wasm32: add instantiated-TB counter; keep store-TCI (E4-E7 narrowed root cause)

tcg/wasm32.c

@@ -32,6 +32,12 @@
 
 __thread uintptr_t tci_tb_ptr;
 __thread bool wasm_tci_only_tb;
+static int instantiated_wasm_count;
+
+EMSCRIPTEN_KEEPALIVE int wasm_instantiated_tb_count(void)
+{
+    return qatomic_read(&instantiated_wasm_count);
+}
 
 /* Disassemble TCI bytecode. */
 int print_insn_tci(bfd_vma addr, disassemble_info *info)
@@ -68,6 +74,7 @@ EM_JS(int, instantiate_wasm, (), {
         var ptr = export_vec_begin + 4 * Module.__wasm32_tb.cur_core_num;
         const fidx = addFunction(inst.exports.start, 'ii');
         Module.__wasm32_tb.dynamic_functions.add(fidx);
+        globalThis.__xteinkDynamicFunctions = Module.__wasm32_tb.dynamic_functions.size;
         memory_v.setUint32(ptr, fidx, true);
 
         const remove_n = memory_v.getInt32(Module.__wasm32_tb.to_remove_instance_idx_ptr, true);
@@ -79,6 +86,7 @@ EM_JS(int, instantiate_wasm, (), {
                 }
             }
             memory_v.setInt32(Module.__wasm32_tb.to_remove_instance_idx_ptr, 0, true);
+            globalThis.__xteinkDynamicFunctions = Module.__wasm32_tb.dynamic_functions.size;
         }
 
         return 0;
@@ -98,6 +106,7 @@ EM_JS(void, flush_tb_instances, (), {
         }
     }
     memory_v.setInt32(tb.to_remove_instance_idx_ptr, 0, true);
+    globalThis.__xteinkDynamicFunctions = tb.dynamic_functions.size;
 });
 
 __thread bool initdone = false;
@@ -1250,6 +1259,7 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             res = tcg_qemu_tb_exec_tci(env);
         } else {
             instantiate_wasm();
+            qatomic_inc(&instantiated_wasm_count);
             res = ((wasm_func_ptr)(*(uint32_t*)tb_entry_ptr))(&ctx);
         }
         if ((uint32_t)ctx.tb_ptr == 0) {

tcg/wasm32/tcg-target.c.inc

@@ -2500,7 +2500,6 @@ static void tcg_wasm_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
     tcg_wasm_out_op_i64_eqz(s);
     tcg_wasm_out_op_if_noret(s);
     
-    // call helper
     tcg_wasm_out_op_global_get_r(s, TCG_AREG0);
     tcg_wasm_out_op_i32_wrap_i64(s);
     tcg_wasm_out_op_global_get_r(s, addr_reg);
@@ -3373,11 +3372,11 @@ static void tcg_out_qemu_st(TCGContext *s, TCGOpcode opc, const TCGArg *args, bo
     tcg_tci_out_qemu_ldst(s, opc, args);
     tcg_wasm_out_qemu_st(s, args, is_64);
     /* ponytail: Store-Containing TBs Run on TCI - Upstream qemu-wasm sets this for every guest store.
-     * PC-windowed bisection (docs/wasm-inflate-panic.md E3) showed the corruption is NOT a single
-     * miscompiled TB: inflate, ROM+IRAM, flash-lower, and flash-upper each compile safely alone, but
-     * the full set corrupts. It is an aggregate timing/rewind or TB-instance race in the compiled
-     * store path, which is why upstream punts all store-TBs to TCI. Ceiling: store-TBs interpreted
-     * (perf cost). Upgrade path: make the restartable-block store path rewind/instance safe. */
+     * Investigation (docs/wasm-inflate-panic.md E3-E7) narrowed it to the restartable-block rewind
+     * machinery around stores, not the store data codegen: both direct and helper store paths corrupt,
+     * a replay-skip precheck does not help, and the crash is deterministic but needs a byte-store TB
+     * and a 32-bit-store TB compiled together (counter-monotonic: adding 16-bit compilation hides it).
+     * Ceiling: store-TBs interpreted (perf cost). Upgrade path: fix restart/register handling. */
     wasm_tci_only_tb = true;
 }
 static void tcg_out_deposit_i32(TCGContext *s, TCGOpcode opc, TCGReg dest, TCGReg arg1, TCGReg arg2, int pos, int len)