[cDAC][wasm] Decode R2R variable locations and expose function identity

[lewing]

Summary

Decode ReadyToRun WebAssembly variable locations through cDAC while keeping wasm unwind state and function identity in the shared StackWalk contract.

• Maintain coherent WASM SP/IP/logical-FP context across R2R unwind and explicit Frame seeding.
• Decode packed wasm register locations as symbolic WasmLocal(Index, WasmDebugValueType) / WasmLocalPair values.
• Resolve VLT_STK from the logical frame pointer already stored in the frame context.
• Expose module-qualified R2R function identity through IStackWalk.
• Preserve packed ICorDebugInfo::VarLoc data through DacDbi.
• Distinguish engine-private locals, unreadable/null byref indirections, and readable stack-homed null references.

Temporary stack

Important

This draft depends on both #133917 and #133086. Their head branches live in the lewing/runtime fork, so this upstream PR cannot target either branch directly and temporarily contains both lower layers. After those PRs merge, their commits will disappear when this branch is rebased onto main.

Lower-layer heads:

• [cDAC][wasm] Resolve ReadyToRun virtual IP ranges #133917: 443fb559f4771c3fbf31a1e85d07ef9aebfd10cc
• [wasm] Preserve R2R variable debug information #133086: 2ea1ed1481d412fa5f461f1b355ce8e51a985dde

The temporary history is exactly:

1. Five [cDAC][wasm] Resolve ReadyToRun virtual IP ranges #133917 virtual-IP commits through 443fb559f47.
2. Six [wasm] Preserve R2R variable debug information #133086 producer commits through replayed a7a349ecf4d.
3. Three consumer commits:
   • 4aac9657b3c — [cdac][wasm] Maintain frame context and expose function identity
   • 657f254f921 — [cdac][wasm] Decode ReadyToRun variable locations
   • 7e72c0e0d16 — [cdac][wasm] Handle unavailable variable values

Producer constants, encoding globals, optimized-record tests, GC specimens, and stack-base invariants remain owned by #133086. Virtual-IP descriptor/traversal and filter-funclet classification remain owned by #133917.

Corrected virtual-IP dependency

#133917 fixes the live runtime model that #130988's mock test did not represent: WASM ReadyToRun virtual IPs are registered in ExecutionManager::s_pVirtualIPRangeList, not RangeSectionMap.

This PR consumes that shared correction rather than adding a parallel lookup. The integrated reader:

• resolves real virtual IP ranges before ordinary RangeSectionMap lookup;
• masks the WASM funclet bit for runtime-function ordering/address arithmetic while retaining funclet identity;
• keeps synthetic virtual entrypoint bases separate from loaded-image bases used for RVA reads;
• uses the actual WASM descriptor shape;
• resolves an executable FilterOffset to its containing runtime function before comparing the masked funclet start.

The last point reflects corrected #133917 head 443fb559f47. A filter entry may be inside the filter runtime function rather than exactly at its start; raw FilterOffset == funcletStart equality is intentionally not used.

StackWalk context and function identity

Native WASM RtlVirtualUnwind updates InterpreterSP, InterpreterIP, and the funclet-resolved InterpreterFP together. cDAC now maintains the same invariant:

• R2R InlinedCallFrame marker INLINED_PINVOKE_FROM_R2R derives IP/FP from CallSiteSP rather than treating marker 1 as an IP.
• TransitionFrame uses its saved R2R SP, lazily derives a zero return address, and derives FP only when the saved SP/IP are valid. The generic argument-area fallback is never parsed as a shadow frame.
• Software exception frames copy the full serialized WASM context.
• Reverse P/Invoke does not probe native caller bytes as a shadow frame. Caller SP is retained with IP/FP cleared.
• A successful unwind into a non-R2R caller likewise retains caller SP with a null IP; a direct regression test pins this boundary.

IStackWalk.GetWasmFunctionIdentity is valid only for ReadyToRun frameless frames and returns:

FunctionTableIndex      raw runtime-global shared-table index from the frame
Module?                 owning R2R Module
RuntimeFunctionIndex?   RUNTIME_FUNCTION index within that image
IsFunclet?              nullable classification when the range/entry is unresolved

Runtime table indices are globally relocated by each module's tableBase, but V8 func_index values are module-local. Consumers therefore need the owning module plus image-relative runtime-function index to select the correct script and translate through its element section.

Logical frame pointer and stack locations

Current producer stack records encode base register 2; REG_FPBASE, REG_SPBASE, and REGNUM_AMBIENT_SP collapse to that value on WASM. The record identifies a logical frame-relative home, not a particular V8 local.

The absolute frame pointer is reconstructed from shadow-stack memory by the shared unwinder:

• root without localloc: logical FP aliases SP;
• root with localloc: logical FP remains the fixed pre-adjustment frame base;
• funclet: logical FP is the parent/establishing method frame.

Measured engine-local indices ($0, $1, $3) are current codegen observations, not cDAC format or API. No FP-local metadata is required. Variable resolution consumes WasmContext.FramePointer.

Variable locations

RyuJIT packs a local index and JIT debug value type into the 32-bit RegNum payload. cDAC receives the encoding from target globals:

• WasmDebugRegisterTypeShift
• WasmDebugValueTypeCount

A non-empty WASM Vars stream with missing, mismatched, impossible, or unknown encoding metadata fails explicitly. Invalid packed registers do not fall back to native register locations.

The contract reports:

• VLT_REG / VLT_REG_BYREF as WasmLocal;
• VLT_REG_REG as WasmLocalPair;
• stack-based kinds as linear-memory locations resolved from the logical context FP.

WasmDebugValueType is JIT debug-encoding vocabulary, not the full stable WebAssembly specification type set. Managed references currently use the JIT's machine I32/I64 representation.

Unavailable and null values

Three cases remain intentionally distinct:

1. Engine-private WASM local: zero physical locations; GetBytes/GetAddress fail with E_NOINTERFACE.
2. Unreadable or null VLT_STK_BYREF indirection: one logical location remains, matching native location count, while address/value/object access fails with CORDBG_E_READVIRTUAL_FAILURE.
3. Direct stack-homed null reference: one readable location; reading its bytes succeeds and returns zero.

The native DAC converts a failed byref read to address zero and subsequently fails because native address zero is unmapped. WASM linear address zero is readable, so carrying that fallback forward would fabricate a successful unrelated value. Non-WASM behavior is unchanged.

Producer validation from #133086

The producer now has exact MinOpts and FullOpts coverage. This is not a minopts-only feature, and optimized-away locals are explicitly absent rather than required to appear.

Representative exact records include:

GcSlotIdentity
local0 [0x36,0x2B1) VLT_STK base=2 offset=0x48  GcMarker(Value=17)
local1 [0x36,0x2B1) VLT_STK base=2 offset=0x44  GcMarker(Value=29)
local2 [0x36,0x2B1) VLT_STK base=2 offset=0x40  legitimate null
local3 [0x36,0x2B1) VLT_STK base=2 offset=0x3C

The reference slots are producer-verified GC_FRAMEREG_REL, pinned/untracked roots across an actual GC. Their common method-wide range is a documented current producer limitation; this PR does not claim per-local range-end fidelity.

Existing live validation

The previous live non-filter validations remain applicable to the equivalent consumer behavior:

Sample.Test.PrintMeaning
module-local function index 6
WasmLocal(Index=1, I32)
live V8 $var1: i32, nonzero

A no-opt SumWithFinally finally-funclet pause also demonstrated parent-FP stack resolution and a known value read from FP + offset.

These runs did not exercise filter-funclet classification. The corrected 443fb559f47 filter behavior is current through focused cDAC tests, including the non-equal filter-entry case. No claim is made that the old full-stack live artifact validates that corrected filter path.

Live two-marker/null C2 validation remains a follow-up on the coherent combined reader/runtime artifact; the producer descriptor and root-slot oracle are now fixed by #133086.

Tests after corrected restack

• Exact filter-funclet test group: 3 passed, 0 failed.
• Focused corrected integration group: 67 passed, 0 failed.
• cDAC UnitTests: 3,231 passed, 0 failed, 0 skipped.
• tools.cdactests:
  • UnitTests: passed;
  • DataGeneratorTests: passed;
  • UsageTests/generated documentation: passed.
• Generated StackWalk.md usage section was refreshed and verified current.
• Post-restack code review found one missing null-IP boundary test/documentation issue; both were added before the final green run.

Existing mutation evidence includes packed-register mismatch, unavailable-value regression, frame-kind identity gating, stale funclet FP, C3 DereferenceOrZero fallback, and #133917's filter-entry raw-equality mutation.

Limitations and readiness

• No native DAC is built on WASM, so DacDbi parity is structural managed unit coverage rather than live _legacyImpl comparison.
• Reference and v128 register encodings have synthetic decode coverage but their live V8 representations remain unproven.
• Nesm's current public tools still do not expose IDebugInfo.GetMethodVarInfo, so the final descriptor-to-CDP join remains a consumer follow-up.
• Browser-wasm cDAC stack-walk CI remains desirable; [cDAC] WebAssembly support: stack walking and managed metadata resolution #130988's reviewer explicitly noted that the WASM specifics were not locally verified: [cDAC] WebAssembly support: stack walking and managed metadata resolution #130988 (review).

The corrected lower-layer integration is complete, but this PR remains draft pending lower-PR readiness and Larry's decision. It is not being marked ready by this update.

Note

This pull request description was generated with GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 7 pipeline(s).
9 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @steveisok, @tommcdon, @dotnet/dotnet-diag
See info in area-owners.md if you want to be subscribed.

[dotnet-policy-service]

Tagging subscribers to 'arch-wasm': @lewing, @pavelsavara
See info in area-owners.md if you want to be subscribed.