rusty_racer 0.1.12 → 0.1.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4542f56f4c8cb1876105fb7f8cd5505e2396a1360cc7624b2574e757ab3ff3da
-  data.tar.gz: cee44a45689b33bc7e9aa5280eb8fd4b5ad7b5b2e1d00984314da7f31de0fcf7
+  metadata.gz: bef5f6ca0708cb89d0468f4aaca77ccdae184114733de79980b2a84c51660cb3
+  data.tar.gz: 843f938abbb31aeb8631bb943052d3b326990eee1e13d38537aecba4c409a7b5
 SHA512:
-  metadata.gz: 16c2bbc4c12f411bf6ed449389cf48be2c83c57314ae66ed829e5d43bcecdeed1347c472cf0de363d525ef69626c13c85b1c5a23074ce2073c364e0199ec9d73
-  data.tar.gz: ad6b2103105c6b9b56dfc9f922ad7ee233e174daba11508b163190bbcde5de7647b156fc00beec8ac06be6de7cc7b23643c2ff347facbc999113f400699cfc27
+  metadata.gz: db1ae8f6a5e6793b5ccb172d9412b94e70535e4b4adb25ba18ba8128bdee006ed29ce87a3de60c4aadaaf497239a27655ae1d9573dad3b4f8b764f12601c7bee
+  data.tar.gz: ed7e48d5c2e942cfbe368e1c61ca7169ef4c126a609e4f9ec189e73f6534946ebeb91e48e284c3965547d6437cdbf1819c6e0498e781adf151d286d1054a4422

data/README.md

@@ -252,14 +252,19 @@ In-thread V8 runs on whatever stack the calling Ruby code is on — including a
 **Fiber**'s separate stack (a plain `Enumerator` is a Fiber, so this is common:
 `Capybara::Result#find`, lazy enumerators, …). This works on the **main thread**,
 where the process stack is the highest address and every Fiber sits below it.
-
-On a **non-main thread** it does not: V8 anchors its "is this the central stack?"
-check to that thread's native stack top (a pthread value it caches, with no API
-to retarget), and a Fiber allocated *above* that top — the usual case off the
-main thread — falls outside the check, so V8 aborts the process on the next GC or
-thrown exception. So **don't call into an isolate from inside a Fiber on a
-worker thread**; drive isolate ops directly on the thread, or keep
-Fiber/Enumerator-mediated JS calls on the main thread.
+That includes a Fiber entered *underneath* a running JS call — a host function
+that resumes a Fiber which evals again — since each operation describes its own
+stack to V8 and restores the enclosing one when it returns.
+
+On a **non-main thread** it does not. V8 decides "is this the central stack?" by
+testing the stack pointer against a window that ends at the thread's native stack
+top — a pthread value it caches, with no API to retarget on POSIX. Only the
+window's *lower* edge follows the per-operation stack limit, so a Fiber allocated
+*above* that top — the usual case off the main thread, whose own stack sits below
+later Fiber mmaps — is outside the window whatever we do, and V8 aborts the
+process on the next GC or thrown exception. So **don't call into an isolate from
+inside a Fiber on a worker thread**; drive isolate ops directly on the thread, or
+keep Fiber/Enumerator-mediated JS calls on the main thread.
 
 ## Installation
 

data/ext/rusty_racer/Cargo.toml

@@ -5,7 +5,7 @@
 # links and loads with no custom archive.
 [package]
 name = "rusty_racer"
-version = "0.1.12"
+version = "0.1.14"
 edition = "2024"
 publish = false
 
@@ -23,7 +23,7 @@ rb-sys = "0.9"
 # ~6-8x faster marshalling for non-ASCII results (measured); ASCII is unaffected.
 # The feature makes the v8 crate fetch Deno's _simdutf prebuilt archive variant
 # (which is built with rusty_v8_enable_simdutf=true) on every platform.
-v8 = { version = "150.3.0", features = ["simdutf"] }
+v8 = { version = "150.4.0", features = ["simdutf"] }
 # pthread stack-bounds query, to set V8's stack limit per op relative to the
 # current native thread (in-thread V8 runs on the Ruby thread's stack).
 libc = "0.2"

data/ext/rusty_racer/src/lib.rs

@@ -54,7 +54,7 @@ use marshal::{js_to_jsval, jsval_to_js, jsval_to_ruby, ruby_to_jsval, JsVal};
 mod ops;
 use ops::{run_source, service_request, Compiled, Request, VmReply};
 mod stack;
-use stack::{current_real_isolate, discover_scan_start_field, set_v8_stack_limit, STACK_DEBUG};
+use stack::{current_real_isolate, discover_scan_start_field, StackScope, STACK_DEBUG};
 mod watchdog;
 use watchdog::{
     arm_watchdog, disarm_watchdog, run_js_bracketed, watchdog_loop, WatchdogShared, WATCHDOG_DEBUG,
@@ -1229,10 +1229,16 @@ struct Core {
     // the owner thread.
     iso_ptr: IsoPtr,
     // Address of V8's conservative-GC-scan stack_start field (see
-    // discover_scan_start_field), or 0 if discovery failed. set_v8_stack_limit
-    // writes the fiber region top here per fiber op so a GC scan stays mapped.
-    // Set once at creation, then read-only; AtomicUsize for shared &Core access.
+    // discover_scan_start_field), or 0 if discovery failed. StackScope writes the
+    // fiber region top here per fiber op so a GC scan stays mapped. Set once at
+    // creation, then read-only; AtomicUsize for shared &Core access.
     scan_start_field: std::sync::atomic::AtomicUsize,
+    // The stack limit currently installed in V8 for this isolate. StackScope
+    // keeps it here because V8 exposes no getter and a nested op running on
+    // another stack has to put the enclosing op's limit back. 0 before the first
+    // op. Owner-thread only, like the isolate itself; AtomicUsize for shared
+    // &Core access.
+    installed_stack_limit: std::sync::atomic::AtomicUsize,
     // Re-entry depth for THIS isolate, readable without a scope (the runner needs
     // it to choose the scope kind before any scope exists): 0 = top-level op
     // (open a fresh HandleScope from iso_ptr); >0 = a host callback is on the V8
@@ -1998,6 +2004,7 @@ impl Isolate {
             _owner_root: RootedThread(BoxValue::new(owner_thread)),
             iso_ptr,
             scan_start_field: std::sync::atomic::AtomicUsize::new(0),
+            installed_stack_limit: std::sync::atomic::AtomicUsize::new(0),
             depth: std::sync::atomic::AtomicU32::new(0),
             procs: Mutex::new(ProcTable::default()),
             default_timeout_ms: timeout_ms,
@@ -2084,29 +2091,69 @@ impl Core {
         // poison the isolate and raise instead of crashing the process.
         use std::panic::AssertUnwindSafe;
         let reply: Option<VmReply> = without_gvl(|| {
-            if depth == 0 {
+            // iso_ptr is *mut v8::Isolate = *mut NonNull<RealIsolate>; the raw
+            // v8::Isolate* the C++ entry points want is that NonNull's value.
+            let real_isolate = unsafe { *(iso as *const *mut c_void) };
+            // Whether this op has to ENTER the isolate itself. At depth 0 always:
+            // between ops the isolate is exited, so each op enters around its run.
+            //
+            // A re-entrant op (a host callback or module resolver, having
+            // reacquired the GVL to run a proc that issued this op, is on the V8
+            // stack) USUALLY does not: the JS on the stack belongs to THIS
+            // isolate, which is therefore already entered on THIS native thread,
+            // and we bootstrap onto the ambient HandleScope instead.
+            //
+            // But an embedder driving MANY isolates (e.g. capybara-simulated's
+            // windows) can interleave them: a host callback on isolate A runs
+            // Ruby that evals isolate B, whose own callback re-enters A. Now A is
+            // on the V8 stack (depth > 0) yet B — not A — is the isolate
+            // CURRENTLY entered on this thread, so bootstrapping a scope on A and
+            // opening a ContextScope would trip V8's "scope and Context do not
+            // belong to the same Isolate" panic (it checks the scope's isolate
+            // against Isolate::GetCurrent()). Detect that case and properly enter
+            // A on top of B, restoring B on exit.
+            let entered = depth == 0 || real_isolate != current_real_isolate();
+            // Snapshot the ENCLOSING op's conservative-GC-scan start BEFORE
+            // entering: Isolate::Enter re-points it at the native top, so reading
+            // it afterwards would hand StackScope the clobbered value to
+            // "restore" — stranding an enclosing FIBER op with a start on the
+            // native stack, whose next GC walks off the fiber's mapped top and
+            // SEGVs. None at depth 0, where the value in the field belongs to the
+            // previous, already-finished op and so is nothing to preserve.
+            let scan_start_field = self.scan_start_field.load(Ordering::Relaxed);
+            let enclosing_scan_start = if depth > 0 && scan_start_field != 0 {
+                Some(unsafe { *(scan_start_field as *const usize) })
+            } else {
+                None
+            };
+            if entered {
                 unsafe { (*iso).enter() };
-                // In-thread: V8 runs on THIS native thread's stack. Re-point its
-                // stack limit at this thread's bottom before running JS — the
-                // create-time limit is fixed at a shallow (or other-thread)
-                // frame, so a deeper entry would false-overflow (and the bad
-                // throw trips V8's IsOnCentralStack CHECK -> fatal). iso_ptr is
-                // *mut v8::Isolate = *mut NonNull<RealIsolate>; the raw
-                // v8::Isolate* the C++ method wants is that NonNull's value.
-                let real_isolate = unsafe { *(iso as *const *mut c_void) };
-                // A live address ABOVE every V8 frame of this op (the scope and
-                // service_request below run in deeper frames). On a fiber it
-                // becomes V8's conservative-GC-scan stack_start so the scan stays
-                // within the live, mapped stack — see set_v8_stack_limit.
-                let stack_top_marker = 0u8;
-                // Word-align (down): V8 CHECKs the scan start is pointer-aligned.
-                // Down stays above all V8 frames (they're a full frame below).
-                let stack_top = (&stack_top_marker as *const u8 as usize) & !(size_of::<usize>() - 1);
-                set_v8_stack_limit(
-                    real_isolate,
-                    self.scan_start_field.load(Ordering::Relaxed),
-                    stack_top,
-                );
+            }
+            // In-thread: V8 runs on whatever stack the Ruby caller is on — this
+            // native thread's, or a Ruby Fiber's if a host callback resumed one.
+            // Describe that stack to the isolate for the duration of the op, and
+            // put the enclosing op's description back afterwards. Both the
+            // create-time limit (fixed at a shallow, possibly other-thread frame)
+            // and an enclosing op's are stale here, and a stale limit doesn't
+            // merely false-overflow — it makes the resulting throw FATAL. See
+            // StackScope.
+            //
+            // stack_top_marker is a live address ABOVE every V8 frame of this op
+            // (the scope and service_request below run in deeper frames); on a
+            // fiber it becomes V8's conservative-GC-scan start so the scan stays
+            // within the live, mapped stack.
+            let stack_top_marker = 0u8;
+            // Word-align (down): V8 CHECKs the scan start is pointer-aligned.
+            // Down stays above all V8 frames (they're a full frame below).
+            let stack_top = (&stack_top_marker as *const u8 as usize) & !(size_of::<usize>() - 1);
+            let stack = StackScope::enter(
+                real_isolate,
+                scan_start_field,
+                enclosing_scan_start,
+                &self.installed_stack_limit,
+                stack_top,
+            );
+            if depth == 0 {
                 let mut reply = std::panic::catch_unwind(AssertUnwindSafe(|| {
                     v8::scope!(let scope, unsafe { &mut *iso });
                     service_request(scope, request, true)
@@ -2145,45 +2192,20 @@ impl Core {
                     istate!(iso_ref).oom_fired = false;
                     reply = reply.map(relabel_oom);
                 }
+                // Drop the stack description BEFORE popping the isolate — exit()
+                // can leave a different one current. At depth 0 the drop restores
+                // nothing (no enclosing op), so this just releases the scope.
+                drop(stack);
                 unsafe { (*iso).exit() };
                 reply
             } else {
-                // Re-entrant (a host callback or module resolver, having
-                // reacquired the GVL to run a proc that issued this op, is on the
-                // V8 stack). USUALLY the JS on the stack belongs to THIS isolate
-                // (same-isolate reentry) — which is therefore already entered on
-                // THIS native thread — so we bootstrap onto the ambient
-                // HandleScope without re-entering.
-                //
-                // But an embedder driving MANY isolates (e.g. capybara-simulated's
-                // windows) can interleave them: a host callback on isolate A runs
-                // Ruby that evals isolate B, whose own callback re-enters A. Now A
-                // is on the V8 stack (depth > 0) yet B — not A — is the isolate
-                // CURRENTLY entered on this thread, so bootstrapping a scope on A
-                // and opening a ContextScope would trip V8's "scope and Context do
-                // not belong to the same Isolate" panic (it checks the scope's
-                // isolate against Isolate::GetCurrent()). Detect that case and
-                // properly enter A on top of B, restoring B on exit. Entering an
-                // already-current isolate is also harmless (V8's entered-isolate
-                // stack nests), so this is correct for same-isolate reentry too —
-                // we only pay the enter/exit when a FOREIGN isolate is on top.
-                //
-                // The stack limit + scan-start set at depth 0 are NOT re-pointed
-                // here: reentry runs in DEEPER frames of the SAME stack, so the
-                // depth-0 values still bound it correctly (whichever isolate is
-                // current — each tracks its own limit). The one exception is a
-                // host callback that SWITCHES stacks — e.g. resumes a Ruby Fiber
-                // that itself evals — where the depth-0 (native) settings are
-                // stale for the fiber; that nested-fiber-under-callback case is an
-                // unsupported edge (the realistic fiber path is a depth-0 eval).
-                let foreign = unsafe { *(iso as *const *mut c_void) } != current_real_isolate();
-                if foreign {
-                    unsafe { (*iso).enter() };
-                }
+                // Re-entrant. `entered` is true only when a FOREIGN isolate was
+                // on top (see above): that one had no ambient scope of ours under
+                // its entry, so it opens a fresh HandleScope exactly as the
+                // depth-0 path does. Same-isolate reentry bootstraps onto the
+                // ambient one instead.
                 let reply = std::panic::catch_unwind(AssertUnwindSafe(|| {
-                    if foreign {
-                        // A had no ambient scope under B's entry — open a fresh
-                        // HandleScope on A, exactly as the depth-0 path does.
+                    if entered {
                         v8::scope!(let scope, unsafe { &mut *iso });
                         service_request(scope, request, false)
                     } else {
@@ -2195,7 +2217,8 @@ impl Core {
                 // Pop A back off (restoring B as current). Safe even after a
                 // panic unwind: the scope's Drop ran but left A entered, and
                 // exit() asserts A == GetCurrent(), which holds here.
-                if foreign {
+                drop(stack);
+                if entered {
                     unsafe { (*iso).exit() };
                 }
                 reply

data/ext/rusty_racer/src/stack.rs

@@ -5,7 +5,7 @@
 // — no IsolateState/JsVal/marshalling. It also hosts current_real_isolate() (the
 // entered-isolate query) since that too is just one of the exported V8 symbols
 // below, kept here so the FFI block stays in one place. The crate uses
-// discover_scan_start_field (once per isolate), set_v8_stack_limit (per op),
+// discover_scan_start_field (once per isolate), StackScope (per op),
 // current_real_isolate (per reentrant op), and STACK_DEBUG (set at init);
 // everything else is private to this module.
 
@@ -14,7 +14,7 @@ use std::ffi::c_void;
 // don't warn it unused.
 #[cfg(target_os = "linux")]
 use std::ptr::null_mut;
-use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
 
 // rusty_v8 doesn't wrap the runtime `v8::Isolate::SetStackLimit(uintptr_t)`, so
 // link the public V8 symbol directly (stable across V8 versions). It sets the
@@ -24,7 +24,7 @@ unsafe extern "C" {
     fn v8__Isolate__SetStackLimit(isolate: *mut c_void, stack_limit: usize);
     // V8's own (exported) accessors down to the conservative-GC-scan Stack
     // object, so we can re-point its stack_start per op when V8 runs on a Ruby
-    // Fiber (see set_fiber_scan_start / discover_scan_start_field). Member fns:
+    // Fiber (see StackScope / discover_scan_start_field). Member fns:
     // the first arg is `this`. The public v8::Isolate* IS i::Isolate*.
     #[link_name = "_ZN2v88internal7Isolate4heapEv"]
     fn v8__internal__Isolate__heap(isolate: *mut c_void) -> *mut c_void;
@@ -52,7 +52,7 @@ pub(crate) fn current_real_isolate() -> *mut c_void {
 }
 
 // Locate V8's conservative-GC-scan stack_start field
-// (heap::base::Stack::current_segment_.start) so set_fiber_scan_start can
+// (heap::base::Stack::current_segment_.start) so StackScope can
 // re-point it per op. The scanner walks [SP, stack_start); on a Ruby Fiber V8's
 // stack_start is still the NATIVE thread top, a different region, so the walk
 // runs off the fiber's mapped top into the guard page and SEGVs (the residual
@@ -178,6 +178,13 @@ fn current_region_bounds_cached(addr: usize) -> (usize, usize) {
 // The [start, end) of the /proc/self/maps mapping containing `addr`. Linux only;
 // (0, 0) elsewhere (and the caller falls back). Reads the file fresh — slow, so
 // only called on a cache miss (a new fiber).
+//
+// Everything that needs a FIBER's real bounds degrades on the (0, 0) platforms,
+// macOS being the shipped one: the stack limit drops to a fixed budget below the
+// SP (see StackScope::enter), and a nested op can no longer widen its GC-scan
+// start to the enclosing op's, so it narrows to its own frame. Both are the
+// pre-fiber-support behaviour rather than a crash, but a darwin implementation
+// (mach_vm_region on the current task) would close the gap.
 #[cfg(target_os = "linux")]
 fn query_region_bounds(addr: usize) -> (usize, usize) {
     use std::io::Read;
@@ -216,11 +223,17 @@ fn query_region_bounds(_addr: usize) -> (usize, usize) {
 // Set from RUSTY_RACER_STACK_DEBUG at init; gates the per-op stack diagnostics.
 pub(crate) static STACK_DEBUG: AtomicBool = AtomicBool::new(false);
 
-// Re-point V8's stack limit at the CURRENT stack each op. In-thread V8 runs
-// wherever the Ruby code is: usually the native thread's pthread stack, but also
-// a Ruby Fiber's separate mmap'd stack (Capybara::Result is an Enumerator) that
-// pthread can't see. The limit MUST sit between the current SP and the real
-// bottom of whatever stack we're on:
+// How V8 describes the stack an op runs on: the stack limit, and — on a Ruby
+// Fiber — the conservative-GC-scan start. Both live in the ISOLATE, not in the
+// op, so an op that runs on a DIFFERENT stack than the one enclosing it (a host
+// callback that resumes a Fiber which evals again) has to install its own and
+// put the enclosing op's back on the way out. Hence a scope: after enter() V8
+// describes the stack we are on now, after the drop the one it described before.
+//
+// In-thread V8 runs wherever the Ruby code is: usually the native thread's
+// pthread stack, but also a Ruby Fiber's separate mmap'd stack (Capybara::Result
+// is an Enumerator) that pthread can't see. The limit MUST sit between the
+// current SP and the real bottom of whatever stack we're on:
 //   * Too high (above SP) and V8 declares a FALSE overflow on entry.
 //   * Too low (below the real bottom) and a deep recursion grows past the
 //     mapped stack and SEGVs the unmapped guard page below it.
@@ -228,85 +241,229 @@ pub(crate) static STACK_DEBUG: AtomicBool = AtomicBool::new(false);
 // native stack, anchor to its pthread bottom; on a fiber, find the bottom of the
 // /proc/self/maps region holding the SP (the fiber's real bottom — anchoring to
 // SP minus a fixed guard punched through the bottom of Avo's small/deep Capybara
-// fibers and SEGV'd). Must be called with the isolate ENTERED. `real_isolate` is
-// the raw v8::Isolate* read out of iso_ptr.
+// fibers and SEGV'd).
+//
+// The limit does double duty, which is why a STALE one is fatal rather than
+// merely wrong: v8::Isolate::SetStackLimit also sets stack_size_ to
+// (base::Stack::GetStackStart() - limit), and V8's "am I on the central stack?"
+// test is (native_top - stack_size_ - margin) < addr <= native_top — that is,
+// exactly (limit - margin, native_top]. Throwing (and GC) CHECKs that window and
+// V8_Fatals the process on a miss. So an op running on a fiber under the
+// ENCLOSING op's native-stack limit doesn't merely false-overflow: the
+// RangeError it then tries to throw aborts. Installing the limit for the stack
+// we are actually on fixes both at once.
 //
-// On a fiber it ALSO re-points V8's conservative-GC-scan stack_start (via
-// scan_start_field, discovered once per isolate) to `stack_top`: Enter just set
-// it to the native top, but the scanner walks [marker, stack_start), so a native
-// start runs the scan off the fiber's mapped stack into unmapped memory and
-// SEGVs (Avo's Capybara filter chain). scan_start_field is 0 when discovery
-// failed (override disabled).
+// RESIDUAL (GC scan across a stack SWITCH): V8 tracks ONE scan segment per
+// isolate, so while a nested op runs on a fiber its enclosing op's frames on the
+// NATIVE stack aren't conservatively scanned — the two live in different
+// mappings and only one range can be described. (A nested op that did NOT switch
+// stacks is fine: it keeps the enclosing op's start, which covers both.) Handles
+// are unaffected — this
+// build has v8_enable_direct_handle off, so every Local lives in a HandleScope
+// block and is iterated precisely, and JS frames are walked precisely from the
+// frame pointers whichever stack they sit on. Only a raw Tagged<> in V8's own
+// C++ frames would be missed, and V8 keeps those in handles across anything that
+// can allocate. There's no fix available: Stack has no API to register a second
+// segment for the same thread.
 //
-// LIMITATION (worker-thread fibers): the GC and a thrown exception ALSO
-// `CHECK(IsOnCentralStack(SP))`, which tests the SP against
-// `base::Stack::GetStackStart()` — the pthread top, cached per native thread,
-// with no API to retarget — NOT the scan start we re-point above. A fiber mmap'd
-// ABOVE that top (the common case on a NON-main native thread, whose stack sits
-// below later fiber mmaps) fails the CHECK, so V8 aborts on the next GC or throw.
-// We can fix the scan (the SEGV) but not that CHECK. On the main thread the
-// process stack is the highest address, so every fiber is below it and both the
-// scan and the CHECK are safe — the Capybara/Avo case. See README.
-pub(crate) fn set_v8_stack_limit(real_isolate: *mut c_void, scan_start_field: usize, stack_top: usize) {
-    let sp_marker = 0u8;
-    let sp = &sp_marker as *const u8 as usize;
-    let (nbottom, ntop) = native_stack_bounds_cached();
-    let on_native = nbottom != 0 && sp > nbottom && sp <= ntop;
-    // Reserve below the limit for V8's own RangeError-throw frames.
-    const NATIVE_GUARD: usize = 128 * 1024;
-    // V8 throws when SP descends to the limit, then needs some real stack BELOW
-    // it to build the RangeError (and V8 itself allows growing a little past the
-    // limit — its overflow slack). On a fiber that reserve must NOT cross the
-    // fiber's real bottom (the mapping below it is an unmapped guard -> SEGV), so
-    // keep it comfortably above V8's slack.
-    const FIBER_RESERVE: usize = 64 * 1024;
-    let mut region = (0usize, 0usize);
-    let limit = if on_native {
-        nbottom + NATIVE_GUARD
-    } else {
-        // Anchor to the FIBER's real bottom (the /proc/self/maps region holding
-        // the SP), not the SP: SP - fixed_guard can punch through the bottom of a
-        // small/deep fiber stack and SEGV (Avo's deep Capybara filter chain).
-        // Reserve FIBER_RESERVE above the bottom for the throw, but keep the
-        // limit below the SP so we don't false-overflow; on a nearly-full fiber
-        // that clamps the headroom down (an early but CLEAN RangeError).
-        region = current_region_bounds_cached(sp);
-        if region.0 != 0 {
-            (region.0 + FIBER_RESERVE).min(sp.saturating_sub(8 * 1024))
+// LIMITATION (worker-thread fibers): only the window's LOWER bound follows the
+// limit. Its upper bound is base::Stack::GetStackStart(), the native pthread
+// top, cached per thread with no way to retarget it (on POSIX
+// base::Stack::SetCurrentThreadStackBounds is UNREACHABLE()). A fiber mmap'd
+// ABOVE that top — the common case on a NON-main native thread, whose stack sits
+// below later fiber mmaps — is outside the window whatever limit we set, so V8
+// aborts on the next throw or GC. On the main thread the process stack is the
+// highest address, so every fiber is below it and the window covers it — the
+// Capybara/Avo case. See README.
+pub(crate) struct StackScope<'a> {
+    real_isolate: *mut c_void,
+    // Address of V8's conservative-GC-scan start field, or 0 when enter()
+    // installed nothing (discovery failed, or no sane limit) — the drop then
+    // restores nothing.
+    scan_start_field: usize,
+    // The limit V8 currently holds for this isolate. Tracked by the caller
+    // because V8 exposes no getter, and a nested op needs the enclosing op's
+    // value to put back. 0 before the isolate's first op.
+    installed_limit: &'a AtomicUsize,
+    // What the drop has to put back, or 0 for "nothing changed, nothing to undo".
+    // Most re-entrant ops run in deeper frames of the SAME stack and so compute
+    // the very values already installed; skipping those writes keeps a nested op
+    // as cheap as it was before it started describing its own stack.
+    restore_limit: usize,
+    restore_scan_start: usize,
+}
+
+impl<'a> StackScope<'a> {
+    // Describe the stack THIS call runs on to the isolate, until the drop. Must
+    // be called with the isolate ENTERED: Isolate::Enter sets the scan start to
+    // the native top, so entering afterwards would clobber a fiber override.
+    //
+    // `enclosing_scan_start` is the scan start of the op this one is nested in,
+    // or None at the outermost op, where no enclosing op exists — then the drop
+    // restores nothing (the values left behind belong to no live frame, and the
+    // next op installs its own before any JS runs). Because Enter re-points the
+    // field, it must be read BEFORE entering. It doubles as the value the drop
+    // puts back and, when a nested op didn't switch stacks, as this op's own
+    // start (see below). `real_isolate` is the raw v8::Isolate* read out of
+    // iso_ptr; `stack_top` is a live address the caller captured ABOVE every V8
+    // frame of this op (used only on a fiber).
+    pub(crate) fn enter(
+        real_isolate: *mut c_void,
+        scan_start_field: usize,
+        enclosing_scan_start: Option<usize>,
+        installed_limit: &'a AtomicUsize,
+        stack_top: usize,
+    ) -> Self {
+        // Only a nested op has an enclosing description to preserve and restore.
+        let nested = enclosing_scan_start.is_some();
+        // 0 doubles as "no enclosing value" throughout: it is never a real start.
+        let prev_scan_start = enclosing_scan_start.unwrap_or(0);
+        let sp_marker = 0u8;
+        let sp = &sp_marker as *const u8 as usize;
+        let (nbottom, ntop) = native_stack_bounds_cached();
+        let on_native = nbottom != 0 && sp > nbottom && sp <= ntop;
+        // Reserve below the limit for V8's own RangeError-throw frames.
+        const NATIVE_GUARD: usize = 128 * 1024;
+        // V8 throws when SP descends to the limit, then needs some real stack
+        // BELOW it to build the RangeError (and V8 itself allows growing a little
+        // past the limit — its overflow slack). On a fiber that reserve must NOT
+        // cross the fiber's real bottom (the mapping below it is an unmapped
+        // guard -> SEGV), so keep it comfortably above V8's slack.
+        const FIBER_RESERVE: usize = 64 * 1024;
+        let mut region = (0usize, 0usize);
+        let limit = if on_native {
+            nbottom + NATIVE_GUARD
         } else {
-            sp.saturating_sub(64 * 1024) // region unknown (non-linux) — best effort
+            // Anchor to the FIBER's real bottom (the /proc/self/maps region
+            // holding the SP), not the SP: SP - fixed_guard can punch through the
+            // bottom of a small/deep fiber stack and SEGV (Avo's deep Capybara
+            // filter chain). Reserve FIBER_RESERVE above the bottom for the
+            // throw, but keep the limit below the SP so we don't false-overflow;
+            // on a nearly-full fiber that clamps the headroom down (an early but
+            // CLEAN RangeError).
+            region = current_region_bounds_cached(sp);
+            if region.0 != 0 {
+                (region.0 + FIBER_RESERVE).min(sp.saturating_sub(8 * 1024))
+            } else {
+                // Region unknown — only Linux can look a fiber's bounds up (see
+                // query_region_bounds), so this is the macOS path. Best effort:
+                // hand JS a fixed budget below the SP and hope the fiber is that
+                // deep. It usually is for an OUTERMOST fiber op, whose SP sits
+                // near the fiber's top, and much less reliably for a NESTED one,
+                // whose SP is already far down the fiber — there this can land
+                // below the fiber's mapped bottom, and V8 then grows through the
+                // guard page (SEGV) instead of throwing. Fixing that properly
+                // means a mach_vm_region lookup for darwin.
+                sp.saturating_sub(64 * 1024)
+            }
+        };
+        // Opt-in diagnostics (RUSTY_RACER_STACK_DEBUG): the SP vs the native
+        // stack [nbottom, ntop], the fiber region (if any), the per-op limit, and
+        // whether the SP is above the limit. A crash with sp_above_limit=false
+        // means the limit is wrong for the current stack.
+        if STACK_DEBUG.load(Ordering::Relaxed) {
+            eprintln!(
+                "[rusty stack] sp={sp:#x} nbottom={nbottom:#x} ntop={ntop:#x} \
+                 region=[{:#x},{:#x}) limit={limit:#x} fiber={} sp_above_limit={} \
+                 fiber_above_native={}",
+                region.0,
+                region.1,
+                !on_native,
+                sp > limit,
+                !on_native && nbottom != 0 && sp > ntop,
+            );
+        }
+        if limit == 0 {
+            // Couldn't determine a sane limit — leave V8's default in place, and
+            // with it a scope that restores nothing.
+            return Self {
+                real_isolate,
+                scan_start_field: 0,
+                installed_limit,
+                restore_limit: 0,
+                restore_scan_start: 0,
+            };
+        }
+        // installed_limit is the sole record of what V8 holds (it has no getter),
+        // so an equal value means the isolate is already described correctly and
+        // the call can be skipped. Nothing else moves the limit behind our back:
+        // Isolate::Enter/Exit leave the stack guard alone, and V8 re-points it
+        // itself only under v8::Locker thread archiving (rusty_v8 exposes no
+        // Locker, and an isolate here is thread-confined) or wasm stack
+        // switching (no wasm stacks exist in this embedding).
+        let prev_limit = installed_limit.load(Ordering::Relaxed);
+        let changed_limit = limit != prev_limit;
+        if changed_limit {
+            unsafe { v8__Isolate__SetStackLimit(real_isolate, limit) };
+            installed_limit.store(limit, Ordering::Relaxed);
+        }
+        // Only a nested op owes anything back: at the outermost op prev_limit is
+        // the previous, already-finished op's, which describes no live frame.
+        let restore_limit = if nested && changed_limit { prev_limit } else { 0 };
+        // Point V8's conservative-GC-scan start at the stack we're on. The
+        // scanner walks [marker, start), so on a fiber a native start runs it off
+        // the fiber's mapped top into unmapped memory and SEGVs (Avo's Capybara
+        // filter chain). Always take the WIDEST start that is still on this
+        // stack, because everything between the marker and it gets scanned and an
+        // enclosing op's frames sit above ours:
+        //   * native stack — the native top, i.e. what V8 itself uses.
+        //   * a fiber we ENTERED (the enclosing op is elsewhere) — this op's
+        //     `stack_top`, which keeps the range between two real stack pointers
+        //     (marker..stack_top) and so guaranteed mapped. We can't use the
+        //     /proc/maps region top: that mapping isn't reliably contiguous, so
+        //     the scan could still hit a hole below it.
+        //   * a fiber we were ALREADY on (a nested op under a host callback that
+        //     didn't switch stacks) — the enclosing op's start, which is above
+        //     ours and in the same mapping, so it covers both ops' frames.
+        let new_scan_start = if on_native {
+            unsafe { v8__base__Stack__GetStackStart() }
+        } else if nested && region.0 != 0 && prev_scan_start > sp && prev_scan_start < region.1 {
+            prev_scan_start
+        } else {
+            stack_top
+        };
+        // Install it, and work out what the drop owes the enclosing op. The value
+        // to put back is the caller's PRE-ENTER snapshot, not whatever the field
+        // holds now: Isolate::Enter re-points the start at the native top, so on
+        // the foreign-isolate reentry path the field has already been clobbered
+        // by the time we get here, and restoring that would strand an enclosing
+        // fiber op with a start on the wrong stack.
+        let restore_scan_start = if scan_start_field != 0 && new_scan_start != 0 {
+            let field = scan_start_field as *mut usize;
+            if unsafe { field.read() } != new_scan_start {
+                unsafe { field.write(new_scan_start) };
+            }
+            if nested && prev_scan_start != 0 && prev_scan_start != new_scan_start {
+                prev_scan_start
+            } else {
+                0 // nothing enclosing to put back, or the drop would be a no-op
+            }
+        } else {
+            0 // nothing installed -> nothing to undo
+        };
+        Self {
+            real_isolate,
+            scan_start_field,
+            installed_limit,
+            restore_limit,
+            restore_scan_start,
         }
-    };
-    if limit == 0 {
-        return; // couldn't determine a sane limit — leave V8's default
-    }
-    unsafe { v8__Isolate__SetStackLimit(real_isolate, limit) };
-    // On a fiber, re-point V8's conservative-GC-scan stack_start to `stack_top`
-    // — a live address captured by the caller ABOVE every V8 frame of this op.
-    // Enter() set the start to the NATIVE top (a different region); the scanner
-    // walks [marker, start), so a native start runs it off the fiber's mapped
-    // top into unmapped memory and SEGVs. Anchoring to stack_top keeps the whole
-    // scan range between two real stack pointers (marker..stack_top), so it's
-    // guaranteed mapped, and every V8 root (all below stack_top) is still found.
-    // (We can't use the /proc/maps region top here: that mapping isn't reliably
-    // contiguous, so the scan could still hit a hole below it.)
-    if !on_native && stack_top != 0 && scan_start_field != 0 {
-        unsafe { (scan_start_field as *mut usize).write(stack_top) };
     }
-    // Opt-in diagnostics (RUSTY_RACER_STACK_DEBUG): the SP vs the native stack
-    // [nbottom, ntop], the fiber region (if any), the per-op limit, and whether
-    // the SP is above the limit. A crash with sp_above_limit=false means the
-    // limit is wrong for the current stack.
-    if STACK_DEBUG.load(Ordering::Relaxed) {
-        eprintln!(
-            "[rusty stack] sp={sp:#x} nbottom={nbottom:#x} ntop={ntop:#x} \
-             region=[{:#x},{:#x}) limit={limit:#x} fiber={} sp_above_limit={} \
-             fiber_above_native={}",
-            region.0,
-            region.1,
-            !on_native,
-            sp > limit,
-            !on_native && nbottom != 0 && sp > ntop,
-        );
+}
+
+impl Drop for StackScope<'_> {
+    // Put the enclosing op's description back, in the reverse order enter()
+    // installed it. A zero means there is nothing to put back: enter() changed
+    // nothing, or this was the isolate's first op and there is no earlier
+    // description. Leaving the last op's settings behind is harmless — every op
+    // installs its own before any JS runs.
+    fn drop(&mut self) {
+        if self.scan_start_field != 0 && self.restore_scan_start != 0 {
+            unsafe { (self.scan_start_field as *mut usize).write(self.restore_scan_start) };
+        }
+        if self.restore_limit != 0 {
+            unsafe { v8__Isolate__SetStackLimit(self.real_isolate, self.restore_limit) };
+            self.installed_limit.store(self.restore_limit, Ordering::Relaxed);
+        }
     }
 }

data/lib/rusty_racer/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RustyRacer
-  VERSION = "0.1.12"
+  VERSION = "0.1.14"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rusty_racer
 version: !ruby/object:Gem::Version
-  version: 0.1.12
+  version: 0.1.14
 platform: ruby
 authors:
 - Keita Urashima
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-07-23 00:00:00.000000000 Z
+date: 2026-07-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rb_sys