Fix x86_64 JIT failures: shift aliasing, FP bail by chaploud · Pull Request #1 · clojurewasm/zwasm

chaploud · 2026-02-12T09:23:32Z

Summary

Fix shift register aliasing bug where rd and rs2 sharing a physical register (e.g., both vreg 3 → RCX) caused the shift amount to be clobbered before use. Root cause of endianness64 failures.
Bail from JIT for FP min/max (NaN propagation), all trunc variants (trap checking), and copysign operations.
Fix restoreCl asymmetry for spilled vregs (push without pop).
Fix binop register aliasing when rd == rs2.
Fix emitEpilogue to store only return values.
Fix encoding issues: rex prefix, shift count, jcc arity.

Test plan

zig build test passes (ARM64 local)
python3 test/spec/run_spec.py --summary — 32,231/32,236 (no regression)
CI: Ubuntu x86_64 spec tests should pass (expect 8 pre-existing failures: return_call 5 + call_indirect 3)
CI: macOS ARM64 should pass as before

JIT compilation was only triggered on aarch64, leaving x86_64 running in pure interpreter/RegIR mode. Add jitSupported() helper to jit.zig and use it in all three JIT trigger points in vm.zig.

- movImm32ToReg: cast 0xB8 to u8 before OR with u3 - emitErrorStubs: use jmpRel32 return value for patching - Fix f64.copysign opcode (0xA6, not 0x8A which is i64.rotr)

- Add rexRR() helper for 32-bit reg-reg REX prefix - Fix emitSibAddr shift overflow (u3 → u8 widening) - Fix u7 cast for vreg shift in spill/reload - Fix jccRel32 call arity (use return value, not manual offset)

The epilogue was flushing ALL dirty vregs to their memory slots, which overwrote the return value in regs[0] with vreg 0's value. Match ARM64 design: only store the result vreg to regs[0].

x86 uses destructive 2-operand form: OP rd, r2 means rd = rd OP r2. To compute rd = r1 OP r2, we first MOV rd, r1 then OP rd, r2. But when rd == r2, the MOV clobbers r2 before the OP reads it. Fix: for commutative ops (add/mul/and/or/xor), swap operands. For SUB, use SCRATCH as intermediate.

emitFpConvert returned void, so bailing on unimplemented opcodes (copysign, ceil/floor/trunc/nearest, unsigned trunc) silently skipped the instruction instead of aborting JIT compilation. This caused copysign to become a no-op, producing wrong results (302 f32_bitwise + 302 f64_bitwise spec test failures). Change emitFpConvert to return bool. Bail returns false, which propagates through compileInstr to abort compilation and fall back to the interpreter. Also fix f64.copysign opcode (was 0x8A, correct is 0xA6).

- emitShift32/64: fix bug where moving value to rd clobbers shift amount when rd and rs2 share the same physical register (e.g., both vreg 3 mapping to RCX). Use SCRATCH as intermediate to avoid aliasing. This was the root cause of endianness64 test failures. - restoreCl: fix spilled vreg asymmetry where push happened in moveShiftCountToCl but pop was skipped in restoreCl (orelse return). - emitFpMinMax64/32: bail to interpreter (return false) because x86 MINSD/MAXSD/MINSS/MAXSS don't propagate NaN per Wasm spec. - emitFpConvert: consolidate all trunc variants to single bail line (need trap checking for NaN/overflow on x86).

- Add --allow-failures N option to spec test runner: exit 0 if failures <= N - CI uses --allow-failures 8 (return_call: 5 + call_indirect: 3) - Set fail-fast: false so both OS matrix jobs run to completion

Root fix: JIT-compiled code now decrements jit_fuel at every loop back-edge and exits with FuelExhausted if exhausted. This replaces the blanket jitSuppressed() for fuel, allowing JIT + fuel to coexist. VM changes: - Add jit_fuel: i64 field (signed for single-branch check) - Sync fuel ↔ jit_fuel before/after executeJIT/executeJITOsr - Map error code 9 → FuelExhausted in both JIT exit handlers - jitSuppressed() now only checks deadline (fuel removed) ARM64 JIT codegen (jit.zig): - emitFuelCheck(): load vm.jit_fuel, SUBS #1, store, B.MI to exit Handles large Vm offsets (>4KB) via MOVZ+ADD - Shared fuel exit stub (1 per function, not per back-edge) - All fuel_check_branches patched to single stub in emitErrorStubs - Add SUBS Xd,Xn,#imm12 (subsImm64) ARM64 encoding

…p stub First memory-op landing. Establishes the Caller-Side ABI for memory access: - X28 = vm_base (memory_base pointer) - X27 = mem_limit (size in bytes) The caller arranges these before invoking the JIT body. Phase 7 follow-up wires Runtime → these regs structurally (D-014 `Runtime.io` injection point dissolves at sub-g, the last JIT row before the spec-pass gate). inst.zig (4 new encoders, all verified via clang): - encLdrWReg / encStrWReg — 32-bit LDR/STR with X-register offset, no shift. Bases 0xB8606800 / 0xB8206800. - encLdrXReg / encStrXReg — 64-bit variants. Bases 0xF8606800 / 0xF8206800. emit.zig — bounds-check + trap stub: - New `bounds_fixups: ArrayList(u32)` tracking byte offsets of B.HS placeholders. Each load/store appends one fixup. - i32.load handler: ORR W16, WZR, W_addr ; zero-extend wasm addr to X16 ADD X16, X16, #offset ; effective addr (skip if offset==0) CMP X16, X27 ; vs mem_limit B.HS trap_stub ; placeholder; fixup recorded LDR W_dest, [X28, X16] - i32.store handler: mirrors load but pops two vregs (addr + val) and emits STR W_val instead. - Function-final `end` extended: when bounds_fixups non-empty, emit a trap stub AFTER the regular RET: MOVZ X0, #1 (trap indicator) [ADD SP, SP, #frame_bytes if any] LDP FP, LR, [SP], #16 RET Then walk fixups, recover B.HS cond from placeholder lower 4 bits, patch each to the trap-stub byte offset. Memarg encoding from ZirInstr (per `interp/memory_ops.zig` + lowerer): payload = offset, extra = align (align unused in this emit). Offset capped at u12 (4095) for sub-f1; larger offsets need a 2-instr MOV+ADD path (sub-f2). 650/650 unit tests pass on Mac aarch64 (was 644 → +4 inst / +2 emit). lint clean. The trap stub IS reachable bytes; the caller's Runtime integration determines whether trap_indicator in X0 propagates into a Wasm trap (D-014's actual dissolution). 7.3 sub-progression: a [x], b1-5 [x], c [x], d1-5 [x], e1-3 [x], f1 [x] (this commit). Sub-f2 (load_8/16/32 variants + sign/zero extend; i64/f32/f64 loads/stores) NEXT.

…_flag Adds trap_flag field to JitRuntime (per ADR-0017 amendment seed): trap_flag: u32 @ 40 ; trap indicator _pad1: u32 @ 44 ; alignment Total head_size grows 40 → 48 bytes; all offsets remain within imm12 budget (W-form scaled by 4 → max 16380). Trap stub rewrite (emit.zig): instead of `MOVZ X0, #1 + epilogue` which conflated trap-vs-returned-1, the stub now does: MOVZ W17, #1 ; trap indicator STR W17, [X19, #trap_flag_off] ; rt.trap_flag = 1 MOVZ X0, #0 ; return value (unused) ADD SP, SP, #frame ; epilogue LDP fp/lr / RET X19 holds the runtime ptr (per ADR-0017 sub-2d-ii); the stub reuses it to address rt.trap_flag. Entry frame (callI32NoArgs) now returns `Error!u32`: - Zeroes rt.trap_flag before BLR - After BLR, reads rt.trap_flag; if non-zero, returns `Error.Trap`; else returns the W0 result. run_wasm.zig propagates Error.Trap through its error union. A new test exercises the trap path end-to-end: trunc_f32_s/nan: NaN input → JIT body's NaN-check FCMP/B.VS fires, branches to trap stub, sets rt.trap_flag=1, returns; entry shim detects flag, surfaces Error.Trap. **First time the v2 JIT detects a Wasm trap at runtime** — sub-h3a's NaN check from the f32-source trapping trunc lands end-to-end through the new trap_flag mechanism. The existing memory-bounds trap stub test now asserts the new B.cond opcode shape rather than the old MOVZ X0,#1 sentinel. Diagnostic M3 (D-022) widens to per-trap-kind reasons in a future cycle. Mac aarch64: 741/741 unit green. OrbStack Ubuntu x86_64: green (tests skip). Windows windowsmini: green (re-run post-push). Refs: ADR-0017 (trap_flag amendment), D-022 follow-up.

…ndments (regret triage) New rule `.claude/rules/bug_fix_survey.md` (regret #9, twin-largest): before applying a bug fix, grep for same-class cases. Codifies the D-027 case study (if-then fix landed; if-result for block / loop needed re-application). Complements textbook_survey.md's task-start discipline with bug-fix-time discipline. 5 new lessons under `.dev/lessons/2026-05-04-*.md`: - emit-monolith-cost (regret #1) — 9-module split target for ADR-0021 row 7.5d-b - liveness-stage-extension-debt (regret #2) — frame-based dispatch restructure deferred - adr-0017-merge-blind-spot (regret #3) — ADR-0017 missed CFG join semantics; X19 amend hid the gap - adr-revision-history-misuse (regret #7) — Revision history needs gap/refinement/expansion categorisation - adr-batch-dependency-order (regret #10) — 4-ADR batch (0017-0020) had implicit DAG; propose Dependencies section INDEX.md gets 5 new rows. Two amendments to `.claude/rules/edge_case_testing.md`: - "Fixture-internal workarounds trigger debt entries" (regret #4) - "Test-side byte offsets must be relative" (regret #6) Regret #5 (default value re-changes) → not a rule; covered by liveness-stage-extension-debt lesson + commit message hygiene. Regret #8 (sub-row ROADMAP normalization) → ADR-0022 retrospective will document; not a one-time bookkeeping row. Cf. ADR-0021 + ADR-0022 (retrospective).

… + refactor + rules cycle Records the session as a single load-bearing artefact, complementing ADR-0021 (operational sub-gate decision) with the broader process lens. Resolves the forward references to ADR-0022 across 6 files (handover.md, 4 lessons, ADR-0021's lineage citations). Triage map for the 10 regrets surfaced at session start: - #1 (emit monolith) → lesson + ADR-0021 row 7.5d-b - #2 (liveness elif chains) → lesson; restructure deferred - #3 (ADR-0017 merge blind-spot) → lesson; ADR re-frame deferred - #4 (fixture workarounds) → edge_case_testing.md amendment - #5 (default-value churn) → lesson + commit-message hygiene - #6 (test byte-offsets) → prologue.zig helper + edge_case_testing.md amendment - #7 (ADR Revision history misuse) → lesson; README convention deferred - #8 (sub-row ROADMAP normalization) → ADR-0022 process improvement § (deferred) - #9 (bug-fix-time survey) → bug_fix_survey.md (NEW rule) - #10 (ADR batch dependency order) → lesson; Dependencies section deferred Out-of-scope items explicitly named (deferred to follow-up cycles): emit.zig 9-module split, ~128-site bulk byte-offset migration, liveness frame restructure, ADR-0017 honest re-framing, .dev/decisions/README.md Dependencies / DAG convention amendment.

… both backends 最高度の優先事項である Wasm 仕様準拠の bounds-check 化。pre-fix の `ea >= mem_limit` チェックが access_size を考慮せず、メモリ末尾ギリギリで N-byte 読み (例: 65532 番地から i32.load 4 byte) が spec 上 trap すべきところを通過させていた。両 backend を同 commit で修正、liveness gap (memory ops 未登録) も同時に discharge。 ARM64 (op_memory.zig): - ADD X17, X16, #access_size (IP1 = ea + size; X17 scratch) - CMP X17, X27 (vs mem_limit) - B.HI trap_stub (unsigned >) - access_size: exhaustive switch covers all 25 i32/i64/f32/f64 ops - X17 scratch conflict with op_call.zig:emitCallIndirect: same X17 として記述。両 handler は op-handler 境界を越えて mid-op で交差しないので衝突しない (module コメントに明示) x86_64 (emit.zig): - LEA RCX, [RDX + access_size] (RCX scratch; RDX 無修正で load addressing 用に温存) - CMP RCX, [R15 + mem_limit_off] - JA trap_stub (unsigned >) - inst.zig 新 encoder encLeaR64BaseDisp8 (REX.W, mod=01, disp8) + 2 byte-level test。docstring に caller constraint 記述 (base=RSP は SIB 必須なので禁止) - access_size switch: 現状 i32 系 8 op のみ網羅 (i64/f64 は D-030 discharge 時に追加); uses_runtime_ptr prescan も同期更新の必要性を `same-class grep target` コメントで明示 Liveness (liveness.zig): - stackEffect に memory ops 追加: loads (1→1), stores (2→0), memory.size (0→1), memory.grow (1→1) - これがないと runI32Export → compileWasm → liveness で UnsupportedOp に落ち、edge_case fixture が動かなかった Fixtures (edge_case_testing.md 規律): - test/edge_cases/p7/memory_bounds/past_limit_load_i32.wat ea=65533 + size=4 = 65537 > 65536 → trap (pre-fix で silently 通過していた境界。本 commit で red→green) - test/edge_cases/p7/memory_bounds/past_limit_load8_u.wat ea=65536 + size=1 = 65537 > 65536 → trap (狭幅 load 境界の独立検出) - 当初の "OK 境界" fixture (at_limit_load_i32, ea+size==mem_limit で trap 不要) は runner が dummy mem_limit=0 を使う制約で exercise 不可 → 削除し D-031 として「runner が module memory section / data segment を populate するようになったら再追加」と debt 化 Test updates: - arm64/emit_test.zig: 4 既存 memory test (i32.load / dispatch / f32f64.load / i32.store) を新 prologue (+ADD X17 word) 用にバイト列更新 - x86_64/emit.zig: 2 既存 memory test (i32.load 完成テスト 78→82 byte / i32.store 配置) を新 prologue (+LEA RCX) 用に更新 - 新 trap fixture 2 件 → edge-case runner 22 → 24 PASS Self-review: code-reviewer subagent を pre-implementation (設計) と post-implementation (diff) の 2 回投入。設計面で X17 衝突回避コメント、 access_size exhaustive switch、fixture 境界値カバーを採用。実装面で encLeaR64BaseDisp8 の RSP 制約 docstring 追加、x86_64 prescan の same-class grep コメント追加を採用。 Refs: Wasm 1.0 spec §4.4.7 (memory.{load,store} trap condition, https://webassembly.github.io/spec/core/exec/instructions.html #memory-instructions), ADR-0021 (op_memory.zig shape), ADR-0026 (x86_64 JitRuntime layout), edge_case_testing.md (boundary fixture discipline), bug_fix_survey.md (same-class grep) Three-host gate: Mac aarch64 + OrbStack Ubuntu x86_64 + windowsmini 全部 test-all green。Mac edge-case runner 24 passed (新 fixture 2 件含む)。

… M3 ringbuffer (#7) 7-issue cleanup batch の最後 2 件 (調査 + 設計レベルが必要だったもの)。両 ADR とも survey → セルフレビュー → 反映の 2 サイクルを経た設計ドキュメントで、実装は別 chunk (7.7-globals / M3-a impl) に委譲。 ADR-0027 (#5 — globals 経路): - 6 主要 Wasm runtime (wasmtime / wasmer / wazero / WAMR / wasm3 / zware) を survey: 100% (6/6) が "globals を vmctx 内に inline embed + [vmctx + offset] で access" を採用。zwasm v1 のみ helper call 路線で ~20 cycle/access の cost penalty を負う異形 - 採用: JitRuntime extern struct を bytes 48-60 で拡張 (globals_base [*]const Value + globals_count u32) - ARM64: X23 を 6 番目の callee-saved invariant として予約 (AAPCS64 callee-saved 10 本のうち 6 本予約 → 4 本残り) - x86_64: ADR-0026 の reload-from-runtime-ptr pattern を踏襲 - ARM64 emit は LDR Rd, [X23, Ridx, LSL #4] (register-offset) を採用、imm12 制限を bypass (~256 globals 上限を回避) - Alternatives B (vtable) / C (VMOffsets) / D (helper call) 全て客観的根拠で reject - ADR-0017 / 0018 / 0026 への amendment 行は 7.7-globals 実装 commit 時に追加 (queue 化) ADR-0028 (#7 — Diagnostic M3 trace ringbuffer 前倒し): - ADR-0016 の M3 phasing を amend: "Phase 7 close 後に再評価" → "7.8 spec gate 着手前に M3-a を land" に方針変更 - 動機: bounds-check #1 fix (commit fe42735) が trace あれば instant に診断可能だった事例 + v1 W54 postmortem (2-3 days → 30 min の診断時間短縮実績) - 設計: 8-byte packed TraceEntry (timestamp / category / event / payload×2) × 32 entries per-thread ring buffer (256 byte / thread) - Categories: jit / regir / regalloc / bounds / trap / exec - Compile-time gate (-Dtrace-ringbuffer) で release zero overhead 維持 (ROADMAP §A12 整合) - Phasing: M3-a (bounds + trap, Phase 7 内) → M3-b (regalloc + jit, Phase 7 close 前) → M3-c (regir + exec, Phase 8+) - Trap stub から drain helper call で caller-saved registers が破壊される旨明記 (post-trap GP register dump は信頼不可、 ringbuffer event sequence のみが canonical audit trail) - D-022 の discharge 前提を満たした (M3-a 実装時に flip) - ADR-0016 への Revision history 追記は M3-a 実装 commit に queue Self-review: code-reviewer subagent を post-design phase に投入。 ADR-0027 で ARM64 callee-saved 計算誤り (X0-X18 caller-saved を含めていた) を critical 指摘 → 修正 (10 本中 6 本予約 → 4 本残りに正確化)。ADR-0028 で trap-time register state 破壊リスクを critical 指摘 → Negative 節に追記。SHA カラムは `<backfill>` に統一 (README.md 規律準拠)。実装は別 chunk: 7.7-globals (ADR-0027 implementation) と M3-a (ADR-0028 implementation) は本 commit には含まない。各実装時にそれぞれ ADR-0017 / 0018 / 0026 / 0016 の Revision history 追記を行う前提。 Refs: ADR-0016, ADR-0017, ADR-0018, ADR-0026, D-021, D-022, ROADMAP §1, §2 P3/P5, §4, §11, §A12, private/notes/ (informal cross-runtime survey notes)

…ap (D-047 closed) Wasm spec §4.4.1.1 says signed division `INT_MIN / -1` traps on `div_s` (the quotient `2^(N-1)` is unrepresentable in N-bit two's complement) but `rem_s` returns 0 (the SDIV+MSUB / IDIV-with-special- case sequence wraps to 0 in the N-bit domain). Without an explicit pre-check the realworld JIT pipeline diverges from the spec on this edge: - ARM64 SDIV silently produces `INT_MIN` for `INT_MIN/-1` → the div_s handler returns the wrong value instead of trapping. - x86_64 IDIV raises `#DE` for both div_s AND rem_s → the JIT process crashes (no #DE handler) on what should be a clean trap (div_s) or a returned 0 (rem_s). Discharge: - ARM64 inst.zig adds `encCmnImmW`/`encCmnImmX` (one-instr CMN test for `Wm == -1` via `ADDS WZR, Wm, #1`) and `encNegsRegW`/`encNegsRegX` (NEGS WZR sets V=1 iff register == INT_MIN). +4 unit tests. - ARM64 op_alu_int.zig wires a 4-instruction overflow guard (CMN + B.NE + NEGS + B.VS-trap-stub) before SDIV when op is `i32.div_s` / `i64.div_s`. rem_s does NOT guard; SDIV+MSUB already produces the spec-correct 0. - x86_64 op_alu_int.zig adds a pre-IDIV guard for both `is_signed` shapes: CMP rhs,-1 / CMP lhs,INT_MIN (movabs-via-RAX for the 64-bit constant). On match: div_s branches to trap_stub via bounds_fixups, rem_s emits XOR dst,dst then JMP-rel32 over the IDIV path. RAX is unused at this point (about to be clobbered by IDIV regardless). - 4 edge-case fixtures under `test/edge_cases/p7/idiv_overflow/` per ADR-0020: i{32,64}_{div,rem}_intmin_neg1. div fixtures expect `trap: integer overflow`; rem fixtures expect `i32: 0` (the i64 fixture wraps result via `i32.wrap_i64` because the edge runner is runI32Export-only). Mac aarch64 test-all: 1087/1092 unit pass + spec_assert 212/0/20 + edge_cases 31/0 (was 27 — 4 new idiv_overflow fixtures). No regressions on the existing 55 realworld + 1158 wast_runner fixtures. Closes D-047.

…ming Locks the JIT-execution sentinel design before per-arch implementation: - New JitRuntime.jit_executed_flag: u32 field (extern struct end position; existing offset constants stay stable). - ARM64 prologue: ORR W17, WZR, #1 + STR W17, [X19+off] (8 bytes, 2 insns). - x86_64 prologue: MOV DWORD PTR [R15+off], 1 (7 bytes, 1 insn). - Always-on (no build-flag gate) per row text + ROADMAP §A12; cost is below bench noise floor. - Same-process consumer reads field directly post-call; cross-process realworld_run_jit child prints `[jit-exec-flag] N` marker line to stderr for parent to grep (8a.2-d). Counter (Alternative A) rejected — 8a.1's pass_diagnostics already records compile-pass invocation counts; ADR-0028's exec category is M3-c-deferred; flag suffices for the named "did JIT run at all?" question. D-054 OrbStack-vs-windowsmini differential becomes the primary near-term consumer: comparing flag value across the two x86_64 hosts on the as-loop-broke fixture localises Rosetta-vs-native divergence. Routine ROADMAP status update only: §9.8a / 8a.2 row notes 8a.2-a [x]; sub-rows 8a.2-b/c/d/e remain. Handover retargets at 8a.2-b (JitRuntime field + ARM64 prologue inject).

…gue inject per ADR-0034 Lands the sentinel field + ARM64 prologue inject: - `JitRuntime.jit_executed_flag: u32 = 0` field appended at struct end (head_size 80 → 88 bytes). New `jit_executed_flag_off` constant + 4-aligned imm12 budget asserts. Layout offsets test extended. - ARM64 prologue gains 2 insns / 8 bytes after X19 = X0 save: - `MOVZ X17, #1` (W17 = 1) - `STR W17, [X19, #jit_executed_flag_off]` X17 = IP1 caller-saved scratch per Arm IHI 0055 §6.4; safe to clobber pre-body. - `prologue.body_start_offset(has_frame)`: 32 → 40 (no frame), 36 → 44 (with frame). Single-source-of-truth helper migrates ~60 sites automatically; 12 hardcoded `out.bytes[N..]` sites in emit_test_local.zig + 1 in emit_test_alu_int.zig bumped +8 inline. - `linker.zig` 2-function test now constructs a proper JitRuntime (was relying on tolerable garbage in X0 for the 5 LDRs; the new STR through X19 mandates a real backing store). Test asserts `rt.jit_executed_flag != 0` after the call — the integration verification for this chunk. Mac local zig build test green default + with -Dtrace- ringbuffer=true. Mac test-all green. Mac lint green. 3-host parallel gate dispatched after push. 8a.2-c (x86_64 prologue inject) follows.

…ugs + dead error path Per ADR-0056 §9.9 scope extension. Stage A foundation chunk: wire the runners that were "documented exit criterion measurement points" but never actually CI-gated, and clean up bench-script non-functional bugs surfaced by Agent Y's audit. ## Wired into test-all - `test-realworld-run-jit` — §9.7 / 7.9-a "40+ RUN-PASS floor" was informally measured before this. Now gates with the classification system (COMPILE-PASS / COMPILE-IMPORTS / COMPILE-OP / COMPILE-VAL / FAIL-OTHER). Mac: 46/55 compile-pass, 0 fail-other (gate green). OrbStack: same. - `test-wasmtime-misc-runtime` — only runtime-asserting runner covering non-SIMD wasm-2.0 features (266/0/0 today; panic gap referenced at the old "NOT in test-all" comment block has long since closed). ADR-0056 discovery #1 ("non-SIMD spec coverage is fake-green via parse+validate-only wast_runner") makes this load-bearing until 9.9-l-1 lands the non-SIMD spec_assert_runner. `test-edge-cases` wiring DEFERRED to 9.9-j-2b. Wiring it surfaced a real JIT bug (i32.rem_s(INT_MIN, -1) returns INT_MIN instead of 0 per Wasm spec §4.4.1.1; i64 path is correct). Filed as D-085 + D-086 (Mac-aarch64-only gate is stale, needs removal). ## Bench script bug fixes (Agent Y finding #1) `scripts/run_bench.sh`: - **Scientific-notation parse bug**: the prior `grep -oE '"mean": [0-9.]+'` regex did not match hyperfine's exponent-form (`8.31753e-06`), capturing only `8.31753` and then `awk * 1000 = 8317.53`. Multiple history.yaml entries (commit c27f74d and prior, x86_64-linux CI rows) carry physically-impossible numbers as a result (e.g. `stddev_ms: 8317.53` next to `min_ms: 2.12 / max_ms: 2.13`). Fixed via `python3` JSON parse for hyperfine's `--export-json`. - **stderr capture**: the prior `>/dev/null 2>&1` swallowed hyperfine + zwasm error output, making bench-script failures opaque ("(failed; logging null)" with zero diagnostic). Now captures stderr to a tmp file and prints first 5 lines on failure. `bench/results/history.yaml`: added a NOTE annotating the tool-bug-contaminated x86_64-linux rows. Treated as ordinal/ qualitative for those rows; subsequent rows are correct. Append- only per ROADMAP §A9, so historical rows are kept. `bench/README.md`: schema clarification — script writes `mean_ms / stddev_ms / min_ms / max_ms` (was incorrectly documented as `median_ms` in the prior README). ## Dead error path fix `src/engine/runner.zig`: renamed `Error.UnsupportedImports` (plural, declared but never raised) → `Error.UnsupportedImport` (singular, matches all actual raise sites at `runtime/instance/instantiate.zig:{255,264,265,267,285,…}`). `test/realworld/run_runner_jit.zig`: `error.UnsupportedImports` catch arm renamed to `error.UnsupportedImport`. Pre-fix the catch arm never matched anything; COMPILE-IMPORTS classification silently miswired to permanent 0. Now correctly identifies realworld fixtures whose imports v2 doesn't yet support (currently 0 fixtures hit this — host imports are accepted via trap-stub branches per §9.7 / 7.9-b design). ## Gate result Mac aarch64 `gate_commit.sh` green; OrbStack `zig build test-all` green (with 2 new wirings, 33/35 steps succeeded, 1586/1598 tests passed + 12 skipped same as before). ADR-0056 cohort progress: 9.9-i-1 (Agent W in flight), 9.9-j-1 (landed), **9.9-j-2 (this commit)**. Next per handover: 9.9-j-2b (D-085 root cause + D-086 gate removal + test-edge-cases wire) OR — per new "sequential" mode — switch to JIT op completion (9.9-m-4 select_typed) and let Agent W report back on its own cadence.

2 of 3 m-3 ops (memory.init = m-3b deferred — requires bigger JitRuntime extension for data_segments slice base + length + the 3-operand pop / bounds-check / memcpy recipe). ## JitRuntime extension (jit_abi.zig) Four new fields at the tail (mirrors m-1b's func_entities extension): - `data_dropped_ptr: [*]u8` + `data_dropped_count: u32` - `elem_dropped_ptr: [*]u8` + `elem_dropped_count: u32` bool stored as u8 (matches extern struct layout). Comptime alignment guards + imm12 budget checks added. head_size: 104 → 136 bytes. Offset constants exposed for codegen. ## setupRuntime population (runner.zig) Now decodes the data + element section counts (via the same `module.find()` + `sections.decode*` calls already used for data/element segment installation) and allocates zero- initialised `[]u8` flag arrays. `RuntimeOwned.deinit` frees them. For modules without segments, the arrays are zero-length (no allocation; ptr left as `undefined` per default). ## JIT dispatch ARM64 (`src/engine/codegen/arm64/emit.zig`): - `LDR X16, [X19, #data_dropped_ptr_off]` (load base) - `MOVZ W17, #1` - `STRB W17, [X16, #idx]` (imm12; idx < 4096 required) - elem.drop identical with elem_dropped_ptr_off. x86_64 (`src/engine/codegen/x86_64/emit.zig`): - `MOV R10, [R15 + dropped_ptr_off]` - New encoder `encStoreImm8MemBaseDisp32(R10, idx, 1)` emits `MOV BYTE PTR [R10+disp32], imm8` (opcode 0xC6 /0). - Both ops added to `usage.zig` `usesRuntimePtr` whitelist (load from r15 → require R15 init per the m-5 discipline). ## Verified - Mac aarch64 `gate_commit.sh` green; OrbStack x86_64 `zig build test-all` green. - emit.zig sizes: ARM64 1869 LOC, x86_64 1963 LOC (under 2000 hard cap). - jit_abi.zig layout test updated (head_size = 136). Spec corpus exercise of data.drop / elem.drop / memory.init lands via k-1 (Wasm 2.0 non-SIMD wast vendor); `bulk.wast` / `memory_init.wast` / `data*.wast` / `elem*.wast` from upstream `WebAssembly/spec/test/core/` will gate end-to-end once both m-3b + l-1 (runtime-asserting runner) + k-1 land. Cohort progress (ADR-0056 / §9.9 close): - 9.9-i-1 [x] Win64 v128 - 9.9-j-1 [x] ADR-0056 scope - 9.9-j-2 [x] test-all wiring (2/3) + bench fixes - 9.9-m-4a/b [x] select_typed GPR + f32/f64 - 9.9-j-2b [x] rem_s alias + edge-cases gate - 9.9-m-5 [x] x86_64 trap-stub R15 prescan - 9.9-m-1a/b [x] ref.null + ref.is_null + ref.func - 9.9-m-3a [x] this commit — data.drop + elem.drop - 9.9-m-3b next — memory.init (bigger; data_segments slice base + length + bounds checks + memcpy recipe) - 9.9-m-2, m-4c, l-1, k-1/k-2, n-1, j-3b — sequential.

Per ADR-0058: extends the m-2 cluster (after m-2a's get/set/size) with `table.fill x`. Inline forward-write loop pops dst/val/n, bounds-checks `dst+n <= tables[x].len`, and writes N copies of val into refs[dst..dst+n]. The m-2b chunk was originally scoped to grow+fill; table.grow split out to m-2d because it requires a host-helper-call path (allocator-in-JitRuntime infrastructure) that's out of m-2 scope per ADR-0058's deferred-follow-up §. ## arm64 (op_table.emitTableFill) Step A captures operands BEFORE any LDR into X10/X11/X12 (the operand-capture discipline codified at ADR-0058 §"Operand-capture discipline"; m-2a's silent-miscompile lesson applied): ORR W17, WZR, W_dst ; snapshot dst (zero-ext i32) ORR X16, XZR, X_val ; snapshot val (full 64-bit ref) ORR W14, WZR, W_n ; snapshot n (zero-ext, loop counter) Step B reads TableSlice (refs / len). Step C bounds-checks `dst+n` via X-form ADD into X13 (both X17/X14 have upper bits zero from the W-form snapshot, so 64-bit add can't wrap into spurious len-violation). B.HI fixup feeds `bounds_fixups`. Step D CBZ W14 skips on n==0. Step E loop body: STR X16, [X11, X17, LSL #3] ; refs[dst] = val ADD X17, X17, #1 ; dst++ SUB X14, X14, #1 ; n-- CBNZ W14, .loop Step F patches the CBZ skip to land post-loop. Total ~14 instructions per call; payload-conditional encoder-budget guard (tableidx < 1024) preserved from m-2a. ## x86_64 (op_table.emitTableFill) Mirror of arm64. SysV holder regs: RDX = dst, R8 = val, R10 = n. The x86_64 allocatable pool {RBX, R12, R13, R14} is disjoint from the prologue scratch {RAX, RCX, RDX, R8, R9, R10, R11}, so the snapshot pass is technically unnecessary for safety; the explicit snapshot mirrors arm64 for cross-arch readability and future-proofs against pool expansion. Recipe: MOV RDX, dst ; snapshot dst (32-bit, zero-ext) MOV R8, val ; snapshot val (full 64-bit) MOV R10, n ; snapshot n (32-bit) MOV RAX, [R15 + tables_ptr_off] MOV R11, [RAX + (tableidx*16)] ; refs MOV R9d, [RAX + (tableidx*16)+8] ; len MOV RAX, RDX ADD RAX, R10 ; dst+n CMP RAX, R9 JA trap_stub ; bounds_fixups TEST R10, R10 JE end ; n==0 fast path .loop: MOV [R11 + RDX*8], R8 ; refs[dst] = val ADD RDX, 1 ADD R10, -1 JNE .loop end: ... `usage.zig` (R15 prescan whitelist) extended with `table.fill` — the bounds-stub trap-flag store requires R15 initialised. ## Edge-case fixtures (test/edge_cases/p9/table_ops/) Three new boundary fixtures (per ADR-0020 / edge_case_testing.md): - fill_happy.wat — 5-entry funcref table; fill 3 slots starting at idx=1; verify slot 2 reads back null via ref.is_null. Exercises the inline-loop emit path. - fill_oob.wat — 3-entry table; dst=2 n=2 → 2+2=4 > 3 → trap. - fill_n_zero.wat — n=0 at the OOB boundary (dst==table.len); no trap, returns sentinel i32:42 to confirm function-tail executed. ## Verification - Mac aarch64 `zig build test-all`: green; p9/table_ops 8/8 PASS (5 m-2a + 3 m-2b). - OrbStack x86_64 `zig build test-all`: pending background gate. - Mac aarch64 `zig build lint --max-warnings 0`: clean. ## Follow-ups - m-2c table.copy + table.init — next chunk. Closes m-2 base scope. Depends on m-3a's elem_dropped_ptr (already wired). - m-2d table.grow — deferred behind allocator-in-JitRuntime helper infrastructure design. References ADR-0017 (JitRuntime layout), ADR-0058 (m-2 family design), Wasm spec §4.4.14 (table.fill).

Per ADR-0058: extends m-2 cluster with `table.copy x y`. Reads 3 operands (n / src / dst), bounds-checks both src+n and dst+n against the respective TableSlice.len fields, then emits a forward (default) or backward (same-table dst > src) memmove loop over u64 ref slots. m-2c is split into two sub-chunks (per chunk-granularity rules on ADR-grade design changes): - m-2c (this chunk) — table.copy. Reuses m-2a's TableSlice ABI surface; no new JitRuntime fields. - m-2c-init (next chunk) — table.init with ElemSlice ABI extension (per-segment u64[] of FuncEntity ptrs). table.grow split out to m-2d behind allocator-helper infra. ## arm64 (op_table.emitTableCopy) Operand-capture discipline preserved (snapshot dst→W17, src→W16, n→W14 BEFORE clobbering X10..X12). Scratch reuse: X10 = tables_ptr (transient) X11 = dst_refs (long-lived for the loop) X12 = src_refs (long-lived; replaces X10's role after Step C1) W13 = dst_len / src_len (transient, reused per bounds check) X15 = ref-transfer scratch (per iteration) Two bounds-fixups (dst then src) feed `bounds_fixups` and trap via the shared stub. Direction switch (`same_table = (dst_tbl == src_tbl)` at JIT compile time): - Same table: emit `CMP W17, W16 ; B.LS .fwd` direction dispatch. The backward arm pre-advances both indices by n then loops with pre-decrement (`SUB W17,W17,#1 ; SUB W16,W16,#1 ; LDR X15,[X12,X16,LSL #3] ; STR X15,[X11,X17,LSL #3] ; ...`). Forward arm uses post-increment. - Different tables: forward only (no overlap possible). End patches: the n==0 CBZ skip and (same-table case) the bwd→end unconditional B jump. ## x86_64 (op_table.emitTableCopy) Mirror of arm64. Holder regs: RDX = dst_idx, R8 = src_idx, R10 = n. Long-lived: R11 = dst_refs, RCX = src_refs. Direction dispatch uses `CMP RDX, R8 ; JBE .fwd`. Backward arm: `ADD RDX,R10 ; ADD R8,R10 ; .loop: ADD RDX,-1 ; ADD R8,-1 ; MOV R9,[RCX+R8*8] ; MOV [R11+RDX*8],R9 ; ADD R10,-1 ; JNE .loop`. Unconditional JMP rel32 (opcode 0xE9) bridges from bwd to end. `usage.zig` extended with `table.copy` (R15 prescan whitelist for the trap-stub flag store). ## Test update `emit_test_local.zig`'s "unsupported op surfaces UnsupportedOp" probe migrated from `.table.copy` (now implemented) to `.table.grow` (deferred to m-2d). The probe specifically targets ops that surface UnsupportedOp at the dispatch level, so it must update as more ops land — established pattern from m-3a's data.drop / elem.drop landing. ## Edge-case fixtures (test/edge_cases/p9/table_ops/) Five new boundary fixtures (per ADR-0020): - copy_same_table_forward.wat — same table, dst <= src, exercises the forward arm. - copy_same_table_backward.wat — same table, dst > src with overlap, exercises the backward arm. - copy_cross_table.wat — two tables, exercises the different-table forward path (no direction dispatch emitted). - copy_oob_dst.wat — dst+n > tables[x].len → trap. - copy_oob_src.wat — src+n > tables[y].len → trap. ## Verification - Mac aarch64 `zig build test-all`: green; p9/table_ops 13/13 PASS (5 m-2a + 3 m-2b + 5 m-2c). - OrbStack x86_64 `zig build test-all`: pending background gate. - Mac aarch64 `zig build lint --max-warnings 0`: clean. ## Follow-ups - m-2c-init table.init — next chunk. Introduces ElemSlice JitRuntime ABI extension (parallel to SegmentSlice from m-3b). - m-2d table.grow — deferred behind allocator-in-JitRuntime helper infrastructure. References ADR-0017, ADR-0058, Wasm spec §4.4.15.

Per ADR-0058 amendment (this commit): introduces ElemSlice JIT ABI extension and implements table.init on both arches. Closes the m-2 cluster's base scope (m-2a..m-2c-init); table.grow remains deferred to m-2d behind allocator-helper infrastructure. ## JitRuntime ABI extension (jit_abi.zig) `ElemSlice = extern struct { refs: [*]const u64, len: u32, _pad: u32 }` = 16 bytes (stride matches SegmentSlice + TableSlice for ABI consistency). Two new tail fields: elem_segments_ptr: [*]const ElemSlice = undefined, elem_segments_count: u32 = 0, head_size: 168 → 184 bytes. Offset constants + comptime alignment / imm12 / 16-byte size guards added. Re-exported from `entry.ElemSlice`. ## Runner runtime wiring (runner.zig) `setupRuntime` now walks the element section to produce two parallel slices: - `elem_segments: []ElemSlice` (one descriptor per declared segment; .refs points into the arena). - `elem_refs: []u64` (contiguous arena sized to sum of all seg.funcidxs.len; pre-populated with FuncEntity-ptr encoding via `@intFromPtr(&func_entities[fidx])`, identical to m-1b's ref.func emit shape). Null entries (`fidx == maxInt(u32)`) get `Value.null_ref`. RuntimeOwned extended with both slices; deinit frees them. ## Codegen — arm64 (op_table.emitTableInit) Operand-capture: snapshot dst→W17, src→W16, n→W14 first. Then: Step B1: tables[x] descriptor → X11 = dst_refs, W13 = dst_len. Step B2: elems[y] descriptor → X12 = elem_refs, W15 = elem_len. Step B3: dropped-flag override — LDR X10, [X19, #elem_dropped_ptr_off] LDRB W9, [X10, #elemidx] CMP W9, #0 CSEL X15, X15, XZR, EQ ; seg_len → 0 if dropped Step C1: bounds src+n vs seg_len → trap. Step C2: bounds dst+n vs dst_len → trap. Step D: CBZ W14 skip on n==0. Step E: forward loop — LDR X15, [X12, X16, LSL #3] ; elem_refs[src] STR X15, [X11, X17, LSL #3] ; tbl.refs[dst] ADD W17, W17, #1 ADD W16, W16, #1 SUB W14, W14, #1 CBNZ W14, .loop Two `bounds_fixups` entries (src then dst). The CSEL dropped- flag override mirrors m-3b's memory.init Step C exactly. ## Codegen — x86_64 (op_table.emitTableInit) Mirror with SysV ABI. Holder regs: RDX = dst, R8 = src, R10 = n. Long-lived: R11 = dst_refs, RCX = elem_refs. Transient: R9d = dst_len, RSI = elem_len. Dropped-flag override via CMOVNE: MOV RAX, [R15 + elem_dropped_ptr_off] ADD RAX, elemidx XOR EDI, EDI MOVZX EDI, byte [RAX + RDI] ; EDI = dropped (0 or 1) XOR EAX, EAX ; zero source TEST RDI, RDI CMOVNE RSI, RAX ; if dropped → RSI = 0 Loop body uses MOV r64 base+idx*8 in both read and write directions (encStoreR64MemBaseIdxLsl3 + encMovR64FromBaseIdxLsl3 already landed at m-2a/m-2b). `usage.zig` (R15 prescan whitelist) extended with `table.init`. ## Edge-case fixtures (test/edge_cases/p9/table_ops/init_*.wat) Five new boundary fixtures (per ADR-0020): - init_happy.wat — element segment with one funcref entry; table.init slot 1; verify slot 1 reads back non-null (i32:0 from ref.is_null since the entry is `ref.func 0`). - init_oob_dst.wat — dst at boundary, n>0 → trap. - init_oob_src.wat — n exceeds segment length → trap. - init_dropped.wat — elem.drop 0 first, then table.init with n=1 → trap (spec §4.4.16: dropped → seg.len = 0). - init_n_zero.wat — elem.drop 0; table.init with n=0 at OOB boundary → no trap, returns sentinel i32:99. ## Verification - Mac aarch64 `zig build test-all`: green; p9/table_ops 18/18 PASS (5 m-2a + 3 m-2b + 5 m-2c + 5 m-2c-init). - OrbStack x86_64 `zig build test-all`: pending background gate. - Mac aarch64 `zig build lint --max-warnings 0`: clean. ## Follow-ups - m-2d table.grow — last m-2 piece; behind allocator-in- JitRuntime helper infrastructure. - D-090 (to file when m-2d lands): table-0 funcptrs_buf cache invalidation after table.set / table.init / table.copy writes; Phase 10+ unification. References ADR-0017 (JitRuntime layout), ADR-0058 (this chunk's design + amendment), Wasm spec §4.4.16 (table.init), ADR-0056 (Phase 9 = Wasm 2.0 100% PASS scope).

…on-func bindings) B144 was an investigation-only cycle. Discovery: ZERO manifest `skip-impl` lines exist in `test/spec/wasm-2.0-assert/` — all 100 SKIP-CROSS-MODULE-IMPORTS sites are runtime emissions from `hasUnbindableImports` returning true in the `.module` dispatch arm. The original B143 survey's Chunk A (func dispatch) is effectively already implemented: Path #1 in hasUnbindableImports correctly allows `func` imports from registered modules through. The actual gap is Path #2 (`.table, .memory, .global => return true`), which fires UNCONDITIONALLY including for spectest — most of the 100 SKIPs are shapes like: (import "spectest" "global_i32" (global i32)) not registered-module cross-imports. B145 = Chunk B Part 1: spectest non-func binding catalog. Spec testsuite values: global_i32=666, global_i64=666, global_f32=666.6, global_f64=666.6. Wire as static catalog + loosen hasUnbindableImports's non-func arm for the recognized spectest names. Reuse `engine.export_lookup` patterns. This re-scoping is a meaningful correction to the B143 chunk plan; it preserves the survey doc as historical record but the implementation path now skips Chunk A entirely.

…pe plumbing (ADR-0111 D4) Vertical slice: codegen now distinguishes i32 vs i64 memory at the per-arch emit layer. arm64 path implements the full i64 wrap-check; x86_64 absorbs the signature change (param threaded but i64 emit body deferred to 10.M-4c). **Plumbing** (arch-symmetric; 16 files touched): - `compileOne` (shared/compile.zig) gains 12th param `memory0_idx_type: sections.MemoryEntry.IdxType` and passes to `emit.compile`. - `arm64/emit.compile` + `x86_64/emit.compile` gain 9th param, imported `sections` for the type alias. - `arm64/ctx.zig::EmitCtx` gains `memory0_idx_type` field (default `.i32` for ergonomic struct-literal init; per-call sites pass explicit value via compile()). - `src/engine/compile.zig::compileWasm` reads memory 0's idx_type from import memory (precedence) or first defined memory; passes through to compileOne. Defaults `.i32` when module has no memory section (op handlers reject memory ops in that state via validator gate `validator_memory_count == 0`). - All 30+ direct `emit.compile()` test call sites updated to pass `.i32` (mechanical; existing byte-identical asserts still hold because the i32 fast path is unchanged). **arm64 emit body** (`op_memory.zig::emitMemOpI64`): - Comptime + runtime 2-stage gate per ADR-0111 D4: when `comptime build_options.wasm_level >= .v3_0` AND `ctx.memory0_idx_type == .i64` → dispatch to emitMemOpI64; else fall through to the existing i32 fast path (byte-identical, asserted by the 9 existing emit_test_memory tests). - i64 path differs from i32 at exactly TWO points: 1. Address load: `encOrrReg(ip0, 31, w_addr)` (X-form, full 64-bit copy) instead of `encOrrRegW(...)` (W-form, zero-extends u32 to u64). This is the spec-defined i64 idx_type address semantic per Wasm 3.0 §5.4.7. 2. Offset materialise: 4-lane MOVZ+MOVK (lanes 0..3) when offset > 0xFFFFFF, vs the i32 path's 2-lane (lanes 0..1) — needed because Wasm 3.0 memarg offset is u64. - Bounds-check, store value pop, final LDR/STR shapes are identical to the i32 path (the existing encoders are X-form already; mem_limit X27 is u64; validator caps i64 memory pages at 2^32 per ADR-0111 / engine/compile.zig 10.M-1 so ea+access_size cannot overflow u64). **Tests** (arm64/emit_test_memory.zig): - New `memory64 i32.load — X-form addr load` — same Wasm op as the existing i32-idx_type test but compiled with `.i64`; asserts body+4 is `encOrrReg` (vs `encOrrRegW`) and remaining bytes are identical. - New `memory64 i64.load offset=0x100000000 — 4-lane MOVZ+MOVK` — verifies lane 2 materialise (MOVK X17, #1 lsl #32) for an offset that exceeds the 2-lane i32 path's reach. Existing 9 emit_test_memory tests stay byte-identical (passing `.i32`); the spec corpus + realworld harness exercise the i32 path daily so the gate's "i32 fast-path byte-identical" invariant per ADR-0111 D4 is the inferred result. **Deferred to 10.M-4c**: x86_64 mirror (R10 MOV imm64 4-lane analogue); `_ = memory0_idx_type;` discard in x86_64/emit.zig documents the param-accepted-but-unused state. Mac `test-all` GREEN (1782/1796 passed, 14 skipped per pre- existing skip count; 0 failed; 0 leaks). Lint clean; zone+fs gates exit 0. Refs: §10 / 10.M-4b; ADR-0111 D4.

…alidated) Spike `private/spikes/p10-it6-naked-trampoline/` validated ADR-0119 §Removal condition #1 — Zig 0.16 `callconv(.naked)` suppresses prologue/epilogue on all three Phase 10 host targets: - aarch64-macos: __TEXT,__text size 0x10 = `mov x16, x29 ; mov x17, x30 ; ret ; brk #0x1`. No `STP X29, X30, ...`. - x86_64-linux-gnu: .text size 0xa = `movq %rbp, %r10 ; movq (%rsp), %r11 ; retq ; ud2`. No `PUSH RBP ; MOV RBP, RSP`. - x86_64-windows-gnu: identical 0xa-byte sequence. MinGW path shares the naked-fn shape with SysV. The post-RET `brk` / `ud2` is the Zig `noreturn`-fallback safety; unreachable in normal control flow. The exported `probe` symbol is C-ABI callable in each object format. User authorized the autonomous flip (chat 2026-05-27) once empirical evidence anchored the design. Spike Status: `merged-into-prod` (per `.claude/rules/spike_discipline.md` §3). Bundle 10.E-codegen-IT-6 exits bucket-3 stop; loop resumes at cycle 3/3 — trampoline impl + op_throw.emit retargeting.

…fn, trap-only body) Phase 10.E IT-6 impl cycle 3a per ADR-0119 (Accepted, 213df2f). Adds `src/engine/codegen/shared/throw_trampoline.zig` as a `callconv(.naked)` function symbol callable from JIT-emitted throw sites in the follow-on cycle. Body shape (trap-only): - arm64: `movz w17, #1 ; str w17, [x19, #trap_flag_off] ; movz x0, #0 ; ret` - x86_64: `movl $1, %r10d ; movl %r10d, off(%r15) ; xorl %eax, %eax ; retq` The trampoline inherits the pinned `*JitRuntime` from the caller (X19 on arm64 / R15 on x86_64 per ADR-0017) — no separate Runtime field load needed. Test verifies (a) symbol address is non-zero (linker exported) and (b) the trampoline, invoked via an inline-asm wrapper that sets up the pinned register with a mock JitRuntime, writes trap_flag = 1. zwasm.zig discovery hookup added so the trampoline's tests join the project test graph. This commit ships the *file scaffolding* + the *invocation contract* (pinned-reg in, trap_flag out) without yet retargeting op_throw.emit (the IT-3 "B-to-trap-stub" shape remains). The trap-only body is intentional placeholder — the dispatchThrow integration + handler-vs-uncaught branch (ADR-0114 D6 steps 3-5) lands in the next cycle, replacing the body without changing the external interface. Bundle 10.E-codegen-IT-6: cycle 3a of ~3.

…; exnref blocker #1 cleared

…61 at ref_test (33 return-fails, #1 gc lever)

…red); pivot to 10.H multi-memory linking Investigated the last counted gc return-fail (.17 'run' InvokeFailed). Root cause #1: runtime call_indirect sig-check is EXACT (sigEq), but a $t1 func called via call_indirect (type $t0) where $t1<:$t0 must succeed. Verified-correct fix recorded in D-198 (sigCompatible = sigEq OR same- module concreteReaches(fe.raw_typeidx, declared)). It advanced .17 past the call_indirects → exposed root cause #2: a further unidentified Trap.Unreachable (not unbound-op, not control-bad-index). .17 is 1 exotic fixture (recursive self-ref func types) needing >=2 coordinated runtime fixes, each non-observable until 'run' fully passes (spike §2) — low ROI. Reverted; DEFERRED as a focused bundle (D-198). gc bundle (10.G) effectively COMPLETE: **62→349 ret / 96 trap / 57 inv** (start-exec, iso-recursive canon, ref.cast narrow, typed call_indirect). Pivot to bundle 10.H-multimem-linking: multi-memory return=396, 11 counted fails (linking0-3 + imports4) — the next observable cluster. No src delta (gc 349/96/57, multi-mem 396, exit 0, 0 panics unchanged).

First GC-on-JIT op family (D-211 bundle). Non-allocating shift+tag, matching the interp (instruction/wasm_3_0/i31_ops.zig + feature/gc/ i31.zig) — anyref is a u32 on the operand stack, regalloc-classed like i32 (.scalar) per ADR-0116 D4: - ref.i31: ADD Wd,Wn,Wn (x<<1) + ORR Wd,Wd,#1 (low-bit-1 tag) - i31.get_s: TST Wn,#1 + B.EQ→trap; ASR Wd,Wn,#1 (sign-extend) - i31.get_u: TST Wn,#1 + B.EQ→trap; LSR Wd,Wn,#1 (high bit zero) null / non-i31 traps via the generic bounds_fixups stub (ADR-0123 D2), matching the interp's NullReference conflation. New arm64 encoders encAsrImmW / encOrrImm1W / encTstImm1W (byte-shape tested). stackEffect 1→1 entries drive both liveness + populateShapeTags. runI32Export round-trip (get_s=1234, get_u(-1)=0x7FFFFFFF) + null-trap e2e, gated to aarch64 until x86_64 lands next cycle (D-211). arm64 migrated op count 352→355.

…in-main is the #1 lever

…/type-subtyping.17 run (return_fail 1→0) Two coordinated runtime fixes (the cyc180/D-198 .17 rabbit hole) that together let .17 'run' pass — interp assert_return now fully green (1233/0): #1 call_indirect/return_call_indirect: accept a callee whose declared func type is a SUBTYPE of the call's expected type, not just structurally equal (Wasm 3.0 §3.3.5.5). sigEq OR (callee_rt==rt and ref_test_ops.concreteReaches(rt, fe.raw_typeidx, declared)). concreteReaches is gti-gated (non-GC modules keep pure sigEq exact-match — no raw sub==target shortcut, which collided with a default-0 raw_typeidx in trap_audit's sig-mismatch test). #2 function-level br: doBranch now treats depth==label_len as a function return (Wasm's implicit outermost block, §4.4.8) via the extracted returnFromFunction, instead of trapping Unreachable. 'run' ends with a top-level (br 0) after all blocks close (label_len=0) — root cause #2 that cyc180 left unidentified. gc/type-subtyping return_fail 1→0. Remaining trap_fail=4 are SEPARATE (other gc/type-subtyping assert_trap; runner's own 'assert_trap class discrimination' note). No regression (mac_gate test-all + lint green).

…l insertion A null table element has typeidx_base[idx] = maxInt(u32) (the "no-func sentinel", compile_init.zig:118/171 + setup.zig:593 pre-seed), DISTINCT from any real canonical typeidx. Confirmed empirically: JIT call_indirect (type 0) through a null elem reports indirect_call_mismatch and does NOT crash (the sentinel reliably mismatches; canonicalTypeidx(type 0)=0 != 0xFFFFFFFF). So D-294 is purely a LABEL bug, and the fix is NOT the risky funcptr-reorder first feared — it is a clean insertion: `CMP typeidx, 0xFFFFFFFF; JE -> uninitialized_elem (code 13)` before the existing sig-CMP at each cind-sig site (the typeidx is already loaded there). New channel mirrors cind_sig; ~8 mechanical sites; arm64 uses `CMN Wn,#1` (imm32 too big for CMP). Exact recipe + sites recorded in the D-294 debt row; handover LEAD updated. Codegen sites themselves left for a fresh-context cycle (this session is extremely deep) — now trivial to execute against the recipe.

…ninitialized_elem (code 13) A null (uninitialized, in-bounds) table element previously mislabelled its trap as indirect_call_mismatch (code 3): the JIT did bounds → sig → funcptr with no null check, and a null slot's typeidx fails the sig CMP. The interp + all three reference engines (wasmtime/wasmer/v1, per the D-292-D audit) report "uninitialized element". A null slot's stored typeidx is maxInt(u32) (the no-func sentinel, compile_init.zig pre-seeds typeidxs to it), DISTINCT from any real canonical id. So the fix is a clean insertion at each inline cind-sig site: a `CMP/CMN typeidx, 0xFFFFFFFF; J(E/B.EQ) → uninitialized_elem (code 13)` PRECEDES the existing sig CMP (the typeidx is already loaded there). Spec order is now bounds → null → sig. New per-kind channel (uninit_elem_fixups) mirrors cind_sig, demuxed to a code-13 stub on both arches: - x86_64: CMP EAX, 0xFFFFFFFF ; JE (6-byte) → emitTrapExitStub(13). - arm64: CMN W16, #1 (= W16 == 0xFFFFFFFF) ; B.EQ → EmitCindStub code 13. Applied to call_indirect (table-0 + multi-table) and return_call_indirect, both arches. jitTrapCode gains 13 => .uninitialized_elem (mapInterpTrap already had it). The subtyping resolve-trampoline path (jitCallIndirectResolve collapses OOB/sig/null to funcptr=0) is NOT covered — null-under-subtyping still reports code 3; that needs the trampoline to return a distinct null sentinel (noted in the D-294 debt row). Tests: runner_trap_test exec case (null call_indirect → code 13, was 3); byte-exact emit tests (x86_64 emit_test_int, arm64 emit_test_call ×2) updated for the inserted CMN/CMP+branch. Verified: JIT + interp both emit "uninitialized element" on /tmp/cn0.wasm.

… (user-directed) User directive (2026-06-07): windowsmini verification load conflicts with the user's ClojureWasmFromScratch dev. Two-phase plan: (1) intensive windowsmini-hardening campaign — get it fully green (first lead: the pass=0-across-every-spec-category anomaly @87635409, windows OK masking a spec-runner failure vs ubuntu's real counts); (2) then suspend windows gating via should_gate_windows.sh --suspend (sentinel .dev/windows_gate_suspended) → 2-host Mac+ubuntu fast loop; --resume before any main merge. A13 strict-3-host merge gate UNCHANGED. Handover rewritten with the directive as #1 priority; CLAUDE.md 3-host invariant + memory updated. Hosts being shut down — no remote kicks, no re-arm.

…efore Win64-risk JIT/fuel codegen (ADR-0174 --resume gate); #3a-3 mapping notes

…#3c-1); remaining gated: JIT-sandboxing block (windows --resume) + #1 preopen BLOCKED by D-251 (C-API has no std.Io)

…+ Phase B/D docs done; JIT-sandboxing/#3a-4/#1-preopen documented follow-ons (user-gated); no release (ADR-0156)

…D-521/D-522) (#144) * ADR-0204 kickoff: binary-size campaign — measured baseline + levers (D-521/D-522) Trigger: dogfooding mailbox from_cljw_05 (cljw measures zwasm at 44% of its shipped code, 4.0 MB budget line). zwasm-side symbol attribution (ReleaseSafe arm64 CLI 5,282,584 B @71cccba76) confirms and re-prioritizes: - api.jit_host_bridge = 1,311 KB / 5,453 syms (92% of api.*) — a comptime thunk cross-product (t2fp x2,880 + t1fp x960 + t0..4), NOT api surface. Lever #1 = D-522 (descriptor-driven trampolines; ABI/api unchanged). - engine.codegen.arm64.emit.compile = one 707 KB symbol (~161-arm ZirOp switch; handlers already extracted, dispatch_collector ADR-0074 substrate exists). Lever #2 = D-521 (finish registration, delete the switch; acceptance = emitted JIT bytes identical). - size_history.yaml baseline re-recorded: ReleaseFast base DOUBLED since 2026-06-12 (1,972,696 -> 3,884,856 B). Docs+ledger only; stage PRs follow separately. * ADR-0204: record D-522 stage-1 characterization (thunk axes) jit_host_bridge instantiation axes = arg-kinds x RetKind(5) x MAX_HOST_SLOTS(64); the x64 slot axis is 94% of the product and exists only to comptime-hardcode the slot index. Stage 1 = shared FP-bridge delegation (~0.8 MB, no ABI change); stage 2 = slot-axis collapse via runtime slot conveyance (~0.4 MB, internal call-sequence change).

chaploud added 9 commits February 12, 2026 16:45

Enable x86_64 JIT compilation in VM dispatch

25fd35a

JIT compilation was only triggered on aarch64, leaving x86_64 running in pure interpreter/RegIR mode. Add jitSupported() helper to jit.zig and use it in all three JIT trigger points in vm.zig.

Fix x86.zig compilation errors exposed by JIT enablement

af8b245

- movImm32ToReg: cast 0xB8 to u8 before OR with u3 - emitErrorStubs: use jmpRel32 return value for patching - Fix f64.copysign opcode (0xA6, not 0x8A which is i64.rotr)

Fix x86.zig encoding issues: rex, shift, jcc arity

885c37c

- Add rexRR() helper for 32-bit reg-reg REX prefix - Fix emitSibAddr shift overflow (u3 → u8 widening) - Fix u7 cast for vreg shift in spill/reload - Fix jccRel32 call arity (use return value, not manual offset)

Fix x86_64 emitEpilogue: store only return value to regs[0]

4cc529b

The epilogue was flushing ALL dirty vregs to their memory slots, which overwrote the return value in regs[0] with vreg 0's value. Match ARM64 design: only store the result vreg to regs[0].

TEMP: add x86_64 JIT debug trace

67a44a9

CI: add --allow-failures for known pre-existing spec test failures

32ff194

- Add --allow-failures N option to spec test runner: exit 0 if failures <= N - CI uses --allow-failures 8 (return_call: 5 + call_indirect: 3) - Set fail-fast: false so both OS matrix jobs run to completion

chaploud merged commit cff89cf into main Feb 12, 2026
2 checks passed

chaploud deleted the fix/ci-failures branch February 16, 2026 00:50

chaploud added a commit that referenced this pull request May 28, 2026

chore(p10): retarget handover at cycle 113 (Tag section id 13 decode)…

7e7c51d

…; exnref blocker #1 cleared

chaploud added a commit that referenced this pull request May 29, 2026

chore(p10): cyc160 — per-manifest fail breakdown infra; retarget cyc1…

62bacd3

…61 at ref_test (33 return-fails, #1 gc lever)

chaploud added a commit that referenced this pull request May 31, 2026

docs(lessons): record /continue context-burn factors — Step-0 survey-…

e1f6b0e

…in-main is the #1 lever

chaploud added a commit that referenced this pull request Jun 8, 2026

chore(p17): re-sequence Tier-1 — #3c store-limits + #1 WASI-preopen b…

d732375

…efore Win64-risk JIT/fuel codegen (ADR-0174 --resume gate); #3a-3 mapping notes

chaploud added a commit that referenced this pull request Jun 8, 2026

chore(p17): reframe Tier-1 — interp sandboxing DONE+green (#3a-1/2 + …

b0b3b89

…#3c-1); remaining gated: JIT-sandboxing block (windows --resume) + #1 preopen BLOCKED by D-251 (C-API has no std.Io)

chaploud added a commit that referenced this pull request Jun 8, 2026

chore(p17): campaign COMPLETE → re-frozen — Tier-1 interp sandboxing …

45f9817

…+ Phase B/D docs done; JIT-sandboxing/#3a-4/#1-preopen documented follow-ons (user-gated); no release (ADR-0156)

chaploud mentioned this pull request Jul 16, 2026

ADR-0204 kickoff: binary-size campaign — measured baseline + levers (D-521/D-522) #144

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Fix x86_64 JIT failures: shift aliasing, FP bail#1

Fix x86_64 JIT failures: shift aliasing, FP bail#1
chaploud merged 9 commits into
mainfrom
fix/ci-failures

chaploud commented Feb 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

chaploud commented Feb 12, 2026

Summary

Test plan

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant