jit(wasm): drop the wasm32 arm of the self-recursive root-bridge inline

pyre/bench/synth/ca_bridge_multiframe_resume_double_call.wasm.jitstats

@@ -2,9 +2,13 @@ bridges_compiled=16
 descr_set_absent=0
 descr_set_ambiguous=0
 descr_set_stale_absent=0
+fbw_blackhole_adopted_multi_frame=0
+fbw_blackhole_adopted_single_frame=0
 fbw_rolled_back_with_effects=0
 fbw_store_journal_rollback_failed=0
-guard_failures=2581
+field_pos_attached_misplaced=0
+field_pos_spec_misplaced=0
+guard_failures=2592
 internal_compile_panics=0
-loops_aborted=1
+loops_aborted=0
 loops_compiled=3

pyre/bench/synth/foriter_call_resume_drops_iteration.wasm.jitstats

@@ -1,11 +1,14 @@
-bridges_compiled=26
+bridges_compiled=27
 descr_set_absent=0
 descr_set_ambiguous=0
 descr_set_stale_absent=0
+fbw_blackhole_adopted_multi_frame=0
+fbw_blackhole_adopted_single_frame=0
 fbw_rolled_back_with_effects=0
+fbw_store_journal_rollback_failed=0
 field_pos_attached_misplaced=0
 field_pos_spec_misplaced=0
-guard_failures=5165
+guard_failures=5150
 internal_compile_panics=0
-loops_aborted=2
+loops_aborted=1
 loops_compiled=3

pyre/bench/synth/recursion_memo_branch.wasm.jitstats

@@ -2,8 +2,13 @@ bridges_compiled=28
 descr_set_absent=0
 descr_set_ambiguous=0
 descr_set_stale_absent=0
+fbw_blackhole_adopted_multi_frame=0
+fbw_blackhole_adopted_single_frame=0
 fbw_rolled_back_with_effects=0
-guard_failures=4724
+fbw_store_journal_rollback_failed=0
+field_pos_attached_misplaced=0
+field_pos_spec_misplaced=0
+guard_failures=4704
 internal_compile_panics=0
-loops_aborted=2
+loops_aborted=1
 loops_compiled=3

pyre/bench/synth/selfrec_bridge_nontail_promote.cranelift.jitstats

@@ -0,0 +1,14 @@
+bridges_compiled=6
+descr_set_absent=0
+descr_set_ambiguous=0
+descr_set_stale_absent=0
+fbw_blackhole_adopted_multi_frame=0
+fbw_blackhole_adopted_single_frame=0
+fbw_rolled_back_with_effects=0
+fbw_store_journal_rollback_failed=0
+field_pos_attached_misplaced=0
+field_pos_spec_misplaced=0
+guard_failures=806
+internal_compile_panics=0
+loops_aborted=0
+loops_compiled=2

pyre/bench/synth/selfrec_bridge_nontail_promote.dynasm.jitstats

@@ -0,0 +1,14 @@
+bridges_compiled=6
+descr_set_absent=0
+descr_set_ambiguous=0
+descr_set_stale_absent=0
+fbw_blackhole_adopted_multi_frame=0
+fbw_blackhole_adopted_single_frame=0
+fbw_rolled_back_with_effects=0
+fbw_store_journal_rollback_failed=0
+field_pos_attached_misplaced=0
+field_pos_spec_misplaced=0
+guard_failures=806
+internal_compile_panics=0
+loops_aborted=0
+loops_compiled=2

pyre/bench/synth/selfrec_bridge_nontail_promote.py

@@ -0,0 +1,38 @@
+# pyre-check: max-pypy-ratio=20
+# Coverage for the self-recursive root-bridge inline when the recursion is
+# non-tail and carries a Ref local.
+#
+# `walk` is self-recursive, takes exact-integer arguments and holds a
+# `BinaryOp` residual, so a guard-failure bridge that reaches its CALL takes the
+# root-bridge admission (`bridge_rec_root_selfrec`, inline_call.rs).
+# `bridge_recursion_overflow` already covers that admission, but only in its
+# easiest form: tail recursion whose live set is two machine integers. Two
+# ingredients of the "a Ref reached an int operation" failure it is meant to
+# guard against were therefore unexercised.
+#
+# `acc * 2` crosses the machine-int boundary partway down the recursion, so the
+# accumulator promotes to a long — a Ref — at a level that moves with the
+# caller's seed, and the overflow guard fires inside the recursive frame. `tag`
+# keeps a second Ref live across the recursive CALL beside it, and the non-tail
+# `inner + len(tag)` leaves a paused caller chain, so the guard's resume stream
+# is multi-frame and mixes Ref with Int rather than being one frame of
+# integers.
+#
+# Byte-parity against CPython/PyPy is the gate: Python integers are unbounded,
+# so the promotion must not be observable in the result.
+_TAGS = ("a", "bb", "ccc", "dddd")
+
+
+def walk(n, acc):
+    if n == 0:
+        return acc
+    tag = _TAGS[n & 3]
+    nxt = acc * 2 + len(tag)
+    inner = walk(n - 1, nxt)
+    return inner + len(tag)
+
+
+out = []
+for i in range(50000):
+    out.append(walk(24, (1 << 50) + i) % 1000000007)
+print(out[0], out[-1], sum(out) % 1000000007)

pyre/bench/synth/selfrec_bridge_nontail_promote.wasm.jitstats

@@ -0,0 +1,14 @@
+bridges_compiled=6
+descr_set_absent=0
+descr_set_ambiguous=0
+descr_set_stale_absent=0
+fbw_blackhole_adopted_multi_frame=0
+fbw_blackhole_adopted_single_frame=0
+fbw_rolled_back_with_effects=0
+fbw_store_journal_rollback_failed=0
+field_pos_attached_misplaced=0
+field_pos_spec_misplaced=0
+guard_failures=806
+internal_compile_panics=0
+loops_aborted=0
+loops_compiled=2

pyre/bench/synth/wasm_ca_trampoline_decline.wasm.jitstats

@@ -1,9 +1,14 @@
-bridges_compiled=1
+bridges_compiled=3
 descr_set_absent=0
 descr_set_ambiguous=0
 descr_set_stale_absent=0
+fbw_blackhole_adopted_multi_frame=0
+fbw_blackhole_adopted_single_frame=0
 fbw_rolled_back_with_effects=0
-guard_failures=404
+fbw_store_journal_rollback_failed=0
+field_pos_attached_misplaced=0
+field_pos_spec_misplaced=0
+guard_failures=601
 internal_compile_panics=0
 loops_aborted=1
 loops_compiled=2

pyre/extra_tests/parity_tests/foriter_body_call_abort_operand_stack.py

@@ -0,0 +1,38 @@
+# The operand stack an aborted inline sub-walk hands back to the interpreter,
+# for a call made inside a FOR_ITER body.
+#
+# When the walker gives up on inlining a callee it flushes the caller's frame
+# at the CALL it entered under and lets the interpreter re-execute the whole
+# call.  That flush rebuilds the operand stack from two sources: the enclosing
+# FOR_ITER's iterator (and anything else below the call) from the vstack
+# mirror, and the call's own operands from the encoded residual op.  The
+# operands do not sit at a fixed byte offset in that op — the method-form CALL
+# helpers lower through a shape whose leading Int list is variable-width, so a
+# reader that assumes the plain shape's offset picks up the Int list's register
+# indices and resolves them in the Ref bank.  The result is a stack of the
+# right HEIGHT (so the flush's depth check passes) holding the wrong objects:
+# here the enclosing loop's iterator arrived as the subscript index, and
+# `SubPattern.__getitem__` raised `TypeError: list indices must be integers or
+# slices, not list_iterator`.
+#
+# `re.compile` of a large flat alternation is the reproducer: `_compile_info`
+# calls `_get_charset_prefix`, whose BRANCH arm loops `for p in av[1]` and
+# subscripts `p[0]` inside the body.  The alternation has to be big enough for
+# that loop to go hot — it is clean below about a thousand branches — and no
+# hand-written class with the same shape has been made to reach the abort leg,
+# so the real module drives it.
+#
+# The compile is the assertion: any wrong operand raises out of `re`.
+
+import re
+
+BRANCHES = 2000
+
+pattern = "|".join("%d" % x for x in range(BRANCHES))
+compiled = re.compile(pattern)
+
+# Alternation is first-match, so "1999" is matched by the earlier "1" branch.
+assert compiled.match("1999").group(0) == "1"
+assert compiled.match("nope") is None
+
+print("OK")

pyre/extra_tests/parity_tests/os_utime_pathconf_truncate.py

@@ -70,9 +70,14 @@ def raises(call, exc):
             os.close(fd)
 
 # `times` is the one argument here that may be spelled either way — it sits
-# before the keyword-only marker.
-os.utime(p, times=(-5.0, -6.0))
-check(os.stat(p).st_mtime_ns == -6_000_000_000, "utime(times=...) by keyword")
+# before the keyword-only marker. The pair is one the platform holds: Windows
+# refuses times before the epoch, for the reason given above.
+atime, mtime = (5.0, 6.0) if sys.platform == "win32" else (-5.0, -6.0)
+os.utime(p, times=(atime, mtime))
+check(
+    os.stat(p).st_mtime_ns == int(mtime) * 1_000_000_000,
+    f"utime(times=...) by keyword -> {os.stat(p).st_mtime_ns}",
+)
 raises(lambda: os.utime(p, (1, 2), times=(3, 4)), TypeError)
 
 # Back to a time the rest of the file can be reasoned about.
@@ -82,6 +87,10 @@ def raises(call, exc):
 # Every name the table carries either answers with a number or refuses the
 # question — the terminal-only limits are not ones a regular file has. What no
 # answer may be is None: a host with no determinate value says so with -1.
+#
+# `pathconf` and the `pathconf_names` table it resolves through are a POSIX
+# surface; neither runtime carries them on Windows, so there is nothing to
+# compare there.
 def limits(target):
     for name in sorted(os.pathconf_names):
         try:
@@ -93,22 +102,23 @@ def limits(target):
         yield name, limit
 
 
-answered = dict(limits(p))
-check(answered, "pathconf answered no name at all")
-check("PC_NAME_MAX" in answered, "pathconf refused PC_NAME_MAX on a regular file")
+if sys.platform != "win32":
+    answered = dict(limits(p))
+    check(answered, "pathconf answered no name at all")
+    check("PC_NAME_MAX" in answered, "pathconf refused PC_NAME_MAX on a regular file")
 
-if os.pathconf in os.supports_fd:
-    fd = os.open(p, os.O_RDONLY)
-    try:
-        by_fd = dict(limits(fd))
-        check(
-            by_fd.get("PC_NAME_MAX") == answered["PC_NAME_MAX"],
-            "the descriptor and the name disagree about PC_NAME_MAX",
-        )
-    finally:
-        os.close(fd)
-
-raises(lambda: os.pathconf(p, "PC_NOT_A_REAL_NAME"), ValueError)
+    if os.pathconf in os.supports_fd:
+        fd = os.open(p, os.O_RDONLY)
+        try:
+            by_fd = dict(limits(fd))
+            check(
+                by_fd.get("PC_NAME_MAX") == answered["PC_NAME_MAX"],
+                "the descriptor and the name disagree about PC_NAME_MAX",
+            )
+        finally:
+            os.close(fd)
+
+    raises(lambda: os.pathconf(p, "PC_NOT_A_REAL_NAME"), ValueError)
 
 # ── truncate's length ─────────────────────────────────────────────────────
 # A length wider than off_t is not a size the file can be given; the cast that

pyre/pyre-jit-trace/src/jitcode_dispatch/fbw_state.rs

@@ -1357,10 +1357,9 @@ fn fbw_deny_hazardous_inline(callee_code_key: usize) {
 ///   the iterator (the two `foriter_exempt_*` witnesses).
 /// * **Self-recursive** — the callee calls itself.  A hot self-recursion
 ///   forms a `CALL_ASSEMBLER` bridge whose moving-nursery callee frame cannot
-///   survive the residual trampoline retaining a pre-call frame pointer; on
-///   the wasm always-portal path the inlined body also type-confuses the
-///   optimizer (`setintbound: got Ref`, the `wasm_ca_trampoline_decline`
-///   witness).  Detected both dynamically (the same `w_code` already nested in
+///   survive the residual trampoline retaining a pre-call frame pointer (the
+///   `wasm_ca_trampoline_decline` witness).  Detected both dynamically (the
+///   same `w_code` already nested in
 ///   the framestack — mutual/deep recursion) and statically
 ///   (`code_is_self_recursive`), since the recursive call residualizes to a
 ///   `CALL_ASSEMBLER` rather than nesting the framestack, so it is already a
@@ -1426,7 +1425,7 @@ pub(crate) fn fbw_abort_nested_unjournaled_residual<Sym: WalkSym>(
     // [`fbw_inline_callee_hazardous`]: a LOOP-BEARING callee (the FOR_ITER
     // Option-C refused-delivery double-advance, the `foriter_exempt_*`
     // witnesses) and a SELF-RECURSIVE callee (the hot `CALL_ASSEMBLER`
-    // recursion-bridge / wasm always-portal `setintbound` type-confusion, the
+    // recursion-bridge frame the residual trampoline cannot retain, the
     // `wasm_ca_trampoline_decline` witness).  Both are properties of the
     // framestack knowable at the residual decline point, so the whole trace
     // aborts before the hazardous body is committed.  Every other nested

pyre/pyre-jit-trace/src/jitcode_dispatch/inline_call.rs

@@ -1300,7 +1300,14 @@ pub(crate) fn reconstructed_all_ref_call_stack<Sym: WalkSym>(
     op: &DecodedOp,
     ctx: &WalkContext<'_, '_, Sym>,
 ) -> Option<Vec<pyre_object::PyObjectRef>> {
-    let fresh = read_ref_var_list_concrete(code, op, 1, ctx);
+    // The Ref list is NOT at a fixed offset: the method-form `CALL` helpers
+    // this leg latches for lower through the mixed `iIRd>r` shape, whose
+    // leading Int list shifts it (`dispatch_residual_call_iIRd_kind` reads it
+    // at `1 + i_width`).  Reading offset 1 there takes the Int list's register
+    // indices into the Ref bank — refs unrelated to the call, of a length that
+    // still passes the flush's depth check.
+    let ref_operand_offset = ref_var_list_operand_offset(code, op)?;
+    let fresh = read_ref_var_list_concrete(code, op, ref_operand_offset, ctx);
     if fresh.is_empty() {
         return None;
     }
@@ -2865,13 +2872,10 @@ pub(crate) fn try_walker_inline_resolved_user_call<Sym: WalkSym>(
     // body sub-walk reaches its own recursive CALL as a nested residual, which
     // `fbw_abort_nested_unjournaled_residual` declines on the self-recursive
     // hazard arm — an abort storm that folds the whole guard bridge back to
-    // residual.  The native `CALL_ASSEMBLER` self-recursion fold already exempts
-    // that decline via `SELFREC_CA_FOLD_ACTIVE`; the same exemption applies to
-    // this admitted inline, whose recursive residual runs concretely at the
-    // pre-execute site (executed, so no replay double-apply).  Native only: the
-    // wasm always-portal path type-confuses the self-recursive inline
-    // (`setintbound: got Ref`), so it keeps the correct residual-fallback
-    // decline.
+    // residual.  The `CALL_ASSEMBLER` self-recursion fold already exempts that
+    // decline via `SELFREC_CA_FOLD_ACTIVE`; the same exemption applies to this
+    // admitted inline, whose recursive residual runs concretely at the
+    // pre-execute site (executed, so no replay double-apply).
     let mut bridge_rec_root_selfrec = false;
     if ctx.trace_ctx.is_bridge_trace
         && args_all_builtin_integer
@@ -2911,12 +2915,11 @@ pub(crate) fn try_walker_inline_resolved_user_call<Sym: WalkSym>(
         if !safe_root_bridge {
             return Ok(None);
         }
-        bridge_rec_root_selfrec = cfg!(not(target_arch = "wasm32"))
-            && unsafe {
-                let raw = pyre_interpreter::w_code_get_ptr(w_code as pyre_object::PyObjectRef)
-                    as *const pyre_interpreter::CodeObject;
-                !raw.is_null() && pyre_interpreter::code_is_self_recursive(&*raw)
-            };
+        bridge_rec_root_selfrec = unsafe {
+            let raw = pyre_interpreter::w_code_get_ptr(w_code as pyre_object::PyObjectRef)
+                as *const pyre_interpreter::CodeObject;
+            !raw.is_null() && pyre_interpreter::code_is_self_recursive(&*raw)
+        };
     }
     // A callee `fbw_abort_nested_unjournaled_residual` already named on its
     // hazard arm residualizes from here on.  The hazard is a static property of

pyre/pyre-jit-trace/src/jitcode_dispatch/mod.rs

@@ -3947,6 +3947,44 @@ fn concrete_from_recorded_opref<Sym: WalkSym>(
     }
 }
 
+/// The `operand_offset` of this op's Ref var-list (`R`), for a reader that
+/// holds only the decoded op and must find that list itself.
+///
+/// A dispatcher that decoded the whole op passes the offset it already
+/// computed; anything reached later — an abort leg, a specializer entered
+/// after resolution — has no such value and must not guess one.  `R` sits at
+/// offset 1 for the Ref-only residual shape (`iRd>r`) but NOT for the mixed
+/// one (`iIRd>r`, `riIRd>r`, `iiIRd>r`), whose leading Int list is itself
+/// variable-width: reading offset 1 there lands on the Int list's length byte
+/// and takes its register indices into the Ref bank, yielding unrelated
+/// objects with a plausible length.
+///
+/// Walks the argcode widths of `blackhole.py:112-157`, the same walk
+/// [`decode_op_at`] performs.  `None` — an op declaring no Ref list, or one
+/// whose earlier operands cannot be width-counted — leaves the caller to
+/// decline.
+///
+/// [`decode_op_at`]: crate::jitcode_runtime::decode_op_at
+fn ref_var_list_operand_offset(code: &[u8], op: &DecodedOp) -> Option<usize> {
+    let first_operand_pc = op.pc + 1;
+    let mut cursor = first_operand_pc;
+    let mut chars = op.argcodes.chars();
+    while let Some(c) = chars.next() {
+        match c {
+            'R' => return Some(cursor - first_operand_pc),
+            'i' | 'c' | 'r' | 'f' => cursor += 1,
+            'L' | 'd' | 'j' => cursor += 2,
+            'I' | 'F' => cursor += 1 + *code.get(cursor)? as usize,
+            '>' => {
+                chars.next()?;
+                cursor += 1;
+            }
+            _ => return None,
+        }
+    }
+    None
+}
+
 /// Read concrete shadow values for a Ref-bank variadic operand list.
 /// Parallels [`read_ref_var_list`] — reads the
 /// same byte indices but resolves through `ctx.concrete_registers_r`.

pyre/pyre-jit-trace/src/jitcode_dispatch/specialize.rs

@@ -3288,6 +3288,16 @@ pub(crate) fn try_walker_specialize_load_type_name_attr<Sym: WalkSym>(
     else {
         return Ok(None);
     };
+    // The metaclass guard below reads the raw `w_class` slot, while the fast
+    // path answers through `typedef::type`, which falls back to
+    // `gettypefor(ob_type)` when that slot is null.  A receiver reached through
+    // that fallback would be guarded against a value its field never holds, and
+    // nothing writes the slot afterwards, so the guard would fail on every
+    // execution forever — one bridge per `trace_eagerness` bucket, without ever
+    // converging.  Fold only what the guard can discharge.
+    if !std::ptr::eq(unsafe { (*concrete_obj).w_class }, metatype) {
+        return Ok(None);
+    }
 
     // guard_class(obj, ob_type): the `W_TypeObject` layout both field reads
     // below index into.  `is_type` is this check.