gateway: publish the argument set at the two builtin dispatches that did not

[youknowone]

Follow-up from the #1209 / #1225 review thread. A complete census of builtin_code_call's call sites, and the two that did not honour its rooting contract.

The contract

builtin_code_call roots nothing of its own — args is a native slice no root walker updates, and the implementation it dispatches to runs Python. Two callers already spell out why that matters:

• funccall_valuestack — "The Python frame slots cease to be roots when dropvalues() clears them, so publish the same live-variable set on pyre's shadow stack before doing so."
• call_builtin_code_positional — "A collection between the outer space.call_function reload and this indirect Rust function-pointer call updates the outer shadow slots but not the copied native slice."

It was nowhere stated on builtin_code_call itself, so each reader re-derives it. It is now.

Census: 11 direct sites, 9 complied

Complied: function.rs ×5 (fixed arity 0..=4), call.rs:946, call.rs:949, call.rs:2573, call_jit.rs:5134.

Did not:

1. funccall_valuestack's PASSTHROUGHARGS1 arm built args_w from peekvalue/make_arguments, then called dropvalues() — which retires exactly the frame slots that rooted those values. Its fixed-arity sibling, 90 lines above, publishes before dropping for that stated reason.
2. call_builtin_with_args, behind the jit_call_known_builtin_N helpers, passed the compiled call's own argument array straight through.

Reachability — please read this before treating it as a bug fix

Neither site is reached today. make_builtin_function_passthrough_args1 and builtin_code_new_passthrough_args1 have no call sites outside their own definitions, so no builtin carries PASSTHROUGHARGS1; and no trace emits known_builtin_call_helper — its addresses are published in jit_fnaddr but unselected. That is the unsurprising part: a live violation of this invariant would already have crashed.

Consequences: no test covers either path, and neither can be covered without first making it reachable. What this buys is that the first registration or first trace emission does not silently arm a GC bug.

Still unjudged

Whether jit_may_force keeps the arguments in the walked jitframe is what separates "stale native copy" from "not rooted at all" for site 2. This change makes the site comply either way; it does not settle that question.

Checked and refuted while doing this

call.rs:2544-2551 (the C-profiler arm) holds an unrooted bound: Vec across a w_str_from_wtf8 loop. Not a defect: w_str_from_wtf8 → malloc_typed → alloc_with_gc_header → std::alloc::alloc is a plain system allocation, not a collection point.

cargo check --all --tests --no-default-features --features dynasm → exit 0.

[coderabbitai]

Warning

Review limit reached

@youknowone, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 29 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 917e7547-804f-495d-8f6f-ff86864c467e

📥 Commits

Reviewing files that changed from the base of the PR and between 6fd2f1c and ac80f25.

📒 Files selected for processing (3)

• pyre/pyre-interpreter/src/function.rs
• pyre/pyre-interpreter/src/gateway.rs
• pyre/pyre-interpreter/src/runtime_ops.rs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🤖 Codex parity review

Static analysis of this diff vs the local RPython/PyPy sources (commit ac80f25).
Updated: 2026-08-14T16:14:12.889Z

Files in the reviewed diff

pyre/pyre-interpreter/src/function.rs
pyre/pyre-interpreter/src/gateway.rs
pyre/pyre-interpreter/src/runtime_ops.rs

1. Regressions to PyPy parity introduced by this patch

None.

2. Other mismatches introduced by this patch

None.

3. Pre-existing mismatches (already present before this patch)

• pyre/pyre-interpreter/src/pyframe.rs:4058 ↔ pypy/interpreter/pyframe.py:497 — PyPy constructs an Arguments object and preserves methodcall and w_function; pyre returns only Vec<PyObjectRef> and discards both. This can lose PyPy-compatible call-error diagnostic context.

• pyre/pyre-interpreter/src/gateway.rs:505 ↔ pypy/interpreter/gateway.py:934 — PyPy’s BuiltinCodePassThroughArguments1 passes (space, w_obj, Arguments) to its implementation; pyre’s BuiltinCodeFn ABI can pass only a flattened object slice. This existing ABI mismatch prevents a literal port of consumers needing an Arguments object.

4. Structural adaptations

• pyre/pyre-interpreter/src/function.rs:3525 ↔ pypy/interpreter/function.py:194 — manual shadow-stack publication/reload of code, receiver, and remaining arguments around dropvalues() implements the liveness that translated RPython supplies automatically. It preserves PyPy’s receiver-plus-rest argument order.

• pyre/pyre-interpreter/src/runtime_ops.rs:239 ↔ rpython/memory/gctransform/shadowstack.py:31 — manual shadow-stack publication of the JIT residual-call code object and argument registers replaces RPython’s GC transform around calls. The helper range is 0–8 arguments, matching the new nine-slot buffer’s capacity.