fix(path): #7621 — path.* arms read an SSO string's inline bytes as a header

`path.resolve("/root", computedShortString)` threw ERR_INVALID_ARG_TYPE where
node returns the path. Every `path.*` codegen arm unboxed its operand with
`unbox_to_i64` (`bitcast double -> i64; and POINTER_MASK`) and handed the low 48
bits to a runtime entry that dereferences them as `*const StringHeader`. That is
the header for a HEAP string and the CHARACTERS for a small-string-optimized one
(SHORT_STRING_TAG, <= SHORT_STRING_MAX_LEN = 5 inline bytes) — so a literal
worked (interned onto the heap) and a computed short string did not. Bisected by
length: 5 bytes throws, 6 works.

Twelve arms were affected, not the five the issue named: resolve, resolve's fold
step, join, win32.join, normalize, extname, dirname, basename, basename(p, ext),
isAbsolute, parse, matchesGlob, plus the win32 sub-namespace equivalents. `parse`
and `matchesGlob` were SILENTLY wrong rather than throwing.

Single-operand arms now call `js_path_arg_header`, which materializes only the
SSO case and reproduces the old mask bit for bit for heap strings AND every
non-string — so each entry point keeps its own established non-string behaviour
(throw, or `unwrap_or_default`). It is deliberately not
`js_get_string_pointer_unified`, which coerces numbers to strings and would turn
`path.isAbsolute(5)` from a throw into `false`.

Two-operand arms take both operands NaN-boxed and unbox inside one runtime call
(`js_path_*_value`). Codegen cannot close that window itself: materializing the
first operand allocates, and `rooting::with_operands_rooted` hands the lowering
registers rather than slots, so the second operand's register is stale with no
re-read to reach for. The runtime entry roots the first operand across the
second's materialization via `RuntimeHandle::across_const`.

Validated locally: the new gap test is byte-identical to node 26.5.1 and exits 0
(it threw at line 2 before the fix); byte-identical again under PERRY_GC_ZEAL=1 +
PERRY_GC_PROTECT_FROMSPACE=1 with 402k copying minors observed; test_parity_path,
test_gap_node_path, test_gap_6371_path_lexical_semantics, test_gap_node_fs and
test_cli_simulation unchanged.

Author: Ralph Küpper

crates/perry-codegen/src/expr/array_methods.rs

@@ -278,17 +278,19 @@ pub(crate) fn lower(ctx: &mut FnCtx<'_>, expr: &Expr) -> Result<String> {
         Expr::StaticPluginResolve(_) => Ok(double_literal(0.0)),
 
         // -------- More cheap stubs --------
+        // #7621: `js_path_arg_header`, not `unbox_to_i64` — the plain mask hands
+        // an SSO string's inline CHARACTERS to a `*StringHeader` consumer.
         Expr::PathNormalize(p) => {
             let p_box = lower_expr(ctx, p)?;
             let blk = ctx.block();
-            let p_handle = unbox_to_i64(blk, &p_box);
+            let p_handle = blk.call(I64, "js_path_arg_header", &[(DOUBLE, &p_box)]);
             let result = blk.call(I64, "js_path_normalize", &[(I64, &p_handle)]);
             Ok(nanbox_string_inline(blk, &result))
         }
         Expr::PathResolve(p) => {
             let p_box = lower_expr(ctx, p)?;
             let blk = ctx.block();
-            let p_handle = unbox_to_i64(blk, &p_box);
+            let p_handle = blk.call(I64, "js_path_arg_header", &[(DOUBLE, &p_box)]);
             let result = blk.call(I64, "js_path_resolve", &[(I64, &p_handle)]);
             Ok(nanbox_string_inline(blk, &result))
         }

crates/perry-codegen/src/expr/arrays_finds.rs

@@ -556,7 +556,12 @@ pub(crate) fn lower(
         Expr::PathExtname(p) => {
             let p_box = lower_expr(ctx, p)?;
             let blk = ctx.block();
-            let p_handle = unbox_to_i64(blk, &p_box);
+            // #7621: `js_path_arg_header`, not `unbox_to_i64` — the plain mask
+            // hands an SSO string's inline CHARACTERS to a `*StringHeader`
+            // consumer. Single-operand arms need no rooting: the materialising
+            // call is immediately followed by the consumer, with nothing
+            // between them that can collect.
+            let p_handle = blk.call(I64, "js_path_arg_header", &[(DOUBLE, &p_box)]);
             let result = blk.call(I64, "js_path_extname", &[(I64, &p_handle)]);
             Ok(nanbox_string_inline(blk, &result))
         }
@@ -591,26 +596,29 @@ pub(crate) fn lower(
                 let p_box = vals[0].clone();
                 let pat_box = vals[1].clone();
                 let blk = ctx.block();
-                let p_handle = unbox_to_i64(blk, &p_box);
-                let pat_handle = unbox_to_i64(blk, &pat_box);
                 let i32_v = blk.call(
                     I32,
-                    "js_path_matches_glob",
-                    &[(I64, &p_handle), (I64, &pat_handle)],
+                    "js_path_matches_glob_value",
+                    &[(DOUBLE, &p_box), (DOUBLE, &pat_box)],
                 );
                 Ok(i32_bool_to_nanbox(blk, &i32_v))
             })
         }
+        // #7621: both operands go to the runtime NaN-BOXED. Unboxing them here
+        // would mean two `js_path_arg_header` calls, and the first one
+        // ALLOCATES for an SSO operand — a collection point with the second
+        // operand still live in a bare register. This API cannot close that
+        // window (`with_operands_rooted` yields registers, not slots, and
+        // `RootedSlot` has no `read` by design), so the pair is unboxed inside
+        // one runtime call that roots across its own materialisation.
         Expr::PathResolveJoin(a, b) => rooting::with_operands_rooted(ctx, &[a, b], |ctx, vals| {
             let a_box = vals[0].clone();
             let b_box = vals[1].clone();
             let blk = ctx.block();
-            let a_handle = unbox_to_i64(blk, &a_box);
-            let b_handle = unbox_to_i64(blk, &b_box);
             let result = blk.call(
                 I64,
-                "js_path_resolve_join",
-                &[(I64, &a_handle), (I64, &b_handle)],
+                "js_path_resolve_join_value",
+                &[(DOUBLE, &a_box), (DOUBLE, &b_box)],
             );
             Ok(nanbox_string_inline(blk, &result))
         }),

crates/perry-codegen/src/expr/instance_misc1.rs

@@ -939,11 +939,22 @@ pub(crate) fn lower(ctx: &mut FnCtx<'_>, expr: &Expr) -> Result<String> {
         // -------- path.join(a, b) -> string --------
         // The HIR variant is binary; multi-arg path.join lowers to
         // chained PathJoin in the HIR.
+        // #7621: both operands reach the runtime NaN-BOXED, so this arm emits
+        // NO unbox at all. Unboxing here would need two `js_path_arg_header`
+        // calls, and the first ALLOCATES for an SSO operand — a collection
+        // point with the second operand still in a bare register, i.e. exactly
+        // the window the #7615 migration exists to remove. Handing both
+        // NaN-boxed doubles to one runtime entry deletes the window from
+        // codegen rather than protecting it: `js_path_join_value` roots operand
+        // 1 across its own materialisation with `RuntimeHandle::across_const`.
+        // See perry-runtime/src/path/value_args.rs.
         Expr::PathJoin(a, b) => rooting::with_operands_rooted(ctx, &[a, b], |ctx, vals| {
             let blk = ctx.block();
-            let a_handle = unbox_to_i64(blk, &vals[0]);
-            let b_handle = unbox_to_i64(blk, &vals[1]);
-            let result = blk.call(I64, "js_path_join", &[(I64, &a_handle), (I64, &b_handle)]);
+            let result = blk.call(
+                I64,
+                "js_path_join_value",
+                &[(DOUBLE, &vals[0]), (DOUBLE, &vals[1])],
+            );
             Ok(nanbox_string_inline(blk, &result))
         }),
 
@@ -953,12 +964,11 @@ pub(crate) fn lower(ctx: &mut FnCtx<'_>, expr: &Expr) -> Result<String> {
         // PathWin32Join in the HIR.
         Expr::PathWin32Join(a, b) => rooting::with_operands_rooted(ctx, &[a, b], |ctx, vals| {
             let blk = ctx.block();
-            let a_handle = unbox_to_i64(blk, &vals[0]);
-            let b_handle = unbox_to_i64(blk, &vals[1]);
+            // #7621: NaN-boxed pair, no unbox here — see `Expr::PathJoin`.
             let result = blk.call(
                 I64,
-                "js_path_win32_join",
-                &[(I64, &a_handle), (I64, &b_handle)],
+                "js_path_win32_join_value",
+                &[(DOUBLE, &vals[0]), (DOUBLE, &vals[1])],
             );
             Ok(nanbox_string_inline(blk, &result))
         }),
@@ -998,7 +1008,17 @@ pub(crate) fn lower(ctx: &mut FnCtx<'_>, expr: &Expr) -> Result<String> {
                             _ => unreachable!(),
                         };
                         let blk = ctx.block();
-                        let h = unbox_to_i64(blk, &lowered[0]);
+                        // #7621: `js_path_arg_header`, not `unbox_to_i64` — the
+                        // plain mask hands an SSO string's inline CHARACTERS to
+                        // a `*StringHeader` consumer. It is emitted INSIDE the
+                        // rooted region, and needs no window of its own: the
+                        // materialising call is immediately followed by its
+                        // consumer with nothing between them, and the helper
+                        // only allocates — it cannot re-enter user code or
+                        // enumerate an object, so per #7198 it cannot initiate a
+                        // moving collection and `with_operands_rooted_across_call`
+                        // would be pure cost here.
+                        let h = blk.call(I64, "js_path_arg_header", &[(DOUBLE, &lowered[0])]);
                         let result = blk.call(I64, fn_name, &[(I64, &h)]);
                         Ok(nanbox_string_inline(blk, &result))
                     }
@@ -1016,34 +1036,46 @@ pub(crate) fn lower(ctx: &mut FnCtx<'_>, expr: &Expr) -> Result<String> {
                         Ok(nanbox_string_inline(blk, &result))
                     }
                     PathWin32Method::BasenameExt | PathWin32Method::ResolveJoin => {
+                        // #7621: two-operand methods hand BOTH operands to the
+                        // runtime NaN-boxed, so this arm emits no unbox at all
+                        // — see the `Expr::PathJoin` comment above for why that
+                        // is stronger than protecting the window here.
                         let fn_name = match method {
-                            PathWin32Method::BasenameExt => "js_path_win32_basename_ext",
-                            PathWin32Method::ResolveJoin => "js_path_win32_resolve_join",
+                            PathWin32Method::BasenameExt => "js_path_win32_basename_ext_value",
+                            PathWin32Method::ResolveJoin => "js_path_win32_resolve_join_value",
                             _ => unreachable!(),
                         };
                         let blk = ctx.block();
-                        let a = unbox_to_i64(blk, &lowered[0]);
-                        let b = unbox_to_i64(blk, &lowered[1]);
-                        let result = blk.call(I64, fn_name, &[(I64, &a), (I64, &b)]);
+                        let result = blk.call(
+                            I64,
+                            fn_name,
+                            &[(DOUBLE, &lowered[0]), (DOUBLE, &lowered[1])],
+                        );
                         Ok(nanbox_string_inline(blk, &result))
                     }
                     PathWin32Method::IsAbsolute => {
                         let blk = ctx.block();
-                        let h = unbox_to_i64(blk, &lowered[0]);
+                        // #7621: SSO-safe unbox — see the Dirname arm above.
+                        let h = blk.call(I64, "js_path_arg_header", &[(DOUBLE, &lowered[0])]);
                         let i32_v = blk.call(I32, "js_path_win32_is_absolute", &[(I64, &h)]);
                         Ok(i32_bool_to_nanbox(blk, &i32_v))
                     }
                     PathWin32Method::MatchesGlob => {
                         let blk = ctx.block();
-                        let p = unbox_to_i64(blk, &lowered[0]);
-                        let pat = unbox_to_i64(blk, &lowered[1]);
-                        let i32_v =
-                            blk.call(I32, "js_path_win32_matches_glob", &[(I64, &p), (I64, &pat)]);
+                        // #7621: NaN-boxed pair, no unbox here.
+                        let i32_v = blk.call(
+                            I32,
+                            "js_path_win32_matches_glob_value",
+                            &[(DOUBLE, &lowered[0]), (DOUBLE, &lowered[1])],
+                        );
                         Ok(i32_bool_to_nanbox(blk, &i32_v))
                     }
                     PathWin32Method::Parse => {
                         let blk = ctx.block();
-                        let h = unbox_to_i64(blk, &lowered[0]);
+                        // #7621: SSO-safe unbox. Before this,
+                        // `path.win32.parse(shortComputed).base` was silently ""
+                        // rather than a throw.
+                        let h = blk.call(I64, "js_path_arg_header", &[(DOUBLE, &lowered[0])]);
                         let result = blk.call(I64, "js_path_win32_parse", &[(I64, &h)]);
                         Ok(nanbox_pointer_inline(blk, &result))
                     }
@@ -1237,7 +1269,8 @@ pub(crate) fn lower(ctx: &mut FnCtx<'_>, expr: &Expr) -> Result<String> {
         Expr::PathDirname(p) => {
             let p_box = lower_expr(ctx, p)?;
             let blk = ctx.block();
-            let p_handle = unbox_to_i64(blk, &p_box);
+            // #7621: SSO-safe unbox (see path/value_args.rs).
+            let p_handle = blk.call(I64, "js_path_arg_header", &[(DOUBLE, &p_box)]);
             let result = blk.call(I64, "js_path_dirname", &[(I64, &p_handle)]);
             Ok(nanbox_string_inline(blk, &result))
         }
@@ -1714,21 +1747,22 @@ pub(crate) fn lower(ctx: &mut FnCtx<'_>, expr: &Expr) -> Result<String> {
         Expr::PathBasename(p) => {
             let p_box = lower_expr(ctx, p)?;
             let blk = ctx.block();
-            let p_handle = unbox_to_i64(blk, &p_box);
+            // #7621: SSO-safe unbox (see path/value_args.rs).
+            let p_handle = blk.call(I64, "js_path_arg_header", &[(DOUBLE, &p_box)]);
             let result = blk.call(I64, "js_path_basename", &[(I64, &p_handle)]);
             Ok(nanbox_string_inline(blk, &result))
         }
         Expr::PathBasenameExt(p, ext) => {
             // path.basename(path, ext) — strips trailing `ext` suffix.
-            // Runtime: js_path_basename_ext(path_ptr, ext_ptr) -> *StringHeader.
+            // #7621: the runtime entry takes both operands NaN-boxed and
+            // unboxes them under a root, so this arm emits no unbox — see
+            // `Expr::PathJoin`.
             rooting::with_operands_rooted(ctx, &[p, ext], |ctx, vals| {
                 let blk = ctx.block();
-                let p_handle = unbox_to_i64(blk, &vals[0]);
-                let e_handle = unbox_to_i64(blk, &vals[1]);
                 let result = blk.call(
                     I64,
-                    "js_path_basename_ext",
-                    &[(I64, &p_handle), (I64, &e_handle)],
+                    "js_path_basename_ext_value",
+                    &[(DOUBLE, &vals[0]), (DOUBLE, &vals[1])],
                 );
                 Ok(nanbox_string_inline(blk, &result))
             })
@@ -1737,7 +1771,10 @@ pub(crate) fn lower(ctx: &mut FnCtx<'_>, expr: &Expr) -> Result<String> {
             // path.parse(p) -> object with { dir, base, ext, name, root }
             let p_box = lower_expr(ctx, p)?;
             let blk = ctx.block();
-            let p_handle = unbox_to_i64(blk, &p_box);
+            // #7621: SSO-safe unbox (see path/value_args.rs). Before this,
+            // `path.parse(shortComputed).base` was silently "" rather than a
+            // throw, because js_path_parse defaults an unreadable header.
+            let p_handle = blk.call(I64, "js_path_arg_header", &[(DOUBLE, &p_box)]);
             let result = blk.call(I64, "js_path_parse", &[(I64, &p_handle)]);
             Ok(nanbox_pointer_inline(blk, &result))
         }

crates/perry-codegen/src/expr/misc_methods.rs

@@ -207,7 +207,8 @@ pub(crate) fn lower(ctx: &mut FnCtx<'_>, expr: &Expr) -> Result<String> {
         Expr::PathIsAbsolute(p) => {
             let p_box = lower_expr(ctx, p)?;
             let blk = ctx.block();
-            let p_handle = unbox_to_i64(blk, &p_box);
+            // #7621: SSO-safe unbox — see crates/perry-runtime/src/path/value_args.rs.
+            let p_handle = blk.call(I64, "js_path_arg_header", &[(DOUBLE, &p_box)]);
             let i32_res = blk.call(I32, "js_path_is_absolute", &[(I64, &p_handle)]);
             Ok(i32_bool_to_nanbox(blk, &i32_res))
         }

crates/perry-codegen/src/runtime_decls/strings.rs

@@ -1528,6 +1528,20 @@ pub fn declare_phase_b_strings(module: &mut LlModule) {
     module.declare_function("js_path_to_namespaced_path_value", DOUBLE, &[DOUBLE]);
     module.declare_function("js_path_matches_glob", I32, &[I64, I64]);
     module.declare_function("js_path_resolve_join", I64, &[I64, I64]);
+    // #7621 — SSO-safe operand entries. `js_path_arg_header` replaces the
+    // `unbox_to_i64` mask on every single-operand arm; the `_value` pair
+    // entries unbox BOTH operands inside the runtime so the first one can be
+    // rooted across the second's materialisation. See
+    // perry-runtime/src/path/value_args.rs.
+    module.declare_function("js_path_arg_header", I64, &[DOUBLE]);
+    module.declare_function("js_path_join_value", I64, &[DOUBLE, DOUBLE]);
+    module.declare_function("js_path_win32_join_value", I64, &[DOUBLE, DOUBLE]);
+    module.declare_function("js_path_resolve_join_value", I64, &[DOUBLE, DOUBLE]);
+    module.declare_function("js_path_win32_resolve_join_value", I64, &[DOUBLE, DOUBLE]);
+    module.declare_function("js_path_basename_ext_value", I64, &[DOUBLE, DOUBLE]);
+    module.declare_function("js_path_win32_basename_ext_value", I64, &[DOUBLE, DOUBLE]);
+    module.declare_function("js_path_matches_glob_value", I32, &[DOUBLE, DOUBLE]);
+    module.declare_function("js_path_win32_matches_glob_value", I32, &[DOUBLE, DOUBLE]);
     module.declare_function("js_object_from_entries", DOUBLE, &[DOUBLE]);
     module.declare_function("js_string_match", I64, &[I64, I64]);
     module.declare_function("js_string_match_all", I64, &[I64, I64]);

crates/perry-runtime/src/path.rs

@@ -1862,5 +1862,8 @@ pub extern "C" fn js_path_win32_relative(
     string_to_js(&parts.join("\\"))
 }
 
+/// NaN-boxed operand entry points (#7621) — see the child module's docs.
+pub mod value_args;
+
 #[cfg(test)]
 mod tests;