Roll back unsafe x64 TSETB inline CAS

Author: Frityet

dynasm/dasm_x86.lua

@@ -1175,8 +1175,6 @@ local map_op = {
 
   imul_2 =	"rmqdw:0FAFrM|rIqdw:69rmI|rSqdw:6BrmS|riqdw:69rmi",
   imul_3 =	"rmIqdw:69rMI|rmSqdw:6BrMS|rmiqdw:69rMi",
-  cmpxchg_2 =	"mrb:0FB0Rm|mrqdw:0FB1Rm", -- 486+
-
   movzx_2 =	"rm/db:0FB6rM|rm/qb:|rm/wb:0FB6rM|rm/dw:0FB7rM|rm/qw:",
   movsx_2 =	"rm/db:0FBErM|rm/qb:|rm/wb:0FBErM|rm/dw:0FBFrM|rm/qw:",
 
@@ -2392,4 +2390,3 @@ end
 return _M
 
 ------------------------------------------------------------------------------
-

notes/perf-regression-audit-2026-07-01.md

@@ -18,13 +18,12 @@ Read-only subagent audits confirmed the major reports:
   without retiring the slot. `m6_jit_recursive_call_unroll` covers this, and
   `t-vm-safepoint` now asserts this recorder path does not perform a scoped
   handshake or scoped slot retirement; public `jit.flush(1)` still does.
-- x64 interpreter table stores remain helper-heavy overall: `TSETS` goes
-  straight to `vmeta_tsets`, and `TSETV`/`TSETR` array stores route through
-  `lj_tab_storetv_forvm_array()` plus barrier checks. The first narrow
-  exception is `TSETB` for stable current-generation array slots: it now emits
-  an inline `lock; cmpxchg` through DynASM's x86 frontend and falls back to the
-  helper for weak tables, moved/retiring arrays, CAS races, nil/metatable
-  decisions, and forwarding sentinels.
+- x64 interpreter table stores remain helper-heavy: `TSETS` goes straight to
+  `vmeta_tsets`, and `TSETV`/`TSETB`/`TSETR` array stores route through
+  `lj_tab_storetv_forvm_array()` plus barrier checks. A narrow `TSETB`
+  inline-CAS experiment was rolled back after a clean rebuild exposed a default
+  `luajit -e 'print(1)'` crash; the remaining fast-path work must first prove
+  the VM barrier/base/PC contract for direct inline stores.
 - x64 `BC_TNEW` has no inline bump allocation. The current safe prerequisite is
   still exact object layout/bitmap/accounting/root-publication support; first
   slice should be empty-table only and fall back to the current helper when any
@@ -42,10 +41,10 @@ Follow-up order:
    keeps stock sweep/finalizer semantics while removing the global root-list
    cache line from normal allocations; bitmap-only sweep and zero-atomic bump
    allocation remain separate follow-up work.
-2. Partially done: `BC_TSETB` has a guarded x64 inline CAS fast path for
-   stable current-generation array slots. Remaining work is `TSETV`/`TSETR`,
-   stable hash slots, and any collectable-value fast barrier path; new-key,
-   metatable, weak, moved/retiring, and forwarded cases stay on helpers.
+2. Reintroduce guarded x64 interpreter store fast paths for existing stable
+   array/hash slots only after the direct-store barrier bridge preserves the
+   same `lua_State` base, saved-PC, weak-write, forwarding, and parent-barrier
+   contracts as `lj_tab_storetv_forvm_array()`.
 3. Restore JIT no-helper ASTORE/HSTORE for stable primitive-value stores before
    collectable-value barrier fast paths.
 4. Add empty-table x64 `BC_TNEW` inline bump allocation behind strict arena,

plan/07_interpreter_vm.md

@@ -229,13 +229,11 @@ reports `386 passed`.
 
 Current store-publication guard: `m5_x64_vm_store_publication` asserts the x64
 VM cannot reintroduce legacy inline `barrierback`/`lj_gc_barrieruv` paths,
-keeps `TSETV`/`TSETR` array stores on `lj_tab_storetv_forvm_array()`, keeps
-`TSETM` range stores on `lj_tab_storetvn_forvm_array()`, keeps `TSETS` on the
-C fallback instead of a direct hash-slot store, and keeps closed `CSET`/`USETx`
-paths on `lj_func_storeuv_*_pub()` release-copy helpers. `TSETB` has a narrow
-x64 inline `lock; cmpxchg` fast path for stable current-generation array slots
-and falls back to `lj_tab_storetv_forvm_array()` for weak tables, moved or
-retiring arrays, CAS races, nil/metatable decisions, and forwarding sentinels.
+keeps `TSETV`/`TSETB`/`TSETR` array stores on
+`lj_tab_storetv_forvm_array()`, keeps `TSETM` range stores on
+`lj_tab_storetvn_forvm_array()`, keeps `TSETS` on the C fallback instead of a
+direct hash-slot store, and keeps closed `CSET`/`USETx` paths on
+`lj_func_storeuv_*_pub()` release-copy helpers.
 
 Current x64 bridge note: the base-library `setmetatable` fast path now
 publishes the table -> metatable edge through `lj_gc2_barrier_obj_pair()` before
@@ -247,9 +245,7 @@ original inline `wbarrier_tv` sketch in favor of a more conservative,
 C-auditable safety surface; x64 closed `USETx`/`CSET` stores release-copy through
 `lj_func_storeuv_*_pub()` helpers, and raw/open cell stores remain stack-local
 writes. The old x64 `vm_gc2_barriertab` helper
-label has no remaining VM branch users and is retired; the `TSETB` inline CAS
-uses DynASM's x86 `cmpxchg` frontend entry rather than literal byte emission;
-the JIT C-call
+label has no remaining VM branch users and is retired; the JIT C-call
 `lj_gc2_barrier_tab_g` path remains separate. The interpreter allocation slow
 path now also runs the GC2 hard-threshold assist from `lj_gc_step_fixtop()` once
 the current legacy VM threshold check branches there, with

plan/12_implementation_plan.md

@@ -137,12 +137,10 @@ escaped, and weak-table references. These lower through split hash/array/newref
 helpers that run the parent-aware value barrier and the P_WEAK weak-write
 bridge; M10 now also pins that traced helper-backed array stores enqueue the
 old parent, not the young value, for idle generational remembered-set draining.
-The x64 VM `TSETV`/`TSETR`/`TSETM` fast array/range stores use post-store
-publication helpers instead of pre-store black-table repair retry branches,
-preserving the `TSETM` table barrier while the stored value snapshot drives GC2
-and legacy repair. `TSETB` keeps those helper fallbacks, but stable
-current-generation array slots now take a guarded inline `lock; cmpxchg` path
-emitted through DynASM's x86 frontend.
+The x64 VM `TSETV`/`TSETB`/`TSETR`/`TSETM` fast array/range stores use
+post-store publication helpers instead of pre-store black-table repair retry
+branches, preserving the `TSETM` table barrier while the stored value snapshot
+drives GC2 and legacy repair.
 Active-MT recording no longer disables all new traces: secondary TGs can still
 record numeric/non-table root and side traces, plus fresh table allocations,
 under the recorder token. The current temporary table boundary is narrower and

src/vm_x64.dasc

@@ -371,43 +371,6 @@
 |.macro x64_vm_tab_node_hmask_acq, dst, node
 |  mov dst, dword [node+TABNODE_HMASK_OFS]	// x64_vm_tab_node_hmask_acq: TSO acquire load.
 |.endmacro
-|.macro x64_vm_tab_array_cas_fast, fallback
-|  mov r9, RC			// Save TValue *slot for helper fallback.
-|  mov RC, r8			// cmpxchg expected value must be in RAX.
-|  test byte TAB:RB->marked, LJ_GC_WEAK
-|  jnz >9
-|  x64_vm_tab_array_acq r8, TAB:RB
-|  cmp r8, TMPR
-|  jne >9
-|  lea ITYPE, [RB+TAB_COLO_SLOTS]
-|  cmp TMPR, ITYPE
-|  je >7
-|  x64_vm_tab_array_flags_acq ITYPEd, TMPR
-|  test ITYPEd, TABARRAY_FLAG_RETIRING
-|  jnz >9
-|7:
-|  mov ITYPE, [BASE+RA*8]
-|  lock; cmpxchg aword [r9], ITYPE
-|  jne >9
-|  test byte TAB:RB->marked, LJ_GC_WEAK
-|  jnz >9
-|  x64_vm_tab_array_acq r8, TAB:RB
-|  cmp r8, TMPR
-|  jne >9
-|  lea ITYPE, [RB+TAB_COLO_SLOTS]
-|  cmp TMPR, ITYPE
-|  je >7
-|  x64_vm_tab_array_flags_acq ITYPEd, TMPR
-|  test ITYPEd, TABARRAY_FLAG_RETIRING
-|  jnz >9
-|7:
-|  mov RC, r9
-|  jmp >7
-|9:
-|  mov RC, r9
-|  jmp fallback
-|7:
-|.endmacro
 |.macro x64_vm_node_next_acq, dst, node
 |  mov dst, node->next		// x64_vm_node_next_acq: TSO acquire load.
 |.endmacro
@@ -4522,24 +4485,13 @@ static void build_ins(BuildCtx *ctx, BCOp op, int defop)
     |  shl RCd, 3
     |  add RC, TMPR
     |  mov r8, [RC]
-    |  mov64 ITYPE, LJ_TFORWARD_BITS
-    |  cmp r8, ITYPE
+    |  mov64 r10, LJ_TFORWARD_BITS
+    |  cmp r8, r10
     |  je ->vmeta_tsetb
     |  cmp r8, LJ_TNIL
     |  je >3				// Previous value is nil?
     |1:
     |2:	 // Set array slot.
-    |  x64_vm_tab_array_cas_fast >6
-    |  cmp TGMARK, 0
-    |  jnz ->vm_gc2_barriertv_tab
-    |  test byte TAB:RB->marked, LJ_GC_BLACK	// isblack(table)
-    |  jz >8
-    |  jmp ->vm_gc2_barriertv_tab
-    |8:
-    |  ins_next
-    |
-    |6:
-    |  movzx r9d, PC_RC
     |.if X64WIN
     |  mov ARG5d, r9d
     |  lea CARG4, [BASE+RA*8]