feat(jit): spec-driven regex replace fallible helper

Author: fffonion

src/vm/jit/builtin_spec.rs

@@ -369,6 +369,22 @@ pub(crate) const TO_STRING_SPEC: BuiltinSpec = BuiltinSpec {
     needs_failure_exit: false,
 };
 
+// ── Family 3: regex fallible ────────────────────────────────────────
+
+/// `re_replace(pattern, text, replacement)` — fallible helper.
+pub(crate) const REGEX_REPLACE_SPEC: BuiltinSpec = BuiltinSpec {
+    name: "regex_replace",
+    arity: 3,
+    inputs: &[
+        InputRepr::HeapPtr(HeapInputKind::String), // replacement (popped third)
+        InputRepr::HeapPtr(HeapInputKind::String), // text (popped second)
+        InputRepr::HeapPtr(HeapInputKind::String), // pattern (popped first)
+    ],
+    output: OutputKind::Tagged(ValueType::String),
+    effect: BuiltinEffect::FallibleHelper,
+    needs_failure_exit: true,
+};
+
 /// Look up the spec for a specialized builtin kind, if one exists.
 ///
 /// Returns `None` for builtins not yet covered by the spec-driven
@@ -407,6 +423,7 @@ pub(crate) fn spec_for(
         }
         super::recorder::SpecializedBuiltinKind::BytesToArrayU8 => Some(&BYTES_TO_ARRAY_U8_SPEC),
         super::recorder::SpecializedBuiltinKind::ToString => Some(&TO_STRING_SPEC),
+        super::recorder::SpecializedBuiltinKind::RegexReplace => Some(&REGEX_REPLACE_SPEC),
         _ => None,
     }
 }

src/vm/jit/recorder.rs

@@ -3411,16 +3411,10 @@ fn analyze_specialized_builtin_call(
         | SpecializedBuiltinKind::BytesFromArrayU8
         | SpecializedBuiltinKind::BytesToUtf8Ascii
         | SpecializedBuiltinKind::BytesToArrayU8
-        | SpecializedBuiltinKind::ToString => {
+        | SpecializedBuiltinKind::ToString
+        | SpecializedBuiltinKind::RegexReplace => {
             unreachable!("spec-covered builtins are handled by the spec-driven path")
         }
-        SpecializedBuiltinKind::RegexReplace => {
-            let _ = frame.pop()?;
-            let _ = frame.pop()?;
-            let _ = frame.pop()?;
-            frame.push(ValueInfo::tagged_typed(ValueType::String));
-            Ok("regex_replace")
-        }
         SpecializedBuiltinKind::TypeOfKnown(_) => {
             let _ = frame.pop()?;
             frame.push(ValueInfo::type_name());
@@ -3535,49 +3529,10 @@ fn emit_specialized_builtin_call(
         | SpecializedBuiltinKind::BytesFromArrayU8
         | SpecializedBuiltinKind::BytesToUtf8Ascii
         | SpecializedBuiltinKind::BytesToArrayU8
-        | SpecializedBuiltinKind::ToString => {
+        | SpecializedBuiltinKind::ToString
+        | SpecializedBuiltinKind::RegexReplace => {
             unreachable!("spec-covered builtins are handled by the spec-driven path")
         }
-        SpecializedBuiltinKind::RegexReplace => {
-            let replacement = ensure_heap_ptr(
-                builder,
-                block,
-                ip,
-                frame.pop()?,
-                HeapContainerKind::String.value_type(),
-            )?;
-            let text = ensure_heap_ptr(
-                builder,
-                block,
-                ip,
-                frame.pop()?,
-                HeapContainerKind::String.value_type(),
-            )?;
-            let pattern = ensure_heap_ptr(
-                builder,
-                block,
-                ip,
-                frame.pop()?,
-                HeapContainerKind::String.value_type(),
-            )?;
-            let out = builder
-                .append_value_inst(
-                    block,
-                    ip,
-                    SsaValueRepr::Tagged,
-                    SsaInstKind::RegexReplace {
-                        pattern: pattern.value.id,
-                        text: text.value.id,
-                        replacement: replacement.value.id,
-                    },
-                )
-                .map(|value| SymbolicValue {
-                    value,
-                    info: ValueInfo::tagged_typed(ValueType::String),
-                })
-                .map_err(|err| TraceRecordError::InvalidIr(err.to_string()))?;
-            Ok(("regex_replace", out))
-        }
         SpecializedBuiltinKind::TypeOfKnown(value_type) => {
             let _ = frame.pop()?;
             let type_name = match value_type {
@@ -4009,6 +3964,15 @@ fn emit_spec_driven_builtin(
             ValueInfo::tagged_typed(ValueType::String),
             spec.name,
         ),
+        SpecializedBuiltinKind::RegexReplace => (
+            SsaInstKind::RegexReplace {
+                pattern: popped[2].value.id,
+                text: popped[1].value.id,
+                replacement: popped[0].value.id,
+            },
+            ValueInfo::tagged_typed(ValueType::String),
+            spec.name,
+        ),
         SpecializedBuiltinKind::ArraySet => {
             let value = &popped[0];
             let index = &popped[1];