Enable old space GC when recording/replaying - #161

Enables old-space (major) GC in replay-node. Until now mark-compact collections were skipped entirely when recording or replaying, so the old generation only ever grew. With this PR major GCs run while recording, triggered at the normal allocation limit, and the resulting recordings replay. In a churn test that pushes ~1.7GB through the old generation with ~120MB live, peak RSS under recording drops from ~1.9GB to ~0.6GB.

When replaying, incremental marking is off and the heap is always allowed to expand, so replay doesn't depend on reproducing the recording's GC timing.

Ported from the Chromium fork

Enabling major GC:

• Stop skipping mark-compact collections in Heap::PerformGarbageCollection (7b72420d07e).
• Enable incremental marking while recording and keep it disabled while replaying (fb7aa5108d1) or when the v8-flags-gc feature is off (f4bfbecd7cf). Without it Heap::ShouldExpandOldGenerationOnSlowAllocation keeps expanding the old generation and a major GC only runs at --max-old-space-size.
• Stop forcing --never-compact (3104d7cad00, a build fix after the flag was removed upstream; in V8 9.4 the flag still exists).

AutoDisallowEvents scopes. The labels are the ones the Chromium fork uses (1917249bb49). Where V8 9.4 names a function differently, the scope is on the 9.4 counterpart and keeps the Chromium fork's label:

• LocalHeap::UnparkSlowPath, LocalHeap::SafepointSlowPath (da7a5cd8b0b), covering the whole function as in the Chromium fork's current code.
• LocalHeap::TryPerformCollection (f417cac55f3). The function no longer exists in the Chromium fork's V8.
• LocalHeap::PerformCollectionAndAllocateAgain (bc3ca2ba1a1).
• Heap::MemoryPressureNotification (8de2fbfb228).
• PagedSpace::RawRefillLabMain, labelled PagedSpaceBase::RawRefillLabMain (7138afe0be7).
• PagedSpace::RawRefillLabBackground, the 9.4 counterpart of ConcurrentAllocator::AllocateFromSpaceFreeList (e39ca9b782a).
• Heap::EnsureSweepingCompleted(HeapObject), the 9.4 counterpart of Heap::EnsureSweepingCompletedForObject (0d24bd38639).
• MarkCompactCollector::EnsureSweepingCompleted, the 9.4 counterpart of Heap::EnsureSweepingCompleted (993ce4f2437).
• cppgc SweeperImpl::Start (1ca67bc0762).
• AllocationCounter::InvokeAllocationObservers, ConcurrentMarking::ScheduleJob, StatsCollector::AllocatedObjectSizeSafepointImpl, Heap::ReportExternalMemoryPressure, Heap::StartIncrementalMarking, Heap::StartIncrementalMarkingIfAllocationLimitIsReached, IncrementalMarkingJob::ScheduleTask, IncrementalMarkingJob::Task::RunInternal, IncrementalMarking::MarkBlackAndVisitObjectDueToLayoutChange (fb7aa5108d1).
• Heap::ActivateMemoryReducerIfNeeded (6e683f09032).
• Heap::CollectAllAvailableGarbage (7e0f242a8eb).
• Heap::StartTearDown, cppgc SweeperImpl::FinishIfRunning (2810b09546e).
• Heap::CollectGarbageOnMemoryPressure (6ab2e8798a8).
• cppgc SweeperImpl::SweepForAllocationIfRunning, as in the Chromium fork's current code.

Behavior that would otherwise depend on GC timing:

• While replaying, let background threads expand the old generation at the allocation limit instead of waiting for a main thread GC, in Heap::ShouldExpandOldGenerationOnSlowAllocation (58b6be11dd5). Waiting can deadlock when the main thread is blocked on an ordered lock that the background thread is next to acquire. The hard limit in Heap::CanExpandOldGenerationBackground still applies.
• Don't use the eval compilation cache when recording/replaying (no-eval-cache), in CompilationCache::LookupEval and CompilationCache::PutEval. Major GCs age entries out of the cache, so whether an eval creates a new script would depend on GC timing.
• Ignore interrupts in StackGuard::HandleInterrupts while events are disallowed (076d23fbc40).
• Defer Managed<T> destructors to Isolate::ReleaseSharedPtrs when the finalizer runs with events disallowed, plus the list-length asserts (ffe66fe960a). Gated on the leak-references feature.
• Keep WasmCode objects alive forever (b8142479974), gated on the leak-references feature as in the Chromium fork's current code.

Asserts, diagnostics and feature tags:

• Assert the use count in Managed<T>::Destructor (9563c03f088).
• Diagnostics for heap allocation failures on background threads, in OldLargeObjectSpace::AllocateRawBackground and PagedSpace::RawRefillLabBackground (4ea00745613).
• The ~LocalHeap diagnostic (c920c27399c).
• Tag the existing GC behavior changes with the gc-changes feature (Heap::ShouldExpandOldGenerationOnSlowAllocation, MemoryReducer::ScheduleTimer, GCTracer::Print, HeapSnapshotJSONSerializer::SerializeImpl) and label the existing AutoDisallowEvents scopes in heap.cc.

Added on top of the Chromium fork

• AutoDisallowEvents in Heap::HandleGCRequest, Heap::FinalizeIncrementalMarkingIfComplete and Heap::FinalizeIncrementalMarkingIncrementally. V8 9.4 finalizes incremental marking in a separate step run from the stack guard, outside every scope listed above. It made recorded calls that don't happen when replaying (Mismatched call expected clock_gettime got gettimeofday). The Chromium fork's V8 has no Heap::FinalizeIncrementalMarkingIncrementally; its Heap::HandleGCRequest and Heap::FinalizeIncrementalMarkingIfComplete only call functions that already carry a scope, so they have none of their own.
• A null check on local_heap in Heap::ShouldExpandOldGenerationOnSlowAllocation, which can be null in 9.4.

Intentional divergences from the Chromium fork

• Concurrent and parallel GC stay disabled when recording. The Chromium fork leaves them enabled while recording and only disables them when replaying or when v8-flags-gc is off. V8 runs this work through Platform::PostJob, almost always from inside a GC, where events are disallowed.
  • Chromium implements PostJob on its own thread pool (base::CreateJob), which carries Replay patches so that worker threads can pick up a job posted while events are disallowed (base/task/thread_pool/job_task_source.cc).
  • Node uses V8's default job implementation, where DefaultJobState::NotifyConcurrencyIncrease returns early while events are disallowed. A job posted during a GC is created but no worker thread is ever told to run it.
  • Observed with the Chromium fork's flags: the page unmapper job, gated by --concurrent-sweeping, ran once and never again. Freed pages were only returned to the OS at teardown, and RSS stayed at ~1.6GB while the JS heap shrank. With --no-concurrent-sweeping RSS follows the heap.
  • The remaining flags were not shown to fail individually. They stay off, as they were before this PR, because they depend on the same job mechanism: --concurrent-marking, --parallel-compaction, --parallel-marking, --parallel-pointer-update and --parallel-scavenge.
  • --concurrent-array-buffer-sweeping also stays disabled in Node. The Chromium fork no longer sets it in either mode.
• GC tasks stay disabled when recording (--incremental-marking-task, --scavenge-task). Node's platform drops tasks marked IsRecordReplayNonDeterministic, so posting them is pointless. Incremental marking advances on allocation and is finalized from the stack guard instead.
• Second-pass weak callbacks still run synchronously inside the GC. The Chromium fork posts a task for them. Node's PostTask makes recorded calls, and the post would happen at a non-deterministic point. As a consequence the Managed<T> deferral applies to every finalizer, so with leak-references enabled those objects live until isolate teardown.
• Heap::CanExpandOldGeneration always returns true when replaying. An existing Node patch that the Chromium fork no longer carries. Left as is, since it keeps a replay from running out of memory when it uses more heap than the recording did.

Testing

• Heap churn script under recording: heap used at exit 1762MB → 294MB, peak RSS 1945MB → 594MB.
• Backend test/node-recording suite: 25 of 25 pass, including a new gc/old-space-churn case that records, checks the heap stays under 800MB, replays and evaluates.
• Node core test test-domain-error-types (--stress-compaction) aborted under recording before this PR and passes now, so it can leave the backend's NodeTestIgnoreList.
• Node core test test/report/test-report-fatal-error.js timed out once on CI while recording (120s). It passes locally with the exact CI binary in every run. Its children run into --max-old-space-size=20 on purpose and now take ~0.9s each instead of ~0.3s, because they do real GC work before aborting. Not root-caused.

Follow-ups

• WeakRef and FinalizationRegistry. Both become observable now that old-space objects die, and Node's own internals use them (event_target.js, abort_controller.js, domain.js). To be ported from the Chromium fork once the FinalizationRegistry work there lands.
• Node embedder finalizers. Weak callbacks run inside the GC with events disallowed, so their calls are passed through unrecorded. They run only while recording and can change state the replay depends on: FileHandle/DirHandle closing their fd and scheduling a warning, N-API finalizers, ObjectWrap destructors. Needs either the Chromium fork's leak-references pattern per site, or recording which handles were finalized and replaying that.
• AsyncWrap::EmitDestroy is a no-op under record/replay, so GC-driven async_hooks destroy hooks never fire. The test-gc-http-client* core tests hang on this and stay in the backend's NodeTestIgnoreList.
• JS-visible weak handles in Node (node_util WeakReference) have the same problem as WeakRef.
• Managed<T> memory. Native objects behind Managed<T> (ICU objects from Intl, WebAssembly modules) are kept until isolate teardown. The list-length asserts in Isolate::ReleaseSharedPtrs and Isolate::RegisterManagedPtrDestructor walk that list on every registration, also when not recording.
• CollectionBarrier. A background thread requesting a GC while recording posts a foreground task through Node's PostTask. The Chromium fork has the same code and no handling; not exercised here.
• Concurrent GC while recording. Would need Node's worker thread job path to work while events are disallowed.
• The test-report-fatal-error CI timeout above.
• eval combined with heap churn crashes on replay (MissingReport), also on a build without this PR. Found while writing a test for the eval cache change, which therefore has no test.
• Coverage. Not yet exercised under GC pressure: worker threads, native addons, WebAssembly.
• Backend. Commit the gc/old-space-churn recording test and the NodeTestIgnoreList change.