youknowone
diff --git a/‎majit/majit-metainterp/src/jitdriver.rs‎
Lines changed: 28 additions & 4 deletions b/‎majit/majit-metainterp/src/jitdriver.rs‎
Lines changed: 28 additions & 4 deletions
diff --git a/‎majit/majit-metainterp/src/pyjitpl.rs‎
Lines changed: 15 additions & 2 deletions b/‎majit/majit-metainterp/src/pyjitpl.rs‎
Lines changed: 15 additions & 2 deletions
diff --git a/‎pyre/bench/synth/kept_stack_deep_var_shortcircuit_mutate.py‎
Lines changed: 3 additions & 3 deletions b/‎pyre/bench/synth/kept_stack_deep_var_shortcircuit_mutate.py‎
Lines changed: 3 additions & 3 deletions
diff --git a/‎pyre/pyre-interpreter/src/call.rs‎
Lines changed: 27 additions & 15 deletions b/‎pyre/pyre-interpreter/src/call.rs‎
Lines changed: 27 additions & 15 deletions
diff --git a/‎pyre/pyre-jit-trace/src/jitcode_dispatch.rs‎
Lines changed: 161 additions & 0 deletions b/‎pyre/pyre-jit-trace/src/jitcode_dispatch.rs‎
Lines changed: 161 additions & 0 deletions
@@ -1783,7 +1783,18 @@ impl<S: JitState> JitDriver<S> {
         match action {
             TraceAction::Continue => {}
             TraceAction::CompileTrace => {
-                self.meta.abort_trace(false);
+                // Successful compile-into-existing-target: raise_if_successful()
+                // raises ContinueRunningNormally (pyjitpl.py:3095-3123), which
+                // bypasses the `except SwitchToBlackhole` handler, so only the
+                // live history teardown runs — `aborted_tracing` accounting is
+                // NOT reached on success (the loop/bridge counter was already
+                // bumped at backend-compile time). Call the live-teardown half
+                // only, not the accounting half.
+                self.meta.abort_trace_live(false);
+                // No aborted_tracing follows on success, so drop the
+                // pending_abort_* payload abort_trace_live staged (else it
+                // attaches this key to a later, unrelated abort's hook).
+                self.meta.clear_pending_abort();
                 self.sym = None;
                 self.meta.clear_trace_session();
                 self.compile_trace_success = true;
@@ -1906,7 +1917,11 @@ impl<S: JitState> JitDriver<S> {
                                         continue_running_normally_values,
                                         None,
                                     );
-                                    self.meta.abort_trace(false);
+                                    // Success edge: live teardown only, no
+                                    // aborted_tracing accounting (see the
+                                    // CompileTrace arm above).
+                                    self.meta.abort_trace_live(false);
+                                    self.meta.clear_pending_abort();
                                     return;
                                 }
                                 // pyjitpl.py:2993-3007: after retrace_needed(),
@@ -2060,7 +2075,11 @@ impl<S: JitState> JitDriver<S> {
                                     continue_running_normally_values,
                                     loop_header_pc,
                                 );
-                                self.meta.abort_trace(false);
+                                // Success edge: live teardown only, no
+                                // aborted_tracing accounting (see the
+                                // CompileTrace arm above).
+                                self.meta.abort_trace_live(false);
+                                self.meta.clear_pending_abort();
                                 return;
                             }
                             // pyjitpl.py:2993-3007: after retrace_needed(),
@@ -2440,7 +2459,12 @@ impl<S: JitState> JitDriver<S> {
                 let (continue_running_normally_values, continue_running_normally_pc) = self
                     .take_continue_running_normally_payload()
                     .map_or((None, None), |(values, pc)| (Some(values), pc));
-                self.meta.abort_trace(false);
+                // Re-observing a success the CompileTrace arm already tore down
+                // (compile_trace_success flag). Live teardown only — the
+                // accounting must not fire (it would double-count a single
+                // successful compile as two aborts).
+                self.meta.abort_trace_live(false);
+                self.meta.clear_pending_abort();
                 self.sym = None;
                 self.meta.clear_trace_session();
                 return Some(DetailedDriverRunOutcome::Jump {
 
@@ -6982,6 +6982,20 @@ impl<M: Clone> MetaInterp<M> {
         self.clear_trace_session();
     }
 
+    /// Drop the `pending_abort_*` payload staged by `abort_trace_live`.
+    ///
+    /// `abort_trace_live` always stages `(green_key, permanent)` for the
+    /// `aborted_tracing` call that normally follows on the `SwitchToBlackhole`
+    /// unwind. A *successful* compile teardown runs `abort_trace_live` for its
+    /// live cleanup but fires no `aborted_tracing` (raise_if_successful raises
+    /// `ContinueRunningNormally`, pyjitpl.py:3095-3123), so the staged key must
+    /// be dropped here — leaving it would attach this successfully-compiled
+    /// key to a later, unrelated abort's `on_trace_abort` hook.
+    pub fn clear_pending_abort(&mut self) {
+        self.pending_abort_green_key = None;
+        self.pending_abort_permanent = false;
+    }
+
     /// Finish the current trace with a terminal `FINISH`, then optimize and compile it.
     ///
     /// `exit_with_exception` selects the FINISH descr per `pyjitpl.py`:
@@ -12575,8 +12589,7 @@ impl<M: Clone> MetaInterp<M> {
                     // fires, so letting stale greenkey linger would
                     // attach this successfully-compiled bridge's key
                     // to a later, unrelated abort.
-                    self.pending_abort_green_key = None;
-                    self.pending_abort_permanent = false;
+                    self.clear_pending_abort();
                     Ok(())
                 }
                 // pyjitpl.py:3220/:3245 `compile.giveup()` per
 
@@ -4,9 +4,9 @@
 # (a non-journaled STORE_SUBSCR-class heap effect committed inside a user
 # frame).  A FOR_ITER trace that consumes the iterator, aborts on the deep
 # kept-stack guard, and then DELIVERS the in-flight item would re-run the body
-# and DOUBLE the mutation.  The `log` length must equal the iteration count
-# exactly (2 mutations per iteration): a doubled delivery over-counts, a
-# dropped iteration under-counts.
+# and DOUBLE the mutation.  The `log` length must equal 3x the iteration count
+# exactly (g, h, and one conditional g/h append per iteration): a doubled
+# delivery over-counts, a dropped iteration under-counts.
 log = []
 
 
 
@@ -2041,20 +2041,20 @@ pub fn call_with_kwargs(
         let instance_slot = pyre_object::gc_roots::shadow_stack_len();
         pyre_object::gc_roots::pin_root(instance);
         // Step 2: __init__(self, *args, **kwargs) with full kwargs support.
-        if let Some(w_insttype) = type_call_init_type(instance, callable) {
-            if let Some(init_fn) =
+        if let Some(w_insttype) = type_call_init_type(instance, callable)
+            && !type_call_type_x_shortcut(callable, pos_args.len(), kwargs.is_empty())
+            && let Some(init_fn) =
                 unsafe { crate::baseobjspace::lookup_in_type(w_insttype, "__init__") }
-            {
-                let mut init_args = Vec::with_capacity(1 + pos_args.len());
-                init_args.push(instance);
-                init_args.extend_from_slice(pos_args);
-                let init_result = if unsafe { crate::is_function(init_fn) } && !kwargs.is_empty() {
-                    call_with_kwargs(frame, init_fn, &init_args, kwargs)?
-                } else {
-                    call_callable(frame, init_fn, &init_args)?
-                };
-                check_init_returned_none(init_result)?;
-            }
+        {
+            let mut init_args = Vec::with_capacity(1 + pos_args.len());
+            init_args.push(instance);
+            init_args.extend_from_slice(pos_args);
+            let init_result = if unsafe { crate::is_function(init_fn) } && !kwargs.is_empty() {
+                call_with_kwargs(frame, init_fn, &init_args, kwargs)?
+            } else {
+                call_callable(frame, init_fn, &init_args)?
+            };
+            check_init_returned_none(init_result)?;
         }
         return Ok(pyre_object::gc_roots::shadow_stack_get(instance_slot));
     }
@@ -2363,7 +2363,9 @@ fn type_descr_call_impl(w_type: PyObjectRef, args: &[PyObjectRef]) -> PyObjectRe
     // Step 2: __init__ — only if __new__ returned an instance of w_type.
     // PyPy checks the Python-level type(instance), so builtin-layout subtypes
     // like set subclasses still run __init__.
-    if let Some(w_insttype) = type_call_init_type(instance, w_type) {
+    if let Some(w_insttype) = type_call_init_type(instance, w_type)
+        && !type_call_type_x_shortcut(w_type, args.len(), true)
+    {
         if let Some(init_fn) =
             unsafe { crate::baseobjspace::lookup_in_type(w_insttype, "__init__") }
         {
@@ -2415,6 +2417,14 @@ fn type_call_init_type(instance: PyObjectRef, w_type: PyObjectRef) -> Option<PyO
     }
 }
 
+/// typeobject.py:735-736 — the `type(x)` shortcut: `type.__call__` skips
+/// __init__ when self is the `type` builtin, there are no keyword
+/// arguments, and exactly one positional argument (`type(x)` returns the
+/// class of x, already produced by __new__).
+fn type_call_type_x_shortcut(w_type: PyObjectRef, nargs: usize, no_kwargs: bool) -> bool {
+    no_kwargs && nargs == 1 && std::ptr::eq(w_type, crate::typedef::w_type())
+}
+
 /// Pointer-based subtype check for descr_call __init__ guard — the MRO
 /// membership scan lives in `pyre_object::w_type_issubtype`.
 fn issubtype_ptr(w_type: PyObjectRef, cls: PyObjectRef) -> bool {
@@ -3627,7 +3637,9 @@ fn type_descr_call_with_mode(
 
     // Step 2: __init__ — only if __new__ returned an instance of w_type.
     // PyPy: descr_call — skips __init__ when __new__ returns a foreign type.
-    if let Some(w_insttype) = type_call_init_type(instance, w_type) {
+    if let Some(w_insttype) = type_call_init_type(instance, w_type)
+        && !type_call_type_x_shortcut(w_type, args.len(), true)
+    {
         if let Some(init_fn) =
             unsafe { crate::baseobjspace::lookup_in_type(w_insttype, "__init__") }
         {
 
@@ -7329,6 +7329,28 @@ pub(crate) fn fbw_vable_scalar_ca_enabled() -> bool {
     })
 }
 
+/// `PYRE_FBW_DEEPKEPT_INT` (default OFF) — extend the deep-kept operand-stack
+/// recovery in [`walker_capture_snapshot_for_last_guard_impl`] to fill an
+/// UNBOXED-INT hole from the Int register bank. A Ref-typed stack slot
+/// semantically holding an Int (e.g. condexpr's `a+i` `IntAdd` result) is left
+/// a hole by the Ref-only fill; when on, the capture reads `registers_i[color]`
+/// (the color named by `semantic_slot_color_for_int_slot`) and boxes the raw
+/// int into a `W_IntObject` (`wrapint`) so the vable array carries a Ref.
+/// Ports the `if length_i:` i-bank section of `get_list_of_active_boxes`
+/// (`pyjitpl.py:206-210`). Default OFF: flag-off is byte-identical to the
+/// int-as-hole behavior (resume re-materializes the int from its defining IR),
+/// mirroring how the S1 mirror extension staged behind `PYRE_FBW_DEEPKEPT_MIRROR`.
+pub(crate) fn deepkept_int_recovery_enabled() -> bool {
+    static ENABLED: std::sync::OnceLock<bool> = std::sync::OnceLock::new();
+    *ENABLED.get_or_init(|| match std::env::var_os("PYRE_FBW_DEEPKEPT_INT") {
+        Some(v) => {
+            let v = v.to_string_lossy();
+            v != "0" && !v.eq_ignore_ascii_case("false")
+        }
+        None => false,
+    })
+}
+
 /// `PYRE_FBW_RAISE` (default ON) — the FBW walker owns the Python raise/except
 /// loop.  The twin NULL-ref guards exempt the trailing `cause` sentinel of a
 /// [`PyreHelperKind::RaiseVarargs`] residual so the walker records the raise.
@@ -10166,6 +10188,145 @@ fn walker_capture_snapshot_for_last_guard_impl(
             } else {
                 Vec::new()
             };
+            // Recover a kept operand-stack slot the walk mirror lost across a
+            // not-taken branch merge.  At a branch guard whose not-taken arm
+            // keeps a CALL result deep on the operand stack
+            // (`t=(g(i),h(i),(g(i) if p or q else h(i)))`), the walk took the
+            // OTHER arm, so `ctx.vstack_boxes[s]` is a `PY_NULL` hole for the
+            // deep slot and the `stack_sync` overlay above omits it — the
+            // resumed vable array then reads that slot NULL and the interpreted
+            // body dereferences it (SIGSEGV).  The trampoline edge-move recovery
+            // (`resolved_recovered`) is empty for this shape, so the mirror is
+            // the only kept-stack source and it has a hole.
+            // Fill the hole from the guard-PC register file: the per-PC
+            // `pcdep_color_slots` map at `guard_py_pc` names the Ref-bank color
+            // that holds operand-stack slot `nlocals + s` at THIS guard PC (the
+            // same authoritative inversion `collect_outer_active_boxes` reads),
+            // and `ctx.registers_r[color]` holds the live guard-state box.  This
+            // is the guard-PC color read (as `resolved_recovered` does for
+            // `registers_r[src]`), NOT the retired stale merge-color read.
+            // This ports `get_list_of_active_boxes`
+            // (rpython/jit/metainterp/pyjitpl.py:177-234), which captures guard
+            // resume boxes from `registers_r[index]` via the per-PC `-live-`
+            // set.
+            // Capture-only: writes the transient snapshot overlay, never the live
+            // shadow (the trace_opcode.rs:2218 bridge-NULL constraint holds).
+            let stack_sync: Vec<(usize, OpRef)> = if guard_py_pc.is_some()
+                && sym.owns_virtualizable_shadow()
+                && !sym.jitcode.is_null()
+            {
+                let gpc = guard_py_pc.unwrap() as usize;
+                let nlocals = sym.nlocals;
+                let nvs = crate::virtualizable_gen::NUM_VABLE_SCALARS;
+                let depth = unsafe {
+                    let jc = &*sym.jitcode;
+                    if jc.payload.code_ptr.is_null() {
+                        0usize
+                    } else {
+                        crate::liveness::liveness_for(jc.payload.code_ptr)
+                            .depth_at_py_pc()
+                            .get(gpc)
+                            .copied()
+                            .unwrap_or(0) as usize
+                    }
+                };
+                let pcdep: Vec<(u8, u16, u16)> = unsafe {
+                    let jc = &*sym.jitcode;
+                    jc.payload
+                        .metadata
+                        .pcdep_color_slots
+                        .get(gpc)
+                        .cloned()
+                        .unwrap_or_default()
+                };
+                let mut covered: std::collections::HashSet<usize> =
+                    stack_sync.iter().map(|&(idx, _)| idx).collect();
+                let mut augmented = stack_sync;
+                for s in 0..depth {
+                    let vidx = nvs + nlocals + s;
+                    if covered.contains(&vidx) {
+                        continue;
+                    }
+                    // Guard-PC Ref color that owns operand-stack slot
+                    // `nlocals + s` (`get_list_of_active_boxes` `if length_r:`
+                    // section, `pyjitpl.py:211-215`).
+                    if let Some(color) =
+                        crate::state::semantic_slot_color_for_ref_slot(&pcdep, nlocals + s)
+                    {
+                        if let Some(&box_op) = ctx.registers_r.get(color) {
+                            // Only a genuine Ref box may fill an operand-stack
+                            // slot: the vable array is uniformly Ref-typed, and
+                            // `build_vable_snapshot_boxes` reads each entry's
+                            // `OpRef::ty()`.  An unboxed-int kept temp (a `Ref`-
+                            // bank color holding an `IntAdd` result, e.g.
+                            // condexpr's `a+i`) is Int-typed and would decode as
+                            // `Box type Int != expected Ref`; it needs a
+                            // `NEW_W_INT` box the capture cannot synthesize
+                            // (boxing here emits into a settled trace →
+                            // `store_final_boxes_in_guard` panic), so leave it a
+                            // hole (the mirror already sourced every restorable
+                            // slot). The int-bank recovery below handles the
+                            // bank-0 channel where a raw int lives in the Int
+                            // register file instead.
+                            if box_op != OpRef::NONE
+                                && !opref_is_null_const_ptr(box_op)
+                                && box_op.ty() == Some(majit_ir::Type::Ref)
+                            {
+                                augmented.push((vidx, box_op));
+                                covered.insert(vidx);
+                            }
+                        }
+                    }
+                    // Int-bank fill (`get_list_of_active_boxes` `if length_i:`
+                    // section, `pyjitpl.py:206-210` —
+                    // `add_box_to_storage(self.registers_i[index])`), gated
+                    // `PYRE_FBW_DEEPKEPT_INT` (default OFF). Ref precedence:
+                    // only fill a slot the Ref bank left a hole. A bank-0 (Int)
+                    // pcdep entry names the Int-bank color owning slot
+                    // `nlocals + s`, and `registers_i[color]` holds the raw
+                    // unboxed int; box it into a `W_IntObject` (`wrapint`, the
+                    // `NewWithVtable` + `SetfieldGc(intval)` pair
+                    // `materialize_loop_carried_value` emits for a Ref-typed
+                    // loop-carried slot) so the uniformly Ref-typed vable array
+                    // carries a Ref, not a raw Int the resume decode would
+                    // reject as `Box type Int != expected Ref`. Default OFF:
+                    // flag-off leaves the int a hole, byte-identical to today
+                    // (resume re-materializes it from its defining IR).
+                    //
+                    // Scaffolding on the current frontend: pyre's operand stack
+                    // is uniformly Ref-banked in the pcdep map
+                    // (`locals_cells_stack_w` is a `W_Root[]` array), so no
+                    // bank-0 stack entry exists yet and this fires nowhere. The
+                    // real int-hole source — a Ref-bank color whose
+                    // `registers_r[color]` OpRef is itself Int-typed — CANNOT be
+                    // boxed here: `wrapint` emits `NewWithVtable` + `SetfieldGc`
+                    // into an already-settled trace at capture time, which trips
+                    // `store_final_boxes_in_guard` (`resume.py:397`
+                    // `resume_position >= 0`). The box must be synthesized at
+                    // operand-stack PUSH time, not lazily at snapshot capture —
+                    // that is a frontend change beyond this capture hook (a
+                    // bank-0 channel, e.g. the tagged-int epic, or a push-time
+                    // NEW_W_INT), tracked as a follow-up. This literal i-bank
+                    // read stays as the RPython-parity channel for when bank-0
+                    // stack entries do exist.
+                    if deepkept_int_recovery_enabled() && !covered.contains(&vidx) {
+                        if let Some(color) =
+                            crate::state::semantic_slot_color_for_int_slot(&pcdep, nlocals + s)
+                        {
+                            if let Some(&raw) = ctx.registers_i.get(color) {
+                                if raw != OpRef::NONE && raw.ty() == Some(majit_ir::Type::Int) {
+                                    let boxed = crate::state::wrapint(ctx.trace_ctx, raw);
+                                    augmented.push((vidx, boxed));
+                                    covered.insert(vidx);
+                                }
+                            }
+                        }
+                    }
+                }
+                augmented
+            } else {
+                stack_sync
+            };
             let saved_shadow: Vec<(usize, Option<OpRef>)> = stack_sync
                 .iter()
                 .map(|&(idx, _)| (idx, ctx.trace_ctx.virtualizable_box_at(idx)))