Keep table length forwarding within poll regions

Author: Frityet

notes/m6.md

@@ -125,6 +125,10 @@ M6 JIT recorder token scaffold:
   `IR_XPOLL` or `IR_XBAR`. This deliberately keeps a trace poll as a hard
   GC-barrier/handshake boundary for shared cells and field stores, even when a
   narrower optimization might be valid in single-threaded stock LuaJIT.
+- Table length forwarding now uses the same boundary: `IR_ALEN` CSE and
+  `t[#t+1]` hint forwarding do not cross `IR_XPOLL` or `IR_XBAR`, so a trace
+  poll cannot reuse a pre-poll array-length snapshot across a safepoint or
+  resize window.
 - Helper-backed indexed table stores can now trace on Linux/x64 through
   release-store helpers. x64 lowers `ASTORE` through
   `lj_tab_storetv_forjit_array()`, hash-slot `HSTORE` through

src/lj_opt_mem.c

@@ -425,7 +425,7 @@ TRef LJ_FASTCALL lj_opt_dse_ahstore(jit_State *J)
 TRef LJ_FASTCALL lj_opt_fwd_alen(jit_State *J)
 {
   IRRef tab = fins->op1;  /* Table reference. */
-  IRRef lim = tab;  /* Search limit. */
+  IRRef lim = poll_alias_limit(J, tab);  /* Search limit. */
   IRRef ref;
 
   /* Search for conflicting HSTORE with numeric key. */

tests/lib/suite_jit.lua

@@ -11,6 +11,7 @@ function M.trace1_ir_state(t, dump)
     array = 0,
     hdradd = 0,
     xload = 0,
+    alen = 0,
     asize = 0,
     eq = 0,
     aref = false,
@@ -39,6 +40,7 @@ function M.trace1_ir_state(t, dump)
         st.hdradd = st.hdradd + 1
       end
       if contains(line, " XLOAD ") then st.xload = st.xload + 1 end
+      if contains(line, " ALEN ") then st.alen = st.alen + 1 end
       if line:match("FLOAD .*tab[.]asize") then st.asize = st.asize + 1 end
       if contains(line, " p64 EQ ") then st.eq = st.eq + 1 end
       if contains(line, " ULE ") then st.ule = true end

tests/suites/m6_jit.lua

@@ -625,6 +625,17 @@ for i = 1, 120 do a[i % 128] = i end
 assert(a[119 % 128] == 119)
 ]=])
       assert_loop_after_xpoll(t, store_dump, "FFI XSTORE loop", { "XSTORE" })
+
+      local alen_dump = t:tmp("lj-m6-alen-xpoll-ir.dump")
+      run_ir_dump_probe(t, alen_dump, [=[
+jit.flush()
+jit.opt.start("hotloop=1", "hotexit=1")
+local t = { 1, 2, 3 }
+local s = 0
+for _ = 1, 80 do s = s + #t end
+assert(s == 240)
+]=])
+      assert_loop_after_xpoll(t, alen_dump, "table ALEN loop", { "ALEN" })
       run_lua_test_case(t, "m5_jit_hash_store_nyi")
       print("M6 JIT XBAR/XPOLL alias guard passed")
     end