fix(runtime): no Rust frame is ever a longjmp target — cc --help segfault fixed, parity gate back online (#9305)

changelog.d/9305-fancy-ascii-word-boundary.md

@@ -0,0 +1,12 @@
+### Fixed
+
+- A `RegExp` combining a lookaround (or backreference) with `\b`/`\B` no
+  longer throws a bogus `SyntaxError: invalid pattern`: the ASCII
+  word-boundary spelling `(?-iu:\b)` the translator emits (#9263) is valid
+  for the linear engine but rejected by fancy-regex's parser, so every
+  pattern forced onto the fancy engine lost its word boundaries.
+  `build_fancy_regex` now rewrites the marker into the equivalent
+  one-code-point-lookaround form. This was the throw inside a microtask
+  that #9305's setjmp miscompile turned into the `cc --help` segfault;
+  with both fixed, `marked`'s html-block regex — and `cc --help` — work
+  again. (#9305)

changelog.d/9305-setjmp-c-trampoline.md

@@ -0,0 +1,13 @@
+### Fixed
+
+- `cc --help` (and any program throwing from inside a microtask) no longer
+  segfaults: every jmp_buf the exception transport can `longjmp` to is now
+  armed inside a dedicated C trampoline (`perry_sjlj_try`) instead of a raw
+  `setjmp` call in Rust. rustc cannot express `returns_twice`, so a Rust
+  frame containing a live `setjmp` was compiled under LLVM's one-return
+  assumption — in `run_microtasks` LLVM colored the stack slot of the
+  spilled TLS-base temporary into the task-record copy loop, and the
+  longjmp return path reloaded NULL. The trampoline makes the hazard
+  unrepresentable for all current and future Rust trap sites; the one
+  remaining raw `setjmp` (the GC's register-snapshot spill, which never
+  longjmps) is documented as the deliberate exception. (#9305)

crates/perry-ext-fastify/src/server.rs

@@ -124,15 +124,54 @@ extern "C" {
     fn js_error_get_message(error: *mut ErrorHeader) -> *mut StringHeader;
 }
 
-#[cfg(target_vendor = "apple")]
 extern "C" {
-    #[link_name = "_setjmp"]
-    fn setjmp(env: *mut c_int) -> c_int;
+    /// The runtime's C setjmp trampoline (#9305, `perry_sjlj.c`, bundled in
+    /// `libperry_runtime.a`). rustc cannot express `returns_twice`, so a raw
+    /// `setjmp` call in a Rust frame is miscompiled under LLVM's one-return
+    /// assumption (stack-slot coloring across the call); every jmp_buf arm
+    /// goes through this C frame instead. Mirrors
+    /// `perry_runtime::exception::arm_trap_and_run`.
+    fn perry_sjlj_try(
+        env: *mut core::ffi::c_void,
+        body: unsafe extern "C" fn(*mut core::ffi::c_void),
+        ctx: *mut core::ffi::c_void,
+    ) -> c_int;
 }
 
-#[cfg(not(target_vendor = "apple"))]
-extern "C" {
-    fn setjmp(env: *mut c_int) -> c_int;
+/// Arm `env` (from `js_try_push`) inside the C trampoline and run `f` under
+/// it. `None` = a JS throw longjmp-landed (exception state set, trap still
+/// pushed). Local mirror of `perry_runtime::exception::arm_trap_and_run` —
+/// this crate deliberately has no Cargo dep on perry-runtime.
+fn arm_trap_and_run<R, F: FnOnce() -> R>(env: *mut c_int, f: F) -> Option<R> {
+    struct Ctx<F, R> {
+        f: Option<F>,
+        ret: Option<R>,
+    }
+    unsafe extern "C" fn invoke<F: FnOnce() -> R, R>(raw: *mut core::ffi::c_void) {
+        let ctx = unsafe { &mut *(raw as *mut Ctx<F, R>) };
+        let f = ctx.f.take().expect("sjlj trampoline invoked body twice");
+        ctx.ret = Some(f());
+    }
+    let mut ctx: Ctx<_, R> = Ctx {
+        f: Some(f),
+        ret: None,
+    };
+    let rc = unsafe {
+        perry_sjlj_try(
+            env as *mut core::ffi::c_void,
+            invoke::<F, R>,
+            &mut ctx as *mut Ctx<_, R> as *mut core::ffi::c_void,
+        )
+    };
+    if rc == 0 {
+        Some(
+            ctx.ret
+                .take()
+                .expect("sjlj trampoline returned 0 without a body result"),
+        )
+    } else {
+        None
+    }
 }
 
 /// Opaque marker for the runtime's Promise struct. We never read its
@@ -1133,22 +1172,24 @@ fn call_hook_awaiting(hook: ClosurePtr, ctx_f64: f64, ctx_handle: Handle) -> Hoo
 
 unsafe fn call_closure2_catching(closure: JsClosure, arg0: f64, arg1: f64) -> ClosureCallResult {
     let trap_buf = js_try_push();
-    let jumped = setjmp(trap_buf);
-    if jumped != 0 {
-        let exc = js_get_exception();
-        js_clear_exception();
-        js_try_end();
-        return ClosureCallResult {
-            value: f64::from_bits(TAG_UNDEFINED),
-            thrown: Some(exc),
-        };
-    }
-
-    let value = closure.call2(arg0, arg1);
-    js_try_end();
-    ClosureCallResult {
-        value,
-        thrown: None,
+    let outcome = arm_trap_and_run(trap_buf, || unsafe { closure.call2(arg0, arg1) });
+    match outcome {
+        Some(value) => {
+            js_try_end();
+            ClosureCallResult {
+                value,
+                thrown: None,
+            }
+        }
+        None => {
+            let exc = js_get_exception();
+            js_clear_exception();
+            js_try_end();
+            ClosureCallResult {
+                value: f64::from_bits(TAG_UNDEFINED),
+                thrown: Some(exc),
+            }
+        }
     }
 }
 
@@ -1159,22 +1200,24 @@ unsafe fn call_closure3_catching(
     arg2: f64,
 ) -> ClosureCallResult {
     let trap_buf = js_try_push();
-    let jumped = setjmp(trap_buf);
-    if jumped != 0 {
-        let exc = js_get_exception();
-        js_clear_exception();
-        js_try_end();
-        return ClosureCallResult {
-            value: f64::from_bits(TAG_UNDEFINED),
-            thrown: Some(exc),
-        };
-    }
-
-    let value = closure.call3(arg0, arg1, arg2);
-    js_try_end();
-    ClosureCallResult {
-        value,
-        thrown: None,
+    let outcome = arm_trap_and_run(trap_buf, || unsafe { closure.call3(arg0, arg1, arg2) });
+    match outcome {
+        Some(value) => {
+            js_try_end();
+            ClosureCallResult {
+                value,
+                thrown: None,
+            }
+        }
+        None => {
+            let exc = js_get_exception();
+            js_clear_exception();
+            js_try_end();
+            ClosureCallResult {
+                value: f64::from_bits(TAG_UNDEFINED),
+                thrown: Some(exc),
+            }
+        }
     }
 }
 

crates/perry-runtime/Cargo.toml

@@ -426,6 +426,10 @@ mach2 = "0.6"
 # See `build.rs` and issue #395 for the rationale.
 [build-dependencies]
 perry-dispatch = { path = "../perry-dispatch" }
+# Build-time only: compiles the 20-line setjmp trampoline
+# (src/ffi/perry_sjlj.c) that the exception transport routes every
+# jmp_buf arm through — rustc cannot express `returns_twice` (#9305).
+cc = "1"
 # Build-time only: fingerprints the compiler/runtime source contract embedded
 # in libperry_runtime so the CLI can reject a stale archive before linking.
 sha2 = "0.11"

crates/perry-runtime/build.rs

@@ -538,6 +538,20 @@ fn main() {
     println!("cargo:rerun-if-changed=src/node_api_host/symbols.txt");
     println!("cargo:rerun-if-changed=../perry-dispatch/src/lib.rs");
     println!("cargo:rerun-if-env-changed=TARGET");
+
+    // setjmp trampoline for the Rust-side exception transport (#9305).
+    // Must be compiled by a C compiler: rustc cannot express
+    // `returns_twice`, so a Rust frame containing a live `setjmp` is
+    // miscompiled under LLVM's one-return assumption (stack-slot
+    // coloring across the call). See the header comment in the C file.
+    println!("cargo:rerun-if-changed=src/ffi/perry_sjlj.c");
+    cc::Build::new()
+        .file("src/ffi/perry_sjlj.c")
+        // The trampoline is never unwound through (a raise targeting a
+        // generated frame is always innermost-above it), but keep CFI so
+        // debuggers and the unwind-table self-check can walk past it.
+        .flag_if_supported("-fasynchronous-unwind-tables")
+        .compile("perry_sjlj");
     println!(
         "cargo:rustc-env=PERRY_RUNTIME_TARGET={}",
         std::env::var("TARGET").expect("TARGET not set by Cargo")

crates/perry-runtime/src/array/iterator.rs

@@ -487,14 +487,15 @@ fn async_from_sync_call_raw(iter: f64, method: &[u8], args: &[f64]) -> Result<Op
         None
     };
     let trap_buf = crate::exception::js_try_push();
-    let jumped = unsafe { crate::ffi::setjmp::setjmp(trap_buf as *mut std::os::raw::c_int) };
-    let result = if jumped == 0 {
+    // Armed in a C trampoline frame (#9305); everything between the landing
+    // and `js_try_end` below is pure TLS bookkeeping.
+    let outcome = crate::exception::arm_trap_and_run(trap_buf, || {
         let args_ptr = if args.is_empty() {
             std::ptr::null()
         } else {
             args.as_ptr()
         };
-        let value = if callable {
+        if callable {
             unsafe {
                 crate::closure::js_native_call_value(
                     method_value_h.get_nanbox_f64(),
@@ -512,12 +513,15 @@ fn async_from_sync_call_raw(iter: f64, method: &[u8], args: &[f64]) -> Result<Op
                     args.len(),
                 )
             }
-        };
-        Ok(Some(value))
-    } else {
-        let exc = crate::exception::js_get_exception();
-        crate::exception::js_clear_exception();
-        Err(exc)
+        }
+    });
+    let result = match outcome {
+        Some(value) => Ok(Some(value)),
+        None => {
+            let exc = crate::exception::js_get_exception();
+            crate::exception::js_clear_exception();
+            Err(exc)
+        }
     };
     if let Some(prev) = prev_this {
         crate::object::js_implicit_this_set(prev);
@@ -545,20 +549,21 @@ fn async_from_sync_call_cached_raw(
     }
     let prev_this = crate::object::js_implicit_this_set(iter);
     let trap_buf = crate::exception::js_try_push();
-    let jumped = unsafe { crate::ffi::setjmp::setjmp(trap_buf as *mut std::os::raw::c_int) };
-    let result = if jumped == 0 {
+    let outcome = crate::exception::arm_trap_and_run(trap_buf, || {
         let args_ptr = if args.is_empty() {
             std::ptr::null()
         } else {
             args.as_ptr()
         };
-        let value =
-            unsafe { crate::closure::js_native_call_value(method_value, args_ptr, args.len()) };
-        Ok(Some(value))
-    } else {
-        let exc = crate::exception::js_get_exception();
-        crate::exception::js_clear_exception();
-        Err(exc)
+        unsafe { crate::closure::js_native_call_value(method_value, args_ptr, args.len()) }
+    });
+    let result = match outcome {
+        Some(value) => Ok(Some(value)),
+        None => {
+            let exc = crate::exception::js_get_exception();
+            crate::exception::js_clear_exception();
+            Err(exc)
+        }
     };
     crate::object::js_implicit_this_set(prev_this);
     crate::exception::js_try_end();
@@ -1156,23 +1161,28 @@ pub(crate) fn array_from_spread_value(value: f64) -> *mut ArrayHeader {
             // `this` is the same defect one frame out.
             let prev_this_h = scope.root_nanbox_f64(prev_this);
             let trap_buf = crate::exception::js_try_push();
-            let jumped =
-                unsafe { crate::ffi::setjmp::setjmp(trap_buf as *mut std::os::raw::c_int) };
             // `js_try_push` captured the handle-stack depth AFTER these roots
-            // were pushed, so the `longjmp` restore below leaves them intact and
-            // reading them here is sound.
-            let iter = if jumped == 0 {
+            // were pushed, so the `longjmp` restore leaves them intact and
+            // reading them here is sound. Armed in a C trampoline frame
+            // (#9305); the rethrow below runs after `js_try_end` pops this
+            // trap, so it targets the enclosing handler.
+            let outcome = crate::exception::arm_trap_and_run(trap_buf, || {
                 crate::closure::js_closure_call0(js_nanbox_get_pointer(rebound_h.get_nanbox_f64())
                     as *const crate::closure::ClosureHeader)
-            } else {
-                // Factory threw: restore the receiver and unwind the trap frame
-                // before re-propagating, so IMPLICIT_THIS can't leak into later
-                // calls (mirrors `async_from_sync_call_cached_raw` above).
-                let exc = crate::exception::js_get_exception();
-                crate::exception::js_clear_exception();
-                crate::object::js_implicit_this_set(prev_this_h.get_nanbox_f64());
-                crate::exception::js_try_end();
-                crate::exception::js_throw(exc)
+            });
+            let iter = match outcome {
+                Some(iter) => iter,
+                None => {
+                    // Factory threw: restore the receiver and unwind the trap
+                    // frame before re-propagating, so IMPLICIT_THIS can't leak
+                    // into later calls (mirrors `async_from_sync_call_cached_raw`
+                    // above).
+                    let exc = crate::exception::js_get_exception();
+                    crate::exception::js_clear_exception();
+                    crate::object::js_implicit_this_set(prev_this_h.get_nanbox_f64());
+                    crate::exception::js_try_end();
+                    crate::exception::js_throw(exc)
+                }
             };
             let iter_h = scope.root_nanbox_f64(iter);
             crate::object::js_implicit_this_set(prev_this_h.get_nanbox_f64());

crates/perry-runtime/src/collection_iter.rs

@@ -17,7 +17,6 @@
 //! call into here so the throw-vs-empty-vs-consume decision lives in one place.
 
 use crate::value::{js_jsvalue_to_string, js_nanbox_get_pointer, JSValue, TAG_NULL, TAG_UNDEFINED};
-use std::os::raw::c_int;
 
 /// `typeof`-style word for a non-iterable value, used to build the Node
 /// "<type> is not iterable" message. `null`/`undefined` are handled by the
@@ -269,17 +268,7 @@ pub(crate) fn constructor_iter(value: f64) -> ConstructorIter {
 }
 
 pub(crate) fn call_capturing_throw(call: impl FnOnce() -> f64) -> Result<f64, f64> {
-    let trap_buf = crate::exception::js_try_push();
-    let jumped = unsafe { crate::ffi::setjmp::setjmp(trap_buf as *mut c_int) };
-    let result = if jumped == 0 {
-        Ok(call())
-    } else {
-        let exc = crate::exception::js_get_exception();
-        crate::exception::js_clear_exception();
-        Err(exc)
-    };
-    crate::exception::js_try_end();
-    result
+    crate::exception::catch_js_throw(call)
 }
 
 pub(crate) fn call_with_this_capturing_throw(