migration decision. Best-effort
         # per crate: a wrapper that can't build on this host must not fail the
-        # whole release — packaging below ships whatever was produced.
+        # whole release — packaging below ships whatever was produced. If the
+        # combined build fails, the core set must still build on its own, and
+        # each extension is then retried alone as before.
         if: runner.os != 'Windows' && matrix.old_glibc_image == '' && matrix.musl_image == ''
         run: |
           set -euo pipefail
           governed_ext_packages=$(./scripts/release_ext_packages.sh)
+          ext_args=""
+          while IFS= read -r name; do
+            ext_args="$ext_args -p $name"
+          done <<< "$governed_ext_packages"
+          core_args="-p perry -p perry-runtime-static -p perry-stdlib-static -p perry-wasm-host ${{ matrix.wasi && needs.build-wasi.outputs.enabled == 'true' && '--features perry/target-wasi' || '' }}"
+          # shellcheck disable=SC2086 # word splitting is the point
+          if mbx build --keep-going --profile prod --target ${{ matrix.target }} $core_args $ext_args; then
+            exit 0
+          fi
+          echo "::warning::combined ext build failed; building the core alone, then each extension on its own"
+          # shellcheck disable=SC2086
+          mbx build --profile prod --target ${{ matrix.target }} $core_args
           while IFS= read -r name; do
             echo "::group::build $name"
-            mbx build --profile prod --target ${{ matrix.target }} \
-              -p perry -p perry-runtime-static -p perry-stdlib-static -p perry-wasm-host -p "$name" ${{ matrix.wasi && needs.build-wasi.outputs.enabled == 'true' && '--features perry/target-wasi' || '' }} \
+            # shellcheck disable=SC2086
+            mbx build --profile prod --target ${{ matrix.target }} $core_args -p "$name" \
               || echo "  (skipped $name — failed to build on this host)"
             echo "::endgroup::"
           done <<< "$governed_ext_packages"
@@ -1742,7 +1766,7 @@ jobs:
   #   manifest.json         (perry_version + target_triple + sha256+size per file)
   #
   # Each matrix entry runs on the natural host runner for its toolchain:
-  #   - Apple targets: macos-14 (real Xcode + SDKs)
+  #   - Apple targets: macos-15 (real Xcode + SDKs)
   #   - Android      : ubuntu-24.04 + pre-installed NDK
   #   - Windows MSVC : windows-latest (clang-cl + lib.exe)
   # — so no Linux→Apple sysroot or Linux→Windows VM dance is needed inside
@@ -1757,19 +1781,19 @@ jobs:
       matrix:
         include:
           # --- Apple, Tier-2 (stable) ---------------------------------------
-          - os: macos-14
+          - os: macos-15
             target: aarch64-apple-darwin
             ui_crate: perry-ui-macos
             ui_lib: libperry_ui_macos.a
           - os: macos-15
             target: x86_64-apple-darwin
             ui_crate: perry-ui-macos
             ui_lib: libperry_ui_macos.a
-          - os: macos-14
+          - os: macos-15
             target: aarch64-apple-ios
             ui_crate: perry-ui-ios
             ui_lib: libperry_ui_ios.a
-          - os: macos-14
+          - os: macos-15
             target: aarch64-apple-ios-sim
             ui_crate: perry-ui-ios
             ui_lib: libperry_ui_ios.a

.github/workflows/release-wasi.yml

@@ -108,9 +108,10 @@ jobs:
         run: |
           set -euo pipefail
           archive="$(python3 scripts/wasi_build_runtime.py wasm32-wasip1 | sed -n 's/^WASI archive: //p' | tail -n 1)"
-          # The optional networking member ships in the archive; default
-          # linked modules still omit it unless PERRY_WASM_NET=1 is selected.
-          python3 scripts/wasi_imports_check.py "$archive" --allow-perry-net
+          # The optional networking and page-discard members ship in the
+          # archive; default linked modules still omit them unless
+          # PERRY_WASM_NET=1 / PERRY_WASM_DISCARD=1 is selected.
+          python3 scripts/wasi_imports_check.py "$archive" --allow-perry-net --allow-perry-host
           python3 scripts/wasi_release.py package --target wasm32-wasip1 --revision "$EXPECTED_SHA" \
             --runtime "$archive" --output wasip1-release
       - name: Upload the wasip1 runtime bundle

.github/workflows/test.yml

@@ -1632,6 +1632,12 @@ jobs:
               # Match the PR lane: Blaze cannot unwind through the naked ABI
               # trampoline. Keep the full unit/integration/doc test inventory.
               MBX_BLAZE=0 RUST_TEST_THREADS=1 python3 scripts/runtime_test_batches.py
+              # The batches above are the dev profile. Release builds drop the
+              # debug-only GC instruments and change inlining, so a unit test
+              # can pass in dev and fail in release (59 did, unseen for weeks).
+              # Default thread count on purpose: a test that needs exclusive
+              # process state must serialize itself (`test_isolation`).
+              MBX_BLAZE=0 cargo test --locked --release -p perry-runtime --lib
             fi
             # `cargo test` only builds lib/bin/test targets — NOT the `staticlib`
             # crate-type — so libperry_runtime.a / libperry_stdlib.a are never

changelog.d/0-wpfacts-arguments-object.md

@@ -0,0 +1,6 @@
+Whole-program facts no longer model a function's `arguments` object as an
+Array. It is an ordinary object whose prototype is `Object.prototype`, with
+own data `length` and `callee`: a store or `Object.defineProperty` on
+`arguments.length` now keeps the stored value, where the facts used to say
+it was always a Number. Proven site counts are unchanged on the chess
+witness, tssrc, tscwork, richards and fastify_inject.

changelog.d/13546-function-receiver-instanceof-getter.md

@@ -0,0 +1,5 @@
+`instanceof` on a function object whose prototype was reset
+(`Object.setPrototypeOf(fn, C.prototype)`) now follows that chain: `fn
+instanceof C` is true, and `fn instanceof Function` is false unless the new
+chain reaches `Function.prototype`. Function objects keep a reset prototype
+in the closure side table, which these checks ignored.

changelog.d/13576-worker-constructor-exports.md

@@ -0,0 +1 @@
+Fix worker messaging constructor exports to share their original thread-realm objects across import forms and captured construction. Keep mutable global replacements separate from core-module exports while preserving explicit CommonJS overrides and named-export synchronization.

changelog.d/13578-uea2-method-on-read.md

@@ -0,0 +1,9 @@
+Per-unit facts: a method called on what a described parameter reaches
+(`context.factory.createIdentifier(..)`, where the callers' values sit beside
+the parameter's marker: a closed function, a run method's parameter) is a
+read of the method's key, not an escape of the receiver. The call runs on the
+values beside the marker, whose contracts carry it to their units. Before,
+the escape made every caller report what it passed, and the census broke the
+passed class, its method and the method's result layout. A closed-function
+fixture now converges in 2 rounds instead of 4 with no broken layout; the
+whole program is unchanged and per unit never proves more than whole.

changelog.d/13579-wpfacts-forwarded-copies-join.md

@@ -0,0 +1 @@
+Per-unit facts reach their fixpoint when several units forward copies of one literal shape that no unit of the module births: the copies join, ascending from the last round, instead of the last forwarder of a round replacing the others. Before, a reader solved between two forwarders never read what the round left and was solved again every round (the Supabase CLI never finished its facts pass).

changelog.d/13580-usg-unlimited-stack.md

@@ -0,0 +1 @@
+The stack-overflow guard now works when the stack limit is unlimited (`ulimit -s unlimited`): runaway recursion throws a catchable `RangeError: Maximum call stack size exceeded` instead of dying with SIGSEGV. The main-thread stack bound is derived from the kernel's own stack mapping, and an unlimited (or address-space-wide) limit uses the kernel's default 8 MiB stack size.

changelog.d/13581-lpad2-pad-before-runtime.md

@@ -0,0 +1,17 @@
+`PERRY_LINK_PAD`, a measurement input for startup A/Bs: whitespace-separated objects placed on the link
+line right after the compiled objects and before the runtime archive, on every final link perry runs
+(executable, dylib, proven tiny program, WASI component), through one reader, `link::link_pad_args()`.
+`PERRY_EXTRA_LINK_ARGS` keeps its place (appended last) and meaning. Unset, the link line is unchanged.
+
+The startup A/B harness's link-pad control (`scripts/a1/linkpad.py`, `scripts/a1/irdiff.sh`) now pads in
+front of the runtime. The linker lays input sections out in command-line order, so a pad between the
+compiled objects and the runtime archive keeps every runtime byte of `.text`, `.rodata` (including the
+merged `.rodata.cst*`/`str1.1` blobs), `.eh_frame` (one filler FDE), `.gcc_except_table`, `.data.rel.ro`
+(anchored at the end of the RELRO region), `.data` and `.bss` at the same address in both arms; the pad
+that is linked last remains only to equalize section ends and the heap start when the runtime itself
+differs. The planner relinks the cached objects until the markers coincide; the proof
+(`<out>/<witness>.layout.txt`) compares markers, section ends, segment starts, the image end and the
+addresses of every runtime symbol both binaries define. Rows that were left by the previous control (ld.so
+`check_match` over runtime `.rodata` names, libc compares over runtime literals) now disappear when the
+runtime is unchanged. `perry_*` record sections and `.eh_frame_hdr` stay unpadded; both arms must be built
+from a perry that has `PERRY_LINK_PAD`.

changelog.d/13582-gcw-walk-without-unwinder.md

@@ -0,0 +1,15 @@
+x86-64 Linux: the GC root scan no longer walks the stack with the system
+unwinder. JS frames step by their frame record (two loads, exact `sp` and
+`rbp`); Rust, shim and foreign frames between them step by their unwind row
+through the runtime's own direct decoder; the walk ends after `main` or at the
+worker base trap. The back-edge poll, `gc()` and the inline allocation slow
+paths are naked shims that hand their caller's frame to the collections they
+run, so those walks start at the JS frame and never step the collector's own
+frames (allocation offers it only on the arena slow path, the poll only
+when it collects). `match_records` rejects a pc past a function's last record in one
+search. On binary-trees a walk drops from 9.1 frames and ~28.7k instructions
+to 1.1 frames and ~8.5k; `_Unwind_Find_FDE` is no longer called by any scan.
+
+A row the walk cannot follow fails closed to `_Unwind_Backtrace`, and when
+that also stops before the end of the stack the process now aborts naming the
+module, instead of silently scanning a truncated stack.

changelog.d/13583-facts-consumed-env-registered.md

@@ -0,0 +1,5 @@
+Register `PERRY_FACTS_CONSUMED` (the codegen-consumed marks of the facts
+dump) with the compile environment as a diagnostics-only variable, like
+`PERRY_FACTS_DUMP`: it records which sites read a program fact and changes
+no emitted code, so it is not a build-cache input. Fixes the environment
+audit test on main.

changelog.d/13584-ctor-own-fn-id.md

@@ -0,0 +1,7 @@
+A class's standalone constructor (the body `super(...)` and `new` of a class
+value run) is compiled under its constructor's own function id instead of
+id 0. Its `this`, definite-init proofs and allocation hotness were read
+from whichever function had HIR id 0; now a store `this.k = v` into a
+definite birth field of a prefix-stable class is the slot store the inlined
+`new C(...)` already emits. A synthesized default constructor gets an id
+nothing is keyed by.

changelog.d/13585-create-data-property-record.md

@@ -0,0 +1,11 @@
+`CreateDataProperty` (public class fields, and the other runtime callers of
+the operation) defines from a Property Descriptor record instead of building a
+four-key JS descriptor object and decoding it back through
+`Reflect.defineProperty`. A class field on a callable class instance (a bound
+function given the class prototype, as ArkType's `Callable` builds) declines
+every shape-owned define and paid both steps: 24k instructions per field,
+1.57 G instructions of the Supabase CLI's `--version`. It is now about 10k.
+Because nothing is read back through `%Object.prototype%`, an inherited `get`
+or `set` there no longer turns a class field into an invalid accessor
+descriptor; `test_gap_class_field_define_record` pins that and the field
+attributes on callable and plain receivers.

changelog.d/13586-wasi-layout-key-assert.md

@@ -0,0 +1,13 @@
+Fix the wasm32 (WASI) runtime build: the compile-time check of the
+`PerryLayoutKey.off` offset used the 64-bit value (14) on every target, but
+with 32-bit pointers the field sits at byte 10, so `perry-runtime` failed to
+compile for wasm32-wasip1/wasip2 and the release build-wasi leg went red. The
+offset and the key size are now stated per pointer width (14/16 on LP64,
+10/12 on ILP32), matching the descriptor constants beside them, and a codegen
+test checks the emitted `%PerryLayoutKey` LLVM type has the same offset and
+size under both data layouts. Native targets are unchanged.
+
+The release wasip1 step now admits `perry_host.discard_pages` in its import
+check (`--allow-perry-host`, as the test workflow already does): the one
+wasip1 archive has carried the opt-in page-discard member since it landed,
+so the check rejected the archive it was meant to ship.

changelog.d/13587-lpad3-relro.md

@@ -0,0 +1 @@
+startup A/B link pad (scripts/a1/linkpad.py): equalizes the RELRO region size (end pad then mid pad in .data.rel.ro) and the aligned TLS size (.tbss end pad), so the RW LOAD start, .tdata, .tbss, .init_array, .fini_array and .data.rel.ro starts coincide when one arm has a larger .got; the layout check compares them; the planner runs up to 30 rounds. Measurement script only, no change to shipping links.

changelog.d/13588-rlt-release-lib-tests.md

@@ -0,0 +1 @@
+perry-runtime's lib tests pass in the release and perry-dev profiles with the default thread count. The GC liveness counters (`copying_minor_cycles` and friends) now count in every lib-test build, not only debug ones, which is what 59 moving-GC tests read; shipping archives are unchanged and a compile-time assert keeps their counters zero-sized. Tests that assert on process-wide state (the event-pump wake flag, the has-active registries, typed-feedback counters, thread-slot claims, the guest host tables) run in their own process through `test_isolation::in_own_process`, and `TestOpsGuard` serializes component host-ops installs, which stops an uncaught throw in one `http::pump` test from aborting the whole test binary. CI's full-tier run now also runs the runtime lib tests in release.

changelog.d/13589-rlk-relinked-ctor-this.md

@@ -0,0 +1,15 @@
+Per-unit compiles of a class relinked as another class's parent are correct.
+After `Object.setPrototypeOf(B, A)`, `Reflect.setPrototypeOf(B, A)` or
+`B.__proto__ = A`, `B`'s `super()` runs `A`'s constructor on a `B` instance.
+When the relink sat in a different statement or module than `A` or `B`, two
+per-unit facts were stronger than the whole program's: `this` of `A`'s
+constructor held only `A` instances, and a unit that merely constructed `B`
+vouched that `B` was never relinked, so `super()` called `B`'s declared
+parent (wrong output, for example `undefined` instead of the fields `A`'s
+constructor sets). Now the unit doing the relink reports the given class, and
+that class's unit runs its constructor on any receiver, as it does for a class
+an `extends` names. Only a class's own unit says whether it is relinked.
+
+Constructing `AbortSignal` through a value (`const S = AbortSignal; new S()`)
+or through the live `super()` of `class X extends AbortSignal` now throws
+`TypeError: Illegal constructor`, as in Node; it used to return a signal.

changelog.d/13598-native-reader-noalias-scopes.md

@@ -0,0 +1,12 @@
+Fix split-module native construction of indexed-owner loop regions. The
+native IR reader accepted only the `!{!"NAME"}` metadata operand of
+`llvm.read_register`, so a function whose typed-array owner region declares
+its noalias scopes (`llvm.experimental.noalias.scope.decl`) failed with
+"unsupported metadata operand" and the whole build refused to link
+(opencode's `@aws-sdk/core` protocols module). The reader now builds any
+inline metadata tuple of strings and tuples through the uniquing MDNode API,
+on both the line and typed call paths, and attaches inline `!alias.scope` /
+`!noalias` tuples on loads and stores, which it used to drop. Comma and
+bracket splitting skips quoted strings, since scope domains embed function
+names. A reader test holds the result equal to LLVM's own parse, and the
+indexed-owner emitter test builds its live output through the reader.