JIT: implement OSR exits, deoptimization, and precise GC

[chrisbbreuer]

Parent: #146
Blocks: #429
Depends on: #431 (completed)
Related: #132, #133
Children: #435, #436, #437, #438, #439 (completed)

Make guarded optimized execution resumable and precisely collectable. Side exits must reconstruct exact bytecode state; exceptions, traps, and GC safepoints must not lose or invent observable work.

Acceptance

• Define OSR entry eligibility and immutable frame-state metadata at every guard, call, exception edge, and safepoint.
• Reconstruct locals, operand stack, accumulator, handlers, and exact step/IP state on deoptimization.
• Emit precise stack maps for movable GC values and validate relocation while optimized frames are live.
• Preserve catch/finally edges, termination, watchdog, debugger, and interpreter/baseline fallback behavior.
• Support invalidation-at-poll resume without executing stale optimized facts past the invalidation point.
• Pass focused deopt/OSR/exception/GC tests, normal/no-GIL differential runs, and relevant sanitizer gates.

Landed checkpoints

• JIT: execute optimizer loop bodies with resumable invalidation polls #435: exact loop OSR entry, cycle-safe backedge copies, multi-iteration execution, budget/checkpoint accounting, and generation invalidation resume.
• JIT: reconstruct calls, exceptions, catch, and finally on deoptimization #436: exact handler-aware recovery for throws, abrupt completions, all call/construct shapes, and interpreter-owned effects.
• JIT: trace and relocate movable values in live optimized frames #437: complete at 057a2ef/ae260112 with deopt-indexed frame/scratch maps, fail-closed active-native publication, live moving compaction, and normal/no-GIL/TSan relocation evidence.
• JIT: lower general reducible loop CFGs with path-exact safepoints #438: complete through 48bfe60/b80e81f7/3d78eaf2 with general reducible regions, fused nested loops, exact internal block checks, edge-owned copies, and per-header moving safepoints; irreducible two-entry control rejects before publication.
• JIT: execute calls, effects, and completion dispatch inside exception regions #439: complete through 628b262/b6d1b62b with executable runtime effects and five-way native finally dispatch, exact nested propagation, fail-closed malformed completion handling, and focused/broad TSan evidence.

Completion checkpoint

Exact reconstruction, live moving-GC integration, runtime effects, and completion dispatch are complete. Recovery-only object locals avoid Number guards, occupy marked loop scratch slots, move during real optimized execution, and resume deterministically in single-mutator and no-GIL TSan gates. Native finally dispatch preserves exact state and consumes normal, throw, return, break, and continue completions once, including remaining outer catch/finally handlers.

The final #439 batch passes 7/7 focused full-root native-finally tests and the broad JIT gate at 164/164 under TSan, with zero failures, skips, or leaks. Exact cooperative-stop, expired-watchdog, and shell-timeout delivery after optimizer checkpoint exits is covered through 89fc073. Backend and broad differential completion remains #434.

[chrisbbreuer]

The #431 dependency is complete at e3f411a. The optimizer now has immutable published SSA artifacts, guarded AArch64 execution, exact pre-accounting side exits, and one equal-cost two-way control shape. Unequal paths deliberately remain rejected because dynamic checkpoint/IP reconstruction belongs here.

The next implementation slice can now define frame-state/deoptimization metadata without conflating it with the completed optimizer-foundation contract.

[chrisbbreuer]

Two #432 foundation checkpoints are now on main:

• d0f8aae publishes deterministic SSA frame states as artifact-owned recovery tables.
• 67e878a adds exact VM reconstruction and a three-way native outcome (miss, complete, deoptimized), so a partial side exit cannot fall through into baseline and restart executed work. Restart-only direct calls explicitly reject artifacts that can side exit.

Normal and TSan focused JIT pass 110/110; normal and TSan optimizer filters pass 21/21 with zero leaks. All acceptance boxes remain open pending generated exits, dynamic step/checkpoint state, handlers/exceptions, OSR, invalidation, and precise stack maps.

[chrisbbreuer]

Landed the first generated partial optimizer exit in 3cbc26a. An unequal-cost guarded numeric branch now runs its common prefix natively, charges exactly that prefix, selects the successor's immutable frame state, reconstructs the activation, and resumes bytecode without restarting. Entry is declined before work if the prefix would cross the budget or a 1,024-step checkpoint.

Evidence: normal/TSan test-jit 111/111 and normal/TSan optimizer filters 23/23, including both branch directions, hot ordinary-call activation routing, identical baseline/deopt step totals, and checkpoint-boundary fallback. Acceptance stays open for handlers/exceptions, OSR, invalidation polling, general control, and precise stack maps.

[chrisbbreuer]

Checkpoint ea669989 is on main.

• Added owned, deterministic edge-specific locals/operand-stack states to optimizer SSA.
• Preserved the exact incoming SSA values for every CFG edge after compaction.
• Added a loop regression proving the preheader and backedge have the same frame shape but distinct loop-carried values at one header.
• Corrected the optimizer documentation to describe the already-landed asymmetric side exit and the new loop-OSR boundary.

Focused zig build test-jit: 111/111 passed, zero leaks. Benchmarks were not rerun because this metadata-only slice does not affect benchmark execution.