[cDAC][wasm] Decode R2R variable locations and expose function identity

[lewing]

Summary

Decode ReadyToRun WebAssembly variable locations through cDAC while keeping wasm unwind state and function identity in the shared StackWalk contract.

• Maintain coherent WASM SP/IP/logical-FP context across R2R unwind and explicit Frame seeding.
• Decode packed wasm register locations as symbolic WasmLocal(Index, WasmDebugValueType) / WasmLocalPair values.
• Resolve VLT_STK from the logical frame pointer already stored in the frame context.
• Expose module-qualified R2R function identity through IStackWalk.
• Preserve packed ICorDebugInfo::VarLoc data through DacDbi.
• Report engine-private locals as unavailable instead of fabricating register value 0.

Temporary stack

Important

This draft depends on #133086 and temporarily includes its producer commits because GitHub cannot target the fork-only lewing-r2r-wasm-debug-info branch from an upstream pull request. After #133086 merges, those commits will disappear when this branch is rebased onto main.

Lower-layer #133086 head: bf831077c6d51ee05f570f86ec534f52a058747c.

Included producer commits:

• e8a353f9c13 — [wasm] Preserve R2R variable debug info
• 3979515fee3 — [wasm] Exclude portable entry pointer from debug variables
• 98296005063 — [wasm] Centralize variable debug register encoding constants
• bf831077c6d — [wasm] Advertise variable debug register encoding

All producer constants and target descriptor globals are now owned by #133086. The consumer history is exactly three commits:

• f1bce1b092d — [cdac][wasm] Maintain frame context and expose function identity
• 4468c51ff7e — [cdac][wasm] Decode ReadyToRun variable locations
• 69ad34f88ef — [cdac][wasm] Characterize unavailable variable values

No native stack registration is intended.

StackWalk context and function identity

Native WASM RtlVirtualUnwind updates InterpreterSP, InterpreterIP, and the funclet-resolved InterpreterFP together. cDAC now maintains the same invariant:

• R2R InlinedCallFrame marker INLINED_PINVOKE_FROM_R2R derives IP/FP from CallSiteSP rather than treating marker 1 as an IP.
• TransitionFrame uses its saved R2R SP, lazily derives a zero return address, and derives FP only when the saved SP/IP are valid. The generic TransitionBlock + sizeof argument-area fallback is never parsed as a shadow frame.
• Software exception frames copy the full serialized WASM context.
• Reverse P/Invoke is detected from GC info; native caller bytes are not probed as a possible shadow frame. Caller SP is retained with IP/FP cleared.

IStackWalk.GetWasmFunctionIdentity is valid only for ReadyToRun frameless frames and returns:

FunctionTableIndex      raw runtime-global shared-table index from the frame
Module?                 owning R2R Module
RuntimeFunctionIndex?   RUNTIME_FUNCTION index within that image
IsFunclet?              nullable classification when the range/entry is unresolved

Runtime shared-table indices are globally relocated by each module's tableBase, but V8 func_index values are module-local. Consumers therefore need both the owning module and image-relative runtime-function index to select the correct wasm script and translate through its element section. Native markers and interpreter frames are rejected before any stack bytes are read.

The prior standalone public WasmFrameLayout helper has been removed; wasm-specific unwind helpers remain internal, consistent with #130988 review feedback.

Variable locations

RyuJIT packs a local index and JIT debug value type into the 32-bit RegNum payload. The encoding constants now live in ICorDebugInfo; cDAC receives the shift and value-count through WASM-only numeric descriptor globals:

• WasmDebugRegisterTypeShift
• WasmDebugValueTypeCount

A non-empty WASM Vars stream with missing, mismatched, or impossible encoding metadata fails explicitly. Invalid packed registers do not fall back to ordinary native register locations.

WasmDebugValueType intentionally names JIT debug-encoding vocabulary, not the complete WebAssembly specification type set. Managed references currently collapse to the JIT's machine I32/I64 representation; unknown codes remain unsupported.

Current JIT stack locations encode base register 2. cDAC resolves those locations from context.FramePointer. Speculative WasmBaseLocal fields were removed because a future producer that named a real FP local would require explicit/versioned semantics, not silently ignoring that local's value.

Exact producer and consumer validation

The pre-#133086 browser baseline contained 5,323 functions with debug bounds and exactly 0 variable entries.

Exact producer records were validated for every range in AddDoubles and SumWithFinally, including:

AddDoubles
var 0 Parameter 0 [0x00,0x22) VLT_REG  0x80000001 = $1 f64
var 0 Parameter 0 [0x22,0x34) VLT_STK2 base=2 offset=0x18
var 1 Parameter 1 [0x00,0x22) VLT_REG  0x80000002 = $2 f64
var 1 Parameter 1 [0x22,0x34) VLT_STK2 base=2 offset=0x10

SumWithFinally
var 0 Parameter 0 [0x00,0x3B)  VLT_REG 0x20000001
var 0 Parameter 0 [0x3B,0x1F2) VLT_STK base=2 offset=0x2C
var 1 Local 0     [0x3B,0x1F2) VLT_STK base=2 offset=0x24

Raw variable bytes from the producer image passed through cDAC and DacDbiImpl.ConvertToVarLoc with exact packed registers and stack offsets.

Live root-frame validation

Sample.Test.PrintMeaning
raw function index 6
cDAC variable 0 / parameter 0
range [0x0,0x32)
WasmLocal(Index=1, I32)
DacDbi VLT_REG 0x20000001
live V8 $var1 : i32, nonzero

The live $var1 value varied across processes, confirming that availability plus exact function/local/type is the correct assertion—not an exact process-specific raw value.

Live funclet stack validation

A no-opt SumWithFinally specimen was paused inside its real finally funclet:

root V8 func_index     7
funclet V8 func_index  8
funclet $var1          2086624   (parent/establishing FP)
root DebugInfo local0  range [0x3B,0x1FC)
location               VLT_STK base=2 offset=0x24
memory [FP+0x24]       07 00 00 00
expected local value   7

This validates the containing-method path and parent-frame stack address without using #131161's synthetic virtual-IP base as live truth.

Tests

• cDAC UnitTests: 3,206 passed, 0 failed, 0 skipped.
• Focused wasm cDAC tests after the final restack: 88 passed, 0 failed.
• tools.cdactests: UnitTests, DataGeneratorTests, and UsageTests all passed.
• Browser wasm R2R tests: 83 passed, 0 failed, 37 skipped.
• Browser clr+libs build: 0 warnings, 0 errors.
• JIT format: passed.
• Rubber-duck architectural re-review of the redesigned consumer: APPROVE, with every prior blocker/high finding verified resolved.

Guard mutations were visibly applied and each went red before restoration:

1. Advertised/decode shift mismatch rejected exact local identity.
2. Removing the pre-existing _totalSize == 0 GetBytes guard returned successful plausible zero and failed its characterization.
3. Removing the ReadyToRun-frame identity gate allowed native/interpreter false-frame bytes and failed both tests.
4. Removing caller FP update left stale funclet FP and failed the context test.

External consumer compatibility

Tank validated the redesigned reader through every cDAC surface currently exposed by the Blazor-Playground/nesm CDP/MCP consumer:

• Nesm.Cdp cDAC gates: 10 passed, 0 failed, 0 skipped.
• Nesm.Mcp cDAC gates: 4 passed, 0 failed, 0 skipped.
• Missing-reader rebuild returned cdac_support_unavailable, not zero discovery or a fabricated value.
• Exact live d5 target: Sample.Test.PrintMeaning, module-local function index 6, instruction/break offset 1627, V8 $var1 index 1, type i32, nonzero value, and Coreclr/Wasm cDAC provenance.

Nesm does not yet expose IDebugInfo.GetMethodVarInfo / DacDbi DoVars, so the final WasmLocal(Index=1, I32) descriptor-to-$var1 join remains a named nesm follow-up. The restacked consumer patch under src/native/managed/cdac has the same stable patch-id as the externally validated d5f26e6 consumer logic; this restack only moved producer-owned constants and descriptor advertisement into the updated #133086 lower layer.

Accuracy and limitations

• The unavailable-value commit characterizes pre-existing ClrDataValue behavior; it does not introduce _totalSize == 0 -> E_NOINTERFACE.
• The no-plausible-zero claim applies to engine-private wasm register locals. Existing cross-platform VLT_STK_BYREF best-effort dereference behavior is unchanged and may retain address zero on an unreadable pointer.
• No native DAC is built on WASM, so DacDbi parity is structural managed unit coverage rather than live _legacyImpl comparison.
• Reference and v128 encodings have synthetic decode coverage but their live V8 representations remain unproven.
• Nesm independently loads the reader and validates live function/module/local identity through its current public surface. It still does not expose cDAC GetMethodVarInfo, so the descriptor-to-CDP join remains a nesm follow-up.
• [cDAC] WebAssembly support: stack walking and managed metadata resolution #130988's reviewer explicitly noted that the WASM unwinder had not been locally run/verified and should eventually enter cDAC CI: [cDAC] WebAssembly support: stack walking and managed metadata resolution #130988 (review). This PR adds substantial unit and live coverage, but browser-wasm cDAC stack-walk CI remains desirable.

Producer ownership and redesigned-reader external validation are satisfied. The PR remains draft pending Larry's decision and lower-layer #133086 readiness; it is not being marked ready by this update.

Note

This pull request description was generated with GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 7 pipeline(s).
9 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @steveisok, @tommcdon, @dotnet/dotnet-diag
See info in area-owners.md if you want to be subscribed.

[dotnet-policy-service]

Tagging subscribers to 'arch-wasm': @lewing, @pavelsavara
See info in area-owners.md if you want to be subscribed.