jit: speed up exception construction, traceback, and property getters

majit/majit-gc/src/collector.rs

@@ -1704,13 +1704,7 @@ impl MiniMarkGC {
         let mut barriers = Vec::with_capacity(self.pinned_objects.len());
         for &obj_addr in &self.pinned_objects {
             let type_id = unsafe { (*header_of(obj_addr)).type_id() };
-            let type_info = self.types.get(type_id);
-            let payload_size = if type_info.item_size > 0 {
-                let length = unsafe { *((obj_addr + type_info.length_offset) as *const usize) };
-                type_info.total_instance_size(length)
-            } else {
-                type_info.size
-            };
+            let payload_size = self.size_for_typeid(obj_addr, type_id, "pinned_barriers");
             let object_size = Self::nursery_allocation_size(GcHeader::SIZE + payload_size);
             barriers.push((obj_addr - GcHeader::SIZE, object_size));
         }
@@ -2623,14 +2617,12 @@ impl MiniMarkGC {
         let hdr_ptr = (obj_addr - GcHeader::SIZE) as *const GcHeader;
         let type_id = unsafe { (*hdr_ptr).type_id() };
         self.validate_type_id(type_id, obj_addr, "allocate_shadow");
-        let type_info = self.types.get(type_id);
-        let payload_size = if type_info.item_size > 0 {
-            let length = unsafe { *((obj_addr + type_info.length_offset) as *const usize) };
-            type_info.total_instance_size(length)
-        } else {
-            type_info.size
-        };
+        let payload_size = self.size_for_typeid(obj_addr, type_id, "allocate_shadow");
         let total_size = GcHeader::SIZE + payload_size;
+        let (item_size, length_offset) = {
+            let type_info = self.types.get(type_id);
+            (type_info.item_size, type_info.length_offset)
+        };
         let shadow_hdr_ptr = self.oldgen.alloc(total_size);
         let shadow_obj = shadow_hdr_ptr as usize + GcHeader::SIZE;
         unsafe {
@@ -2648,9 +2640,9 @@ impl MiniMarkGC {
             if self.gc_state == GcState::Marking {
                 (*(shadow_hdr_ptr as *mut GcHeader)).set_flag(flags::VISITED);
             }
-            if type_info.item_size > 0 {
-                let len_ofs = type_info.length_offset;
-                *((shadow_obj + len_ofs) as *mut usize) = *((obj_addr + len_ofs) as *const usize);
+            if item_size > 0 {
+                *((shadow_obj + length_offset) as *mut usize) =
+                    *((obj_addr + length_offset) as *const usize);
             }
             let nursery_hdr = (obj_addr - GcHeader::SIZE) as *mut GcHeader;
             (*nursery_hdr).set_flag(flags::HAS_SHADOW);
@@ -2714,6 +2706,60 @@ impl MiniMarkGC {
         }
     }
 
+    /// `base.py:134-144 _get_size_for_typeid` — the payload size of `obj_addr`,
+    /// reading the length field when the type is varsize. `None` when the
+    /// length cannot describe an allocation.
+    ///
+    /// Upstream rounds the result here. Pyre's callers each apply their own
+    /// rounding (nursery geometry, arena minimum, inspector alignment), so the
+    /// rounding stays at the call sites.
+    fn try_size_for_typeid(&self, obj_addr: usize, type_id: u32) -> Option<usize> {
+        let type_info = self.types.get(type_id);
+        if type_info.item_size == 0 {
+            return Some(type_info.size);
+        }
+        let length = unsafe { *((obj_addr + type_info.length_offset) as *const usize) };
+        type_info
+            .item_size
+            .checked_mul(length)
+            .and_then(|items| type_info.size.checked_add(items))
+            // No object can be larger than `isize::MAX` — `Layout` refuses to
+            // describe one — so a larger result is a decode failure, not a
+            // request the allocator could ever serve.
+            .filter(|&size| size <= isize::MAX as usize - GcHeader::SIZE)
+    }
+
+    /// Panicking [`Self::try_size_for_typeid`], for the collector paths that
+    /// are about to allocate or copy that many bytes.
+    ///
+    /// A varsize length is read straight out of the object, so a collector that
+    /// reaches an object before its length field is initialized computes a size
+    /// that describes nothing. Report the inputs here: downstream the allocator
+    /// sees only the product, and fails on a `Layout` it cannot even build.
+    fn size_for_typeid(&self, obj_addr: usize, type_id: u32, site: &str) -> usize {
+        match self.try_size_for_typeid(obj_addr, type_id) {
+            Some(size) => size,
+            None => {
+                let type_info = self.types.get(type_id);
+                let length = unsafe { *((obj_addr + type_info.length_offset) as *const usize) };
+                panic!(
+                    "GC BUG: varsize length describes no allocation: length={} (read at \
+                     obj_addr={:#x} + length_offset={}) item_size={} fixed_size={} \
+                     type_id={} header_addr={:#x} nursery_start={:#x} site={}",
+                    length,
+                    obj_addr,
+                    type_info.length_offset,
+                    type_info.item_size,
+                    type_info.size,
+                    type_id,
+                    obj_addr - GcHeader::SIZE,
+                    self.nursery.start_ptr() as usize,
+                    site,
+                );
+            }
+        }
+    }
+
     fn copy_nursery_object(
         &mut self,
         obj_addr: usize,
@@ -2794,18 +2840,11 @@ impl MiniMarkGC {
                 holder_words,
             );
         }
-        let type_info = self.types.get(type_id);
-
         // Compute the actual payload size (for varsize objects, read the length).
-        let actual_payload_size = if type_info.item_size > 0 {
-            let length = unsafe { *((obj_addr + type_info.length_offset) as *const usize) };
-            type_info.total_instance_size(length)
-        } else {
-            type_info.size
-        };
+        let actual_payload_size = self.size_for_typeid(obj_addr, type_id, site);
 
         let total_size = GcHeader::SIZE + actual_payload_size;
-        let has_gc_ptrs = type_info.has_gc_ptrs;
+        let has_gc_ptrs = self.types.get(type_id).has_gc_ptrs;
 
         // minimark.py:1513-1519: if the object has a pre-allocated
         // shadow (from id() or identityhash()), copy into it instead
@@ -3955,14 +3994,7 @@ impl MiniMarkGC {
     fn object_total_size(&self, obj_addr: usize) -> usize {
         let type_id = unsafe { (*header_of(obj_addr)).type_id() };
         self.validate_type_id(type_id, obj_addr, "object_total_size");
-        let type_info = self.types.get(type_id);
-        let payload_size = if type_info.item_size > 0 {
-            let length = unsafe { *((obj_addr + type_info.length_offset) as *const usize) };
-            type_info.total_instance_size(length)
-        } else {
-            type_info.size
-        };
-        GcHeader::SIZE + payload_size
+        GcHeader::SIZE + self.size_for_typeid(obj_addr, type_id, "object_total_size")
     }
 
     /// `base.py:135-141 get_size` / `inspector.py:76-77
@@ -3975,15 +4007,10 @@ impl MiniMarkGC {
         if type_id as usize >= self.types.len() {
             return None;
         }
-        let type_info = self.types.get(type_id);
-        if type_info.item_size == 0 {
-            return Some(type_info.size);
+        let size = self.try_size_for_typeid(obj.0, type_id)?;
+        if self.types.get(type_id).item_size == 0 {
+            return Some(size);
         }
-        let length = unsafe { *((obj.0 + type_info.length_offset) as *const usize) };
-        let size = type_info
-            .item_size
-            .checked_mul(length)?
-            .checked_add(type_info.size)?;
         let align_mask = GcHeader::ALIGN - 1;
         size.checked_add(align_mask).map(|size| size & !align_mask)
     }
@@ -4008,13 +4035,7 @@ impl MiniMarkGC {
         if type_id >= self.types.len() {
             return None;
         }
-        let type_info = self.types.get(type_id as u32);
-        let payload_size = if type_info.item_size > 0 {
-            let length = unsafe { *((addr + type_info.length_offset) as *const usize) };
-            type_info.total_instance_size(length)
-        } else {
-            type_info.size
-        };
+        let payload_size = self.try_size_for_typeid(addr, type_id as u32)?;
         Some(GcHeader::SIZE + payload_size)
     }
 
@@ -5377,13 +5398,7 @@ impl MiniMarkGC {
         let mut saved: Vec<(usize, usize, Vec<u8>)> = Vec::new();
         for &obj_addr in &self.pinned_objects {
             let type_id = unsafe { (*header_of(obj_addr)).type_id() };
-            let type_info = self.types.get(type_id);
-            let payload_size = if type_info.item_size > 0 {
-                let length = unsafe { *((obj_addr + type_info.length_offset) as *const usize) };
-                type_info.total_instance_size(length)
-            } else {
-                type_info.size
-            };
+            let payload_size = self.size_for_typeid(obj_addr, type_id, "pinned_snapshot");
             let total_size = (GcHeader::SIZE + payload_size).max(GcHeader::MIN_NURSERY_OBJ_SIZE);
             let total_size = (total_size + 7) & !7;
             let header_start = obj_addr - GcHeader::SIZE;
@@ -7798,6 +7813,40 @@ mod tests {
         assert!(gc.alloc_oldgen_typed(tid, usize::MAX).is_null());
     }
 
+    /// A varsize length is read out of the object, so a collector reaching an
+    /// object before its length is initialized computes a size that describes
+    /// nothing.  Both shapes must be rejected — in particular the second, where
+    /// the multiplication does *not* overflow and the size is merely far past
+    /// anything `Layout` can express.
+    #[test]
+    fn varsize_length_that_describes_no_allocation_is_rejected() {
+        let mut gc = test_gc(4096);
+        let tid = gc.register_type(TypeInfo::varsize(16, 8, 0, false, Vec::new()));
+
+        // The length field lives at offset 0, so a local stands in for the
+        // object: nothing here allocates, and nothing is dereferenced beyond it.
+        let length = std::cell::Cell::new(0usize);
+        let obj_addr = length.as_ptr() as usize;
+
+        length.set(4);
+        assert_eq!(gc.try_size_for_typeid(obj_addr, tid), Some(16 + 8 * 4));
+
+        length.set(usize::MAX);
+        assert_eq!(gc.try_size_for_typeid(obj_addr, tid), None);
+
+        length.set(isize::MAX as usize / 8);
+        assert_eq!(gc.try_size_for_typeid(obj_addr, tid), None);
+    }
+
+    #[test]
+    #[should_panic(expected = "varsize length describes no allocation")]
+    fn varsize_length_that_describes_no_allocation_names_its_inputs() {
+        let mut gc = test_gc(4096);
+        let tid = gc.register_type(TypeInfo::varsize(16, 8, 0, false, Vec::new()));
+        let length = std::cell::Cell::new(usize::MAX);
+        gc.size_for_typeid(length.as_ptr() as usize, tid, "test");
+    }
+
     /// llsupport/gc.py:563 GcLLDescr_framework
     ///   .get_typeid_from_classptr_if_gcremovetypeptr
     /// pyre's GC stores an explicit vtable→type_id table; verify that

majit/majit-gc/src/oldgen.rs

@@ -87,14 +87,22 @@ impl OldGen {
     ) -> *mut u8 {
         self.try_alloc_with_card_header(total_size, card_header_bytes)
             .unwrap_or_else(|| {
-                let obj_size = Self::allocation_size(total_size);
-                let alloc_size = round_up(
-                    card_header_bytes
-                        .checked_add(obj_size)
-                        .expect("allocation size overflow"),
-                );
-                let layout =
-                    Layout::from_size_align(alloc_size, WORD).expect("invalid allocation layout");
+                // The fallible path also returns None for a request no
+                // allocation could ever satisfy, and `handle_alloc_error`
+                // reports only the byte count. Name the request first, or an
+                // undecodable object size reaches the operator as a bare
+                // `LayoutError` with nothing to attribute it to.
+                let alloc_size = Self::allocation_size(total_size)
+                    .checked_add(card_header_bytes)
+                    .and_then(try_round_up);
+                let layout = alloc_size
+                    .and_then(|alloc_size| Layout::from_size_align(alloc_size, WORD).ok());
+                let Some(layout) = layout else {
+                    panic!(
+                        "GC BUG: oldgen request describes no allocation: \
+                         total_size={total_size} card_header_bytes={card_header_bytes}"
+                    );
+                };
                 alloc::handle_alloc_error(layout)
             })
     }

pyre/bench/synth/exception_subclass_attrs.cranelift.jitstats

@@ -8,7 +8,7 @@ fbw_rolled_back_with_effects=0
 fbw_store_journal_rollback_failed=0
 field_pos_attached_misplaced=0
 field_pos_spec_misplaced=0
-guard_failures=3
+guard_failures=1
 internal_compile_panics=0
 loops_aborted=0
 loops_compiled=1

pyre/bench/synth/exception_subclass_attrs.dynasm.jitstats

@@ -8,7 +8,7 @@ fbw_rolled_back_with_effects=0
 fbw_store_journal_rollback_failed=0
 field_pos_attached_misplaced=0
 field_pos_spec_misplaced=0
-guard_failures=3
+guard_failures=1
 internal_compile_panics=0
 loops_aborted=0
 loops_compiled=1

pyre/bench/synth/exception_subclass_attrs.wasm.jitstats

@@ -8,7 +8,7 @@ fbw_rolled_back_with_effects=0
 fbw_store_journal_rollback_failed=0
 field_pos_attached_misplaced=0
 field_pos_spec_misplaced=0
-guard_failures=2
+guard_failures=1
 internal_compile_panics=0
 loops_aborted=0
 loops_compiled=1

pyre/bench/synth/exception_traceback_loop_forms.cranelift.jitstats

@@ -8,7 +8,7 @@ fbw_rolled_back_with_effects=0
 fbw_store_journal_rollback_failed=0
 field_pos_attached_misplaced=0
 field_pos_spec_misplaced=0
-guard_failures=811
+guard_failures=810
 internal_compile_panics=0
 loops_aborted=0
 loops_compiled=8

pyre/bench/synth/exception_traceback_loop_forms.dynasm.jitstats

@@ -8,7 +8,7 @@ fbw_rolled_back_with_effects=0
 fbw_store_journal_rollback_failed=0
 field_pos_attached_misplaced=0
 field_pos_spec_misplaced=0
-guard_failures=811
+guard_failures=810
 internal_compile_panics=0
 loops_aborted=0
 loops_compiled=8

pyre/bench/synth/exception_traceback_loop_forms.wasm.jitstats

@@ -8,7 +8,7 @@ fbw_rolled_back_with_effects=0
 fbw_store_journal_rollback_failed=0
 field_pos_attached_misplaced=0
 field_pos_spec_misplaced=0
-guard_failures=811
+guard_failures=810
 internal_compile_panics=0
 loops_aborted=0
 loops_compiled=8

pyre/bench/synth/property_getattr_exceptions.py

@@ -1,9 +1,13 @@
-# pyre-check: max-pypy-ratio=86
+# pyre-check: max-pypy-ratio=30
 # Property getter/setter exceptions and __getattr__ hook exceptions
 # propagate out of attribute access instead of being swallowed. Only the
 # exception type is printed so the line matches across CPython/PyPy/Pyre.
+# The raising getter must stay inside the compiled loop: leaving its fget as an
+# opaque residual measured at least 31-37x PyPy in CI.  Keep the hot loop long
+# enough that PyPy clears check.py's timing floor and the ratio ceiling is
+# enforced rather than displayed as an informational lower bound.
 
-N = 50000
+N = 20000000
 
 
 def show(label, fn):

pyre/cpython_tests/README.md

@@ -69,18 +69,18 @@ not even be imported/run — an interpreter or stdlib-compat gap) · `CRASH`
 
 - `.github/workflows/pyre-ci.yml` job `cpython-tests` — gates PRs on the
   baseline-`PASS` subset, dynasm with **JIT on** (`MAJIT_STRICT=1`), on
-  `macos-latest` (aarch64). The baseline is recorded on darwin-aarch64 and the
-  JIT codegen is architecture-specific, so the gate runs on the same arch the
-  baseline was observed on (x86_64 JIT-on is a separate, unstable surface).
+  `ubuntu-24.04` (x86_64). The baseline is recorded on linux-x86_64 and the JIT
+  codegen is architecture-specific, so local baseline comparisons must use the
+  same host.
 - `.github/workflows/pyre-cpython-nightly.yml` — non-gating nightly `--full`
   across three lanes (dynasm JIT-on, dynasm JIT-off, cranelift) with reports
   uploaded as artifacts. A module that passes JIT-off but not JIT-on is a JIT
   correctness divergence.
 
 ## Current state and backlog (Phase 0)
 
-The baseline currently records **205 `PASS`**, 165 `IMPORTERROR`, 22 `FAIL`,
-22 `SKIP`, 14 `CRASH`, and 6 `TIMEOUT` (434 modules, stdlib 3.14.6). The
+The baseline currently records **206 `PASS`**, 161 `IMPORTERROR`, 26 `FAIL`,
+22 `SKIP`, 13 `CRASH`, and 6 `TIMEOUT` (434 modules, stdlib 3.14.6). The
 `PASS` set grows as the gaps below are closed; non-passing modules include both
 import/stdlib gaps and tests that reach semantic failures, crashes, or timeouts.
 (It was 0 `PASS` / 414 `IMPORTERROR` before the

pyre/extra_tests/parity_tests/generator_function_name_objects.py

@@ -0,0 +1,32 @@
+# CPython-suite gap: generator tests do not cover function-name object reuse.
+# parity-tests reason: PyPy stores the function's existing names on a new generator.
+
+"""Generator construction retains the function's current immutable names."""
+
+
+def items():
+    yield 1
+
+
+name = "renamed"
+qualname = "qualified.items"
+items.__name__ = name
+items.__qualname__ = qualname
+generator = items()
+
+assert generator.__name__ is name
+assert generator.__qualname__ is qualname
+
+items.__name__ = "later"
+items.__qualname__ = "later.items"
+assert generator.__name__ == "renamed"
+assert generator.__qualname__ == "qualified.items"
+
+surrogate = "items\ud800"
+items.__name__ = surrogate
+items.__qualname__ = surrogate
+surrogate_generator = items()
+assert surrogate_generator.__name__ is surrogate
+assert surrogate_generator.__qualname__ is surrogate
+
+print("OK")