ZJIT: Add side-exit attribution to HIR profiling

Side-exit code is emitted after the main function body but within the
same address range. Previously all side-exit samples were attributed to
the last HIR instruction (Return), inflating it to ~32%.

Add a synthetic "(side-exits)" line to the HIR source file and create
a debug entry for the side-exit code region. Also fix the aggregation
script to recognize side-exit lines and treat unmapped addresses as
side-exit code.

On lobsters, this reveals that 33% of JIT self-time is spent in
side-exit code (saving frame state and returning to interpreter).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: tekknolagi

tool/zjit_hir_aggregate.rb

@@ -102,7 +102,9 @@ def parse_hir_opcodes(path)
     # Extract opcode: "v42:Fixnum = FixnumAdd v28, v29" -> "FixnumAdd"
     # or "CheckInterrupts" -> "CheckInterrupts"
     # or "Return v33" -> "Return"
-    if stripped =~ /=\s+(\w+)/
+    if stripped =~ /^\(side-exits\)/
+      lines[lineno] = "(side-exits)"
+    elsif stripped =~ /=\s+(\w+)/
       lines[lineno] = $1
     elsif stripped =~ /^(\w+)/
       lines[lineno] = $1
@@ -237,7 +239,7 @@ def lookup_address(lookups, addr)
 
   entry = lookup_address(lookups, abs_addr)
   if entry
-    opcode = hir_opcodes[entry[:line]] || "unknown(line:#{entry[:line]})"
+    opcode = hir_opcodes[entry[:line]] || "(side-exits)"
     opcode_counts[opcode] += 1
     func_opcode_counts[entry[:func_name]][opcode] += 1
   else

zjit/src/codegen.rs

@@ -222,9 +222,11 @@ fn emit_jitdump_for_function(
     // the entry at the lower offset.
     let mut debug_entries: Vec<DebugEntry> = Vec::new();
     let mut seen_offsets: std::collections::HashSet<u64> = std::collections::HashSet::new();
+    let mut max_addr: u64 = start_addr;
     for &(code_ptr, insn_id) in pos_markers {
         if let Some(&line) = insn_id_to_line.get(&insn_id) {
             let addr = code_ptr.raw_addr(cb) as u64;
+            if addr > max_addr { max_addr = addr; }
             if seen_offsets.insert(addr) {
                 debug_entries.push(DebugEntry {
                     code_addr: addr,
@@ -235,6 +237,26 @@ fn emit_jitdump_for_function(
         }
     }
 
+    // The "(side-exits)" line in the HIR text is the last line.
+    // Add a debug entry for it so side-exit code isn't attributed to Return.
+    let side_exit_line = line_offset + hir_text.lines().count() as u32;
+    // Find where side-exit code likely starts: scan forward from the last marker
+    // to find the next instruction boundary (approximation: last marker + some offset)
+    let end_addr = start_addr + code_size as u64;
+    if max_addr + 32 < end_addr {
+        // There's significant code after the last HIR instruction — likely side exits
+        // Use the address 4 bytes after the last marker as a conservative start
+        // (the Return instruction itself is ~20 bytes of code)
+        let side_exit_start = max_addr + 24; // past Return's ~5 arm64 instructions
+        if side_exit_start < end_addr {
+            debug_entries.push(DebugEntry {
+                code_addr: side_exit_start,
+                line: side_exit_line,
+                filename: hir_file_path,
+            });
+        }
+    }
+
     // Write DEBUG_INFO before CODE_LOAD — samply expects this ordering
     if let Err(e) = jitdump.write_debug_info(start_addr, &debug_entries) {
         debug!("Failed to write jitdump debug info: {e}");
@@ -314,6 +336,9 @@ fn format_hir_for_jitdump(function: &Function) -> (String, std::collections::Has
         }
     }
 
+    // Synthetic line for side-exit code attribution
+    writeln!(text, "  (side-exits)").unwrap();
+
     (text, insn_id_to_line)
 }