gc: a collect carrier keeps interpreter mode under JIT and AOT

[aleksisch]

The bug

The collector reads a local from the daslang frame at SP + lv->stackTop (simulate_gc.cpp:1057), driven by FuncInfo::locals[]. A compiled frame keeps its locals somewhere else — LLVM allocas under the JIT, C++ natives under AOT — and nothing ever writes those slots. So heap_collect reached from compiled code sweeps live objects.

Reproduced on master, same program, only the backend differs:

options gc
options persistent_heap

struct Node { x : int }

def do_collect { unsafe(heap_collect(true, false)) }

def worker : int {
    var n = new Node(x = 7)
    do_collect()
    var churn : array<Node?>
    for (i in range(64)) { churn |> push(new Node(x = -1)) }
    return n.x
}

	result
interpreter	worker=7
-jit, before	worker=-1
-jit, after	worker=7

-1 is the churn value read back out of the reused slot. This is the signature recorded in 93cfca0 ("interp prints n.x=7, jit prints n.x=-1"), where a later delete double-freed and tripped the Debug memory_model.h assert while Release passed by luck.

The fix

Function::needCallerStackFrame is already the transitive closure over direct calls seeded on heap_collect (ast_unused.cpp:586-595, seed at module_builtin_runtime.cpp:2505), and the interpreter already denies those functions fastcall for exactly this reason — a frameless carrier breaks the same walk. Both compiled back-ends now decline them as well:

• JIT — make_jit_plan routes a carrier to plan.disabled, beside [no_jit]
• AOT — NoAotMarker marks it noAot

Declined functions interpret at load, which is what Program::linkCppAot already does for every noAot function. One LOG_WARNING per run carries the count; LOG_INFO names each function.

-exe and -lib refuse instead. A standalone binary has no interpreter to fall back to — every used function must be compiled, which is why collect_standalone_functions already errors on [no_jit]. Declining a carrier there would have left it out of codegen with nothing to run, so the decline is scoped to the JIT and AOT-object paths and the exe path reports a carrier the same way it reports [no_jit]. plan.exe_strict is always true, so the build stops:

LLVM EXE: function 'worker' can reach heap_collect, whose locals a compiled frame
does not expose as GC roots; there is no interpreter here to fall back to
Cannot build standalone exe: some functions are no_jit in strict mode

exit 1, no binary. An ordinary -exe still builds and runs.

AOT half, same probe:

before: worker emitted as C++ (8 references in the generated file)
after : 0 — the carrier is excluded and interprets

What this does not fix

tests/gc keeps its -jit and --use-aot skip. The folder is still red for two reasons outside this change:

• the JIT implements neither force_escape_free nor force_allocate_on_stack — test_gc_escape_free_frees reads 5997000 where 0 is expected, and scope-exit free aborts with deleting ..., which is not a chunk pointer
• the test_stackwalk_* cells drive a CollectingWalker rather than heap_collect, so they are not carriers, stay jitted, and their locals are not where the walk looks — same root cause, different seed

Please do not read this as "gc is JIT-safe now". It closes the heap_collect entry point only.

Notes

• No LLVM_JIT_CODEGEN_VERSION bump. The DLL name folds plan.candidates (jit_dll_basename), and probe_dll counts a cached DLL holding a now-disabled function as a mismatch, so the cache self-invalidates twice over.
• Blast radius is narrow. needCallerStackFrame is only ever set from heap_collect and dasLiveHost's two collect entries, so a program that never references a collect is untouched.
• Residual, unchanged from the interpreter. The closure does not cross invoke edges and under-reports on recursive cycles (both stated in the code comment at ast_unused.cpp:588-590). A collect reached only through a block, lambda or function pointer is still caught at runtime by the refusal pre-scan (simulate_gc.cpp:960-978), same as today. contexts.rst:141-145 documents it.

Testing

• JIT before/after probe above, on a local -DDAS_LLVM_DISABLED=OFF build (LLVM 18.1.3). The negative control reverts only llvm_jit_plan.das — it is read at runtime, so no rebuild is needed to flip it.
• AOT before/after via daslang -aot, same probe.
• daslib/aot_cpp.das lints clean. llvm_jit_plan.das format-verifies; it cannot be linted standalone (missing LLVM prerequisite outside a JIT build).
• -exe: the probe is refused with the message above, exit 1, no binary; a hello-world -exe still builds and prints.
• Full --test tests suite on the interpreter: 14530 tests, 14514 passed, 0 failed, 0 errors, 16 skipped.

🤖 Generated with Claude Code