Add FT-safe list subscript HIR

Summary: Adds `ListSubscr`, an FT-safe specialization for exact-list subscripts that cannot use the borrowed `LoadArrayItem` path. It lowers to a runtime helper using `PyList_GetItemRef()` so the result is an owned reference.

Reviewed By: mpage

Differential Revision: D110910346

fbshipit-source-id: ad41ec6a96b60a1f4dc24110551821477854840c

Author: yoney

cinderx/Jit/hir/hir.cpp

@@ -499,6 +499,7 @@ bool Instr::isReplayable() const {
     case Opcode::kIsTruthy:
     case Opcode::kListAppend:
     case Opcode::kListExtend:
+    case Opcode::kListSubscr:
     case Opcode::kLoadAttr:
     case Opcode::kLoadAttrCached:
     case Opcode::kLoadAttrSpecial:
@@ -786,6 +787,7 @@ bool isPassthrough(const Instr& instr) {
     case Opcode::kIsTruthy:
     case Opcode::kListAppend:
     case Opcode::kListExtend:
+    case Opcode::kListSubscr:
     case Opcode::kLoadArg:
     case Opcode::kLoadArrayItem:
     case Opcode::kLoadAttr:

cinderx/Jit/hir/hir.h

@@ -3383,6 +3383,23 @@ class INSTR_CLASS(
       : InstrT(dst, left, right, frame) {}
 };
 
+// FT-only specialized list subscript. This is the free-threaded counterpart
+// to the GIL-build `LoadArrayItem` fast path, but returns an owned reference.
+class INSTR_CLASS(
+    ListSubscr,
+    (TListExact, TLongExact),
+    HasOutput,
+    Operands<2>,
+    DeoptBase) {
+ public:
+  ListSubscr(
+      Register* dst,
+      Register* left,
+      Register* right,
+      const FrameState& frame)
+      : InstrT(dst, left, right, frame) {}
+};
+
 // Return a new iterator for the object, or return it if it's an iterator
 class INSTR_CLASS(GetIter, (TObject), HasOutput, Operands<1>, DeoptBase) {
  public:

cinderx/Jit/hir/instr_effects.cpp

@@ -146,6 +146,7 @@ MemoryEffects memoryEffects(const Instr& inst) {
     case Opcode::kInvokeStaticFunction:
     case Opcode::kIsInstance:
     case Opcode::kIsTruthy:
+    case Opcode::kListSubscr:
     case Opcode::kLoadAttr:
     case Opcode::kLoadAttrCached:
     case Opcode::kLoadAttrSpecial:
@@ -516,6 +517,7 @@ bool hasArbitraryExecution(const Instr& inst) {
     case Opcode::kInvokeStaticFunction:
     case Opcode::kIsInstance:
     case Opcode::kIsTruthy:
+    case Opcode::kListSubscr:
     case Opcode::kLoadAttr:
     case Opcode::kLoadAttrCached:
     case Opcode::kLoadAttrSpecial:

cinderx/Jit/hir/ops.h

@@ -96,6 +96,7 @@ namespace cinderx::jit::hir {
   V(IsTruthy)                      \
   V(ListAppend)                    \
   V(ListExtend)                    \
+  V(ListSubscr)                    \
   V(LoadArrayItem)                 \
   V(LoadFieldAddress)              \
   V(LoadArg)                       \

cinderx/Jit/hir/parser.cpp

@@ -517,6 +517,12 @@ HIRParser::parseInstr(std::string_view opcode, Register* dst, int bb_index) {
       NEW_INSTR(DictSubscr, dst, dict, key, FrameState{});
       break;
     }
+    case Opcode::kListSubscr: {
+      auto list = parseRegister();
+      auto idx = parseRegister();
+      NEW_INSTR(ListSubscr, dst, list, idx, FrameState{});
+      break;
+    }
     case Opcode::kStoreSubscr: {
       auto receiver = parseRegister();
       auto index = parseRegister();

cinderx/Jit/hir/pass.cpp

@@ -203,6 +203,7 @@ Type outputType(
     case Opcode::kImportFrom:
     case Opcode::kImportName:
     case Opcode::kInvokeIterNext:
+    case Opcode::kListSubscr:
     case Opcode::kLoadAttr:
     case Opcode::kLoadAttrCached:
     case Opcode::kLoadAttrSpecial:

cinderx/Jit/hir/printer.cpp

@@ -276,6 +276,7 @@ static std::string format_immediates(const Function* func, const Instr& instr) {
     case Opcode::kIsTruthy:
     case Opcode::kListAppend:
     case Opcode::kListExtend:
+    case Opcode::kListSubscr:
     case Opcode::kLoadCellItem:
     case Opcode::kLoadCurrentFunc:
     case Opcode::kLoadFrame:

cinderx/Jit/hir/simplify.cpp

@@ -880,23 +880,33 @@ Register* simplifySubscript(Env& env, const BinaryOp* instr) {
     }
   }
 
-  // TODO(T255264263). Enable this for FT builds. See P2169673256.
-  if (!kFreeThreadedBuild && (lhs->isA(TListExact) || lhs->isA(TTupleExact))) {
-    Register* adjusted_idx =
-        unboxAndCheckListOrTupleIndex(env, instr, lhs, rhs);
-    if (adjusted_idx == nullptr) {
-      return nullptr;
-    }
-    Py_ssize_t offset = offsetof(PyTupleObject, ob_item);
-    Register* array = lhs;
-    // Lists carry a nested array of ob_item whereas tuples are variable-sized
-    // structs.
+  if constexpr (kFreeThreadedBuild) {
+    // In free-threaded builds we can't use the borrowed LoadArrayItem path
+    // for lists because another thread may overwrite the slot at any time.
+    // With an exact list, we can still skip PyObject_GetItem's generic
+    // dispatch by emitting ListSubscr, which returns an owned reference
+    // via PyList_GetItemRef.
     if (lhs->isA(TListExact)) {
-      array = env.emit<LoadField>(
-          lhs, "ob_item", offsetof(PyListObject, ob_item), TCPtr);
-      offset = 0;
+      return env.emit<ListSubscr>(lhs, rhs, *instr->frameState());
+    }
+  } else {
+    if (lhs->isA(TListExact) || lhs->isA(TTupleExact)) {
+      Register* adjusted_idx =
+          unboxAndCheckListOrTupleIndex(env, instr, lhs, rhs);
+      if (adjusted_idx == nullptr) {
+        return nullptr;
+      }
+      Py_ssize_t offset = offsetof(PyTupleObject, ob_item);
+      Register* array = lhs;
+      // Lists carry a nested array of ob_item whereas tuples are variable-sized
+      // structs.
+      if (lhs->isA(TListExact)) {
+        array = env.emit<LoadField>(
+            lhs, "ob_item", offsetof(PyListObject, ob_item), TCPtr);
+        offset = 0;
+      }
+      return env.emit<LoadArrayItem>(array, adjusted_idx, lhs, offset, TObject);
     }
-    return env.emit<LoadArrayItem>(array, adjusted_idx, lhs, offset, TObject);
   }
 
   // Unicode subscript.

cinderx/Jit/jit_rt.cpp

@@ -2218,4 +2218,22 @@ PyObject* invokeIterNext(PyObject* iterator) {
   return &iterDoneSentinel;
 }
 
+PyObject* listSubscript(
+    [[maybe_unused]] PyObject* list,
+    [[maybe_unused]] PyObject* index) {
+#ifdef Py_GIL_DISABLED
+  Py_ssize_t i = PyNumber_AsSsize_t(index, PyExc_IndexError);
+  if (i == -1 && PyErr_Occurred()) {
+    return nullptr;
+  }
+  if (i < 0) {
+    // Resolve negative indices against the current size.
+    i += PyList_GET_SIZE(list);
+  }
+  return PyList_GetItemRef(list, i);
+#else
+  JIT_ABORT("listSubscript is only used in free-threaded builds");
+#endif
+}
+
 } // namespace cinderx::jit::rt

cinderx/Jit/jit_rt.h

@@ -569,6 +569,12 @@ extern PyObject iterDoneSentinel;
  */
 PyObject* invokeIterNext(PyObject* iterator);
 
+/*
+ * FT-safe exact-list subscript used by ListSubscr. Uses PyList_GetItemRef so
+ * the result is an owned reference.
+ */
+PyObject* listSubscript(PyObject* list, PyObject* index);
+
 } // namespace cinderx::jit::rt
 
 #if PY_VERSION_HEX >= 0x030D0000