JIT: trace and relocate movable values in live optimized frames

Parent: #432 Blocks: #429 Related: #336

Use precise optimizer stack maps to make live optimized frames safe under moving collection.

Acceptance

• Classify every live frame, spill, scratch, and register value at each optimizer safepoint.
• Publish PC/safepoint-indexed root maps and expose the active native frame to the collector.
• Trace and rewrite movable references in optimized frames, including values needed by deoptimization recovery.
• Prove primitive-only maps contain no false roots and pointer-bearing plans contain no missing roots.
• Stress relocation during optimized execution under normal, no-GIL, and sanitizer gates with deterministic post-move behavior.

Completion

057a2ef adds bounded live optimizer moving safepoints. AArch64 loops poll every 64 completed backedges, publish the exact loop-header recovery index after canonical copies, preserve ABI state, and enter the collector with no managed pointer held only in registers. Numeric guards apply only to values consumed by numeric operations; recovery-only objects occupy precisely marked scratch slots and are rewritten in place.

ae26011 runs the real relocation witness in both single-mutator and parallel_js no-GIL contexts. The combined optimizer gate passes 39/39 lowering tests and 68/68 runtime tests in normal and TSan modes. Primitive-only maps remain empty, malformed maps fail closed, and deterministic post-move bytecode recovery reads the relocated object.

Batched checkpoint aa3854d publishes the first non-empty optimizer root maps. Unknown/object-valued parameters needed by call deoptimization now recover directly from their already rooted frame slots, and the selected deopt stack map marks exactly those candidate boxed frame roots (0b11 in the two-parameter direct/tail-call differentials); primitive scratch masks remain empty. Collector exposure and relocation of active native frames remain next.

Batch f8c3a06 verifies the property receiver uses the same deopt-indexed rooted frame-slot map (bit 0) as object-valued call inputs; primitive scratch remains unmarked. Normal and TSan end-to-end property-effect filters pass 4/4.

Precise-root checkpoint on 299325a1/cede562b: every supported call/construct and property/coercion/brand effect exit now publishes non-empty candidate-root masks for its exact callee, receiver, argument, object, key, and value inputs. Table coverage proves the expected 1-, 2-, and 3-slot masks; VM coverage proves computed read/write reconstruction with 0b11 and 0b111 maps under normal and TSan gates.

This advances recovery-time classification only. Publishing active native frames to the collector and tracing/rewriting relocated values in place remain the next required slice, so no #437 acceptance checkbox closes yet.

Checkpoint 4262abf6 connects published maps to the collector-facing runtime:

• each mapped native invocation installs a scoped ActiveNativeRoots descriptor on its interpreter;
• the current deopt/safepoint index, slot counts, pointer presence, and high mask bits are validated before access;
• precise mark/relocation visits only selected runtime-tagged frame and scratch words;
• missing, stale, or malformed maps fail closed, and nested mapless native calls cannot expose a stale outer descriptor;
• relocation coverage proves selected frame/scratch values move while unlisted boxed-looking words remain untouched, under normal and TSan gates.

Generated optimizer code still needs to publish a current index at an in-native GC checkpoint before live moving collection can be enabled, so the exposure/relocation acceptance items remain partially open.

e7cd6d9b expands precise recovery-map coverage to sixteen coercion-effect shapes. Unknown unary operands publish exactly one candidate frame root; binary coercions publish exactly two; scratch masks remain empty because unguarded boxed inputs recover from their canonical frame slots. Normal and TSan lowering plus source-level valueOf exception tests are green.

Checkpoint 125349c expands precise deopt maps across environment, allocation, object initialization, scope, import, and sync/async iterator exits. Zero-stack effects still retain exactly the live boxed frame local; one-, two-, and three-input effects retain their exact canonical frame slots; scratch pointer masks remain empty. Synthetic lowering and end-to-end VM paths pass normal and TSan. No acceptance box closes yet: generated native code still needs a live in-native safepoint index plus relocation stress during optimized execution.

Landed 057a2ef with documentation at 11e4b24. Focused safepoint batches pass 9/9 in normal mode and 9/9 under TSan. This closes classification, publication, rewrite, and current-map precision acceptance. No-GIL relocation stress remains open; benchmark scores are unchanged because the benchmark kernels run without requested compaction.

Completed by 057a2ef, ae26011, and documentation at 47902cb. All acceptance items are satisfied; future native object-producing operations must extend this established map discipline in their owning lowering issues.