[Wasm RyuJIT] Spill live ref/byref values to pinned stack slots at calls by kg · Pull Request #129059 · dotnet/runtime

kg · 2026-06-05T22:58:34Z

No description provided.

dotnet-policy-service · 2026-06-05T22:59:47Z

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Copilot

Pull request overview

This PR introduces a Wasm-specific mechanism intended to make ref/byref values GC-visible across call sites by injecting a new IR node (GT_WASM_SPILL_REF) and a new Wasm phase (WasmSpillRefs) that inserts these nodes and allocates pinned stack spill slots used during Wasm codegen.

Changes:

Add GT_WASM_SPILL_REF node kind and operand iteration support.
Add Compiler::WasmSpillRefs phase to insert spill nodes around calls and allocate spill locals.
Extend Wasm codegen/regalloc to track a spill index and (temporarily) force-enregister a scratch “splash zone” local.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/coreclr/jit/regallocwasm.cpp	Forces the “splash zone” local to be treated as a reg candidate.
src/coreclr/jit/gtlist.h	Adds new Wasm node `WASM_SPILL_REF`.
src/coreclr/jit/gentree.cpp	Updates operand-edge iterator to treat `GT_WASM_SPILL_REF` as unary.
src/coreclr/jit/fgwasm.cpp	Implements `Compiler::WasmSpillRefs` to insert spill nodes and allocate spill locals.
src/coreclr/jit/compphases.h	Adds `PHASE_WASM_SPILL_REFS`.
src/coreclr/jit/compmemkind.h	Adds `WasmSpillRefs` memory kind.
src/coreclr/jit/compiler.h	Adds `m_wasmSpillSlots` field and `WasmSpillRefs` declaration.
src/coreclr/jit/compiler.cpp	Wires `WasmSpillRefs` into the Wasm compilation pipeline.
src/coreclr/jit/codegenwasm.cpp	Emits Wasm for `GT_WASM_SPILL_REF` and resets spill index at calls.
src/coreclr/jit/codegenlinear.cpp	Resets spill index at block boundaries on Wasm.
src/coreclr/jit/codegen.h	Adds `wasmSpillRefIndex` state.

+                if (defs.size())
+                {
+                    JITDUMP("Spilling %d live ref(s) for call\n", defs.size());
+                    DISPNODE(tree);


+    JITDUMP("High water mark for refs was %d\n", highWaterMark);
+    if (highWaterMark == 0)
+        return PhaseStatus::MODIFIED_NOTHING;
+


+            if (tree->IsValue() && tree->TypeIs(TYP_REF, TYP_BYREF) && !tree->OperIs(GT_WASM_SPILL_REF))
+            {
+                // TODO: Can we skip this for GT_LCL_VAR when it lives in memory? Or is it possible
+                //  that the LCL_VAR has been modified since it was loaded onto the Wasm stack?
+                defs.push_back(tree);
+            }


+        varDsc->lvHasExplicitInit = true;
+        varDsc->lvImplicitlyReferenced = true;
+        // If we don't make this var tracked, regalloc will crash when allocating a register for it
+        varDsc->lvTracked = true;
+        m_wasmSpillSlots->at(0) = varNum;


+        // HACK: Ensure that we always enregister the splash zone, even if we are not enregistering other locals
+        if (m_compiler->m_wasmSpillSlots && m_compiler->m_wasmSpillSlots->size() && m_compiler->m_wasmSpillSlots->at(0) == lclNum)
+        {
+            varIsRegCandidate = true;
+        }


AndyAyersMS

Generally looks good.

I'm curious how this intersects/overlaps with LSRA's spill temp mechanism. Not saying we should use that here, but it likely serves a similar purpose.

AndyAyersMS · 2026-06-07T16:31:06Z

+                return GenTree::VisitResult::Continue;
+            });
+
+            if (tree->IsValue() && tree->TypeIs(TYP_REF, TYP_BYREF) && !tree->OperIs(GT_WASM_SPILL_REF))


Check for unused values here?

AndyAyersMS · 2026-06-07T16:31:57Z

+                if (!op->TypeIs(TYP_REF, TYP_BYREF))
+                    return GenTree::VisitResult::Continue;
+
+                for (size_t i = defs.size(); i > 0; i--)


Probably worth commenting what this is doing (removing active defs once we find their use, and keeping the defs collection compact).

jakobbotsch · 2026-06-07T17:00:36Z


 GTNODE(WASM_JEXCEPT     , GenTree            ,0,0,GTK_LEAF|GTK_NOVALUE|DBK_NOTHIR)  // Special jump for Wasm exception handling
 GTNODE(WASM_THROW_REF   , GenTree            ,0,0,GTK_LEAF|GTK_NOVALUE|DBK_NOTHIR)  // Wasm rethrow host exception (exception is an implicit operand)
+GTNODE(WASM_SPILL_REF   , GenTreeOp          ,0,0,GTK_UNOP|DBK_NOTHIR)


Why a new node instead of just using normal stores?

STORE_LCL_VAR doesn't return a value, does it? For this to work, the value has to 'flow through' the spill into the call consuming it

jakobbotsch · 2026-06-07T17:01:09Z

            varIsRegCandidate = false;
        }

+        // HACK: Ensure that we always enregister the splash zone, even if we are not enregistering other locals


Why do these need to be enregistered?

We would have to change the shape of the generated code to have the splash zone live in memory, and it would be much worse CQ

Not sure I understand – if we were doing similar transformation in any other place in the JIT we would just create new locals and store to them. Like gtSplitTree or async do already. What makes that less desirable and why can't it be handled as well as this can automatically by the wasm backend?

For context: https://gist.github.com/kg/cba44f4907f5320966058446fa01c25f

Essentially, the stack shape required to do a memory store on wasm is
[dst, value]

so if I have a list of call args like
[a, b, c, d]
I can't insert a node after b that does a memory store for a spill without first inserting a LCL_ADDR node before b.

If I have a local that's guaranteed to be enregistered, I can insert a tee.local opcode inline that will make a copy of b, and then I can do anything I want as long as I leave b on the stack afterwards (which is easy thanks to the local). By default in debug we don't enregister anything, so I need this hack to ensure I have the ability to tee.local.

Let me know if that doesn't make sense and I can explain in more detail.

jakobbotsch · 2026-06-07T17:03:04Z

+                    if (op == defs[i - 1])
+                    {
+                        defs[i - 1] = defs[defs.size() - 1];
+                        defs.erase(defs.begin() + (defs.size() - 1), defs.end());


This can use pop_back ( async.cpp version could too)

…the GC won't move them

Copilot AI review requested due to automatic review settings June 5, 2026 22:58

kg added arch-wasm WebAssembly architecture area-CodeGen-coreclr CLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI labels Jun 5, 2026

Copilot started reviewing on behalf of kg June 5, 2026 22:58 View session

dotnet-policy-service Bot assigned kg Jun 5, 2026

Copilot AI reviewed Jun 5, 2026

View reviewed changes

This was referenced Jun 6, 2026

slow macOS - "##[error]The job running on agent Azure Pipelines 9 ran longer than the maximum time of 60 minutes." dotnet/dnceng#1883

Open

The Operation will be canceled. The next steps may not contain expected logs. dotnet/dnceng#3008

Open

AndyAyersMS reviewed Jun 7, 2026

View reviewed changes

jakobbotsch reviewed Jun 7, 2026

View reviewed changes

kg added 3 commits June 7, 2026 10:07

[Wasm] Spill live ref/byref values to pinned stack slots at calls so …

efd6a44

…the GC won't move them

Fix a bounds check

02375bb

Set the spill slots as must-init

9a2f3da

kg force-pushed the wasm-spill-refs branch from b614c8f to 9a2f3da Compare June 7, 2026 17:07

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Wasm RyuJIT] Spill live ref/byref values to pinned stack slots at calls#129059

[Wasm RyuJIT] Spill live ref/byref values to pinned stack slots at calls#129059
kg wants to merge 3 commits into
dotnet:mainfrom
kg:wasm-spill-refs

kg commented Jun 5, 2026

Uh oh!

dotnet-policy-service Bot commented Jun 5, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

AndyAyersMS left a comment

Uh oh!

AndyAyersMS Jun 7, 2026

Uh oh!

AndyAyersMS Jun 7, 2026

Uh oh!

jakobbotsch Jun 7, 2026

Uh oh!

kg Jun 7, 2026

Uh oh!

jakobbotsch Jun 7, 2026

Uh oh!

kg Jun 7, 2026

Uh oh!

jakobbotsch Jun 7, 2026

Uh oh!

kg Jun 7, 2026

Uh oh!

jakobbotsch Jun 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

kg commented Jun 5, 2026

Uh oh!

dotnet-policy-service Bot commented Jun 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

AndyAyersMS left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants