jit: three witnessed wrong-code fixes, builtin-subclass mapdict layouts, and a measured FOR_ITER gate widening

majit/majit-gc/src/trace.rs

@@ -370,6 +370,12 @@ pub struct TypeInfo {
     /// reads it through the materialized `TYPE_INFO` table's `infobits`
     /// byte (gc.py:631-642).
     pub is_object: bool,
+    /// Whether this type corresponds to an RPython classdef and therefore
+    /// contributes peers to `assign_inheritance_ids`. Some frontend-private
+    /// storage layouts still carry an `rclass.OBJECT` header (and must set
+    /// `is_object`) while sharing a classdef/vtable with another registered
+    /// type; those layouts must not perturb the classdef census.
+    pub has_subclass_range: bool,
     /// CPython-internal object that remains an OBJECT-layout GC boundary but
     /// is omitted from app-level `gc.get_objects()` enumeration.  This models
     /// 3.11+ interpreter frames: owning coroutine/traceback objects expose
@@ -426,6 +432,7 @@ impl TypeInfo {
             items_have_gc_ptrs: false,
             custom_trace: None,
             is_object: false,
+            has_subclass_range: false,
             hide_from_app_level_inspector: false,
             parent: None,
             subclassrange_min: 0,
@@ -449,6 +456,7 @@ impl TypeInfo {
             items_have_gc_ptrs: false,
             custom_trace: None,
             is_object: false,
+            has_subclass_range: false,
             hide_from_app_level_inspector: false,
             parent: None,
             subclassrange_min: 0,
@@ -491,6 +499,7 @@ impl TypeInfo {
             items_have_gc_ptrs: false,
             custom_trace: None,
             is_object: false,
+            has_subclass_range: false,
             hide_from_app_level_inspector: false,
             parent: None,
             subclassrange_min: 0,
@@ -520,6 +529,7 @@ impl TypeInfo {
             items_have_gc_ptrs: false,
             custom_trace: None,
             is_object: true,
+            has_subclass_range: true,
             hide_from_app_level_inspector: false,
             parent: None,
             subclassrange_min: 0,
@@ -548,6 +558,7 @@ impl TypeInfo {
             items_have_gc_ptrs: false,
             custom_trace: None,
             is_object: true,
+            has_subclass_range: true,
             hide_from_app_level_inspector: false,
             parent: None,
             subclassrange_min: 0,
@@ -574,6 +585,7 @@ impl TypeInfo {
             items_have_gc_ptrs: false,
             custom_trace: None,
             is_object: true,
+            has_subclass_range: true,
             hide_from_app_level_inspector: false,
             parent: Some(parent_typeid),
             subclassrange_min: 0,
@@ -609,6 +621,7 @@ impl TypeInfo {
             items_have_gc_ptrs: false,
             custom_trace: None,
             is_object: true,
+            has_subclass_range: true,
             hide_from_app_level_inspector: false,
             parent: Some(parent_typeid),
             subclassrange_min: 0,
@@ -634,6 +647,7 @@ impl TypeInfo {
             items_have_gc_ptrs: false,
             custom_trace: Some(trace_fn),
             is_object: true,
+            has_subclass_range: true,
             hide_from_app_level_inspector: false,
             parent: Some(parent_typeid),
             subclassrange_min: 0,
@@ -656,6 +670,7 @@ impl TypeInfo {
             items_have_gc_ptrs: false,
             custom_trace: None,
             is_object: false,
+            has_subclass_range: false,
             hide_from_app_level_inspector: false,
             parent: None,
             subclassrange_min: 0,
@@ -682,6 +697,7 @@ impl TypeInfo {
             items_have_gc_ptrs,
             custom_trace: None,
             is_object: false,
+            has_subclass_range: false,
             hide_from_app_level_inspector: false,
             parent: None,
             subclassrange_min: 0,
@@ -704,6 +720,7 @@ impl TypeInfo {
             items_have_gc_ptrs: false,
             custom_trace: Some(trace_fn),
             is_object: false,
+            has_subclass_range: false,
             hide_from_app_level_inspector: false,
             parent: None,
             subclassrange_min: 0,
@@ -713,6 +730,16 @@ impl TypeInfo {
         }
     }
 
+    /// Mark an `rclass.OBJECT`-shaped private storage layout that shares the
+    /// classdef/vtable of another registered type. It remains visible to
+    /// `check_is_object` and app-level GC inspection, but contributes no
+    /// duplicate peer to the subclass-range numbering.
+    pub fn object_layout_without_subclass_range(mut self) -> Self {
+        self.is_object = true;
+        self.has_subclass_range = false;
+        self
+    }
+
     /// Create a varsize type info with a custom trace hook.
     ///
     /// RPython parity: `rgc.register_custom_trace_hook` on a
@@ -732,6 +759,7 @@ impl TypeInfo {
             items_have_gc_ptrs: false, // custom_trace handles ref tracing
             custom_trace: Some(trace_fn),
             is_object: false,
+            has_subclass_range: false,
             hide_from_app_level_inspector: false,
             parent: None,
             subclassrange_min: 0,
@@ -857,7 +885,7 @@ impl TypeRegistry {
 
     /// `gctypelayout.encode_type_shapes_now` parity
     /// (gctypelayout.py:393-398): freezes the registry so subsequent
-    /// `register_type` calls panic and assigns each `is_object`
+    /// `register_type` calls panic and assigns each registered classdef
     /// type its preorder `subclassrange_{min,max}`.
     ///
     /// The bounds come from `rtyper/normalizecalls.py:373-389
@@ -875,7 +903,7 @@ impl TypeRegistry {
         }
         self.can_add_new_types = false;
         self.assign_inheritance_ids();
-        // Refresh layout_table rows for is_object types whose
+        // Refresh layout_table rows for object types whose
         // subclassrange_{min,max} just changed.
         for (i, info) in self.entries.iter().enumerate() {
             self.layout_table[i] = TypeEntry::from_type_info(info, i as u32);
@@ -885,7 +913,7 @@ impl TypeRegistry {
     /// `rtyper/normalizecalls.py:373-389 assign_inheritance_ids` /
     /// `TotalOrderSymbolic` parity (normalizecalls.py:302-354).
     ///
-    /// For each `is_object` type, builds
+    /// For each type representing a registered classdef, builds
     /// `witness = reversed(MRO of cdef ids)` and pairs it with a
     /// matching `witness + [MAX]` peer:
     ///
@@ -909,12 +937,12 @@ impl TypeRegistry {
     /// list without relying on a magic numeric sentinel.
     fn assign_inheritance_ids(&mut self) {
         let n = self.entries.len();
-        // Build reversed-MRO witness for each is_object type.
+        // Build reversed-MRO witness for each registered classdef type.
         // Witness for typeid T = [T_root, ..., T_grandparent, T_parent, T]
         // where T_root is the topmost rclass.OBJECT-layout ancestor.
         let mut witness: Vec<Option<Vec<WitnessElement>>> = vec![None; n];
         for id in 0..n {
-            if !self.entries[id].is_object {
+            if !self.entries[id].has_subclass_range {
                 continue;
             }
             let mut mro: Vec<WitnessElement> = Vec::new();
@@ -927,7 +955,7 @@ impl TypeRegistry {
             witness[id] = Some(mro);
         }
 
-        // Build the peer list: each is_object type contributes a
+        // Build the peer list: each registered classdef contributes a
         // `(witness, owner)` Min peer and a `(witness + [Max], owner)`
         // Max peer. Sort lexicographically by witness; the peer's
         // position becomes its preorder value (TotalOrderSymbolic
@@ -1163,6 +1191,38 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_private_object_layout_does_not_perturb_subclass_ranges() {
+        unsafe fn trace_nothing(_: usize, _: &mut dyn FnMut(*mut majit_ir::GcRef)) {}
+
+        let build = |with_private_layout| {
+            let mut reg = TypeRegistry::new();
+            let parent = reg.register(TypeInfo::object(16));
+            let child = reg.register(TypeInfo::object_subclass(16, parent));
+            if with_private_layout {
+                let private = reg.register(
+                    TypeInfo::with_custom_trace(24, trace_nothing)
+                        .object_layout_without_subclass_range(),
+                );
+                assert!(reg.get(private).is_object);
+                assert!(!reg.get(private).has_subclass_range);
+            }
+            reg.freeze_types();
+            (
+                (
+                    reg.get(parent).subclassrange_min,
+                    reg.get(parent).subclassrange_max,
+                ),
+                (
+                    reg.get(child).subclassrange_min,
+                    reg.get(child).subclassrange_max,
+                ),
+            )
+        };
+
+        assert_eq!(build(false), build(true));
+    }
+
     #[test]
     fn test_for_each_gc_ptr_varsize() {
         // Variable-size object: base_size=8 (length field at offset 0),

majit/majit-metainterp/src/optimizeopt/mod.rs

@@ -2459,6 +2459,18 @@ impl OptContext {
         }
     }
 
+    /// optimizer.py:528-534 new_const(fielddescr) — default value for an
+    /// unset field of a freshly allocated virtual struct.  GC allocations are
+    /// zero-filled, so optimizeopt can answer the read without materialising
+    /// the virtual.
+    pub fn new_const(&mut self, field_type: Type) -> OpRef {
+        match field_type {
+            Type::Int | Type::Void => self.make_constant_int(0),
+            Type::Ref => self.make_constant_ref(GcRef::NULL),
+            Type::Float => self.make_constant_float(0.0),
+        }
+    }
+
     /// vstring.py:110-119 / 171-175 / 251-253 / 281-295
     /// Per-subclass getstrlen() dispatch — returns a cached lgtop OpRef if
     /// available, or computes/emits the length and caches in StrPtrInfo.lgtop.

majit/majit-metainterp/src/optimizeopt/virtualize.rs

@@ -1036,8 +1036,8 @@ impl OptVirtualize {
             // virtual fields but can be resolved from the SizeDescr vtable.
             // RPython doesn't need this because GUARD_CLASS reads the class
             // directly from the object, not via a separate field read.
+            let is_typeptr = op.with_field_descr(|fd| fd.is_typeptr()).unwrap_or(false);
             if field_val.is_none() && matches!(op.opcode, majit_ir::OpCode::GetfieldGcI) {
-                let is_typeptr = op.with_field_descr(|fd| fd.is_typeptr()).unwrap_or(false);
                 if is_typeptr {
                     let vtable = match &info {
                         PtrInfo::Virtual(vinfo) => vinfo
@@ -3943,6 +3943,37 @@ mod tests {
         assert!(result.is_empty(), "NEW should be removed");
     }
 
+    #[test]
+    fn test_fresh_virtual_unwritten_fields_are_typed_zero() {
+        // virtualize.py:184-190 optimize_GETFIELD_GC_I: GC allocations are
+        // zero-filled, so an unset virtual field folds through
+        // optimizer.new_const(fielddescr) without forcing the allocation.
+        for (get_opcode, field_descr) in [
+            (OpCode::GetfieldGcI, field_descr(0)),
+            (OpCode::GetfieldGcR, ref_field_descr(0)),
+            (OpCode::GetfieldGcF, float_field_descr(0)),
+        ] {
+            let mut ops = vec![
+                Op::with_descr(OpCode::NewWithVtable, &[], size_descr(1)),
+                Op::with_descr(
+                    get_opcode,
+                    &[crate::history::test_support::rooted_resop_operand(
+                        Type::Ref,
+                        0,
+                    )],
+                    field_descr,
+                ),
+            ];
+            assign_positions(&mut ops);
+            let result = run_pass(&ops);
+            assert!(
+                result.is_empty(),
+                "{get_opcode:?} of an unset fresh field forced the virtual: {:?}",
+                result.iter().map(|op| op.opcode).collect::<Vec<_>>()
+            );
+        }
+    }
+
     #[test]
     fn test_setfield_getfield_on_virtual() {
         // p0 = new_with_vtable(descr=size1)

pyre/bench/synth/enumerate_bignum_start.cranelift.jitstats

@@ -8,7 +8,7 @@ fbw_rolled_back_with_effects=0
 fbw_store_journal_rollback_failed=0
 field_pos_attached_misplaced=0
 field_pos_spec_misplaced=0
-guard_failures=0
+guard_failures=1
 internal_compile_panics=0
 loops_aborted=0
-loops_compiled=0
+loops_compiled=1

pyre/bench/synth/enumerate_bignum_start.dynasm.jitstats

@@ -8,7 +8,7 @@ fbw_rolled_back_with_effects=0
 fbw_store_journal_rollback_failed=0
 field_pos_attached_misplaced=0
 field_pos_spec_misplaced=0
-guard_failures=0
+guard_failures=1
 internal_compile_panics=0
 loops_aborted=0
-loops_compiled=0
+loops_compiled=1

pyre/bench/synth/enumerate_bignum_start.wasm.jitstats

@@ -8,7 +8,7 @@ fbw_rolled_back_with_effects=0
 fbw_store_journal_rollback_failed=0
 field_pos_attached_misplaced=0
 field_pos_spec_misplaced=0
-guard_failures=0
+guard_failures=1
 internal_compile_panics=0
 loops_aborted=0
-loops_compiled=0
+loops_compiled=1

pyre/bench/synth/exception_traceback_loop_forms.cranelift.jitstats

@@ -8,7 +8,7 @@ fbw_rolled_back_with_effects=0
 fbw_store_journal_rollback_failed=0
 field_pos_attached_misplaced=0
 field_pos_spec_misplaced=0
-guard_failures=812
+guard_failures=811
 internal_compile_panics=0
 loops_aborted=0
 loops_compiled=8

pyre/bench/synth/exception_traceback_loop_forms.dynasm.jitstats

@@ -8,7 +8,7 @@ fbw_rolled_back_with_effects=0
 fbw_store_journal_rollback_failed=0
 field_pos_attached_misplaced=0
 field_pos_spec_misplaced=0
-guard_failures=812
+guard_failures=811
 internal_compile_panics=0
 loops_aborted=0
 loops_compiled=8

pyre/bench/synth/foriter_inlined_callee_build_list.cranelift.jitstats

@@ -0,0 +1,14 @@
+bridges_compiled=0
+descr_set_absent=0
+descr_set_ambiguous=0
+descr_set_stale_absent=0
+fbw_blackhole_adopted_multi_frame=0
+fbw_blackhole_adopted_single_frame=0
+fbw_rolled_back_with_effects=0
+fbw_store_journal_rollback_failed=0
+field_pos_attached_misplaced=0
+field_pos_spec_misplaced=0
+guard_failures=1
+internal_compile_panics=0
+loops_aborted=0
+loops_compiled=1

pyre/bench/synth/foriter_inlined_callee_build_list.dynasm.jitstats

@@ -0,0 +1,14 @@
+bridges_compiled=0
+descr_set_absent=0
+descr_set_ambiguous=0
+descr_set_stale_absent=0
+fbw_blackhole_adopted_multi_frame=0
+fbw_blackhole_adopted_single_frame=0
+fbw_rolled_back_with_effects=0
+fbw_store_journal_rollback_failed=0
+field_pos_attached_misplaced=0
+field_pos_spec_misplaced=0
+guard_failures=1
+internal_compile_panics=0
+loops_aborted=0
+loops_compiled=1

pyre/bench/synth/foriter_inlined_callee_build_list.py

@@ -0,0 +1,18 @@
+# A FOR_ITER trace must keep compiling when an inlined callee allocates a
+# fresh list and copies it into a tuple.  Both fresh allocations are replay-safe
+# and have no reason to abort the caller's loop trace.
+
+
+def chain(item):
+    out = []
+    return len(tuple(out)) + (item - item)
+
+
+def drive(n):
+    last = -1
+    for i in range(n):
+        last = chain(i)
+    return last
+
+
+print(drive(20000))

pyre/bench/synth/foriter_inlined_callee_build_list.wasm.jitstats

@@ -0,0 +1,14 @@
+bridges_compiled=0
+descr_set_absent=0
+descr_set_ambiguous=0
+descr_set_stale_absent=0
+fbw_blackhole_adopted_multi_frame=0
+fbw_blackhole_adopted_single_frame=0
+fbw_rolled_back_with_effects=0
+fbw_store_journal_rollback_failed=0
+field_pos_attached_misplaced=0
+field_pos_spec_misplaced=0
+guard_failures=1
+internal_compile_panics=0
+loops_aborted=0
+loops_compiled=1