ffi: harden indirect CALLXS result storage

Author: Frityet

notes/ffi-callxs-indirect-aggregate-results-2026-07-18.md

@@ -93,6 +93,18 @@ operand. The backend therefore uses `lj_cdata_newv()` and returns an interior
 GCcdata header whose payload satisfies the declared alignment. Ordinary
 aggregates retain the cheaper fixed allocation path.
 
+The interpreter now uses the same combined result info when it preallocates
+aggregate or complex return storage. Previously it retained the declared CType
+ID but called the ordinary allocator, so a cold over-aligned sret call could
+hand native code an under-aligned result buffer. This is a common FFI
+correctness fix rather than a JIT-only semantic change.
+
+Non-aggregate boxed results deliberately remain different: the interpreter
+strips outer attributes from integer, pointer, and enum results before boxing.
+CALLXS therefore allocates those results with the resolved raw CType ID too.
+Keeping the declared ID for every rooted result would make interpreter and JIT
+`ffi.typeof()` disagree and could claim alignment the fixed box did not have.
+
 ## Compatibility and cost
 
 Lua receives the same by-value cdata type and field bytes as the interpreter.
@@ -114,10 +126,13 @@ unchanged.
 The authentic fixture exports two unrelated 24-byte struct result types with
 different field layouts and scalar argument mixtures, plus an exact 24-byte,
 32-byte-aligned result which forces the interior aligned-cdata allocation
-path. Tests require exact CType identity, size/alignment, every field value,
-exact native effect counts, and production `XSAVE`/`CALLXS` IR for all three
-functions. Separate ignored, excess-fixed, open, CALLM, CALLT, and CALLMT cases
-cover the admitted caller/result modes.
+path. A zero-public-argument result proves the hidden pointer can be the whole
+argument tree, a union proves the admission is not struct-tag-specific, and an
+eight-GPR input forces public arguments onto the stack after the hidden ABI
+slot. Tests require exact CType identity, size/alignment, every field value,
+exact native effect counts, and production `XSAVE`/`CALLXS` IR. Separate
+ignored, excess-fixed, open, CALLM, CALLT, and CALLMT cases cover the admitted
+caller/result modes.
 
 The C IR inspector distinguishes scalar boxed results (one raw `XSTORE`) from
 indirect aggregate results (`IRT_NIL`, no `XSTORE`, and exactly one payload
@@ -127,6 +142,11 @@ the returned payload address modulo 32. Forced POSTCALL, deliberate entry
 rejection, and fresh STOPREQ cases verify exact restoration, no completed-call
 replay, and empty native-frame/trace-pin state.
 
+A blocked generated sret call is also held ACTIVE while a remote thread
+completes a full GC and global `jit.flush()`. The result box is reachable only
+through the certified native frame during that interval; exact counters remain
+at eight before release and prove the completed call is never replayed.
+
 Focused validation passed the complete production CALLXS lifecycle suite, the
 full generic scalar/boxed ABI matrix, target-runtime Clang ASan, the documented
 Clang UBSan profile, and clean default, `LUAJIT_DISABLE_JIT`, and

notes/ffi-callxs-rooted-boxed-admission-2026-07-18.md

@@ -9,19 +9,21 @@ activation gate: these result classes use the same ABI-driven argument
 recorder, native-frame lifecycle, and CALLXS emission as the unboxed scalar
 classes.
 
-Bool remains interpreted because normalization still needs a replay-safe
-post-side-effect contract. Aggregate and multi-register results remain future
-work. No file under `plan/` was changed.
+At this checkpoint bool remained interpreted and aggregate results remained
+future work. Subsequent same-day tranches admitted replay-safe bool and
+ABI-indirect aggregate results; this note is retained as the historical boxed
+admission checkpoint. No file under `plan/` was changed.
 
 ## Recorder protocol
 
 The recorder captures the exact raw child CType ID, immutable return info,
 size, and raw IR type before recording arguments. This is necessary because
 vararg inference may grow and relocate the CType table. Raw-child lookup strips
-attributes exactly as the interpreter does, while preserving reference and enum
-identity. Consequently attributed integer typedefs, explicit C references, and
-enum results retain the correct box type without consulting a stale CType
-pointer.
+outer attributes exactly as the interpreter does, while preserving reference
+and enum identity. Consequently attributed integer, pointer, and enum
+declarations produce the same raw box CType as a cold call; explicit C
+references remain references because `CTF_REF` is not an outer attribute node.
+No classification consults a stale CType pointer.
 
 After all argument guards and conversions, a boxed result follows this order:
 
@@ -56,12 +58,13 @@ managed-edge aggregates without a write-barrier design.
 
 ## Compatibility and cost
 
-The public LuaJIT API and ABI are unchanged. The interpreter-visible values
-keep their exact CType identity, including reference and attributed return
-types. The generated path allocates the result box immediately before the
-foreign call instead of immediately after it; this enables safe rooting without
-adding a signature-specific wrapper or a post-return allocation. The only
-post-return addition is the raw payload store.
+The public LuaJIT API and ABI are unchanged. Generated values keep the
+interpreter's exact resolved CType identity: outer scalar/pointer/enum
+attributes are stripped, enums retain their enum node, and references retain
+their reference node. The generated path allocates the result box immediately
+before the foreign call instead of immediately after it; this enables safe
+rooting without adding a signature-specific wrapper or a post-return
+allocation. The only post-return addition is the raw payload store.
 
 As previously authorized for the beta line, custom `lua_Alloc` remains
 temporarily ignored by the GC2/internal allocator policy. This admission uses
@@ -72,8 +75,9 @@ silently treated as complete.
 ## Evidence
 
 - The authentic Lua fixture mechanically requires CALLXS for pointer,
-  reference, enum, i64, u64, high-bit u64, and an attributed u64 typedef; bool
-  mechanically remains interpreted.
+  reference, enum, i64, u64, high-bit u64, and attributed integer/pointer/enum
+  declarations. JIT-disabled baselines require exact `ffi.typeof()` and
+  `ffi.alignof()` equality after outer attributes are stripped.
 - The generated ABI catalogue requires the generic path for all 320 admitted
   rows: 211 unboxed scalar rows and 109 newly admitted boxed rows.
 - IR inspection proves one exact `IR_CNEW` root, inclusion only in the XSAVE
@@ -99,12 +103,13 @@ silently treated as complete.
 Clean default, `LUAJIT_DISABLE_JIT`, and `LUAJIT_DISABLE_FFI` builds and runtime
 smokes pass independently of the sanitizer builds.
 
-## Next work
+## Next work at this checkpoint
 
-The immediate FFI/JIT follow-ups are replay-safe bool results, broader
-protected/continuation and root/tail trace shapes, and aggregate or
-multi-register ABI results. These remain generic ABI-lowering problems; they
-must not reintroduce explicit C-signature matching. Cross-platform deep
-validation and performance work remain b1.2.1 tasks, with the temporary custom
-allocator exception and the separate Lua `atomic` library scheduled after the
-core correctness tranches.
+Replay-safe bool and ABI-indirect aggregate results were the immediate
+follow-ups and are now covered by their later notes. Broader
+protected/continuation and root/tail trace shapes, direct/multi-register
+aggregate ABI results, cross-platform deep validation, and performance work
+remain b1.2.1 tasks. They must remain generic ABI-lowering work and must not
+reintroduce explicit C-signature matching. The temporary custom allocator
+exception and separate Lua `atomic` library remain scheduled after the core
+correctness tranches.

src/lj_ccall.c

@@ -1135,6 +1135,8 @@ static int ccall_set_args(lua_State *L, CTState *cts, CType *ct,
   CTypeID fid;
   CTInfo info = ctype_info_acq(ct);  /* Vararg inference may invalidate ct. */
   CType ctrsnap, *ctr;
+  CTInfo result_info;
+  CTSize result_size;
   MSize maxgpr, ngpr = 0, nsp = 0, narg;
 #if CCALL_NARG_FPR
   MSize nfpr = 0;
@@ -1162,17 +1164,21 @@ static int ccall_set_args(lua_State *L, CTState *cts, CType *ct,
 #endif
 
   /* Perform required setup for some result types. */
-  ctr = ccall_rawchild_wait(L, cts, ct, NULL, &ctrsnap);
+  if (lj_ctype_info_wait(L, cts, ctype_cid(info), &result_info,
+			 &result_size, NULL, &ctrsnap) <= 0)
+    lj_err_caller(L, LJ_ERR_FFI_INVTYPE);
+  ctr = &ctrsnap;
   {
     CTInfo rinfo = ctype_info_acq(ctr);
-    CTSize rsize = ctype_size_acq(ctr);
+    CTSize rsize = result_size;
     if (ctype_isvector(rinfo)) {
       if (!(CCALL_VECTOR_REG && (rsize == 8 || rsize == 16)))
 	goto err_nyi;
     } else if (ctype_iscomplex(rinfo) || ctype_isstruct(rinfo)) {
       /* Preallocate cdata object and anchor it after arguments. */
       CTSize sz = rsize;
-      GCcdata *cd = lj_cdata_new_l(L, cts, ctype_cid(info), sz);
+      GCcdata *cd = lj_cdata_newx_l(L, cts, ctype_cid(info), sz,
+				     result_info);
       void *dp = cdataptr(cd);
       ccall_push_cdata_root(L, cd);
       *has_result_root = 1;

src/lj_crecord.c

@@ -2364,7 +2364,7 @@ static int crec_call(jit_State *J, RecordFFData *rd, GCcdata *cd)
     TRef args, entered, func, callfunc, tr, result_box, result_payload;
     CType ctrsnap;
     CType *ctr;
-    CTypeID result_id;
+    CTypeID result_id, raw_result_id, result_box_id;
     CTInfo ctr_info, result_info;
     CTSize result_size;
     MSize nargs;
@@ -2391,22 +2391,25 @@ static int crec_call(jit_State *J, RecordFFData *rd, GCcdata *cd)
     }
 
     func = emitir(IRT(IR_FLOAD, tp), J->base[0], IRFL_CDATA_PTR);
-    /* Preserve the declared return CType ID on the cdata, exactly like the
-    ** interpreter. Classification uses the resolved raw child snapshot. */
+    /* Aggregates retain the declared return CType ID because the interpreter
+    ** preallocates their storage from the function child. Scalar, pointer and
+    ** enum conversion strips outer attributes, so their boxes must use the raw
+    ** ID to remain exactly interpreter-compatible. */
     result_id = ctype_cid(info);
     /* Resolve the declared result once, retaining both the raw layout child
     ** and the accumulated attributes. In particular, an outer CTA_ALIGN must
     ** survive resolution so CNEW selects lj_cdata_newv before its payload
     ** is exposed as the ABI sret pointer. */
     if (!crec_direct_ctype_info(J, cts, result_id, &result_info, &result_size,
-				NULL, &ctrsnap))
+				&raw_result_id, &ctrsnap))
       lj_trace_err(J, LJ_TRERR_BADTYPE);
     ctr = &ctrsnap;
     ctr_info = ctype_info_acq(ctr);
     /* Enum children live in the relocatable CType table too. Even rejected
     ** result classes must use the recorder's snapshot/retry reader contract. */
     t = crec_ct2irt_snapshot(J, cts, ctr);
     indirect_result = crec_call_indirect_struct_result(ctr_info, result_size);
+    result_box_id = indirect_result ? result_id : raw_result_id;
     if (ctype_isvoid(ctr_info)) {
       t = IRT_NIL;
       rd->nres = 0;
@@ -2456,7 +2459,7 @@ static int crec_call(jit_State *J, RecordFFData *rd, GCcdata *cd)
       /* Over-aligned sret storage must take the CNEW/newv path. The returned
       ** GCcdata is an interior aligned header, so payload is still cd+1. */
       result_box = emitir(IRTG(IR_CNEW, IRT_CDATA),
-			  lj_ir_kint(J, result_id),
+			  lj_ir_kint(J, result_box_id),
 			  indirect_result &&
 			    ctype_align(result_info) > CT_MEMALIGN ?
 			    lj_ir_kint(J, result_size) : TREF_NIL);

tests/t-ffi-callxs-authentic-lib.c

@@ -10,6 +10,9 @@ static int32_t lj_callxs_auth_reference_value = 0x345678;
 static uint32_t lj_callxs_auth_aggregate_alpha_counter;
 static uint32_t lj_callxs_auth_aggregate_beta_counter;
 static uint32_t lj_callxs_auth_aggregate_aligned_counter;
+static uint32_t lj_callxs_auth_aggregate_zero_counter;
+static uint32_t lj_callxs_auth_aggregate_union_counter;
+static uint32_t lj_callxs_auth_aggregate_wide_counter;
 
 /* These deliberately unrelated 24-byte return types both use the fixed-size
 ** aggregate sret ABI on the supported x64 targets. Their distinct field
@@ -33,6 +36,15 @@ typedef struct {
   uint64_t lane[3];
 } lj_callxs_auth_aggregate_aligned __attribute__((aligned(32)));
 
+union lj_callxs_auth_aggregate_union {
+  uint64_t lane[3];
+  struct {
+    int64_t signed_lane;
+    double ratio;
+    uint64_t token;
+  } fields;
+};
+
 typedef char lj_callxs_auth_aggregate_alpha_size[
   sizeof(struct lj_callxs_auth_aggregate_alpha) == 24 ? 1 : -1];
 typedef char lj_callxs_auth_aggregate_beta_size[
@@ -41,6 +53,8 @@ typedef char lj_callxs_auth_aggregate_aligned_size[
   sizeof(lj_callxs_auth_aggregate_aligned) == 24 ? 1 : -1];
 typedef char lj_callxs_auth_aggregate_aligned_align[
   __alignof__(lj_callxs_auth_aggregate_aligned) == 32 ? 1 : -1];
+typedef char lj_callxs_auth_aggregate_union_size[
+  sizeof(union lj_callxs_auth_aggregate_union) == 24 ? 1 : -1];
 
 int32_t lj_callxs_auth_add(int32_t a, int32_t b)
 {
@@ -124,6 +138,11 @@ int32_t *lj_callxs_auth_ptr(int32_t *p)
   return p;
 }
 
+int32_t *lj_callxs_auth_attributed_ptr_result(int32_t *p)
+{
+  return p;
+}
+
 _Bool lj_callxs_auth_bool(int32_t value)
 {
   lj_callxs_auth_counter++;
@@ -157,6 +176,13 @@ enum lj_callxs_auth_enum lj_callxs_auth_enum_result(int32_t value)
   return LJ_CALLXS_AUTH_ENUM_SEVEN;
 }
 
+enum lj_callxs_auth_enum
+lj_callxs_auth_attributed_enum_result(int32_t value)
+{
+  (void)value;
+  return LJ_CALLXS_AUTH_ENUM_SEVEN;
+}
+
 int64_t lj_callxs_auth_i64_result(int32_t value)
 {
   (void)value;
@@ -221,11 +247,55 @@ lj_callxs_auth_aggregate_aligned_result(uint64_t seed)
   return result;
 }
 
+struct lj_callxs_auth_aggregate_alpha
+lj_callxs_auth_aggregate_zero_result(void)
+{
+  struct lj_callxs_auth_aggregate_alpha result;
+  lj_callxs_auth_counter++;
+  lj_callxs_auth_aggregate_zero_counter++;
+  result.cookie = UINT64_C(0x0102030405060708);
+  result.weight = 6.25;
+  result.code = INT32_C(-90210);
+  result.stamp = UINT32_C(0xc001d00d);
+  return result;
+}
+
+union lj_callxs_auth_aggregate_union
+lj_callxs_auth_aggregate_union_result(uint64_t seed)
+{
+  union lj_callxs_auth_aggregate_union result;
+  lj_callxs_auth_counter++;
+  lj_callxs_auth_aggregate_union_counter++;
+  result.lane[0] = UINT64_C(0x8899aabbccdd0000) + seed;
+  result.lane[1] = UINT64_C(0x3ff4000000000000);
+  result.lane[2] = UINT64_C(0x1020304050600000) + seed;
+  return result;
+}
+
+struct lj_callxs_auth_aggregate_beta
+lj_callxs_auth_aggregate_wide_result(uint64_t a, uint64_t b, uint64_t c,
+				     uint64_t d, uint64_t e, uint64_t f,
+				     uint64_t g, uint64_t h)
+{
+  struct lj_callxs_auth_aggregate_beta result;
+  uint64_t sum = a + b + c + d + e + f + g + h;
+  lj_callxs_auth_counter++;
+  lj_callxs_auth_aggregate_wide_counter++;
+  result.debt = -(int64_t)sum;
+  result.stamp = UINT32_C(0x600d0000) + (uint32_t)sum;
+  result.ratio = (float)sum * 0.25f;
+  result.token = UINT64_C(0xabcdef0000000000) + sum;
+  return result;
+}
+
 void lj_callxs_auth_aggregate_reset(void)
 {
   lj_callxs_auth_aggregate_alpha_counter = 0;
   lj_callxs_auth_aggregate_beta_counter = 0;
   lj_callxs_auth_aggregate_aligned_counter = 0;
+  lj_callxs_auth_aggregate_zero_counter = 0;
+  lj_callxs_auth_aggregate_union_counter = 0;
+  lj_callxs_auth_aggregate_wide_counter = 0;
 }
 
 uint32_t lj_callxs_auth_aggregate_alpha_count(void)
@@ -243,6 +313,21 @@ uint32_t lj_callxs_auth_aggregate_aligned_count(void)
   return lj_callxs_auth_aggregate_aligned_counter;
 }
 
+uint32_t lj_callxs_auth_aggregate_zero_count(void)
+{
+  return lj_callxs_auth_aggregate_zero_counter;
+}
+
+uint32_t lj_callxs_auth_aggregate_union_count(void)
+{
+  return lj_callxs_auth_aggregate_union_counter;
+}
+
+uint32_t lj_callxs_auth_aggregate_wide_count(void)
+{
+  return lj_callxs_auth_aggregate_wide_counter;
+}
+
 void lj_callxs_auth_reset(void)
 {
   lj_callxs_auth_counter = 0;