fix(runtime): preserve guarded Set and Symbol fallthroughs

[proggeramlug]

Summary

Follow-up to #7897, whose branch merged while its automated review findings were being addressed.

• validate pointer plausibility before reading a possible Symbol receiver's SYMBOL_MAGIC
• let unknown registered-Set keys continue to the shared Map/Set receiver path, preserving Set.prototype data-property lookup
• construct the Symbol receiver with the canonical NaN-box pointer helper
• add regression coverage for both negative boundaries

Reproduction

The Set regression was reproduced directly on the merged #7897 source. A focused test installs Set.prototype.perryReviewMarker = 7867; the early Set helper returned undefined and the assertion failed with left: NaN, right: 7867. Returning None for an unknown key lets the existing shared receiver path find the prototype property.

The Symbol screen reads four bytes from the candidate receiver. 0x8000_0000_0000 is beyond the canonical plausible-heap upper bound, so the new test requires it to return undefined before the magic load; removing the plausibility guard faults instead of producing a value. Positive coverage still exercises both a Box-leaked Symbol.for(...) and a GC-backed Symbol(...).

Validation

• RUST_TEST_THREADS=1 cargo test -p perry-runtime get_field_by_name_probe_tests (2 passed)
• RUST_TEST_THREADS=1 cargo test -p perry-runtime (2,154 passed, 4 ignored; doc tests 6 ignored)
• python3 scripts/check_test_registration.py
• python3 scripts/check_thread_locals.py
• python3 scripts/addr_class_inventory.py
• cargo fmt --check
• git diff --check
• bash scripts/check_file_size.sh

The address-class audit passes and reports only the pre-existing stale dyn_index.rs ratchet entry already disclosed on #7897.

Performance

The exact reviewed binary was rebuilt with the full compiler/runtime/stdlib wrapper set and compared to the same preserved #7897 base compiler/runtime on the locked quiet M1 mini. Thirty alternating pipeline_big pairs measured:

• base median: 1.693756 s
• fix median: 1.688867 s
• paired geomean: -0.343%
• bootstrap 95% CI: -0.389% to -0.299%
• both arms: exit 0, exact output 556260000 3 3

Refs #7867 and #7897.

Summary by CodeRabbit

• Bug Fixes

  • Improved Symbol property handling for invalid receivers, preventing unsafe metadata checks.
  • Corrected Set property lookup so unknown keys properly fall through to prototype properties.
  • Improved pointer handling for Symbol property access.
  • Improved reliability when property lookups occur during memory management activity.

• Tests

  • Added regression coverage for invalid receivers and Set prototype fallback behavior.
  • Documented benchmark results and confirmed all test gates pass.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b65dc455-eaa4-440f-af52-88d0b65e0191

📥 Commits

Reviewing files that changed from the base of the PR and between d583d93 and 0f96f64.

📒 Files selected for processing (2)

• changelog.d/7898-set-symbol-probe-fallthroughs.md
• crates/perry-runtime/src/object/field_get_set/get_field_by_name_probe_tests.rs

🚧 Files skipped from review as they are similar to previous changes (1)

• changelog.d/7898-set-symbol-probe-fallthroughs.md

---

📝 Walkthrough

Walkthrough

The runtime now validates Symbol receiver addresses before header probing, constructs Symbol pointers with the shared helper, and allows unknown Set properties to fall through to Set.prototype. Regression tests add GC rooting and invalid-address coverage.

Changes

Symbol and Set probe fallthroughs

Layer / File(s)	Summary
Symbol receiver validation and pointer construction crates/perry-runtime/src/object/field_get_set/get_field_by_name_tail.rs, crates/perry-runtime/src/object/field_get_set/probe_dispatch.rs, crates/perry-runtime/src/object/field_get_set/get_field_by_name_probe_tests.rs, changelog.d/7898-set-symbol-probe-fallthroughs.md	Symbol probing checks for a plausible heap address before reading Symbol metadata. Symbol values use js_nanbox_pointer. Tests root GC-sensitive values and cover invalid receivers. The changelog records Symbol behavior and validation.
Set prototype fallthrough crates/perry-runtime/src/object/field_get_set/probe_dispatch.rs, crates/perry-runtime/src/object/field_get_set/get_field_by_name_probe_tests.rs, changelog.d/7898-set-symbol-probe-fallthroughs.md	Unknown Set keys return None and continue through shared prototype lookup. Rooted tests verify lookup on Set.prototype. The changelog records fallback behavior and validation results.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• The #7850 probe family has moved to the property-get IC-miss tail: get_field_by_name_tail probes 4 registries before reading the GcHeader it then switches on (1.8% of pipeline_big) #7867: Addresses the same Symbol and Set property-get probe path in get_field_by_name_tail.

Possibly related PRs

• PerryTS/perry#7897: Modifies the same Symbol and Set property-probe dispatch paths.
• PerryTS/perry#7868: Directly relates to Symbol and Set probe dispatch and validation.
• PerryTS/perry#6941: Modifies the same field-by-name paths with GC rooting and stale-pointer regression coverage.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the runtime changes that preserve guarded Set and Symbol fallthrough behavior.
Description check	✅ Passed	The description clearly covers the changes, issue references, regression tests, validation commands, and performance results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch perf/7867-header-gated-property-tail

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@changelog.d/7898-set-symbol-probe-fallthroughs.md`:
- Line 4: Rewrite the changelog sentence beginning “A possible Symbol header...”
to state that “The runtime reads a candidate Symbol header...” while preserving
the existing condition about the candidate passing the preceding check.

In
`@crates/perry-runtime/src/object/field_get_set/get_field_by_name_probe_tests.rs`:
- Around line 116-126: Make the Set regression test GC-safe by storing set,
set_proto, and the field key in valid shadow slots before any potentially
allocating call, following the pattern in pointer_publish_7154.rs. In the test
flow around js_object_set_field_by_name and tail, reload each operand
immediately before use with js_shadow_slot_get so no stale raw pointer or key is
reused after collection.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ead3361f-ec24-4d9c-ac5a-888af02f83e7

📥 Commits

Reviewing files that changed from the base of the PR and between a871010 and d583d93.

📒 Files selected for processing (4)

• changelog.d/7898-set-symbol-probe-fallthroughs.md
• crates/perry-runtime/src/object/field_get_set/get_field_by_name_probe_tests.rs
• crates/perry-runtime/src/object/field_get_set/get_field_by_name_tail.rs
• crates/perry-runtime/src/object/field_get_set/probe_dispatch.rs