Sync to upstream/release/706 (#2208)

Hey everyone! We've been hard at work fixing bugs and improving native
codegen. Enjoy!

# Analysis

* Rename the class tag to extern in type functions
* Fix #2204
* Rework type unification in terms of subtyping.

This uses the new solver's understanding of subtyping to drive
unification for
some internal callsites. This is a broad change that should result in
more
    consistent inference.  For example:

    ```luau
    local function sum<T>(x: T, y: T, z: (T, T) -> T) return z(x, y) end
    local function sumrec(f: typeof(sum))
return sum(2, 3, function<X>(g: X, h: X): add<X, X> return g + h end)
    end
-- Prior we would claim that `b` is of type `add<X, X> | number`: not
good!
-- We now correctly claim that it is of type `number` thanks to bug
fixes
    -- made to subtyping that did not make their way to the unifier.
    local b = sumrec(sum)
    ```

# Native Codegen

* Improve vector handling in binary operations
* Fix missed optimization causing an assertion failure
* Propagate loads of STORE_VECTOR components produced by UINT_TO_FLOAT
* Constant-fold new operand of CHECK_BUFFER_LEN
* For register load-store propagation, use the second operand only for
LOAD_FLOAT
* TValue store cannot be removed when it's partially over-written
* Rework equality and ordering comparisons to fix issues and be more
type aware
* Migrate Luau NCG IrInst operands representation to SmallVector

# Runtime

* Fix 64-bit countrz to build on 32 bit Windows.
* Remap Luau local debug and type information after performing jump
expansion
* Add support for building Luau as a shared library
* Luau should be able to make fastcalls even if library name is obscured
by a local polyfill

# OSS Contributions

* #2163
* #2167

# Internal Contributors

Co-authored-by: Ariel Weiss <arielweiss@roblox.com>
Co-authored-by: Hunter Goldstein <hgoldstein@roblox.com>
Co-authored-by: Ilya Rezvov <irezvov@roblox.com>
Co-authored-by: Varun Saini <vsaini@roblox.com>
Co-authored-by: Vighnesh Vijay <vvijay@roblox.com>
Co-authored-by: Vyacheslav Egorov <vegorov@roblox.com>

---------

Co-authored-by: Hunter Goldstein <hgoldstein@roblox.com>
Co-authored-by: Varun Saini <61795485+vrn-sn@users.noreply.github.com>
Co-authored-by: Alexander Youngblood <ayoungblood@roblox.com>
Co-authored-by: Menarul Alam <malam@roblox.com>
Co-authored-by: Aviral Goel <agoel@roblox.com>
Co-authored-by: Vighnesh <vvijay@roblox.com>
Co-authored-by: Vyacheslav Egorov <vegorov@roblox.com>
Co-authored-by: Ariel Weiss <aaronweiss@roblox.com>
Co-authored-by: Ilya Rezvov <irezvov@roblox.com>
Co-authored-by: Ariel Weiss <arielweiss@roblox.com>

Author: 10 people

Analysis/include/Luau/NativeStackGuard.h

@@ -18,7 +18,7 @@ struct NativeStackGuard
     uintptr_t low;
 };
 
-}
+} // namespace Luau
 
 namespace Luau
 {

Analysis/include/Luau/OverloadResolution.h

@@ -42,7 +42,7 @@ using IncompatibilityReason = Variant<SubtypingReasonings, ErrorVec>;
  */
 struct SelectedOverload
 {
-   /**
+    /**
      * An unambiguous overload, if one can be selected. This is _not_ necessarily
      * an overload that is valid for the argument pack provided. For example:
      *
@@ -108,7 +108,6 @@ struct OverloadResolution
      * documentation.
      */
     SelectedOverload getUnambiguousOverload() const;
-
 };
 
 struct OverloadResolver
@@ -177,13 +176,7 @@ struct OverloadResolver
         NotNull<DenseHashSet<TypeId>> uniqueTypes
     );
 
-    void testFunction(
-        OverloadResolution& result,
-        TypeId fnTy,
-        TypePackId argsPack,
-        Location fnLocation,
-        NotNull<DenseHashSet<TypeId>> uniqueTypes
-    );
+    void testFunction(OverloadResolution& result, TypeId fnTy, TypePackId argsPack, Location fnLocation, NotNull<DenseHashSet<TypeId>> uniqueTypes);
 
     void testFunctionOrCallMetamethod(
         OverloadResolution& result,

Analysis/include/Luau/RecursionCounter.h

@@ -44,7 +44,6 @@ struct NonExceptionalRecursionLimiter : RecursionCounter
     bool isOk(int limit) const;
 
     NonExceptionalRecursionLimiter(int* count);
-
 };
 
 } // namespace Luau

Analysis/include/Luau/StructuralTypeEquality.h

@@ -15,4 +15,4 @@ bool areEqual(SeenSet& seen, const Type& lhs, const Type& rhs);
 bool areEqual(SeenSet& seen, const TypePackVar& lhs, const TypePackVar& rhs);
 bool areEqual(SeenSet& seen, TypeId lhs, TypeId rhs);
 
-}
+} // namespace Luau

Analysis/include/Luau/Subtyping.h

@@ -195,12 +195,13 @@ struct SubtypingEnvironment
      */
     DenseHashMap<TypeId, TypeId> substitutions{nullptr};
 
-
     // We use this cache to track pairs of subtypes that we tried to subtype, and found them to be in the seen set at the time.
     // In those situations, we return True, but mark the result as not cacheable, because we don't want to cache broader results which
     // led to the seen pair. However, those results were previously being cache in the ephemeralCache, and we still want to cache them somewhere
     // for performance reasons.
     DenseHashMap<std::pair<TypeId, TypeId>, SubtypingResult, TypePairHash> seenSetCache{{}};
+
+    int iterationCount = 0;
 };
 
 struct Subtyping
@@ -248,12 +249,7 @@ struct Subtyping
     // TODO recursion limits
 
     SubtypingResult isSubtype(TypeId subTy, TypeId superTy, NotNull<Scope> scope);
-    SubtypingResult isSubtype(
-        TypePackId subTp,
-        TypePackId superTp,
-        NotNull<Scope> scope,
-        const std::vector<TypeId>& bindableGenerics
-    );
+    SubtypingResult isSubtype(TypePackId subTp, TypePackId superTp, NotNull<Scope> scope, const std::vector<TypeId>& bindableGenerics);
     SubtypingResult isSubtype(
         TypePackId subTp,
         TypePackId superTp,
@@ -334,12 +330,7 @@ struct Subtyping
         const FunctionType* superFunction,
         NotNull<Scope> scope
     );
-    SubtypingResult isCovariantWith(
-        SubtypingEnvironment& env,
-        const MetatableType* subMt,
-        const PrimitiveType* superPrim,
-        NotNull<Scope> scope
-    );
+    SubtypingResult isCovariantWith(SubtypingEnvironment& env, const MetatableType* subMt, const PrimitiveType* superPrim, NotNull<Scope> scope);
     SubtypingResult isCovariantWith(SubtypingEnvironment& env, const TableType* subTable, const PrimitiveType* superPrim, NotNull<Scope> scope);
     SubtypingResult isCovariantWith(SubtypingEnvironment& env, const PrimitiveType* subPrim, const TableType* superTable, NotNull<Scope> scope);
     SubtypingResult isCovariantWith(SubtypingEnvironment& env, const SingletonType* subSingleton, const TableType* superTable, NotNull<Scope> scope);
@@ -442,15 +433,53 @@ struct Subtyping
     );
 
     // Markers to help overload selection.
-    struct Anything{};
-    struct Nothing{};
+    struct Anything
+    {
+    };
+    struct Nothing
+    {
+    };
 
-    SubtypingResult isTailCovariantWithTail(SubtypingEnvironment& env, NotNull<Scope> scope, TypePackId subTp, const VariadicTypePack* sub, TypePackId superTp, const VariadicTypePack* super);
-    SubtypingResult isTailCovariantWithTail(SubtypingEnvironment& env, NotNull<Scope> scope, TypePackId subTp, const GenericTypePack* sub, TypePackId superTp, const GenericTypePack* super);
-    SubtypingResult isTailCovariantWithTail(SubtypingEnvironment& env, NotNull<Scope> scope, TypePackId subTp, const VariadicTypePack* sub, TypePackId superTp, const GenericTypePack* super);
-    SubtypingResult isTailCovariantWithTail(SubtypingEnvironment& env, NotNull<Scope> scope, TypePackId subTp, const GenericTypePack* sub, TypePackId superTp, const VariadicTypePack* super);
+    SubtypingResult isTailCovariantWithTail(
+        SubtypingEnvironment& env,
+        NotNull<Scope> scope,
+        TypePackId subTp,
+        const VariadicTypePack* sub,
+        TypePackId superTp,
+        const VariadicTypePack* super
+    );
+    SubtypingResult isTailCovariantWithTail(
+        SubtypingEnvironment& env,
+        NotNull<Scope> scope,
+        TypePackId subTp,
+        const GenericTypePack* sub,
+        TypePackId superTp,
+        const GenericTypePack* super
+    );
+    SubtypingResult isTailCovariantWithTail(
+        SubtypingEnvironment& env,
+        NotNull<Scope> scope,
+        TypePackId subTp,
+        const VariadicTypePack* sub,
+        TypePackId superTp,
+        const GenericTypePack* super
+    );
+    SubtypingResult isTailCovariantWithTail(
+        SubtypingEnvironment& env,
+        NotNull<Scope> scope,
+        TypePackId subTp,
+        const GenericTypePack* sub,
+        TypePackId superTp,
+        const VariadicTypePack* super
+    );
     SubtypingResult isTailCovariantWithTail(SubtypingEnvironment& env, NotNull<Scope> scope, TypePackId subTp, const GenericTypePack* sub, Nothing);
-    SubtypingResult isTailCovariantWithTail(SubtypingEnvironment& env, NotNull<Scope> scope, Nothing, TypePackId superTp, const GenericTypePack* super);
+    SubtypingResult isTailCovariantWithTail(
+        SubtypingEnvironment& env,
+        NotNull<Scope> scope,
+        Nothing,
+        TypePackId superTp,
+        const GenericTypePack* super
+    );
 
     bool bindGeneric(SubtypingEnvironment& env, TypeId subTy, TypeId superTy) const;
 

Analysis/include/Luau/SubtypingUnifier.h

@@ -0,0 +1,73 @@
+// This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
+#pragma once
+
+#include "Luau/Subtyping.h"
+#include "Luau/Constraint.h"
+#include "Luau/NotNull.h"
+#include "Luau/Type.h"
+#include "Luau/Unifier2.h"
+
+namespace Luau
+{
+
+/**
+ * `SubtypingUnifier` performs unification of type variables by asking whether
+ * the two are subtypes of one another, and then attempts to dispatch any
+ * assumed constraints.
+ */
+struct SubtypingUnifier
+{
+
+    using UpperBounds = DenseHashMap<TypeId, std::vector<std::pair<Location, TypeId>>>;
+
+    /**
+     * Represents attempting to dispatch some number of assumed constraints.
+     */
+    struct Result
+    {
+        /**
+         * Whether we were able to unify successfully. This can fail if,
+         * for example, unifying two free type packs would create a cycle.
+         */
+        UnifyResult unified;
+        /**
+         * A list of outstanding constraints, e.g. subtype constraints where
+         * one of the arguments is a blocked type of some kind.
+         */
+        std::vector<ConstraintV> outstandingConstraints;
+        /**
+         * Upper bound contributors to any free types that we mutated. This is
+         * used if a function type's parameter is inferred to be `never`.
+         */
+        UpperBounds upperBoundContributors;
+    };
+
+    explicit SubtypingUnifier(NotNull<TypeArena> arena, NotNull<BuiltinTypes> builtinTypes, NotNull<InternalErrorReporter> reporter);
+
+    /**
+     * @param constraint The active constraint (used for location data).
+     * @param assumedConstraints The set of assumed constraints for a given subtype check.
+     */
+    Result dispatchConstraints(NotNull<const Constraint> constraint, std::vector<ConstraintV> assumedConstraints) const;
+
+private:
+    NotNull<TypeArena> arena;
+    NotNull<BuiltinTypes> builtinTypes;
+    NotNull<InternalErrorReporter> reporter;
+
+    /**
+     * Attempt to dispatch a *single* constraint.
+     * @return A pair containing whether we were able to unify and if we need to defer the constraint.
+     */
+    std::pair<UnifyResult, bool> dispatchOneConstraint(
+        NotNull<const Constraint> constraint,
+        const ConstraintV& cv,
+        UpperBounds& upperBoundContributors
+    ) const;
+
+    OccursCheckResult occursCheck(TypePackId needle, TypePackId haystack) const;
+
+    bool canBeUnified(TypeId ty) const;
+};
+
+} // namespace Luau

Analysis/include/Luau/TypeUtils.h

@@ -413,4 +413,11 @@ struct ContainsAnyGeneric final : public TypeOnceVisitor
 bool containsGeneric(TypeId ty, NotNull<DenseHashSet<const void*>> generics);
 bool containsGeneric(TypePackId ty, NotNull<DenseHashSet<const void*>> generics);
 
+/**
+ * @return Whether `ty` is a type that cannot be unified with another type,
+ *         such as a blocked type, pending expansion type, or an unsolved
+ *         type function.
+ */
+bool isBlocked(TypeId ty);
+
 } // namespace Luau

Analysis/src/BuiltinDefinitions.cpp

@@ -1747,7 +1747,8 @@ bool MagicFreeze::infer(const MagicFunctionCallContext& context)
     return true;
 }
 
-// MagicFreeze is a magic function because table.freeze is a bounded version of the identity function with a custom output (accepts any subtype of `table` and returns a read-only version of that table).
+// MagicFreeze is a magic function because table.freeze is a bounded version of the identity function with a custom output (accepts any subtype of
+// `table` and returns a read-only version of that table).
 bool MagicFreeze::typeCheck(const MagicFunctionTypeCheckContext& ctx)
 {
     if (!FFlag::LuauTableFreezeCheckIsSubtype)
@@ -1769,8 +1770,10 @@ bool MagicFreeze::typeCheck(const MagicFunctionTypeCheckContext& ctx)
     }
     else if (paramTail)
     {
-        // TODO (CLI-185019): We ideally want to report a Count Mismatch error if there's no head but a variadic tail, but CountMismatch requires actual count size, which we don't have with variadic tails, so we can't report it properly yet.
-        // Instead, we continue to typecheck with the first argument in the variadic tail and report a type mismatch error based on that, which is more informative than reporting a count mismatch where the head (paramTypes.size()) is 0.
+        // TODO (CLI-185019): We ideally want to report a Count Mismatch error if there's no head but a variadic tail, but CountMismatch requires
+        // actual count size, which we don't have with variadic tails, so we can't report it properly yet. Instead, we continue to typecheck with the
+        // first argument in the variadic tail and report a type mismatch error based on that, which is more informative than reporting a count
+        // mismatch where the head (paramTypes.size()) is 0.
         firstParamType = first(*paramTail);
     }
 
@@ -1781,7 +1784,8 @@ bool MagicFreeze::typeCheck(const MagicFunctionTypeCheckContext& ctx)
     }
     else
     {
-        // If we can't get a type from the type or type pack, we testIsSubtype against the entire context's argument type pack to report a Type Pack Mismatch error.
+        // If we can't get a type from the type or type pack, we testIsSubtype against the entire context's argument type pack to report a Type Pack
+        // Mismatch error.
         TypePackId tableTyPack = ctx.typechecker->module->internalTypes.addTypePack({ctx.typechecker->builtinTypes->tableType});
         ctx.typechecker->testIsSubtype(follow(ctx.arguments), tableTyPack, ctx.callSite->location);
         return true;

Analysis/src/BuiltinTypeFunctions.cpp

@@ -528,32 +528,14 @@ TypeFunctionReductionResult<TypeId> numericBinopTypeFunction(
 
         if (!reversed)
             solveResult = solveFunctionCall_DEPRECATED(
-                ctx->arena,
-                ctx->builtins,
-                ctx->normalizer,
-                ctx->typeFunctionRuntime,
-                ctx->ice,
-                ctx->limits,
-                ctx->scope,
-                location,
-                *mmType,
-                argPack
+                ctx->arena, ctx->builtins, ctx->normalizer, ctx->typeFunctionRuntime, ctx->ice, ctx->limits, ctx->scope, location, *mmType, argPack
             );
         else
         {
             TypePack* p = getMutable<TypePack>(argPack);
             std::swap(p->head.front(), p->head.back());
             solveResult = solveFunctionCall_DEPRECATED(
-                ctx->arena,
-                ctx->builtins,
-                ctx->normalizer,
-                ctx->typeFunctionRuntime,
-                ctx->ice,
-                ctx->limits,
-                ctx->scope,
-                location,
-                *mmType,
-                argPack
+                ctx->arena, ctx->builtins, ctx->normalizer, ctx->typeFunctionRuntime, ctx->ice, ctx->limits, ctx->scope, location, *mmType, argPack
             );
         }
 
@@ -755,7 +737,9 @@ TypeFunctionReductionResult<TypeId> concatTypeFunction(
         else
             inferredArgs = {rhsTy, lhsTy};
 
-        if (!solveFunctionCall(ctx, ctx->constraint ? ctx->constraint->location : Location{}, *mmType, ctx->arena->addTypePack(std::move(inferredArgs))))
+        if (!solveFunctionCall(
+                ctx, ctx->constraint ? ctx->constraint->location : Location{}, *mmType, ctx->arena->addTypePack(std::move(inferredArgs))
+            ))
             return {std::nullopt, Reduction::Erroneous, {}, {}};
     }
     else
@@ -1399,30 +1383,30 @@ TypeFunctionReductionResult<TypeId> refineTypeFunction(
     }
 
     std::vector<TypeId> discriminantTypes;
-        for (size_t i = 1; i < typeParams.size(); i++)
-        {
-            auto discriminant = follow(typeParams[i]);
+    for (size_t i = 1; i < typeParams.size(); i++)
+    {
+        auto discriminant = follow(typeParams[i]);
 
-            // Filter out any top level types that are meaningless to refine
-            // against.
-            if (is<UnknownType, NoRefineType>(discriminant))
-                continue;
+        // Filter out any top level types that are meaningless to refine
+        // against.
+        if (is<UnknownType, NoRefineType>(discriminant))
+            continue;
 
-            // If the discriminant type is only:
-            // - The `*no-refine*` type (covered above) or;
-            // - tables, metatables, unions, intersections, functions, or
-            //   negations containing `*no-refine*` (covered below).
-            // There's no point in refining against it.
-            ContainsRefinableType crt;
-            crt.traverse(discriminant);
+        // If the discriminant type is only:
+        // - The `*no-refine*` type (covered above) or;
+        // - tables, metatables, unions, intersections, functions, or
+        //   negations containing `*no-refine*` (covered below).
+        // There's no point in refining against it.
+        ContainsRefinableType crt;
+        crt.traverse(discriminant);
 
-            if (crt.found)
-                discriminantTypes.push_back(discriminant);
-        }
+        if (crt.found)
+            discriminantTypes.push_back(discriminant);
+    }
 
-        // if we don't have any real refinements, i.e. they're all `*no-refine*`, then we can reduce immediately.
-        if (discriminantTypes.empty())
-            return {targetTy, {}};
+    // if we don't have any real refinements, i.e. they're all `*no-refine*`, then we can reduce immediately.
+    if (discriminantTypes.empty())
+        return {targetTy, {}};
 
     const bool targetIsPending = isBlockedOrUnsolvedType(targetTy);