cpyext follow-ups, constructor-argument GC roots, and NULL symbol rejection

majit/majit-backend-dynasm/src/aarch64/assembler.rs

@@ -3494,6 +3494,15 @@ impl<'a> AssemblerARM64<'a> {
                     Some(Loc::Immed(i)) => i.value,
                     _ => 8,
                 };
+                // assembler.py:254 `_push_all_regs_to_jitframe` — the helper
+                // below can collect, and `emit_malloc_slowpath_helper_call`
+                // only saves the volatiles to the *stack*, where the
+                // collector can neither find nor rewrite them.  Spill every
+                // register into the jitframe first, so the gcmap pushed below
+                // describes the live references and the collector forwards
+                // them.  Must precede the argument setup, which clobbers
+                // x0/x1/x2.
+                self.push_all_regs_to_jitframe(&[], true);
                 // _build_malloc_slowpath(kind='var') parity:
                 // x0 = base_size, x1 = item_size, x2 = length
                 self.emit_mov_imm64(0, base_size);
@@ -3509,9 +3518,17 @@ impl<'a> AssemblerARM64<'a> {
                         self.emit_mov_imm64(2, 0);
                     }
                 }
-                // push_gcmap
+                // assembler.py:649-650 push_gcmap — a null gcmap tells the
+                // collector this frame holds no references, so every pointer
+                // spilled above would survive the collection unforwarded.
+                // `push_gcmap` marshals through x16, which is neither an
+                // argument register nor the helper register.
                 let gcmap_ofs = crate::jitframe::JF_GCMAP_OFS as u32;
-                dynasm!(self.mc ; .arch aarch64 ; str xzr, [x29, gcmap_ofs]);
+                if let Some(gcmap) = self.pending_malloc_nursery_gcmap {
+                    self.push_gcmap(gcmap as *mut usize);
+                } else {
+                    dynasm!(self.mc ; .arch aarch64 ; str xzr, [x29, gcmap_ofs]);
+                }
                 self.emit_mov_imm64(
                     3,
                     crate::runner::dynasm_nursery_slowpath_varsize as *const () as i64,
@@ -3520,6 +3537,12 @@ impl<'a> AssemblerARM64<'a> {
                 self.reload_frame_if_necessary();
                 // pop_gcmap
                 dynasm!(self.mc ; .arch aarch64 ; str xzr, [x29, gcmap_ofs]);
+                // assembler.py:283 `_pop_all_regs_from_jitframe` — the helper
+                // restored the volatiles from the stack, so they still name
+                // the pre-collection addresses; the jitframe slots are the
+                // ones the collector rewrote.  x0 is excluded because it
+                // carries the allocation result.
+                self.pop_all_regs_from_jitframe(&[crate::aarch64::registers::X0], true);
                 // `dynasm_nursery_slowpath_varsize` returns x0 = 0 on
                 // real host OOM (calloc failure preserved as NULL per
                 // runner.rs).  Route through the propagate path before

majit/majit-backend-dynasm/src/x86/assembler.rs

@@ -4528,6 +4528,13 @@ impl<'a> Assembler386<'a> {
                     Some(Loc::Immed(i)) => i.value,
                     _ => 8,
                 };
+                // x86/assembler.py:254 `_push_all_regs_to_jitframe` — the
+                // helper below can collect, and unlike the fixed-size path it
+                // is called directly rather than through the trampoline that
+                // spills for it, so nothing else puts the live references
+                // where the gcmap can name them.  Must precede the argument
+                // setup, which clobbers the ABI argument registers.
+                self.push_all_regs_to_jitframe(&[], true);
                 self.emit_abi_int_arg_from_imm(0, base_size);
                 self.emit_abi_int_arg_from_imm(1, itemsize);
                 match arglocs.first() {
@@ -4541,8 +4548,17 @@ impl<'a> Assembler386<'a> {
                         self.emit_abi_int_arg_from_imm(2, 0);
                     }
                 }
+                // assembler.py:649-650 push_gcmap — a null gcmap tells the
+                // collector this frame holds no references, so every pointer
+                // spilled above would survive the collection unforwarded.
+                // `push_gcmap` marshals through the scratch register, which
+                // is not an ABI argument register.
                 let gcmap_ofs = crate::jitframe::JF_GCMAP_OFS;
-                dynasm!(self.mc ; .arch x64 ; mov QWORD [rbp + gcmap_ofs], 0);
+                if let Some(gcmap) = self.pending_malloc_nursery_gcmap {
+                    self.push_gcmap(gcmap as *mut usize);
+                } else {
+                    dynasm!(self.mc ; .arch x64 ; mov QWORD [rbp + gcmap_ofs], 0);
+                }
                 dynasm!(self.mc ; .arch x64
                     ; mov rax, QWORD crate::runner::dynasm_nursery_slowpath_varsize as *const () as i64
                 );
@@ -4552,6 +4568,12 @@ impl<'a> Assembler386<'a> {
                 // gcmap, otherwise the clear would target the freed
                 // nursery copy.
                 self.reload_frame_if_necessary();
+                // assembler.py:283 `_pop_all_regs_from_jitframe` — the
+                // jitframe slots are what the collector rewrote, so reload
+                // from them rather than trusting the callee-save/volatile
+                // state around the call.  EAX is excluded because it carries
+                // the allocation result the null check and result store read.
+                self.pop_all_regs_from_jitframe(&[crate::regloc::EAX], true);
                 // assembler.py:300-322 OOM propagate parity — the
                 // varsize helper now returns NULL on `libc::calloc`
                 // / `gc.alloc_varsize` failure; route that through

pyre/pyre-interpreter/include/pyre3.14/Python.h

@@ -10,7 +10,11 @@ extern "C" {
 
 #define PY_MAJOR_VERSION 3
 #define PY_MINOR_VERSION 14
-#define PY_VERSION_HEX 0x030E0000
+#define PY_MICRO_VERSION 6
+/* 3.14.6 final, matching sys.hexversion. The release-level nibble is 0xF for a
+   final release, so a value ending in 0x00 would put every `#if PY_VERSION_HEX
+   >= 0x030E00F0` extension on its pre-release branch. */
+#define PY_VERSION_HEX 0x030E06F0
 #define PYTHON_API_VERSION 1013
 
 #if defined(_WIN32)

pyre/pyre-interpreter/src/baseobjspace.rs

@@ -3703,10 +3703,24 @@ unsafe fn setitem_list(obj: PyObjectRef, index: PyObjectRef, value: PyObjectRef)
 
 #[inline(never)]
 unsafe fn setitem_list_slice(obj: PyObjectRef, index: PyObjectRef, value: PyObjectRef) -> PyResult {
+    // `STORE_SUBSCR` pops all three operands off the value stack before
+    // dispatching here, so the frame no longer roots any of them and each is a
+    // bare address. Every step below can collect — `slice_unpack` honors
+    // `__index__`, `collect_iterable` runs the iterable's own Python code, and
+    // both list constructors allocate — so publish the operands on the shadow
+    // stack first and read each one back after any step that can collect.
+    let _roots = pyre_object::gc_roots::push_roots();
+    let obj_slot = pyre_object::gc_roots::shadow_stack_len();
+    pyre_object::gc_roots::pin_root(obj);
+    let value_slot = pyre_object::gc_roots::shadow_stack_len();
+    pyre_object::gc_roots::pin_root(value);
+    let index_slot = pyre_object::gc_roots::shadow_stack_len();
+    pyre_object::gc_roots::pin_root(index);
     // CPython 3.14 `list_ass_subscript_lock_held`: unpack the slice first,
     // materialize the replacement next, and only then adjust the bounds
     // against the list's live length. Materializing an arbitrary iterable may
     // mutate `obj` (gh-120384), so using its earlier length is incorrect.
+    let index = pyre_object::gc_roots::shadow_stack_get(index_slot);
     let (raw_start, raw_stop, step) = crate::sliceobject::slice_unpack(
         w_slice_get_start(index),
         w_slice_get_stop(index),
@@ -3715,6 +3729,8 @@ unsafe fn setitem_list_slice(obj: PyObjectRef, index: PyObjectRef, value: PyObje
     // PyPy listobject.py:709-714 wraps non-list iterables into a temporary
     // W_ListObject so the strategy-aware setslice path sees a list operand.
     // CPython additionally protects `a[::-1] = a` with a shallow copy.
+    let obj = pyre_object::gc_roots::shadow_stack_get(obj_slot);
+    let value = pyre_object::gc_roots::shadow_stack_get(value_slot);
     let w_other = if obj == value {
         pyre_object::listobject::w_list_new(pyre_object::listobject::w_list_items_copy_as_vec(
             value,
@@ -3725,6 +3741,9 @@ unsafe fn setitem_list_slice(obj: PyObjectRef, index: PyObjectRef, value: PyObje
         let items = crate::builtins::collect_iterable(value)?;
         pyre_object::listobject::w_list_new(items)
     };
+    let other_slot = pyre_object::gc_roots::shadow_stack_len();
+    pyre_object::gc_roots::pin_root(w_other);
+    let obj = pyre_object::gc_roots::shadow_stack_get(obj_slot);
     let len = w_list_len(obj) as i64;
     let (start, stop, step, slicelength) =
         crate::sliceobject::slice_adjust_indices(raw_start, raw_stop, step, len);
@@ -3736,6 +3755,8 @@ unsafe fn setitem_list_slice(obj: PyObjectRef, index: PyObjectRef, value: PyObje
         // has zero length and inserts/deletes at 5, rather than forming the
         // invalid Rust range `5..2`.
         let s_hi = stop.max(start).max(0) as usize;
+        let obj = pyre_object::gc_roots::shadow_stack_get(obj_slot);
+        let w_other = pyre_object::gc_roots::shadow_stack_get(other_slot);
         pyre_object::listobject::w_list_setslice(obj, s_lo, s_hi, w_other)
             .expect("w_other is always a valid list");
         return Ok(w_none());
@@ -3754,6 +3775,7 @@ unsafe fn setitem_list_slice(obj: PyObjectRef, index: PyObjectRef, value: PyObje
             i += step;
         }
     }
+    let w_other = pyre_object::gc_roots::shadow_stack_get(other_slot);
     let other_len = pyre_object::w_list_len(w_other);
     if other_len != indices.len() {
         return Err(PyError::new(
@@ -3772,8 +3794,19 @@ unsafe fn setitem_list_slice(obj: PyObjectRef, index: PyObjectRef, value: PyObje
     let mut k = 0usize;
     while k < indices.len() {
         let idx = indices[k];
+        // A store can switch the receiver's strategy, and that allocates, so
+        // both lists are re-read from their slots on every iteration and the
+        // item is published before the store that may collect. The item's slot
+        // is bracketed per iteration, or a long extended slice would push one
+        // root per element and never pop them.
+        let _item_roots = pyre_object::gc_roots::push_roots();
+        let w_other = pyre_object::gc_roots::shadow_stack_get(other_slot);
         let item =
             pyre_object::w_list_getitem(w_other, k as i64).expect("k < other_len by construction");
+        let item_slot = pyre_object::gc_roots::shadow_stack_len();
+        pyre_object::gc_roots::pin_root(item);
+        let obj = pyre_object::gc_roots::shadow_stack_get(obj_slot);
+        let item = pyre_object::gc_roots::shadow_stack_get(item_slot);
         if !pyre_object::w_list_setitem(obj, idx, item) {
             return Err(PyError::new(
                 PyErrorKind::IndexError,