ffi: remove unsnapshotted CType conversion

Author: Frityet

notes/ffi-callxs-production-scalars-2026-07-18.md

@@ -117,6 +117,13 @@ activation changes this call site to `crec_ct2irt_snapshot()`. Scalar behavior
 is identical, while enum child relocation now retries or aborts recording
 instead of racing the table.
 
+A follow-up production audit removed the older `crec_ct2irt()` surface
+entirely. Its last caller, the generic cdata-to-cdata recorder conversion, now
+uses the same snapshot-aware helper for both source and destination types.
+Current callers normally pre-resolve enum children, so this does not add work
+to ordinary scalar conversion; it closes the latent unsafe fallback if a
+future conversion reaches that helper with an enum still wrapped.
+
 ## Why boxed results remain interpreted
 
 The existing post-CALLXS `IR_CNEWI` code is not an activation path. CNEWI can

src/lj_ccall.h

@@ -199,10 +199,10 @@ typedef struct CCallNativeState {
   uint32_t post_winerr;		/* Paired Win32 LastError; zero elsewhere. */
 } CCallNativeState;
 
-/* Dormant structural substrate for generated generic FFI calls. Push/pop are
-** single-owner and allocation-free. Capacity exhaustion is the only ordinary
-** push failure and leaves sequence, depth and payload unchanged. Snapshot
-** copies every active frame without dereferencing any published stack offset.
+/* Published structural substrate for generated generic FFI calls. Push/pop
+** are single-owner and allocation-free. Capacity exhaustion is the only
+** ordinary push failure and leaves sequence, depth and payload unchanged.
+** Snapshot copies every active frame without dereferencing a stack offset.
 */
 LJ_FUNC void lj_ffi_native_frame_init(TGState *tg);
 LJ_FUNC void lj_ffi_native_frame_fini(const TGState *tg);
@@ -219,9 +219,9 @@ LJ_FUNC uint32_t lj_ffi_native_frame_depth_acq(const TGState *tg);
 ** allocation-free and nonwaiting; every attempt consumes XSAVE staging and
 ** zero requests a pre-call interpreter exit. Ordinary leave removes the frame.
 ** A forced leave converts it to POSTCALL and retains its exact pin until the
-** non-side-linkable caller-state trace exit invokes cleanup. The default
-** recorder remains gated; explicit test-only activation exercises the admitted
-** scalar lifecycle, including callback suspension and nested generated calls.
+** non-side-linkable caller-state trace exit invokes cleanup. Production x64
+** recording admits the nonallocating scalar result classes whose complete
+** lifecycle includes callback suspension and nested generated calls.
 */
 #define LJ_FFI_NATIVE_LEAVE_FORCE_EXIT	0x80000000u
 LJ_FUNC int lj_ffi_native_trace_enter(lua_State *L, struct GCtrace *T,

src/lj_crecord.c

@@ -947,38 +947,6 @@ static IRType crec_ct2irt_snapshot(jit_State *J, CTState *cts, CType *ct)
   return IRT_CDATA;
 }
 
-/* Convert CType to IRType (if possible). */
-static IRType crec_ct2irt(CTState *cts, CType *ct)
-{
-  CTInfo info = ctype_info_acq(ct);
-  CTSize size;
-  if (ctype_isenum(info)) {
-    ct = ctype_child(cts, ct);
-    info = ctype_info_acq(ct);
-  }
-  size = ctype_size_acq(ct);
-  if (LJ_LIKELY(ctype_isnum(info))) {
-    if ((info & CTF_FP)) {
-      if (size == sizeof(double))
-	return IRT_NUM;
-      else if (size == sizeof(float))
-	return IRT_FLOAT;
-    } else {
-      uint32_t b = lj_fls(size);
-      if (b <= 3)
-	return IRT_I8 + 2*b + ((info & CTF_UNSIGNED) ? 1 : 0);
-    }
-  } else if (ctype_isptr(info)) {
-    return (LJ_64 && size == 8) ? IRT_P64 : IRT_P32;
-  } else if (ctype_iscomplex(info)) {
-    if (size == 2*sizeof(double))
-      return IRT_NUM;
-    else if (size == 2*sizeof(float))
-      return IRT_FLOAT;
-  }
-  return IRT_CDATA;
-}
-
 /* -- Optimized memory fill and copy -------------------------------------- */
 
 /* Maximum length and unroll of inlined copy/fill. */
@@ -1278,8 +1246,9 @@ static int crec_isnonzero(CType *s, void *p)
 static TRef crec_ct_ct(jit_State *J, CType *d, CType *s, TRef dp, TRef sp,
 		       void *svisnz)
 {
-  IRType dt = crec_ct2irt(ctype_ctsG(J2G(J)), d);
-  IRType st = crec_ct2irt(ctype_ctsG(J2G(J)), s);
+  CTState *cts = ctype_ctsG(J2G(J));
+  IRType dt = crec_ct2irt_snapshot(J, cts, d);
+  IRType st = crec_ct2irt_snapshot(J, cts, s);
   CTSize dsize = ctype_size_acq(d), ssize = ctype_size_acq(s);
   CTInfo dinfo = ctype_info_acq(d), sinfo = ctype_info_acq(s);
 

src/lj_ffrecord.c

@@ -687,8 +687,8 @@ static void LJ_FASTCALL recff_math_abs(jit_State *J, RecordFFData *rd)
 {
   TRef tr = lj_ir_tonum(J, J->base[0]);
 #ifdef LJ_XSAVE_TEST_HELPERS
-  /* Test-only dormant-path injection. Production recorders do not emit XSAVE
-  ** until the generic native-call protocol consumes its pending TG fields. */
+  /* Test-only math-path injection. Production generic native calls emit XSAVE
+  ** at their exact entry boundary and consume its pending TG fields there. */
   lj_ffrecord_xsave(J);
 #endif
   J->base[0] = emitir(IRTN(IR_ABS), tr, lj_ir_ksimd(J, LJ_KSIMD_ABS));

src/lj_mtfields.md

@@ -41,7 +41,7 @@ whenever a shared field is introduced or migrated.
 | GCtrace.native_pins | exact native-body admission + lease count | high `CLOSED` bit and low 31-bit count share one CAS acq_rel word; pin increments only while open under an independent body lease; retirement closes after the epoch LP and before slot disposition; final closed unpin publishes count zero before notifying reclaim and must not dereference the body afterward |
 | J->trace_pin_release_seq / J->{trace,mcode}_reclaim_pin_seq | final native-unpin notification + token-owned scan memos | final closed unpin increments by CAS acq_rel; reclaimers load acq before scanning; memo fields are mutated only with recorder token + exact reclaimer gate and are authoritative only when both completed epoch and release sequence match |
 | TG.ffi_native_seq | whole-stack generic FFI native-frame sequence | single owner publishes odd with release then a writer barrier before mutation; final even generation stores release; observers load the initial and final generation acquire and accept only the same even value; wrap poisons odd and fail-stops |
-| TG.ffi_native_depth / TG.ffi_native_frame[] payload | dormant generic FFI native-frame stack | depth and every remotely sampled payload word use atomic release/acquire access; a coherent snapshot additionally requires the enclosing same-even `ffi_native_seq`; offsets are opaque until a later certified stack scanner validates them |
+| TG.ffi_native_depth / TG.ffi_native_frame[] payload | production generic FFI native-frame stack | depth and every remotely sampled payload word use atomic release/acquire access; a coherent snapshot additionally requires the enclosing same-even `ffi_native_seq`; offsets are opaque until the certified stack scanner validates them |
 | g->gc2.ffi_native_scan_* | certified native-frame scanner telemetry | relaxed atomic increments; acquire stats snapshots; counters carry no root-scanning authority |
 | GCtrace.unused1 entry-gate bits | trace metadata flags | `TRACE_SCOPE_FLUSH_PENDING` and `TRACE_ENTRY_INVALIDATED` publish by byte CAS acq_rel and VM/C entry loads acq; invalidation gates entry only, while scoped pending authorizes dependency closure + `EXIT_TRACES` retirement; exittab ownership remains an independent relaxed bit |
 | g->vmevent_owner | VM-event callback owner TG id | one nonwaiting CAS acq_rel; exact-owner CAS release to zero |

src/lj_tg.h

@@ -153,8 +153,8 @@ struct TGState {
   LJTGRegistryKey registry_key;
   uint8_t registry_shadow_missed;  /* Legacy-only attach after slot OOM. */
 #if LJ_HASFFI
-  /* Keep the dormant generic frame substrate last so it cannot perturb any
-  ** existing VM/ABI-sensitive TG offset before generated entry code lands. */
+  /* Keep generic frame publication last so production CALLXS does not perturb
+  ** any existing VM/ABI-sensitive TG offset. */
   uint64_t ffi_native_seq;	/* Even stable, odd owner transition. */
   uint32_t ffi_native_depth;
   LJFFINativeFrame ffi_native_frame[LJ_FFI_NATIVE_FRAME_MAX];

tests/suites/m6_jit.lua

@@ -936,7 +936,7 @@ assert(threading.gcworkers(0) == 1)
 
   add({
     name = "m6_jit_xsave",
-    description = "dormant XSAVE snapshots retain materialized allocation roots",
+    description = "exact XSAVE snapshots retain materialized allocation roots",
     run = function(t)
       local flags = "-DLUA_USE_ASSERT -DLJ_XSAVE_TEST_HELPERS " ..
                     "-DLJ_GC2_TEST_HELPERS"

tests/suites/m7_ffi.lua

@@ -50,6 +50,8 @@ local function assert_generic_ccall_source(t)
   local recorder = read_all(files[1])
   assert(plain_count(recorder, "LJ_FFI_CALLXS_TEST_ACTIVATE") == 0,
          "generic CALLXS still has a test-only production gate")
+  assert(plain_count(recorder, "static IRType crec_ct2irt(") == 0,
+         "recorder retained a non-snapshot CType-to-IR conversion")
   assert(plain_count(recorder, "static TRef crec_call_args(") == 1,
          "generic C-call argument recorder is not unique")
   assert(plain_count(recorder, "IRT(IR_CALLXS, t)") == 1,

tests/t-ffi-native-frames.c

@@ -1,6 +1,6 @@
 /*
-** Deterministic structural tests for the dormant generic FFI native-frame
-** publisher. No test frame grants GC authority or enters native/JIT state.
+** Deterministic structural tests for the generic FFI native-frame publisher.
+** No synthetic test frame grants GC authority or enters native/JIT state.
 */
 
 #include <assert.h>

tests/t-jit-xsave.c

@@ -1,5 +1,5 @@
 /*
-** Focused dormant-path test for IR_XSAVE snapshot identity, allocation
+** Focused exact-path test for IR_XSAVE snapshot identity, allocation
 ** materialization and x64 TG-private root staging.
 */