fix: trace active-mt local table traversal

Author: Frityet

notes/m6.md

@@ -894,3 +894,26 @@ M6 active-MT recorder table boundary:
     secondary-TG table allocation, shared table-read/write, and `__index`
     fallback trace coverage in `t-jit-secondary.lua`;
   - `LJ_TEST_DISABLE_BUILD_CACHE=1 tools/ci/lua_test.sh m6_jit_table_store_helper`.
+
+M6 trace-local `next()` recording:
+- Narrowed the active-MT `next()` recorder fence to non-trace-local tables.
+  A table allocated by the same trace through `TNEW`/`TDUP` has no published
+  pre-existing array/hash generation for another TG to race while the recorder
+  predicts the key/value result types, so stock trace-local `next(t, nil)`
+  recording can stay enabled. Non-trace-local shared traversal still raises
+  NYI under active MT and uses the interpreter path until the traversal-index
+  contract is helper-backed and generation-safe.
+- Added secondary-TG coverage in `tests/t-jit-secondary.lua` for a hot loop
+  that allocates a fresh table, records `next(t, nil)`, and verifies both the
+  stock result and an emitted trace while active MT is latched.
+- Fixed x64 `asm_tvptr()` temp-slot routing so future IR calls that mark
+  `IRTMPREF_OUT2` address `tmptv2` instead of aliasing the first output temp.
+  The current trace-local `next()` path does not need the second output helper,
+  but this keeps the tempref contract correct for the pending shared-traversal
+  helper work.
+- Verification:
+  - `LJ_TEST_DISABLE_BUILD_CACHE=1 tools/ci/lua_test.sh m5_tab_resize_stress`;
+  - `tools/ci/lua_test.sh m5_tab_next_snapshot`;
+  - `LJ_TEST_DISABLE_BUILD_CACHE=1 tools/ci/lua_test.sh m6_jit_token`;
+  - `tools/ci/lua_test.sh m6_jit_table_store_helper`;
+  - `git diff --check`.

src/lj_asm_x86.h

@@ -1239,7 +1239,7 @@ static void asm_tvptr(ASMState *as, Reg dest, IRRef ref, MSize mode)
 #endif
     }
   }
-  if (mode & IRTMPREF_IN2)
+  if (mode & (IRTMPREF_IN2|IRTMPREF_OUT2))
     emit_leatg(as, dest, tmptv2);
   else
     emit_leatg(as, dest, tmptv);

src/lj_record.c

@@ -2093,16 +2093,8 @@ int lj_record_next(jit_State *J, RecordIndex *ix)
 {
   IRType t, tkey, tval;
   TRef trvk;
-  /*
-  ** lj_vm_next returns a key/value pair plus the next traversal index, while
-  ** the recorder predicts result types from the current table generation.
-  ** Another TG can resize the table between those two observations. Keep
-  ** stock single-threaded traversal recording, but after MT activation leave
-  ** traversal to the interpreter until the index/type contract is
-  ** generation-safe.
-  */
-  if (mt_active_acq(J2G(J)))
-    lj_trace_err(J, LJ_TRERR_NYIBC);
+  if (mt_active_acq(J2G(J)) && !rec_idx_tab_trace_local(J, ix->tab))
+    lj_trace_err_info(J, LJ_TRERR_NYIBC);
   t = rec_next_types(tabV(&ix->tabv), ix->keyv.u32.lo);
   tkey = (t & 0xff); tval = (t >> 8);
   trvk = lj_ir_call(J, IRCALL_lj_vm_next, ix->tab, ix->key);

tests/t-jit-secondary.lua

@@ -106,19 +106,40 @@ local worker = th.spawn(function()
   local write_traces = trace_count(32)
   assert(write_traces > 0)
 
+  jit.flush()
+  jit.opt.start("hotloop=1", "hotexit=1", "-sink")
+
+  local function table_next(n)
+    local s = 0
+    for i = 1, n do
+      local t = { only = i }
+      local key, value = next(t, nil)
+      assert(key == "only")
+      s = s + value
+    end
+    return s
+  end
+
+  for _ = 1, 20 do
+    assert(table_next(80) == 3240)
+  end
+  local next_traces = trace_count(32)
+  assert(next_traces > 0)
+
   return root_traces, side_traces, table_traces, read_traces, index_traces,
-	 write_traces, th.current():id()
+	 write_traces, next_traces, th.current():id()
 end)
 
 local ok, root_traces, side_traces, table_traces, read_traces, index_traces,
-      write_traces, tid = worker:join()
-assert(ok == true)
+      write_traces, next_traces, tid = worker:join()
+assert(ok == true, tostring(root_traces))
 assert(type(root_traces) == "number" and root_traces > 0)
 assert(type(side_traces) == "number" and side_traces > root_traces)
 assert(type(table_traces) == "number" and table_traces > 0)
 assert(type(read_traces) == "number" and read_traces > 0)
 assert(type(index_traces) == "number" and index_traces > 0)
 assert(type(write_traces) == "number" and write_traces > 0)
+assert(type(next_traces) == "number" and next_traces > 0)
 assert(tid == worker:id())
 
-print("t-jit-secondary OK: secondary TG records, enters, side-traces, allocates tables, reads/writes shared tables, and preserves __index reads in x64 mcode")
+print("t-jit-secondary OK: secondary TG records, enters, side-traces, allocates tables, reads/writes shared tables, records trace-local next(), and preserves __index reads in x64 mcode")