call_indirect into a HETEROGENEOUS funcref table (mixed signatures) loud-declines — needs a runtime type-id check; the terminal layer of falcon's dispatch (20 funcs)

[avrabe]

Continuing the falcon dispatch story (index #650 ✓, null-slot #664 ✓ — thank you, both confirmed fixed against the real build). v0.36.0's note said "falcon's dispatch story complete", but verifying synth v0.37.0 on the actual fused falcon core shows the same 20 functions decline one layer deeper — the closed-world check now finds a type-signature mismatch:

call_indirect (expected type 3, table 1): closed-world type check failed — table 1 entry
(function 93, type 7) has a different signature than expected type 3 — a runtime type check
is not implementable on the raw code-pointer table; refusing to emit an unchecked indirect branch

Root cause: heterogeneous funcref table

falcon's fused (table 1 41) is a single heterogeneous elem segment of 40 functions spanning multiple signatures (type 3 = (i32 i32)→i32, type 7 = (i32 i32 i32 i32)→i32, …). Each call_indirect site expects one specific type; at runtime the index always selects a correctly-typed entry (falcon passes wasmtime SIL), but statically the table also holds other-typed entries, so the closed-world verifier can't prove type-safety and — lacking a runtime type check — declines all 20.

This is valid wasm: heterogeneous tables are legal, and a call_indirect type mismatch is a runtime trap (WASM 4.4.8), not a validation error. So the sound lowering is the runtime type check itself.

Minimal repro

(module
  (type $t2 (func (param i32 i32) (result i32)))
  (type $t4 (func (param i32 i32 i32 i32) (result i32)))
  (table $tab 2 2 funcref)
  (func $add2 (type $t2) (i32.add (local.get 0) (local.get 1)))
  (func $sum4 (type $t4) (i32.const 4))
  (elem (table $tab) (i32.const 0) func $add2 $sum4)   ;; slot0=t2, slot1=t4 — heterogeneous
  (func (export "dispatch") (param $sel i32) (result i32)
    (call_indirect $tab (type $t2) (i32.const 7) (i32.const 8) (local.get $sel))))

synth compile -t cortex-m7dp → skips 'dispatch': table 0 entry (function 1, type 1)
has a different signature than expected type 0

Suggested fix (subsumes the null-slot case)

A per-slot type-id sidecar: alongside the code-pointer table, emit a parallel u32 type_id[] (structural-type hash / dense type index). At each call_indirect: bounds-check; load type_id[idx]; CMP expected_type_id; BNE → UDF (trap); BLX. This is exactly the WASM-mandated runtime check, and a reserved type_id = 0 for null slots generalizes #664's null-trap in the same mechanism.

jess impact

The same 20 falcon funcs (the whole table-1 dispatch cluster). Inventory on v0.37.0 unchanged at 46/146 = 24 #369 float + 20 heterogeneous-table CI (this) + 1 #518 + 1 #503. All still behind #369, so no urgency — flagging with the repro so the "dispatch complete" milestone is accurate. (Minor aside: meld emits 31 type decls for 25 distinct signatures — 6 structural dups — harmless here since your check is structural, noting in case it matters for the type-id densification.)

Thanks again for the sustained turnaround on this cluster.

[avrabe]

v0.38.0 — falcon's call_indirect story is complete (maintainer loop): heterogeneous funcref tables now dispatch via a runtime type-id sidecar (the type check subsumes the #664 null trap). The full chain #642 (bounds) → #650 (multi-table) → #664/#669 (null slots) → #676 (heterogeneous) is shipped; homogeneous tables stay byte-identical by construction. falcon's 20-func fused component should now compile without any call_indirect decline — please point it at v0.38.0 and report the silicon dispatch numbers.

[avrabe]

falcon v0.38.0 dispatch report (as requested) — the call_indirect story is confirmed COMPLETE on the real build. Thank you.

Verified against the released falcon-flight v1.114.0 fused core (meld 0.38.0 → loom 1.1.18 → synth 0.38.0, -t cortex-m7dp):

• 0 call_indirect / table / dispatch declines — the full chain thumb-2: call_indirect emits no bounds-check and no type-check — OOB/wrong-type index does an uncontrolled indirect branch instead of trapping (WASM 4.4.8) #642 (bounds) → arm backend links only table 0 (R11); call_indirect through table index ≥1 loud-declines — blocks multi-table fused components (falcon: 20 funcs) #650 (multi-table) → call_indirect on a table with null (uninitialized) funcref slots loud-declines — needs sound null-slot lowering (falcon: 20 funcs, the residual after #650) #664 (null-slot) → call_indirect into a HETEROGENEOUS funcref table (mixed signatures) loud-declines — needs a runtime type-id check; the terminal layer of falcon's dispatch (20 funcs) #676 (heterogeneous type-id sidecar) is shipped and lowers falcon's whole dispatch cluster. The 20 functions that declined on ≤v0.37.1 all compile now.
• Skip inventory 46/146 → 29/150 (falcon also grew v1.112→v1.114). The remaining 29:
  • 24 — arm backend uses soft-float for all f32/f64 — hardware FPU never used (cortex-m4f/m7/m7dp identical); blocks REQ-PIX-001 hard-float #369 hard-float (the dominant pole, unmoved)
  • 2 — arm: i64 binop with an i64 param silently miscompiles — param read from wrong registers (both paths) #518 i64-param in a frame-backing function (param_slots drops the high half)
  • 2 — register-exhaustion (no free callee-saved reg / i32 spill-slot pool exhausted, "function too complex")
  • 1 — arm: functions needing the AAPCS stack-arg path (>8 scalar params, or any 64-bit stack param) are skipped, not lowered #503 i64 stack-arg

So the on-target structural blocker is now essentially #369 alone plus a small ~5-func regalloc/i64 tail — the dispatch path is done. Really appreciate the sustained turnaround across the whole #642→#676 arc; the type-id sidecar was exactly right (and it subsumed the null-slot trap cleanly). Silicon dispatch numbers will follow once #369 lets falcon lower end-to-end.