fix(gc): pin long-lived and malloc-resident objects without the space classifier (#7650)

[proggeramlug]

fix(gc): pin long-lived and malloc-resident objects without the space classifier (#7650 follow-up).

#7650 routed every GC_FLAG_PINNED write through gc::pin_object, which reaches
arena::classify_heap_space. That new edge kept a reference chain alive that
-Wl,-dead_strip had been removing, and five perry-ext-* crates stopped
linking:

Undefined symbols for architecture arm64:
  "_js_blob_new",                     referenced from: … fetch_globals::global_this_blob_thunk
  "_js_fetch_with_options",           referenced from: … global_fetch::global_this_fetch_thunk
  "_js_fetch_notify_signal_aborted",  referenced from: … url::abort::fire_abort_listeners

perry-ext-{pdf,lru-cache,node-forge,mongodb,http}. They link a feature-stripped
runtime through perry-ffi's runtime-link, so those thunks have no definition
and only survived because the stripper removed them.

Bisected rather than guessed: the commit before #7650 builds all five clean,
#7650 does not, and reverting only the two perry-runtime call sites
restores the link. perry-stdlib's async_bridge keeps pin_object — its
js_promise_new() promises really are Eden-resident and must arm the young-pin
latch.

pin_object_non_young does the flag write directly for the sites #7650's own
comments already document as long-lived (string/format.rs, the interned format
buffer) and malloc-resident (thread.rs, the spawn promise and its handle) —
they never needed the classifier. Making pin_object conservative instead
(arming for any GC_FLAG_ARENA object) would also remove the edge, but it would
arm on exactly these long-lived pins and throw away the preflight skip #7645
bought.

The claim is checked, not asserted. debug_assert catches a young object in
test builds, and pin_object_non_young_call_sites_are_never_young
(gc/tests/copying/latch.rs) asserts non-youngness for each real call site plus
a control proving the predicate is not vacuously false for everything. Sabotage:
forcing the predicate false reddens the control (0 compile errors, test binary
reached).

Why no gate caught it. cargo-test scopes per-PR runs to the changed crates'
reverse-dependency closure (scripts/ci_test_scope.py); the full workspace runs
on tags and nightly only. perry-ext-* is outside the closure of a
perry-runtime GC change, so this could only have surfaced at the next tag.
Found by running cargo test --release --workspace by hand against main.

[coderabbitai]

Warning

Review limit reached

@proggeramlug, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 48 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 57842002-61c6-4ae6-a59b-72cef4128b9a

📥 Commits

Reviewing files that changed from the base of the PR and between 9617779 and b6639b7.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (8)

• CLAUDE.md
• Cargo.toml
• changelog.d/7653-pin-object-ext-link.md
• crates/perry-runtime/src/gc/mod.rs
• crates/perry-runtime/src/gc/pin.rs
• crates/perry-runtime/src/gc/tests/copying/latch.rs
• crates/perry-runtime/src/string/format.rs
• crates/perry-runtime/src/thread.rs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}