[cDAC][wasm] Decode R2R variable locations and expose function identity

[lewing]

Summary

Decode ReadyToRun WebAssembly variable locations through cDAC while keeping wasm unwind state and function identity in the shared StackWalk contract.

• Maintain coherent WASM SP/IP/logical-FP context across R2R unwind and explicit Frame seeding.
• Decode wasm register locations (localIndex + WASM_LOCAL_REGNUM_BASE) as symbolic WasmLocal(Index) / WasmLocalPair values.
• Resolve VLT_STK from the logical frame pointer already stored in the frame context.
• Expose module-qualified R2R function identity through IStackWalk.
• Preserve the original ICorDebugInfo::VarLoc register values through DacDbi.
• Distinguish engine-private locals, unreadable/null byref indirections, and readable stack-homed null references.

Temporary stack

Important

This draft depends on #133086, whose head branch lives in the lewing/runtime fork, so this upstream PR temporarily carries that lower layer. Its commits will drop out when this branch is rebased after #133086 merges.

Base and lower layer:

• main at 0d3ca16f488 (includes [cDAC][wasm] Resolve ReadyToRun virtual IP ranges #133917, [cDAC][wasm] Map portable entry points to interpreter code and R2R virtual IPs #134827, [cDAC][wasm] Fix stack walks and MethodDesc naming on WebAssembly #135044, [cDAC][wasm] Register platform GC-info decoding #135055, and [cDAC] Return no debug info for ReadyToRun images without a DebugInfo section #135059)
• [wasm] Preserve R2R variable debug information #133086 head a5b5ddcaea5, replayed onto that main as 12 producer commits c35209135e4..e0da19f58bd. [wasm] Preserve R2R variable debug information #133086's own branch contains a merge from an older main; replaying it linearizes the history. The changed lines match [wasm] Preserve R2R variable debug information #133086 exactly; only diff context differs, in three files that main also changed.

Three consumer commits:

• 019c45385b8: [cdac][wasm] Maintain frame context and expose function identity
• a90393058e5: [cdac][wasm] Decode ReadyToRun variable locations
• a9f61e79341: [cdac][wasm] Handle unavailable variable values

Producer constants, register/stack encodings, and producer invariant tests are owned by #133086. Virtual-IP traversal and filter-funclet classification came from #133917, function-table-index lookup from #134827, and consumer identity forwards through #134827's WasmFunctionTableIndexLookup.

Integration with merged PRs

• [cDAC][wasm] Fix stack walks and MethodDesc naming on WebAssembly #135044 (merged): shared R2R InlinedCallFrame handling. An active marker frame whose virtual IP can't be recovered leaves IP null, and the walker fails the walk, matching native StackFrameIterator::NextRaw. This PR keeps that policy and adds two things. Inactive frames (CallerReturnAddress == 0) return early, matching native FrameHasActiveCall. FP comes from the funclet-aware TryGetLogicalFramePointer, matching native GetWasmFramePointerFromStackPointer, instead of the root frame base [cDAC][wasm] Fix stack walks and MethodDesc naming on WebAssembly #135044 left for this PR. A new test pins the funclet case: reverting to the root frame base fails it (expected parent frame 0x200020, got funclet base 0x200000).
• [cDAC][wasm] Register platform GC-info decoding #135055 (merged): WASM GC info is now decoded by main's WasmGCInfoTraits, which matches native Wasm32GcInfoEncoding (including HAS_INTERRUPTIBLE_RANGES = false). This PR no longer carries its own traits class, registration, or duplicate traits tests and docs. [cDAC][wasm] Register platform GC-info decoding #135055's IsScratchRegister returns false; the dropped copy returned true defensively. Neither matters because RyuJIT does not keep GC references in WASM locals.
• [cDAC] Return no debug info for ReadyToRun images without a DebugInfo section #135059 (merged): ReadyToRun images without a DebugInfo section now report no debug info.

StackWalk context and function identity

Native WASM RtlVirtualUnwind updates InterpreterSP, InterpreterIP, and the funclet-resolved InterpreterFP together. cDAC now maintains the same invariant:

• R2R InlinedCallFrame marker INLINED_PINVOKE_FROM_R2R: shared handling ([cDAC][wasm] Fix stack walks and MethodDesc naming on WebAssembly #135044) derives SP/IP from CallSiteSP, and this PR supplies the funclet-aware logical FP.
• TransitionFrame uses its saved R2R SP, lazily derives a zero return address, and derives FP only when the saved SP/IP are valid. The generic argument-area fallback is never parsed as a shadow frame.
• Software exception frames copy the full serialized WASM context.
• Reverse P/Invoke does not probe native caller bytes as a shadow frame. Caller SP is retained with IP/FP cleared.
• A successful unwind into a non-R2R caller likewise retains caller SP with a null IP; a direct regression test pins this boundary.
• Reverse P/Invoke detection reads HasReversePInvokeFrame from the GC-info header, decoded by main's WasmGCInfoTraits ([cDAC][wasm] Register platform GC-info decoding #135055).

IStackWalk.GetWasmFunctionIdentity is valid only for ReadyToRun frameless frames and returns:

FunctionTableIndex      raw runtime-global shared-table index from the frame
Module?                 owning R2R Module
RuntimeFunctionIndex?   RUNTIME_FUNCTION index within that image
IsFunclet?              nullable classification when the range/entry is unresolved

Runtime table indices are globally relocated by each module's tableBase, but V8 func_index values are module-local. Consumers therefore need the owning module plus image-relative runtime-function index to select the correct script and translate through its element section.

Logical frame pointer and stack locations

Current producer stack records encode base register 2; REG_FPBASE, REG_SPBASE, and REGNUM_AMBIENT_SP collapse to that value on WASM. The record identifies a logical frame-relative home, not a particular V8 local.

The absolute frame pointer is reconstructed from shadow-stack memory by the shared unwinder:

• root without localloc: logical FP aliases SP;
• root with localloc: logical FP remains the fixed pre-adjustment frame base;
• funclet: logical FP is the parent/establishing method frame.

Measured engine-local indices ($0, $1, $3) are current codegen observations, not cDAC format or API. No FP-local metadata is required. Variable resolution consumes WasmContext.FramePointer.

Variable locations

Following #133086 c486ea8b02d, every register field in the WASM Vars stream holds a WebAssembly local index biased past the reserved register numbers:

register = localIndex + WASM_LOCAL_REGNUM_BASE   // 3, one past REGNUM_AMBIENT_SP

As on other targets, the value type is not encoded; it follows from the variable's type and the local's declaration. The earlier packed (index, value type) form, the WasmDebugValueType enum, and the WasmDebugRegisterTypeShift/WasmDebugValueTypeCount descriptor globals are gone from both producer and consumer. A register-only location whose register is a reserved pseudo-register (0–2) names no local and is rejected rather than reported as local $0 or a readable register.

The contract reports:

• VLT_REG / VLT_REG_BYREF as WasmLocal;
• VLT_REG_REG as WasmLocalPair;
• stack-based kinds as linear-memory locations resolved from the logical context FP.

For WASM, GetMethodVarInfo uses the ReadyToRun CodeBlock's controlling-method-relative ExecutionManager.GetRelativeOffset result, not the generic CodeVersions path that rejects portable-entrypoint MethodDescs.

Unavailable and null values

Three cases remain intentionally distinct:

1. Engine-private WASM local: zero physical locations; GetBytes/GetAddress fail with E_NOINTERFACE.
2. Unreadable or null VLT_STK_BYREF indirection: one logical location remains, matching native location count, while address/value/object access fails with CORDBG_E_READVIRTUAL_FAILURE.
3. Direct stack-homed null reference: one readable location; reading its bytes succeeds and returns zero.

The native DAC converts a failed byref read to address zero and subsequently fails because native address zero is unmapped. WASM linear address zero is readable, so carrying that fallback forward would fabricate a successful unrelated value. Non-WASM behavior is unchanged.

Live validation

The live validator was rewritten to check contract invariants instead of the codegen values pinned by the previous run. It no longer hardcodes slot offsets, variable ranges, break offsets, V8 function indices, $varN frame-pointer locals, or asset file names:

• GcSlotIdentity and CollectAtGcSafepoint are located through the loaded module's name and code sections.
• With [cDAC][wasm] Fix stack walks and MethodDesc naming on WebAssembly #135044 merged, the paused frame's MethodDesc token is checked strictly against the specimen's IL token.
• The pause is reached by breaking at CollectAtGcSafepoint entry and stepping out until execution returns to GcSlotIdentity. Only same-module runtime helper frames may sit between them; this run had one R2R delay-load helper. The pause is therefore after the blocking GC.Collect() returns.
• local → value bindings come from decoding the specimen's IL (ldc.i4 N; newobj GcMarker::.ctor; stloc X and ldnull; stloc Y).
• SP is $0 by the R2R calling convention. The logical FP and caller SP are reconstructed by cDAC from shadow-stack memory.
• For each IL local: every record uses the documented frame base 2 with one unambiguous offset. The resolved slot equals FP + offset, lies within [SP, callerSP), and the GC info reports the same FRAMEREG_REL slot as live for the whole method.

Build: browser clr+libs at this head (0 warnings, 0 errors), rebuilt because main changed runtime descriptors (#135044). The specimen file from #133086 is linked unmodified into the browser sample. Optimized R2R publish with -p:PublishReadyToRunStripDebugInfo=false (see below). Module SHA-256 6921b8c3ca5ec40bae5b92c538bab45b81e25229da9fb7e5c07f4e107f669416.

PAUSE    entry=0x406 call=0x58E helpers_between=1 step_outs=2 post_gc=0x591
FRAME    sp=0x1FD350 fp=0x1FD350 caller_sp=0x1FD3A0 vip=0x800104B5
IDENTITY raw=25424 module=0x40E9F4C rf=4 funclet=False method=token-0x06000005 (matches IL)
LOCAL0   [0x36,0x2A5) base=2 +0x48 slot=0x1FD398 GcMarker Value=17
LOCAL1   [0x36,0x2A5) base=2 +0x44 slot=0x1FD394 GcMarker Value=29
LOCAL2   [0x36,0x2A5) base=2 +0x40 slot=0x1FD390 null, one location, bytes 00000000
CONTROL  permuted homes keep the type but fail the 17/29 oracle
UNAVAILABLE engine local: 0 locations, GetBytes = E_NOINTERFACE
RESULT   PASS

The variable range end moved from 0x2B1 to 0x2A5 with the producer update; the previous pinned validator would have failed on that alone. On the previous base, a live mutation adding 4 to the consumer's stack offset failed (resolved to 0x1FDFDC, not FP+0x48), and the restored run was green again. That code path is unchanged by this restack.

What this run does not establish:

• FP equals SP at this pause (root method without localloc), so the SP-versus-FP base-selection control is not discriminating here. The earlier GcLocalAcrossFinally funclet run with FP ≠ SP remains the evidence for that.
• DebugInfo ranges are in JIT native-offset space, while WASM R2R GC info and the shadow frame use the synthetic virtual-IP space (GC code length here is 0x4). The validator does not compare across those spaces. General CDP byte-offset → DebugInfo-offset translation remains a follow-up.

Findings for consumers

• Disable unused ReadyToRun metadata on WebAssembly #134690 (merged) makes Browser/WASI ReadyToRun publishing pass --strip-debug-info by default, including for CoreLib and framework libraries. Default publishes therefore contain no variable debug info. Opt out with -p:PublishReadyToRunStripDebugInfo=false.
• On such stripped images, cDAC ReadyToRunJitManager.GetDebugInfo did not mirror native's m_pSectionDebugInfo == NULL early return (readytoruninfo.cpp). It dereferenced the null section pointer; on WASM address 0 is readable, so the result was BadImageFormatException instead of "no debug info". Fixed separately by [cDAC] Return no debug info for ReadyToRun images without a DebugInfo section #135059 (merged).

Tests

• cDAC UnitTests: 3,309 passed, 0 failed.
• ./build.sh -s tools.cdactests -test: UnitTests, DataGeneratorTests, and UsageTests passed; generated docs up to date.
• Consumer commit 1 builds alone and passes all unit tests (3,278). Commit 2 also passed alone (3,303) before the funclet test was folded into commit 1; that fold only adds a test, so its tree is otherwise unchanged.
• Mutations, each confirmed red then restored green:
  • InlinedCallFrame FP reverted to the root frame base: the new funclet test fails (expected 0x200020, got 0x200000);
  • on the previous base: decode base 3 → 2 (8 tests fail), dropping the bias (6 tests fail), and the live stack-offset corruption above.
• Earlier mutation evidence (unavailable values, frame-kind identity gating, stale funclet FP, C3 fallback, swapped C2 slots, CodeVersions offset path) still applies to logic unchanged by this restack.

Limitations and readiness

• No native DAC is built on WASM, so DacDbi parity is structural managed unit coverage rather than live _legacyImpl comparison.
• v128 and reference register locals have synthetic decode coverage only; their live V8 representations remain unproven.
• Browser-wasm cDAC CI remains desirable.

This PR remains draft pending #133086 and Larry's decision.

Note

This pull request description was generated with GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 7 pipeline(s).
9 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @steveisok, @tommcdon, @dotnet/dotnet-diag
See info in area-owners.md if you want to be subscribed.

[dotnet-policy-service]

Tagging subscribers to 'arch-wasm': @lewing, @pavelsavara
See info in area-owners.md if you want to be subscribed.