fix(gc): keep transient side allocations out of the drained-bytes term (#10376)

changelog.d/10377-transient-side-bytes.md

@@ -0,0 +1,3 @@
+### Fixed
+
+- A program that allocates and frees short-lived native scratch in a loop — any `RegExp` call does — no longer accumulates false collection pressure. A million-call `.test()` loop was paying three old-generation collection cycles, one of them a full that traced a 52 MB live heap to free 59 KB, costing 33% more instructions per call (#10376).

crates/perry-runtime/src/gc/policy.rs

@@ -746,6 +746,30 @@ pub(crate) fn gc_note_external_side_free(bytes: usize) {
     GC_EXTERNAL_SIDE_DRAINED_SINCE_FULL.with(|c| c.set(c.get().saturating_add(bytes)));
 }
 
+/// Release external side bytes that were never retained past the operation
+/// that allocated them — regex match scratch, whose owner frees it on the
+/// same call that took it.
+///
+/// They leave [`external_side_live_bytes`] exactly as any other bytes do. What
+/// they must NOT enter is the drained term, whose whole purpose is to
+/// reconstruct bytes a cheap collection released EARLIER than a full would
+/// have ([`external_side_old_reclaim_pressure_bytes`]). A transient
+/// allocation's release is not early: every build, with or without the
+/// parse-boundary band, frees it at the same program point, so there is
+/// nothing to reconstruct. Counting it manufactures old-reclaim pressure out
+/// of per-call churn that no collection ever saw live — #10376, where a
+/// million-call `.test()` loop paid three unproductive old-gen cycles, one of
+/// them a full that freed 59 KB of a 52 MB arena, and 33 % more instructions
+/// per call.
+/// Only the regex scratch owners report through here, and the workspace pins
+/// perry-runtime with `default-features = false`, so a product build has no
+/// caller for it — gate it like its callers rather than leave dead code the
+/// warnings lint gate rejects.
+#[cfg(feature = "regex-engine")]
+pub(crate) fn gc_note_external_side_free_transient(bytes: usize) {
+    GC_EXTERNAL_SIDE_LIVE_BYTES.with(|c| c.set(c.get().saturating_sub(bytes)));
+}
+
 /// The external side-buffer term of OLD-RECLAIM pressure.
 ///
 /// Live bytes plus all reported releases since the last full baseline. The

crates/perry-runtime/src/gc/tests/tiny_parse_pressure.rs

@@ -512,6 +512,59 @@ fn a_finished_collection_moves_the_external_base_to_the_post_collection_reading(
 /// `external_side_live_bytes()` read fails BOTH tests below; deleting the reset
 /// from `finish_full_old_reclaim_baseline` fails
 /// `a_full_collection_clears_the_drained_debt` alone.
+/// A transient side allocation — one the operation that allocated it frees on
+/// the same call — must leave the drained term alone, however many times the
+/// program does it.
+///
+/// The drained term reconstructs bytes a cheap collection released EARLIER
+/// than a full would have. Nothing about regex match scratch is early: every
+/// build frees it at the same program point, so there is nothing to
+/// reconstruct, and accumulating it manufactures old-reclaim pressure out of
+/// per-call churn no collection ever saw live. #10376: a million-call
+/// `.test()` loop paid three old-gen cycles, one a full that traced a 52 MB
+/// arena and freed 59 KB.
+///
+/// Sabotage-proved: pointing `gc_note_external_side_free_transient` at
+/// `gc_note_external_side_free` fails this test on the first iteration's
+/// assertion, with the term 1 MB above the live reading.
+#[cfg(feature = "regex-engine")]
+#[test]
+fn transient_side_allocations_never_enter_the_drained_debt() {
+    use super::super::policy::{
+        external_side_live_bytes, external_side_old_reclaim_pressure_bytes,
+        GC_EXTERNAL_SIDE_DRAINED_SINCE_FULL,
+    };
+    use super::support::*;
+    let _isolation = GcTestIsolationGuard::new();
+    let restore = GC_EXTERNAL_SIDE_DRAINED_SINCE_FULL.with(|cell| cell.replace(0));
+    let live_before = external_side_live_bytes();
+    let term_before = external_side_old_reclaim_pressure_bytes();
+
+    const BYTES: usize = 1024 * 1024;
+    for round in 0..8 {
+        crate::gc::gc_note_external_side_alloc(BYTES);
+        assert_eq!(
+            external_side_old_reclaim_pressure_bytes(),
+            term_before + BYTES,
+            "round {round}: a live transient buffer is pressure like any other"
+        );
+        crate::gc::gc_note_external_side_free_transient(BYTES);
+        assert_eq!(
+            external_side_live_bytes(),
+            live_before,
+            "round {round}: the live reading must fall by what was released"
+        );
+        assert_eq!(
+            external_side_old_reclaim_pressure_bytes(),
+            term_before,
+            "round {round}: releasing a transient buffer must leave no debt \
+             behind — this is what accumulated into a full in #10376"
+        );
+    }
+
+    GC_EXTERNAL_SIDE_DRAINED_SINCE_FULL.with(|cell| cell.set(restore));
+}
+
 #[test]
 fn a_drained_side_byte_still_pays_old_reclaim_until_the_next_full() {
     use super::super::policy::{

crates/perry-runtime/src/regex/perex_memory.rs

@@ -92,7 +92,7 @@ impl Drop for Reservation<'_> {
     fn drop(&mut self) {
         self.budget.live.set(self.budget.live.get() - self.bytes);
         if self.bytes != 0 {
-            crate::gc::gc_note_external_side_free(self.bytes);
+            crate::gc::gc_note_external_side_free_transient(self.bytes);
         }
     }
 }
@@ -153,7 +153,7 @@ impl<T: Copy + Default> Drop for Buffer<'_, T> {
     fn drop(&mut self) {
         self.budget.live.set(self.budget.live.get() - self.bytes);
         if self.bytes != 0 {
-            crate::gc::gc_note_external_side_free(self.bytes);
+            crate::gc::gc_note_external_side_free_transient(self.bytes);
         }
     }
 }

crates/perry-runtime/src/regex/perex_replace_direct.rs

@@ -166,7 +166,7 @@ impl Spans {
 
 impl Drop for Spans {
     fn drop(&mut self) {
-        crate::gc::gc_note_external_side_free(self.noted);
+        crate::gc::gc_note_external_side_free_transient(self.noted);
     }
 }