ffi: trace create event ccall helper

Author: Frityet

notes/ffi-callxs-record-gate.md

@@ -167,6 +167,8 @@ The exact CreateFileMapping-shaped slice traces
 `void *(void *, void *, uint32_t, uint32_t, uint32_t, void *)` calls.
 The exact CreateThread-shaped slice traces
 `void *(void *, uint64_t, void *, void *, uint32_t, void *)` calls.
+The exact CreateEvent/CreateSemaphore-shaped slice traces
+`void *(void *, int32_t, int32_t, void *)` calls.
 Other multi-argument pointer/size shapes remain interpreted.
 The shared GPR helper matrix separately covers exact two-argument
 `pointer,int64_t` and `pointer,uint64_t` span shapes; broader pointer/size

notes/ffi-ccall-jit-trampoline.md

@@ -136,6 +136,8 @@ unsigned-int/pointer argument shape,
 pointer/pointer/unsigned-int/unsigned-int/unsigned-int/pointer argument shape,
 `lj_ccall_jit_ptr_ptr_u64_ptr_ptr_u32_ptr()` for the exact pointer-returning
 pointer/size/pointer/pointer/unsigned-int/pointer argument shape,
+`lj_ccall_jit_ptr_ptr_i32_i32_ptr()` for the exact pointer-returning
+pointer/signed-int/signed-int/pointer argument shape,
 `lj_ccall_jit_i32_ptr_ptr_u64()` for the exact pointer/pointer/size argument
 shape,
 `lj_ccall_jit_i32_ptr_ptr_u32()` / `lj_ccall_jit_u32_ptr_ptr_u32()` for exact
@@ -264,6 +266,9 @@ The scope is deliberately narrow:
 - exact `pointer(pointer, uint64_t, pointer, pointer, uint32_t, pointer)`
   calls, preserving security attributes, stack size, start address, parameter,
   creation flags, and thread-id pointer for CreateThread-style ABI classes;
+- exact `pointer(pointer, int32_t, int32_t, pointer)` calls, preserving
+  security attributes, boolean/count fields, and name pointer for
+  CreateEvent/CreateSemaphore-style ABI classes;
 - exact `int32_t(pointer, pointer, uint64_t)` calls, with the final size
   argument preserved before the helper casts to the exact unsigned 64-bit ABI
   width;
@@ -400,6 +405,8 @@ traced CreateFileMapping-shaped pointer/pointer/uint32/uint32/uint32/pointer
 pointer-returning loops,
 traced CreateThread-shaped pointer/uint64/ptr/ptr/uint32/ptr
 pointer-returning loops,
+traced CreateEvent/CreateSemaphore-shaped pointer/int32/int32/pointer
+pointer-returning loops,
 traced ReadFile/WriteFile-shaped pointer/pointer/uint32/pointer/pointer
 signed-int-result loops,
 traced DeviceIoControl-shaped pointer/uint32/pointer/uint32/pointer/uint32/

notes/ffi-ccall-native-helpers.md

@@ -183,7 +183,10 @@ preserving handle, security attributes, protection flags, max size high/low,
 mapping name, and pointer result. The exact CreateThread-shaped slice traces
 `void *(void *, uint64_t, void *, void *, uint32_t, void *)` calls while
 preserving security attributes, stack size, start address, parameter, creation
-flags, thread-id pointer, and pointer result. Exact
+flags, thread-id pointer, and pointer result. The exact
+CreateEvent/CreateSemaphore-shaped slice traces
+`void *(void *, int32_t, int32_t, void *)` calls while preserving security
+attributes, boolean/count fields, name pointer, and pointer result. Exact
 two-argument `pointer,int64_t` and `pointer,uint64_t` span-style shapes are
 covered by the shared GPR helper matrix, while broader pointer/size families
 still fall back. Broad traced ordinary FFI C calls remain interpreted because

notes/ffi-ptr-ptr-i32-i32-ptr-ccall-helper-2026-07-07.md

@@ -0,0 +1,21 @@
+# FFI CreateEvent/CreateSemaphore-shaped C-call helper
+
+Added exact traced native-state FFI C-call coverage for:
+
+- `void *(void *, int32_t, int32_t, void *)`;
+- runtime helper `lj_ccall_jit_ptr_ptr_i32_i32_ptr()`;
+- recorder matcher `crec_call_jit_ptr_ptr_i32_i32_ptr()`;
+- IR call metadata `IRCALL_lj_ccall_jit_ptr_ptr_i32_i32_ptr`.
+
+This covers Windows CreateEvent/CreateSemaphore-shaped
+security/boolean-or-count/name ABI classes without enabling generic
+`IR_CALLXS`. The matcher requires a fixed non-vararg prototype, a pointer
+return, pointer arguments at the security/name positions, and exact signed
+32-bit integer fields in the middle. The helper remains on the audited
+native-state path and boxes the returned handle pointer as cdata.
+
+Validation plan:
+
+- `make -C src -j$(getconf _NPROCESSORS_ONLN) TARGET_STRIP=:`
+- `LJ_TEST_DISABLE_BUILD_CACHE=1 tools/ci/lua_test.sh m7_ffi_ccall_native`
+- `LUA=$PWD/src/luajit tools/ci/lua_test.sh run_stock_tests -- --quiet lib/ffi`

notes/m7.md

@@ -1762,6 +1762,10 @@ FFI C-call JIT trampoline:
   CreateThread-shaped security/stack-size/start-address/parameter/flags/thread-id
   ABI classes with boxed pointer results, high-bit stack sizes, and high-bit
   DWORD flags preserved.
+  Exact `void *(void *, int32_t, int32_t, void *)` calls now record through
+  `lj_ccall_jit_ptr_ptr_i32_i32_ptr()`, covering
+  CreateEvent/CreateSemaphore-shaped security/boolean-or-count/name ABI classes
+  with boxed pointer results and signed 32-bit fields preserved.
   Exact `int32_t(void *, void *, uint64_t)` calls now record through
   `lj_ccall_jit_i32_ptr_ptr_u64()`, covering memcmp/strncmp-style
   pointer/pointer/size ABI classes with the unsigned 64-bit size preserved.

src/lj_ccall.c

@@ -3848,6 +3848,23 @@ void *lj_ccall_jit_ptr_ptr_u64_ptr_ptr_u32_ptr(lua_State *L,
   return ret;
 }
 
+void *lj_ccall_jit_ptr_ptr_i32_i32_ptr(lua_State *L, void *func,
+				       void *a, int32_t b, int32_t c,
+				       void *d)
+{
+  CTState *cts = ctype_cts(L);
+  CCallNativeState native;
+  uint32_t actions;
+  void *ret;
+  lj_ccall_native_save(L, &native);
+  lj_ccall_native_enter(L, &native, func);
+  ret = ((void *(*)(void *, int32_t, int32_t, void *))(uintptr_t)func)(a, b,
+								       c, d);
+  actions = lj_ccall_native_leave(L, cts, &native, func);
+  lj_ccall_native_checkstop(L, actions, &native);
+  return ret;
+}
+
 int32_t lj_ccall_jit_i32_ptr_ptr_u64(lua_State *L, void *func, void *a,
 				     void *b, uint64_t c)
 {

src/lj_ccall.h

@@ -501,6 +501,9 @@ LJ_FUNC void *lj_ccall_jit_ptr_ptr_u64_ptr_ptr_u32_ptr(lua_State *L,
 						       uint64_t b,
 						       void *c, void *d,
 						       uint32_t e, void *f);
+LJ_FUNC void *lj_ccall_jit_ptr_ptr_i32_i32_ptr(lua_State *L, void *func,
+					       void *a, int32_t b,
+					       int32_t c, void *d);
 LJ_FUNC int32_t lj_ccall_jit_i32_ptr_ptr_u64(lua_State *L, void *func,
 					     void *a, void *b,
 					     uint64_t c);

src/lj_crecord.c

@@ -6463,6 +6463,121 @@ static int crec_call_jit_ptr_ptr_u64_ptr_ptr_u32_ptr(jit_State *J,
   return 1;
 }
 
+static int crec_call_jit_ptr_ptr_i32_i32_ptr(jit_State *J, RecordFFData *rd,
+					     CTState *cts, CType *ct,
+					     CTInfo info, GCcdata *cd,
+					     IRType tp, CTSize fsz)
+{
+  CType ctrsnap, ctfcopy, dcopy;
+  CType *ctr, *ctf, *d;
+  CTypeID fid, did;
+  CTInfo ctr_info, ctfinfo, dinfo;
+  TRef func, arg0, arg1, arg2, arg3, tr;
+  MSize narg = 0;
+
+  if ((info & CTF_VARARG))
+    return 0;
+  while (J->base[1+narg]) {
+    if (narg >= 4)
+      return 0;
+    narg++;
+  }
+  if (narg != 4)
+    return 0;
+
+  ctr = crec_ctype_rawchild(J, cts, ct, &ctrsnap);
+  ctr_info = ctype_info_acq(ctr);
+  if (!ctype_isptr(ctr_info) || ctype_size_acq(ctr) != CTSIZE_PTR)
+    return 0;
+
+  fid = ctype_sib_acq(ct);
+  while (fid) {
+    ctf = crec_ctype_snapshot(J, cts, fid, &ctfcopy);
+    ctfinfo = ctype_info_acq(ctf);
+    if (!ctype_isattrib(ctfinfo)) break;
+    fid = ctype_sib_acq(ctf);
+  }
+
+  if (!fid)
+    return 0;
+  ctf = crec_ctype_snapshot(J, cts, fid, &ctfcopy);
+  ctfinfo = ctype_info_acq(ctf);
+  if (!ctype_isfield(ctfinfo))
+    return 0;
+  fid = ctype_sib_acq(ctf);
+  did = ctype_cid(ctfinfo);
+  d = crec_ctype_rawrefid(J, cts, did, &did, &dcopy);
+  dinfo = ctype_info_acq(d);
+  if (!ctype_isptr(dinfo) || ctype_size_acq(d) != CTSIZE_PTR)
+    return 0;
+  arg0 = crec_ct_tv(J, d, 0, J->base[1], &rd->argv[1]);
+  if (!tref_istype(arg0, IRT_PTR))
+    lj_trace_err(J, LJ_TRERR_NYICALL);
+
+  if (!fid)
+    return 0;
+  ctf = crec_ctype_snapshot(J, cts, fid, &ctfcopy);
+  ctfinfo = ctype_info_acq(ctf);
+  if (!ctype_isfield(ctfinfo))
+    return 0;
+  fid = ctype_sib_acq(ctf);
+  did = ctype_cid(ctfinfo);
+  d = crec_ctype_rawrefid(J, cts, did, &did, &dcopy);
+  dinfo = ctype_info_acq(d);
+  if (!ctype_isinteger(dinfo) || ctype_size_acq(d) != 4 ||
+      (dinfo & CTF_UNSIGNED))
+    return 0;
+  arg1 = crec_ct_tv(J, d, 0, J->base[2], &rd->argv[2]);
+  if (!tref_isint(arg1))
+    lj_trace_err(J, LJ_TRERR_NYICALL);
+
+  if (!fid)
+    return 0;
+  ctf = crec_ctype_snapshot(J, cts, fid, &ctfcopy);
+  ctfinfo = ctype_info_acq(ctf);
+  if (!ctype_isfield(ctfinfo))
+    return 0;
+  fid = ctype_sib_acq(ctf);
+  did = ctype_cid(ctfinfo);
+  d = crec_ctype_rawrefid(J, cts, did, &did, &dcopy);
+  dinfo = ctype_info_acq(d);
+  if (!ctype_isinteger(dinfo) || ctype_size_acq(d) != 4 ||
+      (dinfo & CTF_UNSIGNED))
+    return 0;
+  arg2 = crec_ct_tv(J, d, 0, J->base[3], &rd->argv[3]);
+  if (!tref_isint(arg2))
+    lj_trace_err(J, LJ_TRERR_NYICALL);
+
+  if (!fid)
+    return 0;
+  ctf = crec_ctype_snapshot(J, cts, fid, &ctfcopy);
+  ctfinfo = ctype_info_acq(ctf);
+  if (!ctype_isfield(ctfinfo))
+    return 0;
+  fid = ctype_sib_acq(ctf);
+  did = ctype_cid(ctfinfo);
+  d = crec_ctype_rawrefid(J, cts, did, &did, &dcopy);
+  dinfo = ctype_info_acq(d);
+  if (!ctype_isptr(dinfo) || ctype_size_acq(d) != CTSIZE_PTR)
+    return 0;
+  arg3 = crec_ct_tv(J, d, 0, J->base[4], &rd->argv[4]);
+  if (!tref_istype(arg3, IRT_PTR))
+    lj_trace_err(J, LJ_TRERR_NYICALL);
+  if (fid)
+    return 0;
+
+  if (lj_ctype_cb_isblacklisted(cts, cdata_getptr(cdataptr(cd), fsz)))
+    lj_trace_err(J, LJ_TRERR_BLACKL);
+
+  func = emitir(IRT(IR_FLOAD, tp), J->base[0], IRFL_CDATA_PTR);
+  tr = lj_ir_call(J, IRCALL_lj_ccall_jit_ptr_ptr_i32_i32_ptr,
+		  func, arg0, arg1, arg2, arg3);
+  J->base[0] = emitir(IRTG(IR_CNEWI, IRT_CDATA), lj_ir_kint(J, ctype_cid(info)),
+		      tr);
+  J->needsnap = 1;
+  return 1;
+}
+
 static int crec_call_jit_32_ptr_ptr_u64(jit_State *J, RecordFFData *rd,
 					 CTState *cts, CType *ct,
 					 CTInfo info, GCcdata *cd,
@@ -10347,6 +10462,8 @@ static int crec_call(jit_State *J, RecordFFData *rd, GCcdata *cd)
     if (crec_call_jit_ptr_ptr_u64_ptr_ptr_u32_ptr(J, rd, cts, ct, info, cd,
 						  tp, fsz))
       return 1;
+    if (crec_call_jit_ptr_ptr_i32_i32_ptr(J, rd, cts, ct, info, cd, tp, fsz))
+      return 1;
     if (crec_call_jit_32_ptr_ptr_u64(J, rd, cts, ct, info, cd, tp, fsz))
       return 1;
     if (crec_call_jit_32_ptr_ptr_u32(J, rd, cts, ct, info, cd, tp, fsz))

src/lj_ircall.h

@@ -374,6 +374,7 @@ typedef struct CCallInfo {
   _(FFI,	lj_ccall_jit_ptr_ptr_u32_u32_ptr_u32_u32_ptr, 9, S, PTR, CCI_L|CCI_T) \
   _(FFI,	lj_ccall_jit_ptr_ptr_ptr_u32_u32_u32_ptr, 8, S, PTR, CCI_L|CCI_T) \
   _(FFI,	lj_ccall_jit_ptr_ptr_u64_ptr_ptr_u32_ptr, 8, S, PTR, CCI_L|CCI_T) \
+  _(FFI,	lj_ccall_jit_ptr_ptr_i32_i32_ptr, 6, S, PTR, CCI_L|CCI_T) \
   _(FFI,	lj_ccall_jit_i32_ptr_ptr_u64, 5, S, INT, CCI_L|CCI_T) \
   _(FFI,	lj_ccall_jit_u32_ptr_ptr_u64, 5, S, NUM, CCI_L|CCI_T) \
   _(FFI,	lj_ccall_jit_i32_ptr_ptr_u32, 5, S, INT, CCI_L|CCI_T) \

tests/t-ffi-ccall-jit-lib.c

@@ -336,6 +336,14 @@ int *lj_m7_ccall_jit_ptr_ptr_u64_ptr_ptr_u32_ptr(int *security,
 		      (uint64_t)(uint32_t)(thread_id ? *thread_id : 0)) & 3u);
 }
 
+int *lj_m7_ccall_jit_ptr_ptr_i32_i32_ptr(int *security, int32_t manual,
+					 int32_t initial, int *name)
+{
+  return security + (((uint64_t)(uint32_t)manual +
+		      (uint64_t)(uint32_t)initial +
+		      (uint64_t)(uint32_t)(name ? *name : 0)) & 3u);
+}
+
 int32_t lj_m7_ccall_jit_i32_ptr_ptr_u64(int *a, int *b, uint64_t n)
 {
   return a[n & 3u] + b[(n + UINT64_C(1)) & 3u] +