[proggeramlug]

Summary

Fixes #1813 — the SIGSEGV race in js_native_call_method reached via @perryts/mysql's nativeScramble during concurrent Pool.acquire handshakes.

Root cause: the implicit-this thread-local cell (IMPLICIT_THIS in crates/perry-runtime/src/object/mod.rs) holds the NaN-boxed receiver for the duration of a dynamically-dispatched non-arrow method body. It is set/restored around the call by both js_native_call_method and the codegen js_implicit_this_set save/restore that wraps js_native_call_value. The receiver is a live heap object for the whole call — but the cell was plain thread-local storage that no GC root scanner visited.

When a moving GC runs during that method body — and under this workload it does: Pool.acquire runs a nested stdlib pump (js_run_stdlib_pump) that drains the handshake network IO, and the auth path allocates while building the scramble — the receiver gets evacuated (old-gen) or copied (nursery). With no root slot to rewrite, the cell kept the stale pre-move pointer, and the body's next this-derived dispatch dereferenced freed/relocated memory → the reported fault inside js_native_call_method.

This explains every symptom:

• Concurrency-only / heisenbug: nursery copying and the C4b old-gen evacuation policy only move objects under nursery/RSS pressure, which only happens once the pool opens new connections under load. Sequential (-c 1) never moves the receiver mid-handshake.
• Auth-plugin-agnostic (mysql_native_password SIGSEGV, caching_sha2_password wedge): both paths share concurrent connection-establishment that runs the handshake under the nested pump.
• Sibling of SIGSEGV handling POST requests in compiled Fastify + @perryts/mysql service (0.5.1026 / 46b80d78); GET unaffected #1663 (same Fastify + @perryts/mysql POST shape): that one was a stale TLS pointer in the microtask drain; this is a stale TLS pointer in the implicit-this slot. Same class, different cell.

Fix

Register IMPLICIT_THIS as a GC mutable-root scanner (scan_implicit_this_roots_mut), wired into gc_init() alongside the other object scanners. The mark phase keeps this reachable when the cell is its only root; the rewrite phase follows the forwarding pointer so the cell tracks the receiver's relocation. Non-pointer tags (the TAG_UNDEFINED default, null/int/bool) flow through visit_nanbox_bits as no-ops, so scanning the idle cell between calls is free and safe.

Because every codegen and runtime dispatch site funnels through this one cell, a single scanner closes the gap for all of them.

Testing

• New deterministic regression test test_implicit_this_root_scanner_marks_and_rewrites (in gc/tests/runtime_roots.rs): sets the cell to a nursery receiver, asserts the scanner marks it (not swept) and rewrites it to the relocated copy after set_forwarding_address, and that an idle TAG_UNDEFINED cell is left untouched. Mirrors the existing receiver-rewrite tests for js_native_call_method (split/replace/bigint).
• Full gc:: module: 281 passed, 0 failed.
• Re-ran gc::tests::runtime_roots + gc::tests::evacuation under PERRY_GC_FORCE_EVACUATE=1 PERRY_GC_VERIFY_EVACUATION=1 (real moving GC + post-move stale-reference verifier): all green.
• cargo fmt --all -- --check clean.

I couldn't reproduce the full MySQL-under-concurrency e2e locally (needs the server + package + load), so validation is via the unit tests that exercise the exact moving-GC + implicit-this interaction the crash depends on, plus the force-evacuate/verify stress mode.