feat(reg-vm,vm-jit): J0.1 heap-aware deopt reg reconstruction (fixes B2)

The deopt state map now distinguishes reconstructible scalars from heap refs,
so precise deopt restores reassigned SCALAR params without corrupting
heap/flat-pointer params.

- vm-jit `decode_deopt_live`: reconstruct only `Int`/`Float` regs; skip
  `Handle`/`FlatInt`/`FlatFloat` (heap table index / borrow-pinned buffer
  pointer). The interpreter frame already holds those heap VmValues -- precise
  resume implies no heap writes -- so they must not be decoded as raw scalars.
  Exhaustive match (a new JitValueType must choose a side).
- reg-vm `restore_native_deopt_live_regs`: drop the `< n_params` guard (and the
  now-unused `n_params` arg, updating 3 call sites). Every reg in `live` is now
  a true scalar, so a reassigned scalar param is safe to restore.
- Un-#[ignore] `precise_deopt_restores_reassigned_scalar_param` (B2 repro); it
  now passes. Update the vm-jit `force_bail_at_every_safepoint_captures_correct_state`
  test to the scalar-only-capture contract (heap/flat regs intentionally absent).

Root cause of the earlier failed attempt: it skipped only `Handle`, leaving
`FlatInt`/`FlatFloat` to decode as garbage scalars and corrupt flat-buffer
params. `JitValueType` already carries the flat distinction, so the fix is to
skip all three non-scalar kinds.

Verification (dev container): deopt-stress 9/0, differential 33/0 (incl.
native_heap_reads / native_float_heap_reads / tv2_direct_flat_reads),
jit_acceptance 83/0, rsscript lib 276/0, vm-jit 81/0, default workspace build OK.

Remaining for full J0.1: inlined logical-frame-chain state-map format,
heap-payload-variant / live-out value reconstruction, precise-resume-default-on.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: olwang

crates/rsscript/src/reg_vm/tests.rs

@@ -5637,21 +5637,18 @@ fn main() -> Unit {
         );
     }
 
-    /// B2 (KNOWN GAP — blocked on J0.1 heap-aware deopt state maps; precise resume is
-    /// default-OFF so this is latent, not a production bug): the reg VM binds params as
+    /// B2 (FIXED by J0.1 heap-aware deopt state maps): the reg VM binds params as
     /// locals, so `n = n + 1` rewrites the param register. A native scalar function
-    /// that REASSIGNS a param still live at a safepoint should, on precise deopt,
-    /// restore the param to its native-computed value — but the restore skips every
-    /// `reg < n_params`, resuming with the stale call-time value. The skip is required
-    /// because a heap/flat param (`Handle`/`FlatInt`/…) is marshalled as a raw `i64`
-    /// and is INDISTINGUISHABLE from a scalar `Int` in the deopt payload
-    /// (`JitValueType` loses the `NativeTy` flat/handle distinction); dropping the skip
-    /// corrupts flat-buffer params (proven: it broke `native_heap_reads` /
-    /// `tv2_direct_flat_reads` differential parity). A sound fix must thread the
-    /// scalar-vs-heap param kind into the deopt state map (J0.1). Ignored until then.
-    #[cfg(feature = "native-jit")]
-    #[test]
-    #[ignore = "B2: needs J0.1 NativeTy-aware deopt state maps; precise resume is default-off (latent)"]
+    /// that REASSIGNS a param still live at a safepoint must, on precise deopt, restore
+    /// the param to its native-computed value. The deopt state map distinguishes
+    /// reconstructible scalars (`Int`/`Float`) from heap refs (`Handle`/`FlatInt`/
+    /// `FlatFloat`): `decode_deopt_live` drops the latter (the frame already holds
+    /// their `VmValue`), so `restore_native_deopt_live_regs` can restore ALL scalar
+    /// regs — params included — without the old `< n_params` skip that lost reassigned
+    /// scalar params. (Skipping only `Handle` and not `FlatInt`/`FlatFloat` corrupts
+    /// flat-buffer params — see `native_heap_reads`/`tv2_direct_flat_reads`.)
+    #[cfg(feature = "native-jit")]
+    #[test]
     fn precise_deopt_restores_reassigned_scalar_param() {
         let big: i64 = 4_000_000_000;
         // reg 0 = param x (runtime `big`); reg 0 = x + 1 (REASSIGN, live past the

crates/rsscript/src/reg_vm/tier.rs

@@ -736,23 +736,14 @@ impl RegVm {
     }
 
     #[cfg(feature = "native-jit")]
-    fn restore_native_deopt_live_regs(
-        &mut self,
-        base: usize,
-        n_params: usize,
-        n_regs: usize,
-        live: &[vm_jit::DeoptReg],
-    ) {
+    fn restore_native_deopt_live_regs(&mut self, base: usize, n_regs: usize, live: &[vm_jit::DeoptReg]) {
         for vm_jit::DeoptReg { reg, value } in live {
-            // Params are skipped: a heap/flat param (`Handle`/`FlatInt`/…) is
-            // marshalled as a raw `i64` handle/pointer and is INDISTINGUISHABLE from a
-            // scalar `Int` at this (`JitValueType`) boundary, so writing it back would
-            // corrupt the interpreter frame's heap value. The cost is that a
-            // reassigned *scalar* param resumes with its stale call-time value (see
-            // `precise_deopt_restores_reassigned_scalar_param`, #[ignore]); fixing that
-            // soundly needs `NativeTy`-aware deopt state maps (J0.1), which carry the
-            // scalar-vs-heap param distinction the payload currently loses.
-            if (*reg as usize) < n_params || (*reg as usize) >= n_regs {
+            // Heap-aware deopt (J0.1): every entry in `live` is a TRUE scalar —
+            // `decode_deopt_live` drops `Handle`/`FlatInt`/`FlatFloat` regs — so a
+            // reassigned SCALAR param is safe to restore (no `< n_params` guard).
+            // Heap / flat-pointer params never reach here, so the interpreter frame
+            // keeps its own heap value.
+            if (*reg as usize) >= n_regs {
                 continue;
             }
             let vm_value = match value {
@@ -802,7 +793,7 @@ impl RegVm {
             let value = self.reg(caller_base + *reg).clone();
             self.set_reg(child_base + index, value);
         }
-        self.restore_native_deopt_live_regs(child_base, callee.params, callee.regs, &child.live);
+        self.restore_native_deopt_live_regs(child_base, callee.regs, &child.live);
 
         let Some(caller_frame) = self.frames.last_mut() else {
             return false;
@@ -839,7 +830,7 @@ impl RegVm {
     ) -> bool {
         let original_len = self.frames.len();
         let original_ip = self.frames.last().map(|frame| frame.ip).unwrap_or_default();
-        self.restore_native_deopt_live_regs(base, func.params, func.regs, live);
+        self.restore_native_deopt_live_regs(base, func.regs, live);
         let resumed = self.push_native_child_deopt_frame(unit, func, base, resume_ip, child);
         if !resumed {
             self.frames.truncate(original_len);
@@ -1412,7 +1403,7 @@ impl RegVm {
                         // SKIPPING parameter registers: their window slots
                         // `base..base+n_params` are already valid and may hold heap
                         // `VmValue`s the scalar deopt payload cannot represent.
-                        self.restore_native_deopt_live_regs(base, func.params, func.regs, &live);
+                        self.restore_native_deopt_live_regs(base, func.regs, &live);
                         // Resume interpretation AT the bailing instruction.
                         self.frames.last_mut().expect("active frame").ip = resume_ip as usize;
                         scratch.restore(self.native.as_mut());

crates/vm-jit/src/lib.rs

@@ -2013,13 +2013,22 @@ impl NativeModule {
         site.live
             .iter()
             .filter_map(|&(reg, ty)| {
-                payload.get(payload_base + reg as usize).map(|&bits| {
-                    let value = match ty {
-                        JitValueType::Float => DeoptValue::Float(f64::from_bits(bits as u64)),
-                        _ => DeoptValue::Int(bits),
-                    };
-                    DeoptReg { reg, value }
-                })
+                let &bits = payload.get(payload_base + reg as usize)?;
+                // Heap-aware deopt (J0.1): only a TRUE scalar (`Int`/`Float`) reg is
+                // reconstructible as a deopt value. A non-scalar reg — a `Handle` (heap
+                // table index) or a `FlatInt`/`FlatFloat` (raw borrow-pinned buffer
+                // pointer) — carries no scalar payload; the interpreter frame already
+                // holds its heap `VmValue` (precise resume implies no heap writes), so
+                // it MUST NOT be decoded as a raw `Int`/`Float` and written back.
+                // Exhaustive on purpose: a new `JitValueType` must choose a side here.
+                let value = match ty {
+                    JitValueType::Int => DeoptValue::Int(bits),
+                    JitValueType::Float => DeoptValue::Float(f64::from_bits(bits as u64)),
+                    JitValueType::Handle | JitValueType::FlatInt | JitValueType::FlatFloat => {
+                        return None;
+                    }
+                };
+                Some(DeoptReg { reg, value })
             })
             .collect()
     }
@@ -7649,39 +7658,51 @@ mod tests {
                     }
                 };
 
-                // The captured live registers must be exactly the map's live set...
+                // Heap-aware deopt (J0.1): the captured live set is exactly the SCALAR
+                // (`Int`/`Float`) subset of the map's live set — `Handle`/`FlatInt`/
+                // `FlatFloat` regs are reconstructed from the interpreter frame, not the
+                // payload, so they are intentionally absent from the capture.
                 let mut captured: Vec<u32> = live.iter().map(|r| r.reg).collect();
                 captured.sort_unstable();
-                let mut expected_regs: Vec<u32> = site.live.iter().map(|(r, _)| *r).collect();
+                let mut expected_regs: Vec<u32> = site
+                    .live
+                    .iter()
+                    .filter(|(_, ty)| matches!(ty, JitValueType::Int | JitValueType::Float))
+                    .map(|(r, _)| *r)
+                    .collect();
                 expected_regs.sort_unstable();
                 assert_eq!(
                     captured, expected_regs,
-                    "{}: site {} live-reg set mismatch (map vs capture)",
+                    "{}: site {} scalar live-reg set mismatch (map vs capture)",
                     case.name, k
                 );
 
-                // ...and each captured value must match what the function computes,
-                // including FlatInt pointer registers (checked as the raw arg word).
-                for &(reg, _ty) in &site.live {
-                    let got = live_value(&out, reg).expect("captured reg present");
-                    if case.func.reg_types[reg as usize] == FlatInt {
-                        assert_eq!(
-                            got,
-                            DeoptValue::Int(case.args[reg as usize]),
-                            "{}: site {} reg {} (flat ptr) value mismatch",
-                            case.name,
-                            k,
-                            reg
-                        );
-                    } else {
-                        assert_eq!(
-                            got,
-                            (case.expect)(reg),
-                            "{}: site {} reg {} value mismatch",
-                            case.name,
-                            k,
-                            reg
-                        );
+                // ...each captured SCALAR value must match what the function computes;
+                // a non-scalar (Handle/FlatInt/FlatFloat) reg is NOT reconstructed and
+                // must be absent from the capture.
+                for &(reg, ty) in &site.live {
+                    match ty {
+                        JitValueType::Int | JitValueType::Float => {
+                            let got =
+                                live_value(&out, reg).expect("captured scalar reg present");
+                            assert_eq!(
+                                got,
+                                (case.expect)(reg),
+                                "{}: site {} reg {} value mismatch",
+                                case.name,
+                                k,
+                                reg
+                            );
+                        }
+                        JitValueType::Handle | JitValueType::FlatInt | JitValueType::FlatFloat => {
+                            assert!(
+                                live_value(&out, reg).is_none(),
+                                "{}: site {} reg {} (non-scalar) must not be reconstructed",
+                                case.name,
+                                k,
+                                reg
+                            );
+                        }
                     }
                 }
 

docs/planning/vm-optimizing-jit-plan.md

@@ -37,6 +37,7 @@ numeric-mode language decision). Owner: TBD. Created 2026-06-20; status updated
 | Item | State | Notes |
 |---|---|---|
 | **J0.0–J0.3** precise-deopt spine | **shipped (leaf/scalar subset)** | `NativeOutcome::Deopt` + per-site safepoint ids + live-reg capture + state-map + precise resume + every-safepoint stress test. **Precise resume is default-OFF** (gated by `RSS_JIT_PRECISE_DEOPT` / a test entrypoint); production still re-runs from the function top (byte-identical for the side-effect-free subset). The state-map is `resume_ip + live registers` — **not** yet the full inlined logical-frame-chain format J0.1 describes. So: done for the current leaf/scalar subset; full inlined-frame / side-effecting deopt is still **future**. |
+| **J0.1 (heap-aware reg reconstruction)** | **shipped (slice)** | The deopt state map now distinguishes reconstructible scalars (`Int`/`Float`) from heap refs (`Handle`/`FlatInt`/`FlatFloat`): `decode_deopt_live` reconstructs only scalar regs (the interpreter frame already holds heap values — precise resume implies no heap writes), and `restore_native_deopt_live_regs` restores ALL scalar regs incl. **reassigned scalar params** (the `< n_params` skip is gone). Fixes the reassigned-scalar-param resume bug (`precise_deopt_restores_reassigned_scalar_param`); flat-buffer params stay uncorrupted. **Remaining for full J0.1:** inlined logical-frame-chain state-map format, heap-payload-variant / live-out *value* reconstruction (native-built heap values across a bail), and enabling precise resume by default. |
 | **J0.4** heap writes + deopt-after-write | **future** | blocked on native heap-write codegen; the native subset is read-only today. |
 | **J0.5** in-generated-code `VmLimits` accounting | **future** | currently the Model-A fallback (see J6); the `VmLimitsSnapshot` tick/poll machinery is not built. |
 | **J1** profiling | **shipped** | per-call-site type feedback on dynamic sites, warm-gated, no interpreter regression. (Branch profiling **not** shipped — it regressed `bool_logic_loop` ~7%; needs a hot/cold dispatch split.) |