Fix ref count insertion bug that causes failure on 3.16

Summary:
Jit/hir/refcount_insertion.cpp keeps two pieces of transient state that must agree:

- env.borrowed_regs — the set of live RegStates that are Borrowed with non-empty support, so they can be promoted to Owned (with an Incref) when their support is invalidated.
- each RegState's own kind_.

invalidateBorrowSupport() walks env.borrowed_regs and asserts every entry is still borrowed. Three call sites moved a RegState to Uncounted via RegState::setUncounted() without removing it from env.borrowed_regs, so a later invalidation found a stale, non-borrowed
entry.

The one that actually fired is in processOutput(): for a passthrough instruction whose output type is immortal-only, the shared RegState is marked Uncounted while the model was still registered as borrowed. Compiling re._parser:parse with its inlined callees hits
this.

The change

Added a setUncounted(Env&, RegState&) helper that drops the borrowed_regs registration before changing the kind, and routed all three sites through it. env.borrow_support is intentionally left as-is — it's a union over all borrowed values, so bits can't be cleared for
one value in isolation, and over-approximating there only costs a scan that finds nothing to promote.

Reviewed By: yoney

Differential Revision: D116666441

fbshipit-source-id: 42c6091cb61e0dbe7a06b17a3ca7b28457e97393

Author: DinoV

cinderx/Jit/hir/refcount_insertion.cpp

@@ -519,6 +519,19 @@ void registerBorrowSupport(Env& env, RegState& rstate) {
   env.borrowed_regs.emplace(&rstate);
 }
 
+// Mark the given RegState Uncounted, dropping any registration it had in
+// env.borrowed_regs. An uncounted value never needs promoting to owned, so
+// leaving it registered would trip the invariant in invalidateBorrowSupport().
+//
+// env.borrow_support is deliberately left alone: it's the union of the support
+// of every borrowed value, so bits can't be cleared for one value in
+// isolation, and an over-approximation there only costs a scan that finds
+// nothing to promote.
+void setUncounted(Env& env, RegState& rstate) {
+  env.borrowed_regs.erase(&rstate);
+  rstate.setUncounted();
+}
+
 // Invalidate the borrow support represented by either a bit index or an
 // AliasClass, updating live value state and inserting Increfs to promote
 // values to owned as appropriate.
@@ -664,7 +677,7 @@ void useSimpleInState(Env& env, BasicBlock* block) {
     // immortal sentinel.
     if (block == cond->false_bb()) {
       Register* reg = cond->getOperand(0);
-      map_get(env.live_regs, reg).setUncounted();
+      setUncounted(env, map_get(env.live_regs, reg));
     }
   } else if (term->isCondBranchCheckType()) {
     // Ci_PyWaitHandleObject is an uncounted singleton, so we adjust its
@@ -673,7 +686,7 @@ void useSimpleInState(Env& env, BasicBlock* block) {
     if (cond->type() == TWaitHandle) {
       if (block == cond->true_bb()) {
         Register* reg = cond->getOperand(0);
-        map_get(env.live_regs, reg).setUncounted();
+        setUncounted(env, map_get(env.live_regs, reg));
       }
     }
   }
@@ -1034,7 +1047,7 @@ void processOutput(Env& env, const Instr& instr, const MemoryEffects& effects) {
     auto& rstate = map_get(env.live_regs, output);
     rstate.addCopy(output);
     if (isUncounted(output)) {
-      rstate.setUncounted();
+      setUncounted(env, rstate);
     }
     return;
   }