Descend unary, binary, and comparison helpers through generated JIT paths

AGENTS.md

@@ -233,6 +233,13 @@ comment at the site citing both sides.
 - Confirm the worktree (`git rev-parse --show-toplevel`) before editing and
   before staging — dozens of sibling worktrees share one `.git`.
 
+## Build and CI polling
+
+- Never check a running local build or CI job more often than once every five
+  minutes. While it runs, continue useful independent work when any is
+  available; otherwise wait for the five-minute boundary. Do not spend tokens
+  on repetitive status-only updates.
+
 ## Before committing
 
 - `cargo test --all --no-default-features --features dynasm`. Both halves matter.

majit/majit-backend-dynasm/src/lib.rs

@@ -635,6 +635,38 @@ fn handle_fail_propagate_exception(frame_ptr: *mut jitframe::JitFrame) -> i64 {
     value
 }
 
+/// Read a guard's logical fail arguments from its physical JITFRAME slots.
+///
+/// `llsupport/assembler.py::store_info_on_descr` writes `0xFFFF` for a
+/// resume-data hole, and `ResumeDataDirectReader.decode_ref` (plus the other
+/// typed decoders) asks the CPU for a physical slot only in its TAGBOX arm.
+/// TAGCONST/TAGVIRTUAL values are reconstructed from resume metadata instead.
+/// Majit's [`guard::decode_rd_loc_slot`] represents the sentinel as `None`;
+/// use zero as the inert carrier, exactly as
+/// `DynasmBackend::execute_token_ints_raw` does. Only a synthetic
+/// descriptor with no `rd_locs` entry at all retains the historical
+/// identity-slot fallback used by backend tests.
+unsafe fn guard_fail_values(
+    descr: &dyn majit_ir::FailDescr,
+    frame_ptr: *mut jitframe::JitFrame,
+) -> Vec<i64> {
+    let rd_locs_len = descr.rd_locs().len();
+    descr
+        .fail_arg_types()
+        .iter()
+        .enumerate()
+        .map(|(i, _)| {
+            if i < rd_locs_len {
+                guard::decode_rd_loc_slot(descr, i)
+                    .map(|slot| unsafe { llmodel::get_int_value_direct(frame_ptr, slot) as i64 })
+                    .unwrap_or(0)
+            } else {
+                unsafe { llmodel::get_int_value_direct(frame_ptr, i) as i64 }
+            }
+        })
+        .collect()
+}
+
 /// compile.py `AbstractResumeGuardDescr.handle_fail`.
 ///
 /// Upstream:
@@ -682,16 +714,12 @@ fn handle_fail_resume_guard(
 ) -> i64 {
     let trace_id = descr.trace_id();
     let fail_index = descr.fail_index_per_trace();
-    let n_fail_args = descr.fail_arg_types().len();
-    let mut raw_values: Vec<i64> = Vec::with_capacity(n_fail_args);
-    for i in 0..n_fail_args {
-        // PyPy `llmodel.py _decode_pos` parity: read the slot
-        // from `descr.rd_locs[i]`.  Synthetic descrs without `rd_locs`
-        // fall back to identity slot indexing — same shape as the
-        // pre-Slice-MM table-miss path.
-        let slot = guard::decode_rd_loc_slot(descr, i).unwrap_or(i);
-        raw_values.push(unsafe { llmodel::get_int_value_direct(frame_ptr, slot) as i64 });
-    }
+    // PyPy `llsupport/assembler.py::store_info_on_descr` plus
+    // `ResumeDataDirectReader.decode_ref` parity: a 0xFFFF entry is a
+    // resume-data hole, not permission to read the same-numbered physical
+    // slot. The old fallback turned an unrelated or uninitialised JITFRAME
+    // word into a Ref and registered it as a GC root during bridge recovery.
+    let mut raw_values = unsafe { guard_fail_values(descr, frame_ptr) };
 
     let guard_value_operand = majit_backend::guard_value_counter_slot(descr)
         .map(|slot| unsafe { llmodel::get_int_value_direct(frame_ptr, slot) as i64 });
@@ -918,6 +946,46 @@ mod tests {
         ptr
     }
 
+    #[test]
+    fn test_guard_fail_values_do_not_read_resume_holes() {
+        let descr = majit_backend::make_resume_guard_descr_typed(vec![Type::Ref, Type::Int]);
+        let fail_descr = descr.as_fail_descr().expect("resume guard descr");
+        fail_descr.set_rd_locs(vec![0xFFFF, 2]);
+
+        // Slot 0 deliberately contains a pointer-shaped poison. The first
+        // logical failarg is a resume-data hole, so recovery must not publish
+        // or root this physical word as a Ref. The mapped second argument is
+        // still read from its encoded physical slot.
+        let jf = unsafe { alloc_test_jitframe(0, &[0x1234_5678, 11, 77]) };
+        let values = unsafe { guard_fail_values(fail_descr, jf) };
+        assert_eq!(values, vec![0, 77]);
+
+        unsafe { libc::free(jf as *mut std::ffi::c_void) };
+    }
+
+    #[test]
+    fn test_guard_fail_values_all_holes_need_no_frame_slots() {
+        let descr = majit_backend::make_resume_guard_descr_typed(vec![Type::Ref; 3]);
+        let fail_descr = descr.as_fail_descr().expect("resume guard descr");
+        fail_descr.set_rd_locs(vec![0xFFFF; 3]);
+
+        // No physical slot exists for these logical positions. In particular,
+        // recovery must not perform even a speculative read of a hole.
+        let jf = unsafe { alloc_test_jitframe(0, &[]) };
+        assert_eq!(unsafe { guard_fail_values(fail_descr, jf) }, vec![0; 3]);
+        unsafe { libc::free(jf as *mut std::ffi::c_void) };
+    }
+
+    #[test]
+    fn test_guard_fail_values_synthetic_descr_keeps_identity_slots() {
+        let descr = majit_backend::make_resume_guard_descr_typed(vec![Type::Int; 2]);
+        let fail_descr = descr.as_fail_descr().expect("resume guard descr");
+        assert!(fail_descr.rd_locs().is_empty());
+        let jf = unsafe { alloc_test_jitframe(0, &[11, 77]) };
+        assert_eq!(unsafe { guard_fail_values(fail_descr, jf) }, vec![11, 77]);
+        unsafe { libc::free(jf as *mut std::ffi::c_void) };
+    }
+
     // ── Bug 1 regression: unresolved target must not dereference result as pointer ──
     // The old code let the helper return value flow into `mov rdx, rax; mov rcx, [rdx]`
     // which dereferenced an integer as a pointer. This test verifies the trampoline

majit/majit-metainterp/src/blackhole.rs

@@ -10470,6 +10470,11 @@ pub fn build_inline_call_only_bh_builder() -> BlackholeInterpBuilder {
             "new_with_vtable/d>r",
             majit_translate::insns::BC_NEW_WITH_VTABLE,
         ),
+        // The header read `jtransform.rs rewrite_op_getfield` replaces,
+        // in the ref bank (`OpKind::GuardClass`: one ref register in, the
+        // class out) — emitted once a descended helper reads `ob_type`
+        // through a graph the codewriter looks inside.
+        ("guard_class/r>r", majit_translate::insns::BC_GUARD_CLASS_R),
     ] {
         insns.insert(key.to_string(), byte);
     }
@@ -10930,6 +10935,9 @@ pub fn wire_bhimpl_handlers(builder: &mut BlackholeInterpBuilder) {
     // Canonical key is `guard_class/r>i`; the previous `/ri` shape was
     // a pyre-invented bigram that omitted the `>i` return marker.
     builder.wire_handler("guard_class/r>i", handler_guard_class);
+    // The same op with its result in the ref bank — the bank of the header
+    // read `jtransform.rs rewrite_op_getfield` replaced (`BC_GUARD_CLASS_R`).
+    builder.wire_handler("guard_class/r>r", handler_guard_class_r);
     // RPython `rpython/jit/metainterp/blackhole.py:1537-1539`:
     //   @arguments("r", "d", "d")
     //   def bhimpl_record_quasiimmut_field(struct, fielddescr, mutatefielddescr):
@@ -11261,6 +11269,18 @@ fn handler_guard_class(
     bh.registers_i[code[p + 1] as usize] = typeptr;
     Ok(p + 2)
 }
+/// [`handler_guard_class`] with the class delivered to the ref bank —
+/// `guard_class/r>r`, for a header read the graph typed as a GC ref.
+fn handler_guard_class_r(
+    bh: &mut BlackholeInterpreter,
+    code: &[u8],
+    p: usize,
+) -> Result<usize, DispatchError> {
+    let cpu = bh.cpu();
+    let typeptr = cpu.bh_classof(bh.registers_r[code[p] as usize]);
+    bh.registers_r[code[p + 1] as usize] = typeptr;
+    Ok(p + 2)
+}
 /// Safe fallback for the obsolete pyre-only named vtable lookup.
 ///
 /// PyPy's `ClassRepr.getclsfield` emits an ordinary field read; it never tries

majit/majit-metainterp/src/compile.rs

@@ -4607,8 +4607,26 @@
     fn set_adr_jump_offset(&self, offset: usize) {
         unsafe { *self.adr_jump_offset.get() = offset };
     }
+    /// `store_info_on_descr` writes `guardtok.faildescr.rd_locs`
+    /// (`llsupport/assembler.py:279`), so a backend that emits machine code for
+    /// this guard leaves its own physical positions here.  The frontend's
+    /// identity-with-holes layout is resume data instead, and
+    /// `_copy_resume_data_from` never runs `store_final_boxes_in_guard` on a
+    /// copied descr, so it is written only on the donor.  Read through to the
+    /// donor when no backend has written one, the same way `fail_arg_types`,
+    /// `rd_numb` and `rd_consts` chase `get_resumestorage(): return prev`
+    /// (`compile.py:847-850`).  Without it the hole mask is empty on every
+    /// backend that keeps failargs in their logical slots, and both consumers
+    /// silently take their unmasked branch.
     fn rd_locs(&self) -> &[u16] {
-        unsafe { &*self.rd_locs.get() }
+        let own = unsafe { &*self.rd_locs.get() };
+        if !own.is_empty() {
+            return own;
+        }
+        self.prev()
+            .as_fail_descr()
+            .map(|fd| fd.rd_locs())
+            .unwrap_or(&[])
     }
     fn set_rd_locs(&self, locs: Vec<u16>) {
         unsafe { *self.rd_locs.get() = locs };
@@ -5157,6 +5175,24 @@
         my_fd.set_rd_consts_arc(donor_fd.rd_consts_arc());
         my_fd.set_rd_virtuals_arc(donor_fd.rd_virtuals_arc());
         my_fd.set_rd_pendingfields_arc(donor_fd.rd_pendingfields_arc());
+        // `AbstractFailDescr.rd_locs` is a backend slot upstream, written
+        // only by `store_info_on_descr`, which every upstream backend runs —
+        // so `copy_all_attributes_from` has nothing to carry there.  Pyre also
+        // seeds it in `store_final_boxes_in_guard` with the resume numbering's
+        // identity-with-holes layout, which cranelift and wasm keep because
+        // they leave failargs in their logical slots.  That seed belongs to
+        // the payload copied just above: the known-class bitfield inside
+        // `rd_numb` holds one bit per non-hole Ref livebox, and
+        // `deserialize_optimizer_knowledge` can only find those bits by
+        // masking its fail args with the same holes.
+        //
+        // Every caller hands a descr the optimizer minted for a guard put in
+        // place of an already-emitted one — `replace_guard_op`, the
+        // GUARD_VALUE and GUARD_CLASS strengthening arms of
+        // `optimize_guard_value` / `replace_old_guard_with_guard_class`, and
+        // the vectorizer's `inhert_attributes` — and such a descr never
+        // reaches `store_final_boxes_in_guard`, so it has no layout of its own.
+        my_fd.set_rd_locs(donor_fd.rd_locs().to_vec());
         // compile.py — chain.clone() preserves the donor's
         // (already-flattened) accumulator chain on self, identity-stable.
         let donor_chain = donor_fd.vector_info();

majit/majit-metainterp/src/jitcode/assembler.rs

@@ -3542,6 +3542,64 @@ impl JitCodeBuilder {
         self.inline_call_r_v(sub_jitcode_idx, &[], None);
     }
 
+    /// Emit RPython's canonical `inline_call_{r,ir,irf}_{i,r,f,v}`
+    /// bytecode shape.
+    ///
+    /// This is deliberately separate from [`Self::inline_call_r_r`] and its
+    /// siblings.  Those methods predate the codewriter port and emit pyre's
+    /// opaque `inline_call_nested_ext/P` payload, including explicit callee
+    /// destination registers.  `jtransform.py handle_regular_call` instead
+    /// emits a JitCode descr followed by kind-separated varlists; the callee's
+    /// `MIFrame.setup_call` places each list at the start of its matching
+    /// register bank.  `pyre-jit`'s SSA assembler uses this method for that
+    /// orthodox stream.
+    pub fn canonical_inline_call(
+        &mut self,
+        key: &'static str,
+        sub_jitcode_idx: u16,
+        args_i: Option<&[u16]>,
+        args_r: Option<&[u16]>,
+        args_f: Option<&[u16]>,
+        result: Option<(JitArgKind, u16)>,
+    ) {
+        self.write_insn(key);
+        self.push_u16(sub_jitcode_idx);
+        if let Some(args) = args_i {
+            self.push_canonical_inline_varlist(args, JitArgKind::Int);
+        }
+        if let Some(args) = args_r {
+            self.push_canonical_inline_varlist(args, JitArgKind::Ref);
+        }
+        if let Some(args) = args_f {
+            self.push_canonical_inline_varlist(args, JitArgKind::Float);
+        }
+        if let Some((kind, dst)) = result {
+            match kind {
+                JitArgKind::Int => self.touch_reg(dst),
+                JitArgKind::Ref => self.touch_ref_reg(dst),
+                JitArgKind::Float => self.touch_float_reg(dst),
+            }
+            self.push_reg_u8(dst, "canonical inline_call return");
+        }
+    }
+
+    fn push_canonical_inline_varlist(&mut self, args: &[u16], kind: JitArgKind) {
+        if args.len() > u8::MAX as usize {
+            self.encoding_overflow = true;
+            self.push_u8(0);
+            return;
+        }
+        self.push_u8(args.len() as u8);
+        for &src in args {
+            match kind {
+                JitArgKind::Int => self.touch_reg(src),
+                JitArgKind::Ref => self.touch_ref_reg(src),
+                JitArgKind::Float => self.touch_float_reg(src),
+            }
+            self.push_reg_u8(src, "canonical inline_call argument");
+        }
+    }
+
     pub fn inline_call_r_i(
         &mut self,
         sub_jitcode_idx: u16,

majit/majit-metainterp/src/jitcode/mod.rs

@@ -590,6 +590,11 @@ pub struct JitCode {
     /// `JitCodeBuilder` populates this during runtime per-CodeObject
     /// emission.
     pub exec: JitCodeExecState,
+    /// Which descriptor namespace bytecode `d`/`j` operands address.
+    /// `from_canonical` wraps a source-translator JitCode whose operands use
+    /// the process-wide codewriter table; `JitCodeBuilder` creates a runtime
+    /// Python-code body whose operands use `exec.descrs`.
+    uses_global_descr_pool: bool,
     /// Reachable symbolic residual targets, computed after the runtime wrapper
     /// has received its final function-address bindings and descriptor pool.
     ///
@@ -633,6 +638,7 @@ impl JitCode {
         Self {
             core: majit_translate::jitcode::JitCode::new(name),
             exec: JitCodeExecState::default(),
+            uses_global_descr_pool: false,
             reachable_symbolic_residuals: std::sync::OnceLock::new(),
         }
     }
@@ -662,10 +668,15 @@ impl JitCode {
                 jit_merge_point_offset,
                 ..JitCodeExecState::default()
             },
+            uses_global_descr_pool: true,
             reachable_symbolic_residuals: std::sync::OnceLock::new(),
         }
     }
 
+    pub fn uses_global_descr_pool(&self) -> bool {
+        self.uses_global_descr_pool
+    }
+
     /// Borrow the canonical core (e.g. for serialization that
     /// re-serializes only the canonical fields).
     pub fn core(&self) -> &majit_translate::jitcode::JitCode {
@@ -683,7 +694,9 @@ impl JitCode {
 
 impl Default for JitCode {
     fn default() -> Self {
-        Self::from_canonical(majit_translate::jitcode::JitCode::default())
+        let mut jitcode = Self::from_canonical(majit_translate::jitcode::JitCode::default());
+        jitcode.uses_global_descr_pool = false;
+        jitcode
     }
 }
 
@@ -692,6 +705,7 @@ impl Clone for JitCode {
         Self {
             core: self.core.clone(),
             exec: self.exec.clone(),
+            uses_global_descr_pool: self.uses_global_descr_pool,
             reachable_symbolic_residuals: self.reachable_symbolic_residuals.clone(),
         }
     }

majit/majit-metainterp/src/optimizeopt/virtualize.rs

@@ -1173,10 +1173,21 @@ impl OptVirtualize {
                     field_descr.offset(),
                 );
             }
-            let field_val = match &info {
+            // virtualize.py `optimize_GETFIELD_GC_I`:
+            //     fieldop = opinfo.getfield(op.getdescr())
+            //     self.make_equal_to(op, fieldop)
+            // `info.py AbstractStructPtrInfo.getfield` returns `self._fields[index]`
+            // — the stored Box itself, so `make_equal_to` forwards the read onto
+            // that box and a later `get_box_replacement` walks the box's own
+            // `_forwarded` chain. A virtualizable slot holds an `Operand`, so hand
+            // that operand over directly. Reading the slot back by POSITION
+            // instead re-keys it into whichever inputarg namespace the current
+            // pass owns: `VirtualizableTracker::init` seeds the slots from the
+            // seeding pass's inputargs, and an unrolled body owns a disjoint
+            // range, so the position resolves there to a fresh host that carries
+            // none of the facts the seeded box holds.
+            let field_box: Option<Operand> = match &info {
                 _ if !slot_resolvable => None,
-                PtrInfo::Virtual(vinfo) => get_field(&vinfo.fields, field_idx),
-                PtrInfo::VirtualStruct(vinfo) => get_field(&vinfo.fields, field_idx),
                 PtrInfo::Virtualizable(vstate) => vstate
                     .fields
                     .iter()
@@ -1190,7 +1201,18 @@ impl OptVirtualize {
                             op.result_type(),
                         )
                     })
-                    .map(|(_, b)| b.to_opref()),
+                    .map(|(_, b)| b.get_box_replacement(false)),
+                _ => None,
+            };
+            if let Some(b_val) = field_box {
+                let b_old = Operand::from_bound_op(op_rc);
+                ctx.make_equal_to(&b_old, &b_val);
+                return OptimizationResult::Remove;
+            }
+            let field_val = match &info {
+                _ if !slot_resolvable => None,
+                PtrInfo::Virtual(vinfo) => get_field(&vinfo.fields, field_idx),
+                PtrInfo::VirtualStruct(vinfo) => get_field(&vinfo.fields, field_idx),
                 _ => None,
             };
             if let Some(val_ref) = field_val {