asm: snapshot x86 CNEW ctype metadata

Author: Frityet

notes/x86-asm-cnew-ctype-snapshot-2026-07-07.md

@@ -0,0 +1,17 @@
+# x86 ASM CNEW CType Snapshot
+
+`asm_cnew()` now reconstructs `CNEW`/`CNEWI` allocation metadata through
+`lj_ctype_info_predefined()` or the sequence-checked
+`lj_ctype_info_snapshot()` helper instead of calling the live `lj_ctype_info()`
+walker during backend assembly.
+
+The x64 allocation code still receives the same size and alignment bits when
+the ctype table is stable. If a parser publish is active or the snapshot races
+ctype table growth, assembly aborts with `CTBUSY` and the interpreter can retry
+later rather than assembling allocation code from a stale `CType *`.
+
+Validation:
+
+- `make -C src -j$(nproc) TARGET_STRIP=:`
+- `tools/ci/lua_test.sh m7_ffi_jit_cnew`
+- `tools/ci/lua_test.sh m7_ffi_typeinfo_snapshot`

src/lj_asm_x86.h

@@ -3011,7 +3011,14 @@ static void asm_cnew(ASMState *as, IRIns *ir)
   CTState *cts = ctype_ctsG(J2G(as->J));
   CTypeID id = (CTypeID)IR(ir->op1)->i;
   CTSize sz;
-  CTInfo info = lj_ctype_info(cts, id, &sz);
+  CTInfo info;
+  int ok = lj_ctype_info_predefined(cts, id, &info, &sz, NULL, NULL);
+  if (ok <= 0)
+    ok = lj_ctype_info_snapshot(cts, id, &info, &sz, NULL, NULL);
+  if (ok < 0)
+    lj_trace_err(as->J, LJ_TRERR_CTBUSY);
+  if (!ok)
+    lj_trace_err(as->J, LJ_TRERR_BADTYPE);
   const CCallInfo *ci = &lj_ir_callinfo[IRCALL_lj_cdata_new_forjit];
   IRRef args[4];
   lj_assertA(sz != CTSIZE_INVALID || (ir->o == IR_CNEW && ir->op2 != REF_NIL),