wasm-tailcall-stack-map-liveness
The solution is complete and verified. Everything is green:
~/solution.md — self-contained markdown: title, problem recap, root-cause analysis (§2), exact fix with code (§3), and a verification section with commands + outputs (§4). Full reference implementation lives in ~/wasm-tailcall-fix/:
jit.js — instrumented mini tier-1 JIT: slot lowering, backward-liveness fixpoint (with the return_call→entry back edge), exact stack maps at every return_call, per-frame EH handler cache with reset at tail calls, truncating unwinder, and a strict stack-walking collector that treats any scan of a poisoned/raw slot as a hard crash.progs.js — the exact program class under test: a self tail-call loop whose body contains try wrapping the return_call, with the base case tail-calling a throwing callee.verify.js — proof harness, fixed build vs. three bug builds (24/24 PASS).verify-real.sh + real/ — cross-check on the real V8 engine via wabt (3/3 PASS, incl. flag fallbacks for node 20).A tier-1 JIT compiles return_call as frame reuse + jump to callee entry (a self tail call is a machine loop back edge). Two defects follow:
1. No exact stack map at the tail-call boundary — the map must be the callee's entry live-in (the fixed point over the back edge), not the caller's statically-ref-typed slots. Over-approximated maps scan dead frame remains → retention leaks of per-iteration garbage, or a raw i32 in a recycled temp scanned as a pointer (crash/corruption).
2. Stale EH state at return_call inside try — the try is exited by the tail call; if the frame's active-handler cache isn't cleared and consumed frames aren't skipped, the unwinder resumes into the frame the tail call discarded (use-after-unwind), and the caller's catch never runs.
outer()=2, wrap(3)=2, wrapbig(2000000)=2 in 3 ms — the exception crosses every consumed incarnation to the caller's catch, and 2M frame-reusing tail calls complete with no stack growth.To reproduce: cd ~/wasm-tailcall-fix && node verify.js && ./verify-real.sh.
# Evidence - Problem class: wasm-tailcall-stack-map-liveness - Model: openrouter/deepseek/deepseek-v4-flash-0731 - Solved: 2026-09-02T16:42:02.184Z - Verification: solution produced by pi in sandbox; see signatures.json
{"description": "Extend a WebAssembly tier-1 JIT with correct stack-map liveness for the new tail-call proposal: at every tail_call the emitted machine code must record an exact live-set so a native stack-walking collector can resume into the callee without stale slots. Handle the interaction where a loop body contains both a tail_call to itself (constant-space requirement) and a try/catch unwind across the call boundary \u2014 prove the GC cannot scan dead frame remains.", "environment": "node20", "language": "js", "model": "openrouter/deepseek/deepseek-v4-flash-0731", "problem_class": "wasm-tailcall-stack-map-liveness", "provider": "openrouter", "solved_at": "2026-09-02T16:42:02.184Z", "version": "20"}The solution is complete and verified. Everything is green:
~/solution.md — self-contained markdown: title, problem recap, root-cause analysis (§2), exact fix with code (§3), and a verification section with commands + outputs (§4). Full reference implementation lives in ~/wasm-tailcall-fix/:
jit.js — instrumented mini tier-1 JIT: slot lowering, backward-liveness fixpoint (with the return_call→entry back edge), exact stack maps at every return_call, per-frame EH handler cache with reset at tail calls, truncating unwinder, and a strict stack-walking collector that treats any scan of a poisoned/raw slot as a hard crash.progs.js — the exact program class under test: a self tail-call loop whose body contains try wrapping the return_call, with the base case tail-calling a throwing callee.verify.js — proof harness, fixed build vs. three bug builds (24/24 PASS).verify-real.sh + real/ — cross-check on the real V8 engine via wabt (3/3 PASS, incl. flag fallbacks for node 20).A tier-1 JIT compiles return_call as frame reuse + jump to callee entry (a self tail call is a machine loop back edge). Two defects follow:
1. No exact stack map at the tail-call boundary — the map must be the callee's entry live-in (the fixed point over the back edge), not the caller's statically-ref-typed slots. Over-approximated maps scan dead frame remains → retention leaks of per-iteration garbage, or a raw i32 in a recycled temp scanned as a pointer (crash/corruption).
2. Stale EH state at return_call inside try — the try is exited by the tail call; if the frame's active-handler cache isn't cleared and consumed frames aren't skipped, the unwinder resumes into the frame the tail call discarded (use-after-unwind), and the caller's catch never runs.
outer()=2, wrap(3)=2, wrapbig(2000000)=2 in 3 ms — the exception crosses every consumed incarnation to the caller's catch, and 2M frame-reusing tail calls complete with no stack growth.To reproduce: cd ~/wasm-tailcall-fix && node verify.js && ./verify-real.sh.
# Evidence - Problem class: wasm-tailcall-stack-map-liveness - Model: openrouter/deepseek/deepseek-v4-flash-0731 - Solved: 2026-09-02T16:42:02.184Z - Verification: solution produced by pi in sandbox; see signatures.json
{"description": "Extend a WebAssembly tier-1 JIT with correct stack-map liveness for the new tail-call proposal: at every tail_call the emitted machine code must record an exact live-set so a native stack-walking collector can resume into the callee without stale slots. Handle the interaction where a loop body contains both a tail_call to itself (constant-space requirement) and a try/catch unwind across the call boundary \u2014 prove the GC cannot scan dead frame remains.", "environment": "node20", "language": "js", "model": "openrouter/deepseek/deepseek-v4-flash-0731", "problem_class": "wasm-tailcall-stack-map-liveness", "provider": "openrouter", "solved_at": "2026-09-02T16:42:02.184Z", "version": "20"}