0%

s13 — Unwinding + Exception Handling

Goal

Panics propagate correctly through native-compiled frames on every target: DWARF CFI + Itanium personality on ELF/Mach-O, SEH funclets on Windows, Invoke/Resume unwind edges fully lowered (replacing the s10 abort stubs), and cleanup-edge ownership exactly matching AIMS-frozen identity and order.

Implementation Sketch

  • Itanium path (linux/macos + qemu targets): .eh_frame CFI emission for every function (prologue/epilogue rules, callee-saved tracking from regalloc), LSDA call-site tables for Invoke landing-pad-equivalents, personality routine linkage (reuse the existing runtime personality contract — ori_panic is extern C-unwind; mirror ori_llvm’s Itanium model), Resume re-raise.
  • Cleanup-edge ownership: unwind blocks carry AIMS-frozen logical cleanup events (unwind_cleanup output in the realized ArcFunction). BIR/MIR preserve their stable identities and order; the selected physical plan chooses the decrement/helper encoding. Extend the s06 preservation check over unwind edges; bracket double panic via ori_drop_cleanup_enter/ori_drop_cleanup_exit.
  • SEH path (Windows): funclet-based cleanup (the existing ori_llvm SEH model — cleanuppad-equivalent funclets, ori_try_call trampoline shape at seh_main_thunk precedent); CodeView-adjacent unwind info (.pdata/.xdata) for x64.
  • wasm: no unwinding in MVP wasm — panic maps to trap/abort per the existing wasm EH posture (EhModel::Itanium is configured for wasm in LLVM but traps in practice; mirror observable behavior; decision recorded).
  • Per-target CFI encoders: x86-64/aarch64/riscv64/s390x CFI directives differ (return-address column, save-slot conventions); the s390x 160-byte save area interacts with CFI.

Test Strategy

  • Matrix: {panic in leaf, panic through N frames, panic with live RC values needing cleanup, catch via ori_run_main boundary, double-panic} x targets (SEH cells on Windows CI or cross-validation fixture) — evaluator/VM/LLVM/native parity for every applicable cell.
  • Semantic pin: cleanup-edge ownership pin — a panic path executes exactly the AIMS-frozen logical cleanup set and order. Compare the ORI_TRACE_RC physical projection with the LLVM twin; require a clean leak check across a caught panic.
  • Negative pin: corrupted CFI fixture fails the unwind test (not silently absorbed); double-panic aborts with the canonical message.

Work Items

  • .eh_frame CFI emission per target (x86-64/aarch64/riscv64/s390x) driven by regalloc frame data.
  • LSDA + personality + Invoke/Resume lowering (unwind edges real; s10 stubs deleted); exact frozen cleanup/unwind-event correspondence extended, with the selected CompiledLayoutPlan separately validating its physical action sequence.
  • Windows SEH funclets + .pdata/.xdata unwind info.
  • wasm trap posture decision + implementation matching observable LLVM-backend behavior.
  • Panic matrix green on all targets with cleanup-RC pins, cross-backend parity, leak-clean caught-panic, double-panic abort pin.