[wasm] Pass Int128, Decimal128 and wide vectors by value

docs/design/coreclr/botr/clr-abi.md

@@ -717,9 +717,7 @@ A frame pointer, if used, points at the bottom of the "fixed" portion of the sta
 
 Arguments and return values are processed via the Type Lowering algorithm below.
 
-If a struct is returned via a hidden buffer, the address is supplied by the caller and passed just after the managed `this`, or after `$sp` argument when `this` is not present. In such cases the return value of the method is the address of the return value. But if the struct can be passed on the Wasm stack it is returned on the Wasm stack per the Type Lowering rules.
-
-(TBD: ABI for vector types)
+If a struct is returned via a hidden buffer, the address is supplied by the caller and passed just after the managed `this`, or after `$sp` argument when `this` is not present. In such cases the return value of the method is the address of the return value. Structs passed by value across multiple Wasm parameters are still returned through a hidden buffer.
 
 ### Type Lowering
 
@@ -735,22 +733,28 @@ Managed types are lowered to WebAssembly value types according to the following
 | `nint`, `nuint`, pointer, byref, function pointer | `i32` (pointer-sized) |
 | Reference types (class, string, array, szarray, interface) | `i32` (pointer-sized) |
 | Value type (struct) — single primitive field, no padding | Unwrap recursively to the field's wasm type |
-| Value type (struct) — single field with padding, multiple fields, or SIMD type | Passed by reference (`i32` pointer) |
+| `Vector64<T>` | `i64` |
+| `Vector128<T>`, or a 16-byte `Vector<T>` | `v128` |
+| `Int128`, `UInt128`, `Decimal128` | Two `i64` parameters |
+| `Vector256<T>` | Two `v128` parameters |
+| `Vector512<T>` | Four `v128` parameters |
+| Value type (struct) — single field with padding, multiple fields, or another non-unwrappable SIMD type | Passed by reference (`i32` pointer) |
 | Empty struct (zero instance fields) | Not currently elided; since .NET empty structs have size 1, they are treated as non-unwrappable structs and passed by reference.|
 
 **Struct unwrapping** is recursive: a struct containing a single struct field, where the inner struct
 has the same size as the outer, is unwrapped until a primitive is reached or the rule no longer applies.
 For example, a struct `Wrapper { Inner value; }` where `Inner { int x; }` is unwrapped all the way
-to `i32`.
+to `i32`. A single-field struct wrapping one of the multi-parameter types above is passed the same
+way as the type it wraps.
 
 A struct is **not** unwrapped when:
 - It has more than one instance field.
 - It has exactly one instance field but the field's size differs from the struct's size (i.e., the
  struct has padding due to explicit layout or alignment attributes).
 
-Structs that cannot be unwrapped, including SIMD types for now, are passed by reference. The caller
-allocates space on the linear stack and passes a pointer. For return values, the caller provides a
-hidden return buffer pointer.
+Structs that cannot be unwrappedare passed by reference. The caller allocates space on the linear
+stack and passes a pointer. All multi-parameter types above, and structs that cannot be unwrapped,
+are returned through a hidden return buffer.
 
 ### Prolog
 

docs/design/coreclr/botr/readytorun-format.md

@@ -1105,6 +1105,36 @@ it knows a hidden retbuf pointer argument is present in the Wasm parameter list.
 | `V` | `v128` parameter (a `Vector128<T>`, or a 16-byte `Vector<T>`, passed by value) |
 | `S<N>` | struct parameter passed by reference, `<N>` is the struct size in bytes |
 | `e` | empty struct parameter — elided from Wasm args but present in the string |
+| `<slot><E>` | multi-slot parameter passed by value, see below |
+
+**Multi-slot parameters**: some types are passed by value across several Wasm parameters
+because no single Wasm value type can hold them, matching the Wasm C ABI. The slot
+character is followed by the factor by which the type's alignment is elevated above that
+slot's natural alignment:
+
+| Encoding | Slots | Alignment | Type |
+|---|---|---|---|
+| `l2` | 2 x `i64` | 16 (elevated 2x) | `Int128`, `UInt128`, `Decimal128` |
+| `V2` | 2 x `v128` | 32 (elevated 2x) | `Vector256<T>` |
+| `V4` | 4 x `v128` | 64 (elevated 4x) | `Vector512<T>` |
+
+A single-field struct wrapping one of these is passed the same way as the type it wraps,
+matching the treatment of a struct wrapping a `v128`.
+
+The digit is required. A repeated slot character without one — `ll`, `VV` — is not an
+aggregate: it is two independent scalar parameters, which is how every implementation
+reads it. So `ll2VV4` is `i64`, `Int128`, `Vector128<T>`, `Vector512<T>`. The grammar stays
+unambiguous because no other token places a digit after a slot character; `S<N>` consumes
+its own digits.
+
+These types are still *returned* through a hidden buffer, encoded as `S<N>` like any other
+aggregate. Limitation: a single digit carries both the slot count and the elevation factor,
+so an aggregate whose elevation differs from its slot count has no spelling. That includes
+one whose alignment is merely natural for its slot type, which would need count `N` with
+elevation 1. No such type exists in the Wasm ABI today.
+
+WasmAppBuilder does not emit or consume multi-slot tokens: they do not appear in
+`InternalCall` or `PInvoke` signatures.
 
 **Suffix**:
 
@@ -1133,6 +1163,8 @@ prefix to distinguish thunk categories:
 | `static MyStruct F()` where `MyStruct` is 16 bytes | `S16p` |
 | `static void F(MyStruct s)` where `MyStruct` is 8 bytes | `vS8p` |
 | `static int F(float x, double y)` | `ifdp` |
+| `static long F(long tag, Int128 v, int t)` | `lll2ip` |
+| `static int F(long tag, Vector512<int> v, int t)` | `ilV4ip` |
 | `[UnmanagedCallersOnly] static int F(int x)` | `ii` |
 
 **Slot sizing for structs**: When computing interpreter stack layout, struct parameters

src/coreclr/inc/jiteeversionguid.h

@@ -37,11 +37,11 @@
 
 #include <minipal/guid.h>
 
-constexpr GUID JITEEVersionIdentifier = { /* 513ac378-778b-4db5-b560-ebecaa000a4b */
-0x513ac378,
-0x778b,
-0x4db5,
- {0xb5, 0x60, 0xeb, 0xec, 0xaa, 0x00, 0x0a, 0x4b}
+constexpr GUID JITEEVersionIdentifier = { /* aa3cece7-a5f9-4b4e-9309-852c8bd4bdb1 */
+0xaa3cece7,
+0xa5f9,
+0x4b4e,
+ {0x93, 0x09, 0x85, 0x2c, 0x8b, 0xd4, 0xbd, 0xb1}
  };
 
 #endif // JIT_EE_VERSIONING_GUID_H

src/coreclr/jit/codegenlinear.cpp

@@ -1760,6 +1760,7 @@ void CodeGen::genConsumeRegs(GenTree* tree)
  genConsumeRegs(tree->gtGetOp1());
  genConsumeRegs(tree->gtGetOp2());
  }
+#endif
  else if (tree->OperIsFieldList())
  {
  for (GenTreeFieldList::Use& use : tree->AsFieldList()->Uses())
@@ -1768,7 +1769,6 @@ void CodeGen::genConsumeRegs(GenTree* tree)
  genConsumeRegs(fieldNode);
  }
  }
-#endif
  else if (tree->OperIsLocalRead())
  {
  // A contained lcl var must be living on stack and marked as reg optional, or not be a

src/coreclr/jit/codegenwasm.cpp

@@ -3063,12 +3063,12 @@ void CodeGen::genCall(GenTreeCall* call)
 
  for (CallArg& arg : call->gtArgs.EarlyArgs())
  {
-genConsumeReg(arg.GetEarlyNode());
+genConsumeRegs(arg.GetEarlyNode());
  }
 
  for (CallArg& arg : call->gtArgs.LateArgs())
  {
-genConsumeReg(arg.GetLateNode());
+genConsumeRegs(arg.GetLateNode());
  }
 
  if (call->NeedsNullCheck())
@@ -3118,7 +3118,13 @@ void CodeGen::genCallInstruction(GenTreeCall* call)
  }
  else if (callRetType == TYP_STRUCT)
  {
- typeStack.Push(m_compiler->info.compCompHnd->getWasmLowering(call->gtRetClsHnd));
+ CorInfoWasmType retWasmType = m_compiler->info.compCompHnd->getWasmLowering(call->gtRetClsHnd);
+ // A struct wider than the wasm value it lowers to is returned through a hidden buffer,
+ // so it must have been handled by the retbuf branch above.
+ assert(retWasmType != CORINFO_WASM_TYPE_VOID);
+ assert(m_compiler->info.compCompHnd->getClassSize(call->gtRetClsHnd) <=
+ genTypeSize(WasmClassifier::ToJitType(retWasmType)));
+ typeStack.Push(retWasmType);
  }
  else
  {

src/coreclr/jit/compiler.cpp

@@ -759,7 +759,9 @@ var_types Compiler::getReturnTypeForStruct(CORINFO_CLASS_HANDLE clsHnd,
 #if defined(TARGET_WASM)
  CorInfoWasmType abiType = info.compCompHnd->getWasmLowering(clsHnd);
 
- if (abiType == CORINFO_WASM_TYPE_VOID)
+ // A struct wider than the wasm value it lowers to is split across several of them when
+ // passed, but returned via a hidden buffer like any other aggregate.
+ if ((abiType == CORINFO_WASM_TYPE_VOID) || (structSize > genTypeSize(WasmClassifier::ToJitType(abiType))))
  {
  howToReturnStruct = SPK_ByReference;
  useType = TYP_UNKNOWN;

src/coreclr/jit/lower.cpp

@@ -3195,7 +3195,6 @@ size_t Lowering::MarkPutArgAndFieldListNodes(GenTree* node)
  {
  for (GenTreeFieldList::Use& operand : node->AsFieldList()->Uses())
  {
- assert(operand.GetNode()->OperIsPutArg());
  result += MarkPutArgAndFieldListNodes(operand.GetNode());
  }
  }

src/coreclr/jit/targetwasm.cpp

@@ -87,6 +87,26 @@ ABIPassingInformation WasmClassifier::Classify(Compiler* comp,
  else
  {
  abiType = ToJitType(wasmAbiType);
+
+ // A struct wider than the wasm value it lowers to is passed by value across several
+ // of them, matching the wasm C ABI: Int128 as 2 x i64, a 256-bit vector as 2 x v128,
+ // a 512-bit vector as 4 x v128. A struct can be narrower than its value (see the
+ // segment size below), so this must compare sizes rather than count slots.
+ unsigned segSize = genTypeSize(abiType);
+ if (structLayout->GetSize() > segSize)
+ {
+ unsigned numSegs = structLayout->GetSize() / segSize;
+ assert((numSegs * segSize) == structLayout->GetSize());
+
+ ABIPassingInformation info(comp, numSegs);
+ for (unsigned i = 0; i < numSegs; i++)
+ {
+ regNumber reg = MakeWasmReg(m_localIndex++, abiType);
+ info.Segment(i) = ABIPassingSegment::InRegister(reg, i * segSize, segSize);
+ }
+
+ return info;
+ }
  }
 
  regNumber reg = MakeWasmReg(m_localIndex++, genActualType(abiType));

src/coreclr/tools/Common/Compiler/CompilerTypeSystemContext.Wasm.cs

@@ -1,18 +1,25 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
+using System;
 using System.Collections.Generic;
 
 using Internal.TypeSystem;
 
+using Debug = System.Diagnostics.Debug;
+
 namespace ILCompiler
 {
  public partial class CompilerTypeSystemContext
  {
  private readonly object _structCacheLock = new object();
  private readonly Dictionary<int, TypeDesc> _structsBySize = new Dictionary<int, TypeDesc>();
+ private readonly Dictionary<int, TypeDesc> _returnStructsBySize = new Dictionary<int, TypeDesc>();
  private volatile TypeDesc _cachedEmptyStruct;
  private volatile TypeDesc _wasmV128Type;
+ private volatile TypeDesc _wasmInt128Type;
+ private volatile TypeDesc _wasmV256Type;
+ private volatile TypeDesc _wasmV512Type;
 
  /// <summary>
  /// Gets the type RaiseSignature produces for the 'V' encoding. All v128 types share the same
@@ -34,6 +41,40 @@ public TypeDesc WasmV128Type
  }
  }
 
+ /// <summary>
+ /// Gets the type RaiseSignature produces for an elevated multi-slot encoding ('l2', 'V2', 'V4'),
+ /// where the digit is the factor by which the type's alignment is elevated above the slot's
+ /// natural alignment. A thunk is keyed by its signature string, so every type spelling an
+ /// encoding shares one and raising can only resolve a stand-in. For 'V2' and 'V4' the
+ /// candidates are instantiations of a single generic type, so any element type stands for
+ /// the rest; for 'l2' they are unrelated types -- Int128, UInt128, Decimal128 -- agreeing in
+ /// nothing but the signature. Both are sound because the signature is all the thunk's frame
+ /// layout derives from, which is what the asserts below hold the stand-in to. Resolving a
+ /// fixed type also keeps raising independent of the order lowering encountered them in.
+ /// </summary>
+ public TypeDesc GetWasmElevatedType(char slot, int elevation)
+ {
+ TypeDesc type = (slot, elevation) switch
+ {
+ ('l', 2) => _wasmInt128Type ??= SystemModule.GetType("System"u8, "Int128"u8),
+ ('V', 2) => _wasmV256Type ??= InstantiateOverByte("Vector256`1"u8),
+ ('V', 4) => _wasmV512Type ??= InstantiateOverByte("Vector512`1"u8),
+ _ => throw new InvalidOperationException($"Unknown elevated signature encoding: {slot}{elevation}")
+ };
+
+ // The slot layout alone does not imply alignment, so the resolved type must supply it:
+ // a 16-byte 8-aligned struct is spelled 'S16', not 'l2'.
+ int slotSize = slot == 'l' ? 8 : 16;
+ Debug.Assert(((DefType)type).InstanceFieldSize.AsInt == slotSize * elevation);
+ Debug.Assert(((DefType)type).InstanceFieldAlignment.AsInt == slotSize * elevation);
+
+ return type;
+
+ TypeDesc InstantiateOverByte(ReadOnlySpan<byte> name) =>
+ ((MetadataType)SystemModule.GetType("System.Runtime.Intrinsics"u8, name))
+ .MakeInstantiatedType(GetWellKnownType(WellKnownType.Byte));
+ }
+
  /// <summary>
  /// Gets the first empty struct type encountered during lowering, or null if none has been seen.
  /// Used by RaiseSignature to produce a roundtrippable type for the 'e' encoding.
@@ -65,10 +106,40 @@ public void CacheStructBySize(TypeDesc type)
  }
 
  /// <summary>
- /// Gets a previously cached struct type of the specified byte size.
- /// Returns null if no struct of that size has been cached.
- /// Used by RaiseSignature to produce a roundtrippable type for the 'S&lt;N&gt;' encoding.
+ /// Caches a struct return type by size. Kept apart from the parameter cache because the two
+ /// classes are not interchangeable: a multi-slot type spells <c>S&lt;N&gt;</c> as a return but
+ /// re-lowers to its slot form as a parameter, so letting one answer for the other would give
+ /// an ordinary same-sized struct that type's larger alignment.
+ /// </summary>
+ public void CacheReturnStructBySize(TypeDesc type)
+ {
+ int size = type.GetElementSize().AsInt;
+ if (size <= 0)
+ return;
+
+ lock (_structCacheLock)
+ {
+ _returnStructsBySize.TryAdd(size, type);
+ }
+ }
+
+ /// <summary>
+ /// Gets a previously cached struct return type of the specified byte size, falling back to a
+ /// parameter of that size. Returns null if neither has been cached.
  /// </summary>
+ public TypeDesc GetCachedReturnStructOfSize(int size)
+ {
+ lock (_structCacheLock)
+ {
+ if (_returnStructsBySize.TryGetValue(size, out TypeDesc result))
+ {
+ return result;
+ }
+ }
+
+ return GetCachedStructOfSize(size);
+ }
+
  public TypeDesc GetCachedStructOfSize(int size)
  {
  lock (_structCacheLock)

src/coreclr/tools/Common/JitInterface/CorInfoImpl.cs

@@ -4027,6 +4027,15 @@ private CorInfoWasmType getWasmLowering(CORINFO_CLASS_STRUCT_* structHnd)
  }
 #endif
 
+ // A type split across several wasm parameters reports the slot type it splits into;
+ // the JIT derives the count from the struct's size.
+ if (WasmLowering.TryGetMultiSegmentLayout(type, out WasmValueType multiSlotType, out _))
+ {
+ return multiSlotType == WasmValueType.I64
+ ? CorInfoWasmType.CORINFO_WASM_TYPE_I64
+ : CorInfoWasmType.CORINFO_WASM_TYPE_V128;
+ }
+
  TypeDesc abiType = WasmLowering.LowerToAbiType(type);
 
  if (abiType == null)

docs/design/coreclr/botr/clr-abi.md

@@ -717,9 +717,7 @@ A frame pointer, if used, points at the bottom of the "fixed" portion of the sta
 
 Arguments and return values are processed via the Type Lowering algorithm below.
 
-If a struct is returned via a hidden buffer, the address is supplied by the caller and passed just after the managed `this`, or after `$sp` argument when `this` is not present. In such cases the return value of the method is the address of the return value. But if the struct can be passed on the Wasm stack it is returned on the Wasm stack per the Type Lowering rules.
-
-(TBD: ABI for vector types)
+If a struct is returned via a hidden buffer, the address is supplied by the caller and passed just after the managed `this`, or after `$sp` argument when `this` is not present. In such cases the return value of the method is the address of the return value. Structs passed by value across multiple Wasm parameters are still returned through a hidden buffer.
 
 ### Type Lowering
 
@@ -735,22 +733,28 @@ Managed types are lowered to WebAssembly value types according to the following
 | `nint`, `nuint`, pointer, byref, function pointer | `i32` (pointer-sized) |
 | Reference types (class, string, array, szarray, interface) | `i32` (pointer-sized) |
 | Value type (struct) — single primitive field, no padding | Unwrap recursively to the field's wasm type |
-| Value type (struct) — single field with padding, multiple fields, or SIMD type | Passed by reference (`i32` pointer) |
+| `Vector64<T>` | `i64` |
+| `Vector128<T>`, or a 16-byte `Vector<T>` | `v128` |
+| `Int128`, `UInt128`, `Decimal128` | Two `i64` parameters |
+| `Vector256<T>` | Two `v128` parameters |
+| `Vector512<T>` | Four `v128` parameters |
+| Value type (struct) — single field with padding, multiple fields, or another non-unwrappable SIMD type | Passed by reference (`i32` pointer) |
 | Empty struct (zero instance fields) | Not currently elided; since .NET empty structs have size 1, they are treated as non-unwrappable structs and passed by reference.|
 
 **Struct unwrapping** is recursive: a struct containing a single struct field, where the inner struct
 has the same size as the outer, is unwrapped until a primitive is reached or the rule no longer applies.
 For example, a struct `Wrapper { Inner value; }` where `Inner { int x; }` is unwrapped all the way
-to `i32`.
+to `i32`. A single-field struct wrapping one of the multi-parameter types above is passed the same
+way as the type it wraps.
 
 A struct is **not** unwrapped when:
 - It has more than one instance field.
 - It has exactly one instance field but the field's size differs from the struct's size (i.e., the
  struct has padding due to explicit layout or alignment attributes).
 
-Structs that cannot be unwrapped, including SIMD types for now, are passed by reference. The caller
-allocates space on the linear stack and passes a pointer. For return values, the caller provides a
-hidden return buffer pointer.
+Structs that cannot be unwrappedare passed by reference. The caller allocates space on the linear
+stack and passes a pointer. All multi-parameter types above, and structs that cannot be unwrapped,
+are returned through a hidden return buffer.
 
 ### Prolog
 

docs/design/coreclr/botr/readytorun-format.md

@@ -1105,6 +1105,36 @@ it knows a hidden retbuf pointer argument is present in the Wasm parameter list.
 | `V` | `v128` parameter (a `Vector128<T>`, or a 16-byte `Vector<T>`, passed by value) |
 | `S<N>` | struct parameter passed by reference, `<N>` is the struct size in bytes |
 | `e` | empty struct parameter — elided from Wasm args but present in the string |
+| `<slot><E>` | multi-slot parameter passed by value, see below |
+
+**Multi-slot parameters**: some types are passed by value across several Wasm parameters
+because no single Wasm value type can hold them, matching the Wasm C ABI. The slot
+character is followed by the factor by which the type's alignment is elevated above that
+slot's natural alignment:
+
+| Encoding | Slots | Alignment | Type |
+|---|---|---|---|
+| `l2` | 2 x `i64` | 16 (elevated 2x) | `Int128`, `UInt128`, `Decimal128` |
+| `V2` | 2 x `v128` | 32 (elevated 2x) | `Vector256<T>` |
+| `V4` | 4 x `v128` | 64 (elevated 4x) | `Vector512<T>` |
+
+A single-field struct wrapping one of these is passed the same way as the type it wraps,
+matching the treatment of a struct wrapping a `v128`.
+
+The digit is required. A repeated slot character without one — `ll`, `VV` — is not an
+aggregate: it is two independent scalar parameters, which is how every implementation
+reads it. So `ll2VV4` is `i64`, `Int128`, `Vector128<T>`, `Vector512<T>`. The grammar stays
+unambiguous because no other token places a digit after a slot character; `S<N>` consumes
+its own digits.
+
+These types are still *returned* through a hidden buffer, encoded as `S<N>` like any other
+aggregate. Limitation: a single digit carries both the slot count and the elevation factor,
+so an aggregate whose elevation differs from its slot count has no spelling. That includes
+one whose alignment is merely natural for its slot type, which would need count `N` with
+elevation 1. No such type exists in the Wasm ABI today.
+
+WasmAppBuilder does not emit or consume multi-slot tokens: they do not appear in
+`InternalCall` or `PInvoke` signatures.
 
 **Suffix**:
 
@@ -1133,6 +1163,8 @@ prefix to distinguish thunk categories:
 | `static MyStruct F()` where `MyStruct` is 16 bytes | `S16p` |
 | `static void F(MyStruct s)` where `MyStruct` is 8 bytes | `vS8p` |
 | `static int F(float x, double y)` | `ifdp` |
+| `static long F(long tag, Int128 v, int t)` | `lll2ip` |
+| `static int F(long tag, Vector512<int> v, int t)` | `ilV4ip` |
 | `[UnmanagedCallersOnly] static int F(int x)` | `ii` |
 
 **Slot sizing for structs**: When computing interpreter stack layout, struct parameters

src/coreclr/inc/jiteeversionguid.h

@@ -37,11 +37,11 @@
 
 #include <minipal/guid.h>
 
-constexpr GUID JITEEVersionIdentifier = { /* 513ac378-778b-4db5-b560-ebecaa000a4b */
-0x513ac378,
-0x778b,
-0x4db5,
- {0xb5, 0x60, 0xeb, 0xec, 0xaa, 0x00, 0x0a, 0x4b}
+constexpr GUID JITEEVersionIdentifier = { /* aa3cece7-a5f9-4b4e-9309-852c8bd4bdb1 */
+0xaa3cece7,
+0xa5f9,
+0x4b4e,
+ {0x93, 0x09, 0x85, 0x2c, 0x8b, 0xd4, 0xbd, 0xb1}
  };
 
 #endif // JIT_EE_VERSIONING_GUID_H

src/coreclr/jit/codegenlinear.cpp

@@ -1760,6 +1760,7 @@ void CodeGen::genConsumeRegs(GenTree* tree)
  genConsumeRegs(tree->gtGetOp1());
  genConsumeRegs(tree->gtGetOp2());
  }
+#endif
  else if (tree->OperIsFieldList())
  {
  for (GenTreeFieldList::Use& use : tree->AsFieldList()->Uses())
@@ -1768,7 +1769,6 @@ void CodeGen::genConsumeRegs(GenTree* tree)
  genConsumeRegs(fieldNode);
  }
  }
-#endif
  else if (tree->OperIsLocalRead())
  {
  // A contained lcl var must be living on stack and marked as reg optional, or not be a

src/coreclr/jit/codegenwasm.cpp

@@ -3063,12 +3063,12 @@ void CodeGen::genCall(GenTreeCall* call)
 
  for (CallArg& arg : call->gtArgs.EarlyArgs())
  {
-genConsumeReg(arg.GetEarlyNode());
+genConsumeRegs(arg.GetEarlyNode());
  }
 
  for (CallArg& arg : call->gtArgs.LateArgs())
  {
-genConsumeReg(arg.GetLateNode());
+genConsumeRegs(arg.GetLateNode());
  }
 
  if (call->NeedsNullCheck())
@@ -3118,7 +3118,13 @@ void CodeGen::genCallInstruction(GenTreeCall* call)
  }
  else if (callRetType == TYP_STRUCT)
  {
- typeStack.Push(m_compiler->info.compCompHnd->getWasmLowering(call->gtRetClsHnd));
+ CorInfoWasmType retWasmType = m_compiler->info.compCompHnd->getWasmLowering(call->gtRetClsHnd);
+ // A struct wider than the wasm value it lowers to is returned through a hidden buffer,
+ // so it must have been handled by the retbuf branch above.
+ assert(retWasmType != CORINFO_WASM_TYPE_VOID);
+ assert(m_compiler->info.compCompHnd->getClassSize(call->gtRetClsHnd) <=
+ genTypeSize(WasmClassifier::ToJitType(retWasmType)));
+ typeStack.Push(retWasmType);
  }
  else
  {

src/coreclr/jit/compiler.cpp

@@ -759,7 +759,9 @@ var_types Compiler::getReturnTypeForStruct(CORINFO_CLASS_HANDLE clsHnd,
 #if defined(TARGET_WASM)
  CorInfoWasmType abiType = info.compCompHnd->getWasmLowering(clsHnd);
 
- if (abiType == CORINFO_WASM_TYPE_VOID)
+ // A struct wider than the wasm value it lowers to is split across several of them when
+ // passed, but returned via a hidden buffer like any other aggregate.
+ if ((abiType == CORINFO_WASM_TYPE_VOID) || (structSize > genTypeSize(WasmClassifier::ToJitType(abiType))))
  {
  howToReturnStruct = SPK_ByReference;
  useType = TYP_UNKNOWN;

src/coreclr/jit/lower.cpp

@@ -3195,7 +3195,6 @@ size_t Lowering::MarkPutArgAndFieldListNodes(GenTree* node)
  {
  for (GenTreeFieldList::Use& operand : node->AsFieldList()->Uses())
  {
- assert(operand.GetNode()->OperIsPutArg());
  result += MarkPutArgAndFieldListNodes(operand.GetNode());
  }
  }

src/coreclr/jit/targetwasm.cpp

@@ -87,6 +87,26 @@ ABIPassingInformation WasmClassifier::Classify(Compiler* comp,
  else
  {
  abiType = ToJitType(wasmAbiType);
+
+ // A struct wider than the wasm value it lowers to is passed by value across several
+ // of them, matching the wasm C ABI: Int128 as 2 x i64, a 256-bit vector as 2 x v128,
+ // a 512-bit vector as 4 x v128. A struct can be narrower than its value (see the
+ // segment size below), so this must compare sizes rather than count slots.
+ unsigned segSize = genTypeSize(abiType);
+ if (structLayout->GetSize() > segSize)
+ {
+ unsigned numSegs = structLayout->GetSize() / segSize;
+ assert((numSegs * segSize) == structLayout->GetSize());
+
+ ABIPassingInformation info(comp, numSegs);
+ for (unsigned i = 0; i < numSegs; i++)
+ {
+ regNumber reg = MakeWasmReg(m_localIndex++, abiType);
+ info.Segment(i) = ABIPassingSegment::InRegister(reg, i * segSize, segSize);
+ }
+
+ return info;
+ }
  }
 
  regNumber reg = MakeWasmReg(m_localIndex++, genActualType(abiType));

src/coreclr/tools/Common/Compiler/CompilerTypeSystemContext.Wasm.cs

@@ -1,18 +1,25 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
+using System;
 using System.Collections.Generic;
 
 using Internal.TypeSystem;
 
+using Debug = System.Diagnostics.Debug;
+
 namespace ILCompiler
 {
  public partial class CompilerTypeSystemContext
  {
  private readonly object _structCacheLock = new object();
  private readonly Dictionary<int, TypeDesc> _structsBySize = new Dictionary<int, TypeDesc>();
+ private readonly Dictionary<int, TypeDesc> _returnStructsBySize = new Dictionary<int, TypeDesc>();
  private volatile TypeDesc _cachedEmptyStruct;
  private volatile TypeDesc _wasmV128Type;
+ private volatile TypeDesc _wasmInt128Type;
+ private volatile TypeDesc _wasmV256Type;
+ private volatile TypeDesc _wasmV512Type;
 
  /// <summary>
  /// Gets the type RaiseSignature produces for the 'V' encoding. All v128 types share the same
@@ -34,6 +41,40 @@ public TypeDesc WasmV128Type
  }
  }
 
+ /// <summary>
+ /// Gets the type RaiseSignature produces for an elevated multi-slot encoding ('l2', 'V2', 'V4'),
+ /// where the digit is the factor by which the type's alignment is elevated above the slot's
+ /// natural alignment. A thunk is keyed by its signature string, so every type spelling an
+ /// encoding shares one and raising can only resolve a stand-in. For 'V2' and 'V4' the
+ /// candidates are instantiations of a single generic type, so any element type stands for
+ /// the rest; for 'l2' they are unrelated types -- Int128, UInt128, Decimal128 -- agreeing in
+ /// nothing but the signature. Both are sound because the signature is all the thunk's frame
+ /// layout derives from, which is what the asserts below hold the stand-in to. Resolving a
+ /// fixed type also keeps raising independent of the order lowering encountered them in.
+ /// </summary>
+ public TypeDesc GetWasmElevatedType(char slot, int elevation)
+ {
+ TypeDesc type = (slot, elevation) switch
+ {
+ ('l', 2) => _wasmInt128Type ??= SystemModule.GetType("System"u8, "Int128"u8),
+ ('V', 2) => _wasmV256Type ??= InstantiateOverByte("Vector256`1"u8),
+ ('V', 4) => _wasmV512Type ??= InstantiateOverByte("Vector512`1"u8),
+ _ => throw new InvalidOperationException($"Unknown elevated signature encoding: {slot}{elevation}")
+ };
+
+ // The slot layout alone does not imply alignment, so the resolved type must supply it:
+ // a 16-byte 8-aligned struct is spelled 'S16', not 'l2'.
+ int slotSize = slot == 'l' ? 8 : 16;
+ Debug.Assert(((DefType)type).InstanceFieldSize.AsInt == slotSize * elevation);
+ Debug.Assert(((DefType)type).InstanceFieldAlignment.AsInt == slotSize * elevation);
+
+ return type;
+
+ TypeDesc InstantiateOverByte(ReadOnlySpan<byte> name) =>
+ ((MetadataType)SystemModule.GetType("System.Runtime.Intrinsics"u8, name))
+ .MakeInstantiatedType(GetWellKnownType(WellKnownType.Byte));
+ }
+
  /// <summary>
  /// Gets the first empty struct type encountered during lowering, or null if none has been seen.
  /// Used by RaiseSignature to produce a roundtrippable type for the 'e' encoding.
@@ -65,10 +106,40 @@ public void CacheStructBySize(TypeDesc type)
  }
 
  /// <summary>
- /// Gets a previously cached struct type of the specified byte size.
- /// Returns null if no struct of that size has been cached.
- /// Used by RaiseSignature to produce a roundtrippable type for the 'S&lt;N&gt;' encoding.
+ /// Caches a struct return type by size. Kept apart from the parameter cache because the two
+ /// classes are not interchangeable: a multi-slot type spells <c>S&lt;N&gt;</c> as a return but
+ /// re-lowers to its slot form as a parameter, so letting one answer for the other would give
+ /// an ordinary same-sized struct that type's larger alignment.
+ /// </summary>
+ public void CacheReturnStructBySize(TypeDesc type)
+ {
+ int size = type.GetElementSize().AsInt;
+ if (size <= 0)
+ return;
+
+ lock (_structCacheLock)
+ {
+ _returnStructsBySize.TryAdd(size, type);
+ }
+ }
+
+ /// <summary>
+ /// Gets a previously cached struct return type of the specified byte size, falling back to a
+ /// parameter of that size. Returns null if neither has been cached.
  /// </summary>
+ public TypeDesc GetCachedReturnStructOfSize(int size)
+ {
+ lock (_structCacheLock)
+ {
+ if (_returnStructsBySize.TryGetValue(size, out TypeDesc result))
+ {
+ return result;
+ }
+ }
+
+ return GetCachedStructOfSize(size);
+ }
+
  public TypeDesc GetCachedStructOfSize(int size)
  {
  lock (_structCacheLock)

src/coreclr/tools/Common/JitInterface/CorInfoImpl.cs

@@ -4027,6 +4027,15 @@ private CorInfoWasmType getWasmLowering(CORINFO_CLASS_STRUCT_* structHnd)
  }
 #endif
 
+ // A type split across several wasm parameters reports the slot type it splits into;
+ // the JIT derives the count from the struct's size.
+ if (WasmLowering.TryGetMultiSegmentLayout(type, out WasmValueType multiSlotType, out _))
+ {
+ return multiSlotType == WasmValueType.I64
+ ? CorInfoWasmType.CORINFO_WASM_TYPE_I64
+ : CorInfoWasmType.CORINFO_WASM_TYPE_V128;
+ }
+
  TypeDesc abiType = WasmLowering.LowerToAbiType(type);
 
  if (abiType == null)

docs/design/coreclr/botr/clr-abi.md

@@ -717,9 +717,7 @@ A frame pointer, if used, points at the bottom of the "fixed" portion of the sta
 
 Arguments and return values are processed via the Type Lowering algorithm below.
 
-If a struct is returned via a hidden buffer, the address is supplied by the caller and passed just after the managed `this`, or after `$sp` argument when `this` is not present. In such cases the return value of the method is the address of the return value. But if the struct can be passed on the Wasm stack it is returned on the Wasm stack per the Type Lowering rules.
-
-(TBD: ABI for vector types)
+If a struct is returned via a hidden buffer, the address is supplied by the caller and passed just after the managed `this`, or after `$sp` argument when `this` is not present. In such cases the return value of the method is the address of the return value. Structs passed by value across multiple Wasm parameters are still returned through a hidden buffer.
 
 ### Type Lowering
 
@@ -735,22 +733,28 @@ Managed types are lowered to WebAssembly value types according to the following
 | `nint`, `nuint`, pointer, byref, function pointer | `i32` (pointer-sized) |
 | Reference types (class, string, array, szarray, interface) | `i32` (pointer-sized) |
 | Value type (struct) — single primitive field, no padding | Unwrap recursively to the field's wasm type |
-| Value type (struct) — single field with padding, multiple fields, or SIMD type | Passed by reference (`i32` pointer) |
+| `Vector64<T>` | `i64` |
+| `Vector128<T>`, or a 16-byte `Vector<T>` | `v128` |
+| `Int128`, `UInt128`, `Decimal128` | Two `i64` parameters |
+| `Vector256<T>` | Two `v128` parameters |
+| `Vector512<T>` | Four `v128` parameters |
+| Value type (struct) — single field with padding, multiple fields, or another non-unwrappable SIMD type | Passed by reference (`i32` pointer) |
 | Empty struct (zero instance fields) | Not currently elided; since .NET empty structs have size 1, they are treated as non-unwrappable structs and passed by reference.|
 
 **Struct unwrapping** is recursive: a struct containing a single struct field, where the inner struct
 has the same size as the outer, is unwrapped until a primitive is reached or the rule no longer applies.
 For example, a struct `Wrapper { Inner value; }` where `Inner { int x; }` is unwrapped all the way
-to `i32`.
+to `i32`. A single-field struct wrapping one of the multi-parameter types above is passed the same
+way as the type it wraps.
 
 A struct is **not** unwrapped when:
 - It has more than one instance field.
 - It has exactly one instance field but the field's size differs from the struct's size (i.e., the
  struct has padding due to explicit layout or alignment attributes).
 
-Structs that cannot be unwrapped, including SIMD types for now, are passed by reference. The caller
-allocates space on the linear stack and passes a pointer. For return values, the caller provides a
-hidden return buffer pointer.
+Structs that cannot be unwrappedare passed by reference. The caller allocates space on the linear
+stack and passes a pointer. All multi-parameter types above, and structs that cannot be unwrapped,
+are returned through a hidden return buffer.
 
 ### Prolog
 

docs/design/coreclr/botr/readytorun-format.md

@@ -1105,6 +1105,36 @@ it knows a hidden retbuf pointer argument is present in the Wasm parameter list.
 | `V` | `v128` parameter (a `Vector128<T>`, or a 16-byte `Vector<T>`, passed by value) |
 | `S<N>` | struct parameter passed by reference, `<N>` is the struct size in bytes |
 | `e` | empty struct parameter — elided from Wasm args but present in the string |
+| `<slot><E>` | multi-slot parameter passed by value, see below |
+
+**Multi-slot parameters**: some types are passed by value across several Wasm parameters
+because no single Wasm value type can hold them, matching the Wasm C ABI. The slot
+character is followed by the factor by which the type's alignment is elevated above that
+slot's natural alignment:
+
+| Encoding | Slots | Alignment | Type |
+|---|---|---|---|
+| `l2` | 2 x `i64` | 16 (elevated 2x) | `Int128`, `UInt128`, `Decimal128` |
+| `V2` | 2 x `v128` | 32 (elevated 2x) | `Vector256<T>` |
+| `V4` | 4 x `v128` | 64 (elevated 4x) | `Vector512<T>` |
+
+A single-field struct wrapping one of these is passed the same way as the type it wraps,
+matching the treatment of a struct wrapping a `v128`.
+
+The digit is required. A repeated slot character without one — `ll`, `VV` — is not an
+aggregate: it is two independent scalar parameters, which is how every implementation
+reads it. So `ll2VV4` is `i64`, `Int128`, `Vector128<T>`, `Vector512<T>`. The grammar stays
+unambiguous because no other token places a digit after a slot character; `S<N>` consumes
+its own digits.
+
+These types are still *returned* through a hidden buffer, encoded as `S<N>` like any other
+aggregate. Limitation: a single digit carries both the slot count and the elevation factor,
+so an aggregate whose elevation differs from its slot count has no spelling. That includes
+one whose alignment is merely natural for its slot type, which would need count `N` with
+elevation 1. No such type exists in the Wasm ABI today.
+
+WasmAppBuilder does not emit or consume multi-slot tokens: they do not appear in
+`InternalCall` or `PInvoke` signatures.
 
 **Suffix**:
 
@@ -1133,6 +1163,8 @@ prefix to distinguish thunk categories:
 | `static MyStruct F()` where `MyStruct` is 16 bytes | `S16p` |
 | `static void F(MyStruct s)` where `MyStruct` is 8 bytes | `vS8p` |
 | `static int F(float x, double y)` | `ifdp` |
+| `static long F(long tag, Int128 v, int t)` | `lll2ip` |
+| `static int F(long tag, Vector512<int> v, int t)` | `ilV4ip` |
 | `[UnmanagedCallersOnly] static int F(int x)` | `ii` |
 
 **Slot sizing for structs**: When computing interpreter stack layout, struct parameters

src/coreclr/inc/jiteeversionguid.h

@@ -37,11 +37,11 @@
 
 #include <minipal/guid.h>
 
-constexpr GUID JITEEVersionIdentifier = { /* 513ac378-778b-4db5-b560-ebecaa000a4b */
-0x513ac378,
-0x778b,
-0x4db5,
- {0xb5, 0x60, 0xeb, 0xec, 0xaa, 0x00, 0x0a, 0x4b}
+constexpr GUID JITEEVersionIdentifier = { /* aa3cece7-a5f9-4b4e-9309-852c8bd4bdb1 */
+0xaa3cece7,
+0xa5f9,
+0x4b4e,
+ {0x93, 0x09, 0x85, 0x2c, 0x8b, 0xd4, 0xbd, 0xb1}
  };
 
 #endif // JIT_EE_VERSIONING_GUID_H

src/coreclr/jit/codegenlinear.cpp

@@ -1760,6 +1760,7 @@ void CodeGen::genConsumeRegs(GenTree* tree)
  genConsumeRegs(tree->gtGetOp1());
  genConsumeRegs(tree->gtGetOp2());
  }
+#endif
  else if (tree->OperIsFieldList())
  {
  for (GenTreeFieldList::Use& use : tree->AsFieldList()->Uses())
@@ -1768,7 +1769,6 @@ void CodeGen::genConsumeRegs(GenTree* tree)
  genConsumeRegs(fieldNode);
  }
  }
-#endif
  else if (tree->OperIsLocalRead())
  {
  // A contained lcl var must be living on stack and marked as reg optional, or not be a

src/coreclr/jit/codegenwasm.cpp

@@ -3063,12 +3063,12 @@ void CodeGen::genCall(GenTreeCall* call)
 
  for (CallArg& arg : call->gtArgs.EarlyArgs())
  {
-genConsumeReg(arg.GetEarlyNode());
+genConsumeRegs(arg.GetEarlyNode());
  }
 
  for (CallArg& arg : call->gtArgs.LateArgs())
  {
-genConsumeReg(arg.GetLateNode());
+genConsumeRegs(arg.GetLateNode());
  }
 
  if (call->NeedsNullCheck())
@@ -3118,7 +3118,13 @@ void CodeGen::genCallInstruction(GenTreeCall* call)
  }
  else if (callRetType == TYP_STRUCT)
  {
- typeStack.Push(m_compiler->info.compCompHnd->getWasmLowering(call->gtRetClsHnd));
+ CorInfoWasmType retWasmType = m_compiler->info.compCompHnd->getWasmLowering(call->gtRetClsHnd);
+ // A struct wider than the wasm value it lowers to is returned through a hidden buffer,
+ // so it must have been handled by the retbuf branch above.
+ assert(retWasmType != CORINFO_WASM_TYPE_VOID);
+ assert(m_compiler->info.compCompHnd->getClassSize(call->gtRetClsHnd) <=
+ genTypeSize(WasmClassifier::ToJitType(retWasmType)));
+ typeStack.Push(retWasmType);
  }
  else
  {

src/coreclr/jit/compiler.cpp

@@ -759,7 +759,9 @@ var_types Compiler::getReturnTypeForStruct(CORINFO_CLASS_HANDLE clsHnd,
 #if defined(TARGET_WASM)
  CorInfoWasmType abiType = info.compCompHnd->getWasmLowering(clsHnd);
 
- if (abiType == CORINFO_WASM_TYPE_VOID)
+ // A struct wider than the wasm value it lowers to is split across several of them when
+ // passed, but returned via a hidden buffer like any other aggregate.
+ if ((abiType == CORINFO_WASM_TYPE_VOID) || (structSize > genTypeSize(WasmClassifier::ToJitType(abiType))))
  {
  howToReturnStruct = SPK_ByReference;
  useType = TYP_UNKNOWN;

src/coreclr/jit/lower.cpp

@@ -3195,7 +3195,6 @@ size_t Lowering::MarkPutArgAndFieldListNodes(GenTree* node)
  {
  for (GenTreeFieldList::Use& operand : node->AsFieldList()->Uses())
  {
- assert(operand.GetNode()->OperIsPutArg());
  result += MarkPutArgAndFieldListNodes(operand.GetNode());
  }
  }

src/coreclr/jit/targetwasm.cpp

@@ -87,6 +87,26 @@ ABIPassingInformation WasmClassifier::Classify(Compiler* comp,
  else
  {
  abiType = ToJitType(wasmAbiType);
+
+ // A struct wider than the wasm value it lowers to is passed by value across several
+ // of them, matching the wasm C ABI: Int128 as 2 x i64, a 256-bit vector as 2 x v128,
+ // a 512-bit vector as 4 x v128. A struct can be narrower than its value (see the
+ // segment size below), so this must compare sizes rather than count slots.
+ unsigned segSize = genTypeSize(abiType);
+ if (structLayout->GetSize() > segSize)
+ {
+ unsigned numSegs = structLayout->GetSize() / segSize;
+ assert((numSegs * segSize) == structLayout->GetSize());
+
+ ABIPassingInformation info(comp, numSegs);
+ for (unsigned i = 0; i < numSegs; i++)
+ {
+ regNumber reg = MakeWasmReg(m_localIndex++, abiType);
+ info.Segment(i) = ABIPassingSegment::InRegister(reg, i * segSize, segSize);
+ }
+
+ return info;
+ }
  }
 
  regNumber reg = MakeWasmReg(m_localIndex++, genActualType(abiType));

src/coreclr/tools/Common/Compiler/CompilerTypeSystemContext.Wasm.cs

@@ -1,18 +1,25 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
+using System;
 using System.Collections.Generic;
 
 using Internal.TypeSystem;
 
+using Debug = System.Diagnostics.Debug;
+
 namespace ILCompiler
 {
  public partial class CompilerTypeSystemContext
  {
  private readonly object _structCacheLock = new object();
  private readonly Dictionary<int, TypeDesc> _structsBySize = new Dictionary<int, TypeDesc>();
+ private readonly Dictionary<int, TypeDesc> _returnStructsBySize = new Dictionary<int, TypeDesc>();
  private volatile TypeDesc _cachedEmptyStruct;
  private volatile TypeDesc _wasmV128Type;
+ private volatile TypeDesc _wasmInt128Type;
+ private volatile TypeDesc _wasmV256Type;
+ private volatile TypeDesc _wasmV512Type;
 
  /// <summary>
  /// Gets the type RaiseSignature produces for the 'V' encoding. All v128 types share the same
@@ -34,6 +41,40 @@ public TypeDesc WasmV128Type
  }
  }
 
+ /// <summary>
+ /// Gets the type RaiseSignature produces for an elevated multi-slot encoding ('l2', 'V2', 'V4'),
+ /// where the digit is the factor by which the type's alignment is elevated above the slot's
+ /// natural alignment. A thunk is keyed by its signature string, so every type spelling an
+ /// encoding shares one and raising can only resolve a stand-in. For 'V2' and 'V4' the
+ /// candidates are instantiations of a single generic type, so any element type stands for
+ /// the rest; for 'l2' they are unrelated types -- Int128, UInt128, Decimal128 -- agreeing in
+ /// nothing but the signature. Both are sound because the signature is all the thunk's frame
+ /// layout derives from, which is what the asserts below hold the stand-in to. Resolving a
+ /// fixed type also keeps raising independent of the order lowering encountered them in.
+ /// </summary>
+ public TypeDesc GetWasmElevatedType(char slot, int elevation)
+ {
+ TypeDesc type = (slot, elevation) switch
+ {
+ ('l', 2) => _wasmInt128Type ??= SystemModule.GetType("System"u8, "Int128"u8),
+ ('V', 2) => _wasmV256Type ??= InstantiateOverByte("Vector256`1"u8),
+ ('V', 4) => _wasmV512Type ??= InstantiateOverByte("Vector512`1"u8),
+ _ => throw new InvalidOperationException($"Unknown elevated signature encoding: {slot}{elevation}")
+ };
+
+ // The slot layout alone does not imply alignment, so the resolved type must supply it:
+ // a 16-byte 8-aligned struct is spelled 'S16', not 'l2'.
+ int slotSize = slot == 'l' ? 8 : 16;
+ Debug.Assert(((DefType)type).InstanceFieldSize.AsInt == slotSize * elevation);
+ Debug.Assert(((DefType)type).InstanceFieldAlignment.AsInt == slotSize * elevation);
+
+ return type;
+
+ TypeDesc InstantiateOverByte(ReadOnlySpan<byte> name) =>
+ ((MetadataType)SystemModule.GetType("System.Runtime.Intrinsics"u8, name))
+ .MakeInstantiatedType(GetWellKnownType(WellKnownType.Byte));
+ }
+
  /// <summary>
  /// Gets the first empty struct type encountered during lowering, or null if none has been seen.
  /// Used by RaiseSignature to produce a roundtrippable type for the 'e' encoding.
@@ -65,10 +106,40 @@ public void CacheStructBySize(TypeDesc type)
  }
 
  /// <summary>
- /// Gets a previously cached struct type of the specified byte size.
- /// Returns null if no struct of that size has been cached.
- /// Used by RaiseSignature to produce a roundtrippable type for the 'S&lt;N&gt;' encoding.
+ /// Caches a struct return type by size. Kept apart from the parameter cache because the two
+ /// classes are not interchangeable: a multi-slot type spells <c>S&lt;N&gt;</c> as a return but
+ /// re-lowers to its slot form as a parameter, so letting one answer for the other would give
+ /// an ordinary same-sized struct that type's larger alignment.
+ /// </summary>
+ public void CacheReturnStructBySize(TypeDesc type)
+ {
+ int size = type.GetElementSize().AsInt;
+ if (size <= 0)
+ return;
+
+ lock (_structCacheLock)
+ {
+ _returnStructsBySize.TryAdd(size, type);
+ }
+ }
+
+ /// <summary>
+ /// Gets a previously cached struct return type of the specified byte size, falling back to a
+ /// parameter of that size. Returns null if neither has been cached.
  /// </summary>
+ public TypeDesc GetCachedReturnStructOfSize(int size)
+ {
+ lock (_structCacheLock)
+ {
+ if (_returnStructsBySize.TryGetValue(size, out TypeDesc result))
+ {
+ return result;
+ }
+ }
+
+ return GetCachedStructOfSize(size);
+ }
+
  public TypeDesc GetCachedStructOfSize(int size)
  {
  lock (_structCacheLock)

src/coreclr/tools/Common/JitInterface/CorInfoImpl.cs

@@ -4027,6 +4027,15 @@ private CorInfoWasmType getWasmLowering(CORINFO_CLASS_STRUCT_* structHnd)
  }
 #endif
 
+ // A type split across several wasm parameters reports the slot type it splits into;
+ // the JIT derives the count from the struct's size.
+ if (WasmLowering.TryGetMultiSegmentLayout(type, out WasmValueType multiSlotType, out _))
+ {
+ return multiSlotType == WasmValueType.I64
+ ? CorInfoWasmType.CORINFO_WASM_TYPE_I64
+ : CorInfoWasmType.CORINFO_WASM_TYPE_V128;
+ }
+
  TypeDesc abiType = WasmLowering.LowerToAbiType(type);
 
  if (abiType == null)

docs/design/coreclr/botr/clr-abi.md

@@ -717,9 +717,7 @@ A frame pointer, if used, points at the bottom of the "fixed" portion of the sta
 
 Arguments and return values are processed via the Type Lowering algorithm below.
 
-If a struct is returned via a hidden buffer, the address is supplied by the caller and passed just after the managed `this`, or after `$sp` argument when `this` is not present. In such cases the return value of the method is the address of the return value. But if the struct can be passed on the Wasm stack it is returned on the Wasm stack per the Type Lowering rules.
-
-(TBD: ABI for vector types)
+If a struct is returned via a hidden buffer, the address is supplied by the caller and passed just after the managed `this`, or after `$sp` argument when `this` is not present. In such cases the return value of the method is the address of the return value. Structs passed by value across multiple Wasm parameters are still returned through a hidden buffer.
 
 ### Type Lowering
 
@@ -735,22 +733,28 @@ Managed types are lowered to WebAssembly value types according to the following
 | `nint`, `nuint`, pointer, byref, function pointer | `i32` (pointer-sized) |
 | Reference types (class, string, array, szarray, interface) | `i32` (pointer-sized) |
 | Value type (struct) — single primitive field, no padding | Unwrap recursively to the field's wasm type |
-| Value type (struct) — single field with padding, multiple fields, or SIMD type | Passed by reference (`i32` pointer) |
+| `Vector64<T>` | `i64` |
+| `Vector128<T>`, or a 16-byte `Vector<T>` | `v128` |
+| `Int128`, `UInt128`, `Decimal128` | Two `i64` parameters |
+| `Vector256<T>` | Two `v128` parameters |
+| `Vector512<T>` | Four `v128` parameters |
+| Value type (struct) — single field with padding, multiple fields, or another non-unwrappable SIMD type | Passed by reference (`i32` pointer) |
 | Empty struct (zero instance fields) | Not currently elided; since .NET empty structs have size 1, they are treated as non-unwrappable structs and passed by reference.|
 
 **Struct unwrapping** is recursive: a struct containing a single struct field, where the inner struct
 has the same size as the outer, is unwrapped until a primitive is reached or the rule no longer applies.
 For example, a struct `Wrapper { Inner value; }` where `Inner { int x; }` is unwrapped all the way
-to `i32`.
+to `i32`. A single-field struct wrapping one of the multi-parameter types above is passed the same
+way as the type it wraps.
 
 A struct is **not** unwrapped when:
 - It has more than one instance field.
 - It has exactly one instance field but the field's size differs from the struct's size (i.e., the
  struct has padding due to explicit layout or alignment attributes).
 
-Structs that cannot be unwrapped, including SIMD types for now, are passed by reference. The caller
-allocates space on the linear stack and passes a pointer. For return values, the caller provides a
-hidden return buffer pointer.
+Structs that cannot be unwrappedare passed by reference. The caller allocates space on the linear
+stack and passes a pointer. All multi-parameter types above, and structs that cannot be unwrapped,
+are returned through a hidden return buffer.
 
 ### Prolog
 

docs/design/coreclr/botr/readytorun-format.md

@@ -1105,6 +1105,36 @@ it knows a hidden retbuf pointer argument is present in the Wasm parameter list.
 | `V` | `v128` parameter (a `Vector128<T>`, or a 16-byte `Vector<T>`, passed by value) |
 | `S<N>` | struct parameter passed by reference, `<N>` is the struct size in bytes |
 | `e` | empty struct parameter — elided from Wasm args but present in the string |
+| `<slot><E>` | multi-slot parameter passed by value, see below |
+
+**Multi-slot parameters**: some types are passed by value across several Wasm parameters
+because no single Wasm value type can hold them, matching the Wasm C ABI. The slot
+character is followed by the factor by which the type's alignment is elevated above that
+slot's natural alignment:
+
+| Encoding | Slots | Alignment | Type |
+|---|---|---|---|
+| `l2` | 2 x `i64` | 16 (elevated 2x) | `Int128`, `UInt128`, `Decimal128` |
+| `V2` | 2 x `v128` | 32 (elevated 2x) | `Vector256<T>` |
+| `V4` | 4 x `v128` | 64 (elevated 4x) | `Vector512<T>` |
+
+A single-field struct wrapping one of these is passed the same way as the type it wraps,
+matching the treatment of a struct wrapping a `v128`.
+
+The digit is required. A repeated slot character without one — `ll`, `VV` — is not an
+aggregate: it is two independent scalar parameters, which is how every implementation
+reads it. So `ll2VV4` is `i64`, `Int128`, `Vector128<T>`, `Vector512<T>`. The grammar stays
+unambiguous because no other token places a digit after a slot character; `S<N>` consumes
+its own digits.
+
+These types are still *returned* through a hidden buffer, encoded as `S<N>` like any other
+aggregate. Limitation: a single digit carries both the slot count and the elevation factor,
+so an aggregate whose elevation differs from its slot count has no spelling. That includes
+one whose alignment is merely natural for its slot type, which would need count `N` with
+elevation 1. No such type exists in the Wasm ABI today.
+
+WasmAppBuilder does not emit or consume multi-slot tokens: they do not appear in
+`InternalCall` or `PInvoke` signatures.
 
 **Suffix**:
 
@@ -1133,6 +1163,8 @@ prefix to distinguish thunk categories:
 | `static MyStruct F()` where `MyStruct` is 16 bytes | `S16p` |
 | `static void F(MyStruct s)` where `MyStruct` is 8 bytes | `vS8p` |
 | `static int F(float x, double y)` | `ifdp` |
+| `static long F(long tag, Int128 v, int t)` | `lll2ip` |
+| `static int F(long tag, Vector512<int> v, int t)` | `ilV4ip` |
 | `[UnmanagedCallersOnly] static int F(int x)` | `ii` |
 
 **Slot sizing for structs**: When computing interpreter stack layout, struct parameters

src/coreclr/inc/jiteeversionguid.h

@@ -37,11 +37,11 @@
 
 #include <minipal/guid.h>
 
-constexpr GUID JITEEVersionIdentifier = { /* 513ac378-778b-4db5-b560-ebecaa000a4b */
-0x513ac378,
-0x778b,
-0x4db5,
- {0xb5, 0x60, 0xeb, 0xec, 0xaa, 0x00, 0x0a, 0x4b}
+constexpr GUID JITEEVersionIdentifier = { /* aa3cece7-a5f9-4b4e-9309-852c8bd4bdb1 */
+0xaa3cece7,
+0xa5f9,
+0x4b4e,
+ {0x93, 0x09, 0x85, 0x2c, 0x8b, 0xd4, 0xbd, 0xb1}
  };
 
 #endif // JIT_EE_VERSIONING_GUID_H

src/coreclr/jit/codegenlinear.cpp

@@ -1760,6 +1760,7 @@ void CodeGen::genConsumeRegs(GenTree* tree)
  genConsumeRegs(tree->gtGetOp1());
  genConsumeRegs(tree->gtGetOp2());
  }
+#endif
  else if (tree->OperIsFieldList())
  {
  for (GenTreeFieldList::Use& use : tree->AsFieldList()->Uses())
@@ -1768,7 +1769,6 @@ void CodeGen::genConsumeRegs(GenTree* tree)
  genConsumeRegs(fieldNode);
  }
  }
-#endif
  else if (tree->OperIsLocalRead())
  {
  // A contained lcl var must be living on stack and marked as reg optional, or not be a

src/coreclr/jit/codegenwasm.cpp

@@ -3063,12 +3063,12 @@ void CodeGen::genCall(GenTreeCall* call)
 
  for (CallArg& arg : call->gtArgs.EarlyArgs())
  {
-genConsumeReg(arg.GetEarlyNode());
+genConsumeRegs(arg.GetEarlyNode());
  }
 
  for (CallArg& arg : call->gtArgs.LateArgs())
  {
-genConsumeReg(arg.GetLateNode());
+genConsumeRegs(arg.GetLateNode());
  }
 
  if (call->NeedsNullCheck())
@@ -3118,7 +3118,13 @@ void CodeGen::genCallInstruction(GenTreeCall* call)
  }
  else if (callRetType == TYP_STRUCT)
  {
- typeStack.Push(m_compiler->info.compCompHnd->getWasmLowering(call->gtRetClsHnd));
+ CorInfoWasmType retWasmType = m_compiler->info.compCompHnd->getWasmLowering(call->gtRetClsHnd);
+ // A struct wider than the wasm value it lowers to is returned through a hidden buffer,
+ // so it must have been handled by the retbuf branch above.
+ assert(retWasmType != CORINFO_WASM_TYPE_VOID);
+ assert(m_compiler->info.compCompHnd->getClassSize(call->gtRetClsHnd) <=
+ genTypeSize(WasmClassifier::ToJitType(retWasmType)));
+ typeStack.Push(retWasmType);
  }
  else
  {

src/coreclr/jit/compiler.cpp

@@ -759,7 +759,9 @@ var_types Compiler::getReturnTypeForStruct(CORINFO_CLASS_HANDLE clsHnd,
 #if defined(TARGET_WASM)
  CorInfoWasmType abiType = info.compCompHnd->getWasmLowering(clsHnd);
 
- if (abiType == CORINFO_WASM_TYPE_VOID)
+ // A struct wider than the wasm value it lowers to is split across several of them when
+ // passed, but returned via a hidden buffer like any other aggregate.
+ if ((abiType == CORINFO_WASM_TYPE_VOID) || (structSize > genTypeSize(WasmClassifier::ToJitType(abiType))))
  {
  howToReturnStruct = SPK_ByReference;
  useType = TYP_UNKNOWN;

src/coreclr/jit/lower.cpp

@@ -3195,7 +3195,6 @@ size_t Lowering::MarkPutArgAndFieldListNodes(GenTree* node)
  {
  for (GenTreeFieldList::Use& operand : node->AsFieldList()->Uses())
  {
- assert(operand.GetNode()->OperIsPutArg());
  result += MarkPutArgAndFieldListNodes(operand.GetNode());
  }
  }

src/coreclr/jit/targetwasm.cpp

@@ -87,6 +87,26 @@ ABIPassingInformation WasmClassifier::Classify(Compiler* comp,
  else
  {
  abiType = ToJitType(wasmAbiType);
+
+ // A struct wider than the wasm value it lowers to is passed by value across several
+ // of them, matching the wasm C ABI: Int128 as 2 x i64, a 256-bit vector as 2 x v128,
+ // a 512-bit vector as 4 x v128. A struct can be narrower than its value (see the
+ // segment size below), so this must compare sizes rather than count slots.
+ unsigned segSize = genTypeSize(abiType);
+ if (structLayout->GetSize() > segSize)
+ {
+ unsigned numSegs = structLayout->GetSize() / segSize;
+ assert((numSegs * segSize) == structLayout->GetSize());
+
+ ABIPassingInformation info(comp, numSegs);
+ for (unsigned i = 0; i < numSegs; i++)
+ {
+ regNumber reg = MakeWasmReg(m_localIndex++, abiType);
+ info.Segment(i) = ABIPassingSegment::InRegister(reg, i * segSize, segSize);
+ }
+
+ return info;
+ }
  }
 
  regNumber reg = MakeWasmReg(m_localIndex++, genActualType(abiType));

src/coreclr/tools/Common/Compiler/CompilerTypeSystemContext.Wasm.cs

@@ -1,18 +1,25 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
+using System;
 using System.Collections.Generic;
 
 using Internal.TypeSystem;
 
+using Debug = System.Diagnostics.Debug;
+
 namespace ILCompiler
 {
  public partial class CompilerTypeSystemContext
  {
  private readonly object _structCacheLock = new object();
  private readonly Dictionary<int, TypeDesc> _structsBySize = new Dictionary<int, TypeDesc>();
+ private readonly Dictionary<int, TypeDesc> _returnStructsBySize = new Dictionary<int, TypeDesc>();
  private volatile TypeDesc _cachedEmptyStruct;
  private volatile TypeDesc _wasmV128Type;
+ private volatile TypeDesc _wasmInt128Type;
+ private volatile TypeDesc _wasmV256Type;
+ private volatile TypeDesc _wasmV512Type;
 
  /// <summary>
  /// Gets the type RaiseSignature produces for the 'V' encoding. All v128 types share the same
@@ -34,6 +41,40 @@ public TypeDesc WasmV128Type
  }
  }
 
+ /// <summary>
+ /// Gets the type RaiseSignature produces for an elevated multi-slot encoding ('l2', 'V2', 'V4'),
+ /// where the digit is the factor by which the type's alignment is elevated above the slot's
+ /// natural alignment. A thunk is keyed by its signature string, so every type spelling an
+ /// encoding shares one and raising can only resolve a stand-in. For 'V2' and 'V4' the
+ /// candidates are instantiations of a single generic type, so any element type stands for
+ /// the rest; for 'l2' they are unrelated types -- Int128, UInt128, Decimal128 -- agreeing in
+ /// nothing but the signature. Both are sound because the signature is all the thunk's frame
+ /// layout derives from, which is what the asserts below hold the stand-in to. Resolving a
+ /// fixed type also keeps raising independent of the order lowering encountered them in.
+ /// </summary>
+ public TypeDesc GetWasmElevatedType(char slot, int elevation)
+ {
+ TypeDesc type = (slot, elevation) switch
+ {
+ ('l', 2) => _wasmInt128Type ??= SystemModule.GetType("System"u8, "Int128"u8),
+ ('V', 2) => _wasmV256Type ??= InstantiateOverByte("Vector256`1"u8),
+ ('V', 4) => _wasmV512Type ??= InstantiateOverByte("Vector512`1"u8),
+ _ => throw new InvalidOperationException($"Unknown elevated signature encoding: {slot}{elevation}")
+ };
+
+ // The slot layout alone does not imply alignment, so the resolved type must supply it:
+ // a 16-byte 8-aligned struct is spelled 'S16', not 'l2'.
+ int slotSize = slot == 'l' ? 8 : 16;
+ Debug.Assert(((DefType)type).InstanceFieldSize.AsInt == slotSize * elevation);
+ Debug.Assert(((DefType)type).InstanceFieldAlignment.AsInt == slotSize * elevation);
+
+ return type;
+
+ TypeDesc InstantiateOverByte(ReadOnlySpan<byte> name) =>
+ ((MetadataType)SystemModule.GetType("System.Runtime.Intrinsics"u8, name))
+ .MakeInstantiatedType(GetWellKnownType(WellKnownType.Byte));
+ }
+
  /// <summary>
  /// Gets the first empty struct type encountered during lowering, or null if none has been seen.
  /// Used by RaiseSignature to produce a roundtrippable type for the 'e' encoding.
@@ -65,10 +106,40 @@ public void CacheStructBySize(TypeDesc type)
  }
 
  /// <summary>
- /// Gets a previously cached struct type of the specified byte size.
- /// Returns null if no struct of that size has been cached.
- /// Used by RaiseSignature to produce a roundtrippable type for the 'S&lt;N&gt;' encoding.
+ /// Caches a struct return type by size. Kept apart from the parameter cache because the two
+ /// classes are not interchangeable: a multi-slot type spells <c>S&lt;N&gt;</c> as a return but
+ /// re-lowers to its slot form as a parameter, so letting one answer for the other would give
+ /// an ordinary same-sized struct that type's larger alignment.
+ /// </summary>
+ public void CacheReturnStructBySize(TypeDesc type)
+ {
+ int size = type.GetElementSize().AsInt;
+ if (size <= 0)
+ return;
+
+ lock (_structCacheLock)
+ {
+ _returnStructsBySize.TryAdd(size, type);
+ }
+ }
+
+ /// <summary>
+ /// Gets a previously cached struct return type of the specified byte size, falling back to a
+ /// parameter of that size. Returns null if neither has been cached.
  /// </summary>
+ public TypeDesc GetCachedReturnStructOfSize(int size)
+ {
+ lock (_structCacheLock)
+ {
+ if (_returnStructsBySize.TryGetValue(size, out TypeDesc result))
+ {
+ return result;
+ }
+ }
+
+ return GetCachedStructOfSize(size);
+ }
+
  public TypeDesc GetCachedStructOfSize(int size)
  {
  lock (_structCacheLock)

src/coreclr/tools/Common/JitInterface/CorInfoImpl.cs

@@ -4027,6 +4027,15 @@ private CorInfoWasmType getWasmLowering(CORINFO_CLASS_STRUCT_* structHnd)
  }
 #endif
 
+ // A type split across several wasm parameters reports the slot type it splits into;
+ // the JIT derives the count from the struct's size.
+ if (WasmLowering.TryGetMultiSegmentLayout(type, out WasmValueType multiSlotType, out _))
+ {
+ return multiSlotType == WasmValueType.I64
+ ? CorInfoWasmType.CORINFO_WASM_TYPE_I64
+ : CorInfoWasmType.CORINFO_WASM_TYPE_V128;
+ }
+
  TypeDesc abiType = WasmLowering.LowerToAbiType(type);
 
  if (abiType == null)

docs/design/coreclr/botr/clr-abi.md

@@ -717,9 +717,7 @@ A frame pointer, if used, points at the bottom of the "fixed" portion of the sta
 
 Arguments and return values are processed via the Type Lowering algorithm below.
 
-If a struct is returned via a hidden buffer, the address is supplied by the caller and passed just after the managed `this`, or after `$sp` argument when `this` is not present. In such cases the return value of the method is the address of the return value. But if the struct can be passed on the Wasm stack it is returned on the Wasm stack per the Type Lowering rules.
-
-(TBD: ABI for vector types)
+If a struct is returned via a hidden buffer, the address is supplied by the caller and passed just after the managed `this`, or after `$sp` argument when `this` is not present. In such cases the return value of the method is the address of the return value. Structs passed by value across multiple Wasm parameters are still returned through a hidden buffer.
 
 ### Type Lowering
 
@@ -735,22 +733,28 @@ Managed types are lowered to WebAssembly value types according to the following
 | `nint`, `nuint`, pointer, byref, function pointer | `i32` (pointer-sized) |
 | Reference types (class, string, array, szarray, interface) | `i32` (pointer-sized) |
 | Value type (struct) — single primitive field, no padding | Unwrap recursively to the field's wasm type |
-| Value type (struct) — single field with padding, multiple fields, or SIMD type | Passed by reference (`i32` pointer) |
+| `Vector64<T>` | `i64` |
+| `Vector128<T>`, or a 16-byte `Vector<T>` | `v128` |
+| `Int128`, `UInt128`, `Decimal128` | Two `i64` parameters |
+| `Vector256<T>` | Two `v128` parameters |
+| `Vector512<T>` | Four `v128` parameters |
+| Value type (struct) — single field with padding, multiple fields, or another non-unwrappable SIMD type | Passed by reference (`i32` pointer) |
 | Empty struct (zero instance fields) | Not currently elided; since .NET empty structs have size 1, they are treated as non-unwrappable structs and passed by reference.|
 
 **Struct unwrapping** is recursive: a struct containing a single struct field, where the inner struct
 has the same size as the outer, is unwrapped until a primitive is reached or the rule no longer applies.
 For example, a struct `Wrapper { Inner value; }` where `Inner { int x; }` is unwrapped all the way
-to `i32`.
+to `i32`. A single-field struct wrapping one of the multi-parameter types above is passed the same
+way as the type it wraps.
 
 A struct is **not** unwrapped when:
 - It has more than one instance field.
 - It has exactly one instance field but the field's size differs from the struct's size (i.e., the
  struct has padding due to explicit layout or alignment attributes).
 
-Structs that cannot be unwrapped, including SIMD types for now, are passed by reference. The caller
-allocates space on the linear stack and passes a pointer. For return values, the caller provides a
-hidden return buffer pointer.
+Structs that cannot be unwrappedare passed by reference. The caller allocates space on the linear
+stack and passes a pointer. All multi-parameter types above, and structs that cannot be unwrapped,
+are returned through a hidden return buffer.
 
 ### Prolog
 

docs/design/coreclr/botr/readytorun-format.md

@@ -1105,6 +1105,36 @@ it knows a hidden retbuf pointer argument is present in the Wasm parameter list.
 | `V` | `v128` parameter (a `Vector128<T>`, or a 16-byte `Vector<T>`, passed by value) |
 | `S<N>` | struct parameter passed by reference, `<N>` is the struct size in bytes |
 | `e` | empty struct parameter — elided from Wasm args but present in the string |
+| `<slot><E>` | multi-slot parameter passed by value, see below |
+
+**Multi-slot parameters**: some types are passed by value across several Wasm parameters
+because no single Wasm value type can hold them, matching the Wasm C ABI. The slot
+character is followed by the factor by which the type's alignment is elevated above that
+slot's natural alignment:
+
+| Encoding | Slots | Alignment | Type |
+|---|---|---|---|
+| `l2` | 2 x `i64` | 16 (elevated 2x) | `Int128`, `UInt128`, `Decimal128` |
+| `V2` | 2 x `v128` | 32 (elevated 2x) | `Vector256<T>` |
+| `V4` | 4 x `v128` | 64 (elevated 4x) | `Vector512<T>` |
+
+A single-field struct wrapping one of these is passed the same way as the type it wraps,
+matching the treatment of a struct wrapping a `v128`.
+
+The digit is required. A repeated slot character without one — `ll`, `VV` — is not an
+aggregate: it is two independent scalar parameters, which is how every implementation
+reads it. So `ll2VV4` is `i64`, `Int128`, `Vector128<T>`, `Vector512<T>`. The grammar stays
+unambiguous because no other token places a digit after a slot character; `S<N>` consumes
+its own digits.
+
+These types are still *returned* through a hidden buffer, encoded as `S<N>` like any other
+aggregate. Limitation: a single digit carries both the slot count and the elevation factor,
+so an aggregate whose elevation differs from its slot count has no spelling. That includes
+one whose alignment is merely natural for its slot type, which would need count `N` with
+elevation 1. No such type exists in the Wasm ABI today.
+
+WasmAppBuilder does not emit or consume multi-slot tokens: they do not appear in
+`InternalCall` or `PInvoke` signatures.
 
 **Suffix**:
 
@@ -1133,6 +1163,8 @@ prefix to distinguish thunk categories:
 | `static MyStruct F()` where `MyStruct` is 16 bytes | `S16p` |
 | `static void F(MyStruct s)` where `MyStruct` is 8 bytes | `vS8p` |
 | `static int F(float x, double y)` | `ifdp` |
+| `static long F(long tag, Int128 v, int t)` | `lll2ip` |
+| `static int F(long tag, Vector512<int> v, int t)` | `ilV4ip` |
 | `[UnmanagedCallersOnly] static int F(int x)` | `ii` |
 
 **Slot sizing for structs**: When computing interpreter stack layout, struct parameters

src/coreclr/inc/jiteeversionguid.h

@@ -37,11 +37,11 @@
 
 #include <minipal/guid.h>
 
-constexpr GUID JITEEVersionIdentifier = { /* 513ac378-778b-4db5-b560-ebecaa000a4b */
-0x513ac378,
-0x778b,
-0x4db5,
- {0xb5, 0x60, 0xeb, 0xec, 0xaa, 0x00, 0x0a, 0x4b}
+constexpr GUID JITEEVersionIdentifier = { /* aa3cece7-a5f9-4b4e-9309-852c8bd4bdb1 */
+0xaa3cece7,
+0xa5f9,
+0x4b4e,
+ {0x93, 0x09, 0x85, 0x2c, 0x8b, 0xd4, 0xbd, 0xb1}
  };
 
 #endif // JIT_EE_VERSIONING_GUID_H

src/coreclr/jit/codegenlinear.cpp

@@ -1760,6 +1760,7 @@ void CodeGen::genConsumeRegs(GenTree* tree)
  genConsumeRegs(tree->gtGetOp1());
  genConsumeRegs(tree->gtGetOp2());
  }
+#endif
  else if (tree->OperIsFieldList())
  {
  for (GenTreeFieldList::Use& use : tree->AsFieldList()->Uses())
@@ -1768,7 +1769,6 @@ void CodeGen::genConsumeRegs(GenTree* tree)
  genConsumeRegs(fieldNode);
  }
  }
-#endif
  else if (tree->OperIsLocalRead())
  {
  // A contained lcl var must be living on stack and marked as reg optional, or not be a

src/coreclr/jit/codegenwasm.cpp

@@ -3063,12 +3063,12 @@ void CodeGen::genCall(GenTreeCall* call)
 
  for (CallArg& arg : call->gtArgs.EarlyArgs())
  {
-genConsumeReg(arg.GetEarlyNode());
+genConsumeRegs(arg.GetEarlyNode());
  }
 
  for (CallArg& arg : call->gtArgs.LateArgs())
  {
-genConsumeReg(arg.GetLateNode());
+genConsumeRegs(arg.GetLateNode());
  }
 
  if (call->NeedsNullCheck())
@@ -3118,7 +3118,13 @@ void CodeGen::genCallInstruction(GenTreeCall* call)
  }
  else if (callRetType == TYP_STRUCT)
  {
- typeStack.Push(m_compiler->info.compCompHnd->getWasmLowering(call->gtRetClsHnd));
+ CorInfoWasmType retWasmType = m_compiler->info.compCompHnd->getWasmLowering(call->gtRetClsHnd);
+ // A struct wider than the wasm value it lowers to is returned through a hidden buffer,
+ // so it must have been handled by the retbuf branch above.
+ assert(retWasmType != CORINFO_WASM_TYPE_VOID);
+ assert(m_compiler->info.compCompHnd->getClassSize(call->gtRetClsHnd) <=
+ genTypeSize(WasmClassifier::ToJitType(retWasmType)));
+ typeStack.Push(retWasmType);
  }
  else
  {

src/coreclr/jit/compiler.cpp

@@ -759,7 +759,9 @@ var_types Compiler::getReturnTypeForStruct(CORINFO_CLASS_HANDLE clsHnd,
 #if defined(TARGET_WASM)
  CorInfoWasmType abiType = info.compCompHnd->getWasmLowering(clsHnd);
 
- if (abiType == CORINFO_WASM_TYPE_VOID)
+ // A struct wider than the wasm value it lowers to is split across several of them when
+ // passed, but returned via a hidden buffer like any other aggregate.
+ if ((abiType == CORINFO_WASM_TYPE_VOID) || (structSize > genTypeSize(WasmClassifier::ToJitType(abiType))))
  {
  howToReturnStruct = SPK_ByReference;
  useType = TYP_UNKNOWN;

src/coreclr/jit/lower.cpp

@@ -3195,7 +3195,6 @@ size_t Lowering::MarkPutArgAndFieldListNodes(GenTree* node)
  {
  for (GenTreeFieldList::Use& operand : node->AsFieldList()->Uses())
  {
- assert(operand.GetNode()->OperIsPutArg());
  result += MarkPutArgAndFieldListNodes(operand.GetNode());
  }
  }

src/coreclr/jit/targetwasm.cpp

@@ -87,6 +87,26 @@ ABIPassingInformation WasmClassifier::Classify(Compiler* comp,
  else
  {
  abiType = ToJitType(wasmAbiType);
+
+ // A struct wider than the wasm value it lowers to is passed by value across several
+ // of them, matching the wasm C ABI: Int128 as 2 x i64, a 256-bit vector as 2 x v128,
+ // a 512-bit vector as 4 x v128. A struct can be narrower than its value (see the
+ // segment size below), so this must compare sizes rather than count slots.
+ unsigned segSize = genTypeSize(abiType);
+ if (structLayout->GetSize() > segSize)
+ {
+ unsigned numSegs = structLayout->GetSize() / segSize;
+ assert((numSegs * segSize) == structLayout->GetSize());
+
+ ABIPassingInformation info(comp, numSegs);
+ for (unsigned i = 0; i < numSegs; i++)
+ {
+ regNumber reg = MakeWasmReg(m_localIndex++, abiType);
+ info.Segment(i) = ABIPassingSegment::InRegister(reg, i * segSize, segSize);
+ }
+
+ return info;
+ }
  }
 
  regNumber reg = MakeWasmReg(m_localIndex++, genActualType(abiType));

src/coreclr/tools/Common/Compiler/CompilerTypeSystemContext.Wasm.cs

@@ -1,18 +1,25 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
+using System;
 using System.Collections.Generic;
 
 using Internal.TypeSystem;
 
+using Debug = System.Diagnostics.Debug;
+
 namespace ILCompiler
 {
  public partial class CompilerTypeSystemContext
  {
  private readonly object _structCacheLock = new object();
  private readonly Dictionary<int, TypeDesc> _structsBySize = new Dictionary<int, TypeDesc>();
+ private readonly Dictionary<int, TypeDesc> _returnStructsBySize = new Dictionary<int, TypeDesc>();
  private volatile TypeDesc _cachedEmptyStruct;
  private volatile TypeDesc _wasmV128Type;
+ private volatile TypeDesc _wasmInt128Type;
+ private volatile TypeDesc _wasmV256Type;
+ private volatile TypeDesc _wasmV512Type;
 
  /// <summary>
  /// Gets the type RaiseSignature produces for the 'V' encoding. All v128 types share the same
@@ -34,6 +41,40 @@ public TypeDesc WasmV128Type
  }
  }
 
+ /// <summary>
+ /// Gets the type RaiseSignature produces for an elevated multi-slot encoding ('l2', 'V2', 'V4'),
+ /// where the digit is the factor by which the type's alignment is elevated above the slot's
+ /// natural alignment. A thunk is keyed by its signature string, so every type spelling an
+ /// encoding shares one and raising can only resolve a stand-in. For 'V2' and 'V4' the
+ /// candidates are instantiations of a single generic type, so any element type stands for
+ /// the rest; for 'l2' they are unrelated types -- Int128, UInt128, Decimal128 -- agreeing in
+ /// nothing but the signature. Both are sound because the signature is all the thunk's frame
+ /// layout derives from, which is what the asserts below hold the stand-in to. Resolving a
+ /// fixed type also keeps raising independent of the order lowering encountered them in.
+ /// </summary>
+ public TypeDesc GetWasmElevatedType(char slot, int elevation)
+ {
+ TypeDesc type = (slot, elevation) switch
+ {
+ ('l', 2) => _wasmInt128Type ??= SystemModule.GetType("System"u8, "Int128"u8),
+ ('V', 2) => _wasmV256Type ??= InstantiateOverByte("Vector256`1"u8),
+ ('V', 4) => _wasmV512Type ??= InstantiateOverByte("Vector512`1"u8),
+ _ => throw new InvalidOperationException($"Unknown elevated signature encoding: {slot}{elevation}")
+ };
+
+ // The slot layout alone does not imply alignment, so the resolved type must supply it:
+ // a 16-byte 8-aligned struct is spelled 'S16', not 'l2'.
+ int slotSize = slot == 'l' ? 8 : 16;
+ Debug.Assert(((DefType)type).InstanceFieldSize.AsInt == slotSize * elevation);
+ Debug.Assert(((DefType)type).InstanceFieldAlignment.AsInt == slotSize * elevation);
+
+ return type;
+
+ TypeDesc InstantiateOverByte(ReadOnlySpan<byte> name) =>
+ ((MetadataType)SystemModule.GetType("System.Runtime.Intrinsics"u8, name))
+ .MakeInstantiatedType(GetWellKnownType(WellKnownType.Byte));
+ }
+
  /// <summary>
  /// Gets the first empty struct type encountered during lowering, or null if none has been seen.
  /// Used by RaiseSignature to produce a roundtrippable type for the 'e' encoding.
@@ -65,10 +106,40 @@ public void CacheStructBySize(TypeDesc type)
  }
 
  /// <summary>
- /// Gets a previously cached struct type of the specified byte size.
- /// Returns null if no struct of that size has been cached.
- /// Used by RaiseSignature to produce a roundtrippable type for the 'S&lt;N&gt;' encoding.
+ /// Caches a struct return type by size. Kept apart from the parameter cache because the two
+ /// classes are not interchangeable: a multi-slot type spells <c>S&lt;N&gt;</c> as a return but
+ /// re-lowers to its slot form as a parameter, so letting one answer for the other would give
+ /// an ordinary same-sized struct that type's larger alignment.
+ /// </summary>
+ public void CacheReturnStructBySize(TypeDesc type)
+ {
+ int size = type.GetElementSize().AsInt;
+ if (size <= 0)
+ return;
+
+ lock (_structCacheLock)
+ {
+ _returnStructsBySize.TryAdd(size, type);
+ }
+ }
+
+ /// <summary>
+ /// Gets a previously cached struct return type of the specified byte size, falling back to a
+ /// parameter of that size. Returns null if neither has been cached.
  /// </summary>
+ public TypeDesc GetCachedReturnStructOfSize(int size)
+ {
+ lock (_structCacheLock)
+ {
+ if (_returnStructsBySize.TryGetValue(size, out TypeDesc result))
+ {
+ return result;
+ }
+ }
+
+ return GetCachedStructOfSize(size);
+ }
+
  public TypeDesc GetCachedStructOfSize(int size)
  {
  lock (_structCacheLock)

src/coreclr/tools/Common/JitInterface/CorInfoImpl.cs

@@ -4027,6 +4027,15 @@ private CorInfoWasmType getWasmLowering(CORINFO_CLASS_STRUCT_* structHnd)
  }
 #endif
 
+ // A type split across several wasm parameters reports the slot type it splits into;
+ // the JIT derives the count from the struct's size.
+ if (WasmLowering.TryGetMultiSegmentLayout(type, out WasmValueType multiSlotType, out _))
+ {
+ return multiSlotType == WasmValueType.I64
+ ? CorInfoWasmType.CORINFO_WASM_TYPE_I64
+ : CorInfoWasmType.CORINFO_WASM_TYPE_V128;
+ }
+
  TypeDesc abiType = WasmLowering.LowerToAbiType(type);
 
  if (abiType == null)

docs/design/coreclr/botr/clr-abi.md

@@ -717,9 +717,7 @@ A frame pointer, if used, points at the bottom of the "fixed" portion of the sta
 
 Arguments and return values are processed via the Type Lowering algorithm below.
 
-If a struct is returned via a hidden buffer, the address is supplied by the caller and passed just after the managed `this`, or after `$sp` argument when `this` is not present. In such cases the return value of the method is the address of the return value. But if the struct can be passed on the Wasm stack it is returned on the Wasm stack per the Type Lowering rules.
-
-(TBD: ABI for vector types)
+If a struct is returned via a hidden buffer, the address is supplied by the caller and passed just after the managed `this`, or after `$sp` argument when `this` is not present. In such cases the return value of the method is the address of the return value. Structs passed by value across multiple Wasm parameters are still returned through a hidden buffer.
 
 ### Type Lowering
 
@@ -735,22 +733,28 @@ Managed types are lowered to WebAssembly value types according to the following
 | `nint`, `nuint`, pointer, byref, function pointer | `i32` (pointer-sized) |
 | Reference types (class, string, array, szarray, interface) | `i32` (pointer-sized) |
 | Value type (struct) — single primitive field, no padding | Unwrap recursively to the field's wasm type |
-| Value type (struct) — single field with padding, multiple fields, or SIMD type | Passed by reference (`i32` pointer) |
+| `Vector64<T>` | `i64` |
+| `Vector128<T>`, or a 16-byte `Vector<T>` | `v128` |
+| `Int128`, `UInt128`, `Decimal128` | Two `i64` parameters |
+| `Vector256<T>` | Two `v128` parameters |
+| `Vector512<T>` | Four `v128` parameters |
+| Value type (struct) — single field with padding, multiple fields, or another non-unwrappable SIMD type | Passed by reference (`i32` pointer) |
 | Empty struct (zero instance fields) | Not currently elided; since .NET empty structs have size 1, they are treated as non-unwrappable structs and passed by reference.|
 
 **Struct unwrapping** is recursive: a struct containing a single struct field, where the inner struct
 has the same size as the outer, is unwrapped until a primitive is reached or the rule no longer applies.
 For example, a struct `Wrapper { Inner value; }` where `Inner { int x; }` is unwrapped all the way
-to `i32`.
+to `i32`. A single-field struct wrapping one of the multi-parameter types above is passed the same
+way as the type it wraps.
 
 A struct is **not** unwrapped when:
 - It has more than one instance field.
 - It has exactly one instance field but the field's size differs from the struct's size (i.e., the
  struct has padding due to explicit layout or alignment attributes).
 
-Structs that cannot be unwrapped, including SIMD types for now, are passed by reference. The caller
-allocates space on the linear stack and passes a pointer. For return values, the caller provides a
-hidden return buffer pointer.
+Structs that cannot be unwrappedare passed by reference. The caller allocates space on the linear
+stack and passes a pointer. All multi-parameter types above, and structs that cannot be unwrapped,
+are returned through a hidden return buffer.
 
 ### Prolog
 

docs/design/coreclr/botr/readytorun-format.md

@@ -1105,6 +1105,36 @@ it knows a hidden retbuf pointer argument is present in the Wasm parameter list.
 | `V` | `v128` parameter (a `Vector128<T>`, or a 16-byte `Vector<T>`, passed by value) |
 | `S<N>` | struct parameter passed by reference, `<N>` is the struct size in bytes |
 | `e` | empty struct parameter — elided from Wasm args but present in the string |
+| `<slot><E>` | multi-slot parameter passed by value, see below |
+
+**Multi-slot parameters**: some types are passed by value across several Wasm parameters
+because no single Wasm value type can hold them, matching the Wasm C ABI. The slot
+character is followed by the factor by which the type's alignment is elevated above that
+slot's natural alignment:
+
+| Encoding | Slots | Alignment | Type |
+|---|---|---|---|
+| `l2` | 2 x `i64` | 16 (elevated 2x) | `Int128`, `UInt128`, `Decimal128` |
+| `V2` | 2 x `v128` | 32 (elevated 2x) | `Vector256<T>` |
+| `V4` | 4 x `v128` | 64 (elevated 4x) | `Vector512<T>` |
+
+A single-field struct wrapping one of these is passed the same way as the type it wraps,
+matching the treatment of a struct wrapping a `v128`.
+
+The digit is required. A repeated slot character without one — `ll`, `VV` — is not an
+aggregate: it is two independent scalar parameters, which is how every implementation
+reads it. So `ll2VV4` is `i64`, `Int128`, `Vector128<T>`, `Vector512<T>`. The grammar stays
+unambiguous because no other token places a digit after a slot character; `S<N>` consumes
+its own digits.
+
+These types are still *returned* through a hidden buffer, encoded as `S<N>` like any other
+aggregate. Limitation: a single digit carries both the slot count and the elevation factor,
+so an aggregate whose elevation differs from its slot count has no spelling. That includes
+one whose alignment is merely natural for its slot type, which would need count `N` with
+elevation 1. No such type exists in the Wasm ABI today.
+
+WasmAppBuilder does not emit or consume multi-slot tokens: they do not appear in
+`InternalCall` or `PInvoke` signatures.
 
 **Suffix**:
 
@@ -1133,6 +1163,8 @@ prefix to distinguish thunk categories:
 | `static MyStruct F()` where `MyStruct` is 16 bytes | `S16p` |
 | `static void F(MyStruct s)` where `MyStruct` is 8 bytes | `vS8p` |
 | `static int F(float x, double y)` | `ifdp` |
+| `static long F(long tag, Int128 v, int t)` | `lll2ip` |
+| `static int F(long tag, Vector512<int> v, int t)` | `ilV4ip` |
 | `[UnmanagedCallersOnly] static int F(int x)` | `ii` |
 
 **Slot sizing for structs**: When computing interpreter stack layout, struct parameters

src/coreclr/inc/jiteeversionguid.h

@@ -37,11 +37,11 @@
 
 #include <minipal/guid.h>
 
-constexpr GUID JITEEVersionIdentifier = { /* 513ac378-778b-4db5-b560-ebecaa000a4b */
-0x513ac378,
-0x778b,
-0x4db5,
- {0xb5, 0x60, 0xeb, 0xec, 0xaa, 0x00, 0x0a, 0x4b}
+constexpr GUID JITEEVersionIdentifier = { /* aa3cece7-a5f9-4b4e-9309-852c8bd4bdb1 */
+0xaa3cece7,
+0xa5f9,
+0x4b4e,
+ {0x93, 0x09, 0x85, 0x2c, 0x8b, 0xd4, 0xbd, 0xb1}
  };
 
 #endif // JIT_EE_VERSIONING_GUID_H

src/coreclr/jit/codegenlinear.cpp

@@ -1760,6 +1760,7 @@ void CodeGen::genConsumeRegs(GenTree* tree)
  genConsumeRegs(tree->gtGetOp1());
  genConsumeRegs(tree->gtGetOp2());
  }
+#endif
  else if (tree->OperIsFieldList())
  {
  for (GenTreeFieldList::Use& use : tree->AsFieldList()->Uses())
@@ -1768,7 +1769,6 @@ void CodeGen::genConsumeRegs(GenTree* tree)
  genConsumeRegs(fieldNode);
  }
  }
-#endif
  else if (tree->OperIsLocalRead())
  {
  // A contained lcl var must be living on stack and marked as reg optional, or not be a

src/coreclr/jit/codegenwasm.cpp

@@ -3063,12 +3063,12 @@ void CodeGen::genCall(GenTreeCall* call)
 
  for (CallArg& arg : call->gtArgs.EarlyArgs())
  {
-genConsumeReg(arg.GetEarlyNode());
+genConsumeRegs(arg.GetEarlyNode());
  }
 
  for (CallArg& arg : call->gtArgs.LateArgs())
  {
-genConsumeReg(arg.GetLateNode());
+genConsumeRegs(arg.GetLateNode());
  }
 
  if (call->NeedsNullCheck())
@@ -3118,7 +3118,13 @@ void CodeGen::genCallInstruction(GenTreeCall* call)
  }
  else if (callRetType == TYP_STRUCT)
  {
- typeStack.Push(m_compiler->info.compCompHnd->getWasmLowering(call->gtRetClsHnd));
+ CorInfoWasmType retWasmType = m_compiler->info.compCompHnd->getWasmLowering(call->gtRetClsHnd);
+ // A struct wider than the wasm value it lowers to is returned through a hidden buffer,
+ // so it must have been handled by the retbuf branch above.
+ assert(retWasmType != CORINFO_WASM_TYPE_VOID);
+ assert(m_compiler->info.compCompHnd->getClassSize(call->gtRetClsHnd) <=
+ genTypeSize(WasmClassifier::ToJitType(retWasmType)));
+ typeStack.Push(retWasmType);
  }
  else
  {

src/coreclr/jit/compiler.cpp

@@ -759,7 +759,9 @@ var_types Compiler::getReturnTypeForStruct(CORINFO_CLASS_HANDLE clsHnd,
 #if defined(TARGET_WASM)
  CorInfoWasmType abiType = info.compCompHnd->getWasmLowering(clsHnd);
 
- if (abiType == CORINFO_WASM_TYPE_VOID)
+ // A struct wider than the wasm value it lowers to is split across several of them when
+ // passed, but returned via a hidden buffer like any other aggregate.
+ if ((abiType == CORINFO_WASM_TYPE_VOID) || (structSize > genTypeSize(WasmClassifier::ToJitType(abiType))))
  {
  howToReturnStruct = SPK_ByReference;
  useType = TYP_UNKNOWN;

src/coreclr/jit/lower.cpp

@@ -3195,7 +3195,6 @@ size_t Lowering::MarkPutArgAndFieldListNodes(GenTree* node)
  {
  for (GenTreeFieldList::Use& operand : node->AsFieldList()->Uses())
  {
- assert(operand.GetNode()->OperIsPutArg());
  result += MarkPutArgAndFieldListNodes(operand.GetNode());
  }
  }

src/coreclr/jit/targetwasm.cpp

@@ -87,6 +87,26 @@ ABIPassingInformation WasmClassifier::Classify(Compiler* comp,
  else
  {
  abiType = ToJitType(wasmAbiType);
+
+ // A struct wider than the wasm value it lowers to is passed by value across several
+ // of them, matching the wasm C ABI: Int128 as 2 x i64, a 256-bit vector as 2 x v128,
+ // a 512-bit vector as 4 x v128. A struct can be narrower than its value (see the
+ // segment size below), so this must compare sizes rather than count slots.
+ unsigned segSize = genTypeSize(abiType);
+ if (structLayout->GetSize() > segSize)
+ {
+ unsigned numSegs = structLayout->GetSize() / segSize;
+ assert((numSegs * segSize) == structLayout->GetSize());
+
+ ABIPassingInformation info(comp, numSegs);
+ for (unsigned i = 0; i < numSegs; i++)
+ {
+ regNumber reg = MakeWasmReg(m_localIndex++, abiType);
+ info.Segment(i) = ABIPassingSegment::InRegister(reg, i * segSize, segSize);
+ }
+
+ return info;
+ }
  }
 
  regNumber reg = MakeWasmReg(m_localIndex++, genActualType(abiType));

src/coreclr/tools/Common/Compiler/CompilerTypeSystemContext.Wasm.cs

@@ -1,18 +1,25 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
+using System;
 using System.Collections.Generic;
 
 using Internal.TypeSystem;
 
+using Debug = System.Diagnostics.Debug;
+
 namespace ILCompiler
 {
  public partial class CompilerTypeSystemContext
  {
  private readonly object _structCacheLock = new object();
  private readonly Dictionary<int, TypeDesc> _structsBySize = new Dictionary<int, TypeDesc>();
+ private readonly Dictionary<int, TypeDesc> _returnStructsBySize = new Dictionary<int, TypeDesc>();
  private volatile TypeDesc _cachedEmptyStruct;
  private volatile TypeDesc _wasmV128Type;
+ private volatile TypeDesc _wasmInt128Type;
+ private volatile TypeDesc _wasmV256Type;
+ private volatile TypeDesc _wasmV512Type;
 
  /// <summary>
  /// Gets the type RaiseSignature produces for the 'V' encoding. All v128 types share the same
@@ -34,6 +41,40 @@ public TypeDesc WasmV128Type
  }
  }
 
+ /// <summary>
+ /// Gets the type RaiseSignature produces for an elevated multi-slot encoding ('l2', 'V2', 'V4'),
+ /// where the digit is the factor by which the type's alignment is elevated above the slot's
+ /// natural alignment. A thunk is keyed by its signature string, so every type spelling an
+ /// encoding shares one and raising can only resolve a stand-in. For 'V2' and 'V4' the
+ /// candidates are instantiations of a single generic type, so any element type stands for
+ /// the rest; for 'l2' they are unrelated types -- Int128, UInt128, Decimal128 -- agreeing in
+ /// nothing but the signature. Both are sound because the signature is all the thunk's frame
+ /// layout derives from, which is what the asserts below hold the stand-in to. Resolving a
+ /// fixed type also keeps raising independent of the order lowering encountered them in.
+ /// </summary>
+ public TypeDesc GetWasmElevatedType(char slot, int elevation)
+ {
+ TypeDesc type = (slot, elevation) switch
+ {
+ ('l', 2) => _wasmInt128Type ??= SystemModule.GetType("System"u8, "Int128"u8),
+ ('V', 2) => _wasmV256Type ??= InstantiateOverByte("Vector256`1"u8),
+ ('V', 4) => _wasmV512Type ??= InstantiateOverByte("Vector512`1"u8),
+ _ => throw new InvalidOperationException($"Unknown elevated signature encoding: {slot}{elevation}")
+ };
+
+ // The slot layout alone does not imply alignment, so the resolved type must supply it:
+ // a 16-byte 8-aligned struct is spelled 'S16', not 'l2'.
+ int slotSize = slot == 'l' ? 8 : 16;
+ Debug.Assert(((DefType)type).InstanceFieldSize.AsInt == slotSize * elevation);
+ Debug.Assert(((DefType)type).InstanceFieldAlignment.AsInt == slotSize * elevation);
+
+ return type;
+
+ TypeDesc InstantiateOverByte(ReadOnlySpan<byte> name) =>
+ ((MetadataType)SystemModule.GetType("System.Runtime.Intrinsics"u8, name))
+ .MakeInstantiatedType(GetWellKnownType(WellKnownType.Byte));
+ }
+
  /// <summary>
  /// Gets the first empty struct type encountered during lowering, or null if none has been seen.
  /// Used by RaiseSignature to produce a roundtrippable type for the 'e' encoding.
@@ -65,10 +106,40 @@ public void CacheStructBySize(TypeDesc type)
  }
 
  /// <summary>
- /// Gets a previously cached struct type of the specified byte size.
- /// Returns null if no struct of that size has been cached.
- /// Used by RaiseSignature to produce a roundtrippable type for the 'S&lt;N&gt;' encoding.
+ /// Caches a struct return type by size. Kept apart from the parameter cache because the two
+ /// classes are not interchangeable: a multi-slot type spells <c>S&lt;N&gt;</c> as a return but
+ /// re-lowers to its slot form as a parameter, so letting one answer for the other would give
+ /// an ordinary same-sized struct that type's larger alignment.
+ /// </summary>
+ public void CacheReturnStructBySize(TypeDesc type)
+ {
+ int size = type.GetElementSize().AsInt;
+ if (size <= 0)
+ return;
+
+ lock (_structCacheLock)
+ {
+ _returnStructsBySize.TryAdd(size, type);
+ }
+ }
+
+ /// <summary>
+ /// Gets a previously cached struct return type of the specified byte size, falling back to a
+ /// parameter of that size. Returns null if neither has been cached.
  /// </summary>
+ public TypeDesc GetCachedReturnStructOfSize(int size)
+ {
+ lock (_structCacheLock)
+ {
+ if (_returnStructsBySize.TryGetValue(size, out TypeDesc result))
+ {
+ return result;
+ }
+ }
+
+ return GetCachedStructOfSize(size);
+ }
+
  public TypeDesc GetCachedStructOfSize(int size)
  {
  lock (_structCacheLock)

src/coreclr/tools/Common/JitInterface/CorInfoImpl.cs

@@ -4027,6 +4027,15 @@ private CorInfoWasmType getWasmLowering(CORINFO_CLASS_STRUCT_* structHnd)
  }
 #endif
 
+ // A type split across several wasm parameters reports the slot type it splits into;
+ // the JIT derives the count from the struct's size.
+ if (WasmLowering.TryGetMultiSegmentLayout(type, out WasmValueType multiSlotType, out _))
+ {
+ return multiSlotType == WasmValueType.I64
+ ? CorInfoWasmType.CORINFO_WASM_TYPE_I64
+ : CorInfoWasmType.CORINFO_WASM_TYPE_V128;
+ }
+
  TypeDesc abiType = WasmLowering.LowerToAbiType(type);
 
  if (abiType == null)

docs/design/coreclr/botr/clr-abi.md

@@ -717,9 +717,7 @@ A frame pointer, if used, points at the bottom of the "fixed" portion of the sta
 
 Arguments and return values are processed via the Type Lowering algorithm below.
 
-If a struct is returned via a hidden buffer, the address is supplied by the caller and passed just after the managed `this`, or after `$sp` argument when `this` is not present. In such cases the return value of the method is the address of the return value. But if the struct can be passed on the Wasm stack it is returned on the Wasm stack per the Type Lowering rules.
-
-(TBD: ABI for vector types)
+If a struct is returned via a hidden buffer, the address is supplied by the caller and passed just after the managed `this`, or after `$sp` argument when `this` is not present. In such cases the return value of the method is the address of the return value. Structs passed by value across multiple Wasm parameters are still returned through a hidden buffer.
 
 ### Type Lowering
 
@@ -735,22 +733,28 @@ Managed types are lowered to WebAssembly value types according to the following
 | `nint`, `nuint`, pointer, byref, function pointer | `i32` (pointer-sized) |
 | Reference types (class, string, array, szarray, interface) | `i32` (pointer-sized) |
 | Value type (struct) — single primitive field, no padding | Unwrap recursively to the field's wasm type |
-| Value type (struct) — single field with padding, multiple fields, or SIMD type | Passed by reference (`i32` pointer) |
+| `Vector64<T>` | `i64` |
+| `Vector128<T>`, or a 16-byte `Vector<T>` | `v128` |
+| `Int128`, `UInt128`, `Decimal128` | Two `i64` parameters |
+| `Vector256<T>` | Two `v128` parameters |
+| `Vector512<T>` | Four `v128` parameters |
+| Value type (struct) — single field with padding, multiple fields, or another non-unwrappable SIMD type | Passed by reference (`i32` pointer) |
 | Empty struct (zero instance fields) | Not currently elided; since .NET empty structs have size 1, they are treated as non-unwrappable structs and passed by reference.|
 
 **Struct unwrapping** is recursive: a struct containing a single struct field, where the inner struct
 has the same size as the outer, is unwrapped until a primitive is reached or the rule no longer applies.
 For example, a struct `Wrapper { Inner value; }` where `Inner { int x; }` is unwrapped all the way
-to `i32`.
+to `i32`. A single-field struct wrapping one of the multi-parameter types above is passed the same
+way as the type it wraps.
 
 A struct is **not** unwrapped when:
 - It has more than one instance field.
 - It has exactly one instance field but the field's size differs from the struct's size (i.e., the
  struct has padding due to explicit layout or alignment attributes).
 
-Structs that cannot be unwrapped, including SIMD types for now, are passed by reference. The caller
-allocates space on the linear stack and passes a pointer. For return values, the caller provides a
-hidden return buffer pointer.
+Structs that cannot be unwrappedare passed by reference. The caller allocates space on the linear
+stack and passes a pointer. All multi-parameter types above, and structs that cannot be unwrapped,
+are returned through a hidden return buffer.
 
 ### Prolog
 

docs/design/coreclr/botr/readytorun-format.md

@@ -1105,6 +1105,36 @@ it knows a hidden retbuf pointer argument is present in the Wasm parameter list.
 | `V` | `v128` parameter (a `Vector128<T>`, or a 16-byte `Vector<T>`, passed by value) |
 | `S<N>` | struct parameter passed by reference, `<N>` is the struct size in bytes |
 | `e` | empty struct parameter — elided from Wasm args but present in the string |
+| `<slot><E>` | multi-slot parameter passed by value, see below |
+
+**Multi-slot parameters**: some types are passed by value across several Wasm parameters
+because no single Wasm value type can hold them, matching the Wasm C ABI. The slot
+character is followed by the factor by which the type's alignment is elevated above that
+slot's natural alignment:
+
+| Encoding | Slots | Alignment | Type |
+|---|---|---|---|
+| `l2` | 2 x `i64` | 16 (elevated 2x) | `Int128`, `UInt128`, `Decimal128` |
+| `V2` | 2 x `v128` | 32 (elevated 2x) | `Vector256<T>` |
+| `V4` | 4 x `v128` | 64 (elevated 4x) | `Vector512<T>` |
+
+A single-field struct wrapping one of these is passed the same way as the type it wraps,
+matching the treatment of a struct wrapping a `v128`.
+
+The digit is required. A repeated slot character without one — `ll`, `VV` — is not an
+aggregate: it is two independent scalar parameters, which is how every implementation
+reads it. So `ll2VV4` is `i64`, `Int128`, `Vector128<T>`, `Vector512<T>`. The grammar stays
+unambiguous because no other token places a digit after a slot character; `S<N>` consumes
+its own digits.
+
+These types are still *returned* through a hidden buffer, encoded as `S<N>` like any other
+aggregate. Limitation: a single digit carries both the slot count and the elevation factor,
+so an aggregate whose elevation differs from its slot count has no spelling. That includes
+one whose alignment is merely natural for its slot type, which would need count `N` with
+elevation 1. No such type exists in the Wasm ABI today.
+
+WasmAppBuilder does not emit or consume multi-slot tokens: they do not appear in
+`InternalCall` or `PInvoke` signatures.
 
 **Suffix**:
 
@@ -1133,6 +1163,8 @@ prefix to distinguish thunk categories:
 | `static MyStruct F()` where `MyStruct` is 16 bytes | `S16p` |
 | `static void F(MyStruct s)` where `MyStruct` is 8 bytes | `vS8p` |
 | `static int F(float x, double y)` | `ifdp` |
+| `static long F(long tag, Int128 v, int t)` | `lll2ip` |
+| `static int F(long tag, Vector512<int> v, int t)` | `ilV4ip` |
 | `[UnmanagedCallersOnly] static int F(int x)` | `ii` |
 
 **Slot sizing for structs**: When computing interpreter stack layout, struct parameters

src/coreclr/inc/jiteeversionguid.h

@@ -37,11 +37,11 @@
 
 #include <minipal/guid.h>
 
-constexpr GUID JITEEVersionIdentifier = { /* 513ac378-778b-4db5-b560-ebecaa000a4b */
-0x513ac378,
-0x778b,
-0x4db5,
- {0xb5, 0x60, 0xeb, 0xec, 0xaa, 0x00, 0x0a, 0x4b}
+constexpr GUID JITEEVersionIdentifier = { /* aa3cece7-a5f9-4b4e-9309-852c8bd4bdb1 */
+0xaa3cece7,
+0xa5f9,
+0x4b4e,
+ {0x93, 0x09, 0x85, 0x2c, 0x8b, 0xd4, 0xbd, 0xb1}
  };
 
 #endif // JIT_EE_VERSIONING_GUID_H

src/coreclr/jit/codegenlinear.cpp

@@ -1760,6 +1760,7 @@ void CodeGen::genConsumeRegs(GenTree* tree)
  genConsumeRegs(tree->gtGetOp1());
  genConsumeRegs(tree->gtGetOp2());
  }
+#endif
  else if (tree->OperIsFieldList())
  {
  for (GenTreeFieldList::Use& use : tree->AsFieldList()->Uses())
@@ -1768,7 +1769,6 @@ void CodeGen::genConsumeRegs(GenTree* tree)
  genConsumeRegs(fieldNode);
  }
  }
-#endif
  else if (tree->OperIsLocalRead())
  {
  // A contained lcl var must be living on stack and marked as reg optional, or not be a

src/coreclr/jit/codegenwasm.cpp

@@ -3063,12 +3063,12 @@ void CodeGen::genCall(GenTreeCall* call)
 
  for (CallArg& arg : call->gtArgs.EarlyArgs())
  {
-genConsumeReg(arg.GetEarlyNode());
+genConsumeRegs(arg.GetEarlyNode());
  }
 
  for (CallArg& arg : call->gtArgs.LateArgs())
  {
-genConsumeReg(arg.GetLateNode());
+genConsumeRegs(arg.GetLateNode());
  }
 
  if (call->NeedsNullCheck())
@@ -3118,7 +3118,13 @@ void CodeGen::genCallInstruction(GenTreeCall* call)
  }
  else if (callRetType == TYP_STRUCT)
  {
- typeStack.Push(m_compiler->info.compCompHnd->getWasmLowering(call->gtRetClsHnd));
+ CorInfoWasmType retWasmType = m_compiler->info.compCompHnd->getWasmLowering(call->gtRetClsHnd);
+ // A struct wider than the wasm value it lowers to is returned through a hidden buffer,
+ // so it must have been handled by the retbuf branch above.
+ assert(retWasmType != CORINFO_WASM_TYPE_VOID);
+ assert(m_compiler->info.compCompHnd->getClassSize(call->gtRetClsHnd) <=
+ genTypeSize(WasmClassifier::ToJitType(retWasmType)));
+ typeStack.Push(retWasmType);
  }
  else
  {

src/coreclr/jit/compiler.cpp

@@ -759,7 +759,9 @@ var_types Compiler::getReturnTypeForStruct(CORINFO_CLASS_HANDLE clsHnd,
 #if defined(TARGET_WASM)
  CorInfoWasmType abiType = info.compCompHnd->getWasmLowering(clsHnd);
 
- if (abiType == CORINFO_WASM_TYPE_VOID)
+ // A struct wider than the wasm value it lowers to is split across several of them when
+ // passed, but returned via a hidden buffer like any other aggregate.
+ if ((abiType == CORINFO_WASM_TYPE_VOID) || (structSize > genTypeSize(WasmClassifier::ToJitType(abiType))))
  {
  howToReturnStruct = SPK_ByReference;
  useType = TYP_UNKNOWN;

src/coreclr/jit/lower.cpp

@@ -3195,7 +3195,6 @@ size_t Lowering::MarkPutArgAndFieldListNodes(GenTree* node)
  {
  for (GenTreeFieldList::Use& operand : node->AsFieldList()->Uses())
  {
- assert(operand.GetNode()->OperIsPutArg());
  result += MarkPutArgAndFieldListNodes(operand.GetNode());
  }
  }

src/coreclr/jit/targetwasm.cpp

@@ -87,6 +87,26 @@ ABIPassingInformation WasmClassifier::Classify(Compiler* comp,
  else
  {
  abiType = ToJitType(wasmAbiType);
+
+ // A struct wider than the wasm value it lowers to is passed by value across several
+ // of them, matching the wasm C ABI: Int128 as 2 x i64, a 256-bit vector as 2 x v128,
+ // a 512-bit vector as 4 x v128. A struct can be narrower than its value (see the
+ // segment size below), so this must compare sizes rather than count slots.
+ unsigned segSize = genTypeSize(abiType);
+ if (structLayout->GetSize() > segSize)
+ {
+ unsigned numSegs = structLayout->GetSize() / segSize;
+ assert((numSegs * segSize) == structLayout->GetSize());
+
+ ABIPassingInformation info(comp, numSegs);
+ for (unsigned i = 0; i < numSegs; i++)
+ {
+ regNumber reg = MakeWasmReg(m_localIndex++, abiType);
+ info.Segment(i) = ABIPassingSegment::InRegister(reg, i * segSize, segSize);
+ }
+
+ return info;
+ }
  }
 
  regNumber reg = MakeWasmReg(m_localIndex++, genActualType(abiType));

src/coreclr/tools/Common/Compiler/CompilerTypeSystemContext.Wasm.cs

@@ -1,18 +1,25 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
+using System;
 using System.Collections.Generic;
 
 using Internal.TypeSystem;
 
+using Debug = System.Diagnostics.Debug;
+
 namespace ILCompiler
 {
  public partial class CompilerTypeSystemContext
  {
  private readonly object _structCacheLock = new object();
  private readonly Dictionary<int, TypeDesc> _structsBySize = new Dictionary<int, TypeDesc>();
+ private readonly Dictionary<int, TypeDesc> _returnStructsBySize = new Dictionary<int, TypeDesc>();
  private volatile TypeDesc _cachedEmptyStruct;
  private volatile TypeDesc _wasmV128Type;
+ private volatile TypeDesc _wasmInt128Type;
+ private volatile TypeDesc _wasmV256Type;
+ private volatile TypeDesc _wasmV512Type;
 
  /// <summary>
  /// Gets the type RaiseSignature produces for the 'V' encoding. All v128 types share the same
@@ -34,6 +41,40 @@ public TypeDesc WasmV128Type
  }
  }
 
+ /// <summary>
+ /// Gets the type RaiseSignature produces for an elevated multi-slot encoding ('l2', 'V2', 'V4'),
+ /// where the digit is the factor by which the type's alignment is elevated above the slot's
+ /// natural alignment. A thunk is keyed by its signature string, so every type spelling an
+ /// encoding shares one and raising can only resolve a stand-in. For 'V2' and 'V4' the
+ /// candidates are instantiations of a single generic type, so any element type stands for
+ /// the rest; for 'l2' they are unrelated types -- Int128, UInt128, Decimal128 -- agreeing in
+ /// nothing but the signature. Both are sound because the signature is all the thunk's frame
+ /// layout derives from, which is what the asserts below hold the stand-in to. Resolving a
+ /// fixed type also keeps raising independent of the order lowering encountered them in.
+ /// </summary>
+ public TypeDesc GetWasmElevatedType(char slot, int elevation)
+ {
+ TypeDesc type = (slot, elevation) switch
+ {
+ ('l', 2) => _wasmInt128Type ??= SystemModule.GetType("System"u8, "Int128"u8),
+ ('V', 2) => _wasmV256Type ??= InstantiateOverByte("Vector256`1"u8),
+ ('V', 4) => _wasmV512Type ??= InstantiateOverByte("Vector512`1"u8),
+ _ => throw new InvalidOperationException($"Unknown elevated signature encoding: {slot}{elevation}")
+ };
+
+ // The slot layout alone does not imply alignment, so the resolved type must supply it:
+ // a 16-byte 8-aligned struct is spelled 'S16', not 'l2'.
+ int slotSize = slot == 'l' ? 8 : 16;
+ Debug.Assert(((DefType)type).InstanceFieldSize.AsInt == slotSize * elevation);
+ Debug.Assert(((DefType)type).InstanceFieldAlignment.AsInt == slotSize * elevation);
+
+ return type;
+
+ TypeDesc InstantiateOverByte(ReadOnlySpan<byte> name) =>
+ ((MetadataType)SystemModule.GetType("System.Runtime.Intrinsics"u8, name))
+ .MakeInstantiatedType(GetWellKnownType(WellKnownType.Byte));
+ }
+
  /// <summary>
  /// Gets the first empty struct type encountered during lowering, or null if none has been seen.
  /// Used by RaiseSignature to produce a roundtrippable type for the 'e' encoding.
@@ -65,10 +106,40 @@ public void CacheStructBySize(TypeDesc type)
  }
 
  /// <summary>
- /// Gets a previously cached struct type of the specified byte size.
- /// Returns null if no struct of that size has been cached.
- /// Used by RaiseSignature to produce a roundtrippable type for the 'S&lt;N&gt;' encoding.
+ /// Caches a struct return type by size. Kept apart from the parameter cache because the two
+ /// classes are not interchangeable: a multi-slot type spells <c>S&lt;N&gt;</c> as a return but
+ /// re-lowers to its slot form as a parameter, so letting one answer for the other would give
+ /// an ordinary same-sized struct that type's larger alignment.
+ /// </summary>
+ public void CacheReturnStructBySize(TypeDesc type)
+ {
+ int size = type.GetElementSize().AsInt;
+ if (size <= 0)
+ return;
+
+ lock (_structCacheLock)
+ {
+ _returnStructsBySize.TryAdd(size, type);
+ }
+ }
+
+ /// <summary>
+ /// Gets a previously cached struct return type of the specified byte size, falling back to a
+ /// parameter of that size. Returns null if neither has been cached.
  /// </summary>
+ public TypeDesc GetCachedReturnStructOfSize(int size)
+ {
+ lock (_structCacheLock)
+ {
+ if (_returnStructsBySize.TryGetValue(size, out TypeDesc result))
+ {
+ return result;
+ }
+ }
+
+ return GetCachedStructOfSize(size);
+ }
+
  public TypeDesc GetCachedStructOfSize(int size)
  {
  lock (_structCacheLock)

src/coreclr/tools/Common/JitInterface/CorInfoImpl.cs

@@ -4027,6 +4027,15 @@ private CorInfoWasmType getWasmLowering(CORINFO_CLASS_STRUCT_* structHnd)
  }
 #endif
 
+ // A type split across several wasm parameters reports the slot type it splits into;
+ // the JIT derives the count from the struct's size.
+ if (WasmLowering.TryGetMultiSegmentLayout(type, out WasmValueType multiSlotType, out _))
+ {
+ return multiSlotType == WasmValueType.I64
+ ? CorInfoWasmType.CORINFO_WASM_TYPE_I64
+ : CorInfoWasmType.CORINFO_WASM_TYPE_V128;
+ }
+
  TypeDesc abiType = WasmLowering.LowerToAbiType(type);
 
  if (abiType == null)

docs/design/coreclr/botr/clr-abi.md

@@ -717,9 +717,7 @@ A frame pointer, if used, points at the bottom of the "fixed" portion of the sta
 
 Arguments and return values are processed via the Type Lowering algorithm below.
 
-If a struct is returned via a hidden buffer, the address is supplied by the caller and passed just after the managed `this`, or after `$sp` argument when `this` is not present. In such cases the return value of the method is the address of the return value. But if the struct can be passed on the Wasm stack it is returned on the Wasm stack per the Type Lowering rules.
-
-(TBD: ABI for vector types)
+If a struct is returned via a hidden buffer, the address is supplied by the caller and passed just after the managed `this`, or after `$sp` argument when `this` is not present. In such cases the return value of the method is the address of the return value. Structs passed by value across multiple Wasm parameters are still returned through a hidden buffer.
 
 ### Type Lowering
 
@@ -735,22 +733,28 @@ Managed types are lowered to WebAssembly value types according to the following
 | `nint`, `nuint`, pointer, byref, function pointer | `i32` (pointer-sized) |
 | Reference types (class, string, array, szarray, interface) | `i32` (pointer-sized) |
 | Value type (struct) — single primitive field, no padding | Unwrap recursively to the field's wasm type |
-| Value type (struct) — single field with padding, multiple fields, or SIMD type | Passed by reference (`i32` pointer) |
+| `Vector64<T>` | `i64` |
+| `Vector128<T>`, or a 16-byte `Vector<T>` | `v128` |
+| `Int128`, `UInt128`, `Decimal128` | Two `i64` parameters |
+| `Vector256<T>` | Two `v128` parameters |
+| `Vector512<T>` | Four `v128` parameters |
+| Value type (struct) — single field with padding, multiple fields, or another non-unwrappable SIMD type | Passed by reference (`i32` pointer) |
 | Empty struct (zero instance fields) | Not currently elided; since .NET empty structs have size 1, they are treated as non-unwrappable structs and passed by reference.|
 
 **Struct unwrapping** is recursive: a struct containing a single struct field, where the inner struct
 has the same size as the outer, is unwrapped until a primitive is reached or the rule no longer applies.
 For example, a struct `Wrapper { Inner value; }` where `Inner { int x; }` is unwrapped all the way
-to `i32`.
+to `i32`. A single-field struct wrapping one of the multi-parameter types above is passed the same
+way as the type it wraps.
 
 A struct is **not** unwrapped when:
 - It has more than one instance field.
 - It has exactly one instance field but the field's size differs from the struct's size (i.e., the
  struct has padding due to explicit layout or alignment attributes).
 
-Structs that cannot be unwrapped, including SIMD types for now, are passed by reference. The caller
-allocates space on the linear stack and passes a pointer. For return values, the caller provides a
-hidden return buffer pointer.
+Structs that cannot be unwrappedare passed by reference. The caller allocates space on the linear
+stack and passes a pointer. All multi-parameter types above, and structs that cannot be unwrapped,
+are returned through a hidden return buffer.
 
 ### Prolog
 

docs/design/coreclr/botr/readytorun-format.md

@@ -1105,6 +1105,36 @@ it knows a hidden retbuf pointer argument is present in the Wasm parameter list.
 | `V` | `v128` parameter (a `Vector128<T>`, or a 16-byte `Vector<T>`, passed by value) |
 | `S<N>` | struct parameter passed by reference, `<N>` is the struct size in bytes |
 | `e` | empty struct parameter — elided from Wasm args but present in the string |
+| `<slot><E>` | multi-slot parameter passed by value, see below |
+
+**Multi-slot parameters**: some types are passed by value across several Wasm parameters
+because no single Wasm value type can hold them, matching the Wasm C ABI. The slot
+character is followed by the factor by which the type's alignment is elevated above that
+slot's natural alignment:
+
+| Encoding | Slots | Alignment | Type |
+|---|---|---|---|
+| `l2` | 2 x `i64` | 16 (elevated 2x) | `Int128`, `UInt128`, `Decimal128` |
+| `V2` | 2 x `v128` | 32 (elevated 2x) | `Vector256<T>` |
+| `V4` | 4 x `v128` | 64 (elevated 4x) | `Vector512<T>` |
+
+A single-field struct wrapping one of these is passed the same way as the type it wraps,
+matching the treatment of a struct wrapping a `v128`.
+
+The digit is required. A repeated slot character without one — `ll`, `VV` — is not an
+aggregate: it is two independent scalar parameters, which is how every implementation
+reads it. So `ll2VV4` is `i64`, `Int128`, `Vector128<T>`, `Vector512<T>`. The grammar stays
+unambiguous because no other token places a digit after a slot character; `S<N>` consumes
+its own digits.
+
+These types are still *returned* through a hidden buffer, encoded as `S<N>` like any other
+aggregate. Limitation: a single digit carries both the slot count and the elevation factor,
+so an aggregate whose elevation differs from its slot count has no spelling. That includes
+one whose alignment is merely natural for its slot type, which would need count `N` with
+elevation 1. No such type exists in the Wasm ABI today.
+
+WasmAppBuilder does not emit or consume multi-slot tokens: they do not appear in
+`InternalCall` or `PInvoke` signatures.
 
 **Suffix**:
 
@@ -1133,6 +1163,8 @@ prefix to distinguish thunk categories:
 | `static MyStruct F()` where `MyStruct` is 16 bytes | `S16p` |
 | `static void F(MyStruct s)` where `MyStruct` is 8 bytes | `vS8p` |
 | `static int F(float x, double y)` | `ifdp` |
+| `static long F(long tag, Int128 v, int t)` | `lll2ip` |
+| `static int F(long tag, Vector512<int> v, int t)` | `ilV4ip` |
 | `[UnmanagedCallersOnly] static int F(int x)` | `ii` |
 
 **Slot sizing for structs**: When computing interpreter stack layout, struct parameters

src/coreclr/inc/jiteeversionguid.h

@@ -37,11 +37,11 @@
 
 #include <minipal/guid.h>
 
-constexpr GUID JITEEVersionIdentifier = { /* 513ac378-778b-4db5-b560-ebecaa000a4b */
-0x513ac378,
-0x778b,
-0x4db5,
- {0xb5, 0x60, 0xeb, 0xec, 0xaa, 0x00, 0x0a, 0x4b}
+constexpr GUID JITEEVersionIdentifier = { /* aa3cece7-a5f9-4b4e-9309-852c8bd4bdb1 */
+0xaa3cece7,
+0xa5f9,
+0x4b4e,
+ {0x93, 0x09, 0x85, 0x2c, 0x8b, 0xd4, 0xbd, 0xb1}
  };
 
 #endif // JIT_EE_VERSIONING_GUID_H

src/coreclr/jit/codegenlinear.cpp

@@ -1760,6 +1760,7 @@ void CodeGen::genConsumeRegs(GenTree* tree)
  genConsumeRegs(tree->gtGetOp1());
  genConsumeRegs(tree->gtGetOp2());
  }
+#endif
  else if (tree->OperIsFieldList())
  {
  for (GenTreeFieldList::Use& use : tree->AsFieldList()->Uses())
@@ -1768,7 +1769,6 @@ void CodeGen::genConsumeRegs(GenTree* tree)
  genConsumeRegs(fieldNode);
  }
  }
-#endif
  else if (tree->OperIsLocalRead())
  {
  // A contained lcl var must be living on stack and marked as reg optional, or not be a

src/coreclr/jit/codegenwasm.cpp

@@ -3063,12 +3063,12 @@ void CodeGen::genCall(GenTreeCall* call)
 
  for (CallArg& arg : call->gtArgs.EarlyArgs())
  {
-genConsumeReg(arg.GetEarlyNode());
+genConsumeRegs(arg.GetEarlyNode());
  }
 
  for (CallArg& arg : call->gtArgs.LateArgs())
  {
-genConsumeReg(arg.GetLateNode());
+genConsumeRegs(arg.GetLateNode());
  }
 
  if (call->NeedsNullCheck())
@@ -3118,7 +3118,13 @@ void CodeGen::genCallInstruction(GenTreeCall* call)
  }
  else if (callRetType == TYP_STRUCT)
  {
- typeStack.Push(m_compiler->info.compCompHnd->getWasmLowering(call->gtRetClsHnd));
+ CorInfoWasmType retWasmType = m_compiler->info.compCompHnd->getWasmLowering(call->gtRetClsHnd);
+ // A struct wider than the wasm value it lowers to is returned through a hidden buffer,
+ // so it must have been handled by the retbuf branch above.
+ assert(retWasmType != CORINFO_WASM_TYPE_VOID);
+ assert(m_compiler->info.compCompHnd->getClassSize(call->gtRetClsHnd) <=
+ genTypeSize(WasmClassifier::ToJitType(retWasmType)));
+ typeStack.Push(retWasmType);
  }
  else
  {

src/coreclr/jit/compiler.cpp

@@ -759,7 +759,9 @@ var_types Compiler::getReturnTypeForStruct(CORINFO_CLASS_HANDLE clsHnd,
 #if defined(TARGET_WASM)
  CorInfoWasmType abiType = info.compCompHnd->getWasmLowering(clsHnd);
 
- if (abiType == CORINFO_WASM_TYPE_VOID)
+ // A struct wider than the wasm value it lowers to is split across several of them when
+ // passed, but returned via a hidden buffer like any other aggregate.
+ if ((abiType == CORINFO_WASM_TYPE_VOID) || (structSize > genTypeSize(WasmClassifier::ToJitType(abiType))))
  {
  howToReturnStruct = SPK_ByReference;
  useType = TYP_UNKNOWN;

src/coreclr/jit/lower.cpp

@@ -3195,7 +3195,6 @@ size_t Lowering::MarkPutArgAndFieldListNodes(GenTree* node)
  {
  for (GenTreeFieldList::Use& operand : node->AsFieldList()->Uses())
  {
- assert(operand.GetNode()->OperIsPutArg());
  result += MarkPutArgAndFieldListNodes(operand.GetNode());
  }
  }

src/coreclr/jit/targetwasm.cpp

@@ -87,6 +87,26 @@ ABIPassingInformation WasmClassifier::Classify(Compiler* comp,
  else
  {
  abiType = ToJitType(wasmAbiType);
+
+ // A struct wider than the wasm value it lowers to is passed by value across several
+ // of them, matching the wasm C ABI: Int128 as 2 x i64, a 256-bit vector as 2 x v128,
+ // a 512-bit vector as 4 x v128. A struct can be narrower than its value (see the
+ // segment size below), so this must compare sizes rather than count slots.
+ unsigned segSize = genTypeSize(abiType);
+ if (structLayout->GetSize() > segSize)
+ {
+ unsigned numSegs = structLayout->GetSize() / segSize;
+ assert((numSegs * segSize) == structLayout->GetSize());
+
+ ABIPassingInformation info(comp, numSegs);
+ for (unsigned i = 0; i < numSegs; i++)
+ {
+ regNumber reg = MakeWasmReg(m_localIndex++, abiType);
+ info.Segment(i) = ABIPassingSegment::InRegister(reg, i * segSize, segSize);
+ }
+
+ return info;
+ }
  }
 
  regNumber reg = MakeWasmReg(m_localIndex++, genActualType(abiType));

src/coreclr/tools/Common/Compiler/CompilerTypeSystemContext.Wasm.cs

@@ -1,18 +1,25 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
+using System;
 using System.Collections.Generic;
 
 using Internal.TypeSystem;
 
+using Debug = System.Diagnostics.Debug;
+
 namespace ILCompiler
 {
  public partial class CompilerTypeSystemContext
  {
  private readonly object _structCacheLock = new object();
  private readonly Dictionary<int, TypeDesc> _structsBySize = new Dictionary<int, TypeDesc>();
+ private readonly Dictionary<int, TypeDesc> _returnStructsBySize = new Dictionary<int, TypeDesc>();
  private volatile TypeDesc _cachedEmptyStruct;
  private volatile TypeDesc _wasmV128Type;
+ private volatile TypeDesc _wasmInt128Type;
+ private volatile TypeDesc _wasmV256Type;
+ private volatile TypeDesc _wasmV512Type;
 
  /// <summary>
  /// Gets the type RaiseSignature produces for the 'V' encoding. All v128 types share the same
@@ -34,6 +41,40 @@ public TypeDesc WasmV128Type
  }
  }
 
+ /// <summary>
+ /// Gets the type RaiseSignature produces for an elevated multi-slot encoding ('l2', 'V2', 'V4'),
+ /// where the digit is the factor by which the type's alignment is elevated above the slot's
+ /// natural alignment. A thunk is keyed by its signature string, so every type spelling an
+ /// encoding shares one and raising can only resolve a stand-in. For 'V2' and 'V4' the
+ /// candidates are instantiations of a single generic type, so any element type stands for
+ /// the rest; for 'l2' they are unrelated types -- Int128, UInt128, Decimal128 -- agreeing in
+ /// nothing but the signature. Both are sound because the signature is all the thunk's frame
+ /// layout derives from, which is what the asserts below hold the stand-in to. Resolving a
+ /// fixed type also keeps raising independent of the order lowering encountered them in.
+ /// </summary>
+ public TypeDesc GetWasmElevatedType(char slot, int elevation)
+ {
+ TypeDesc type = (slot, elevation) switch
+ {
+ ('l', 2) => _wasmInt128Type ??= SystemModule.GetType("System"u8, "Int128"u8),
+ ('V', 2) => _wasmV256Type ??= InstantiateOverByte("Vector256`1"u8),
+ ('V', 4) => _wasmV512Type ??= InstantiateOverByte("Vector512`1"u8),
+ _ => throw new InvalidOperationException($"Unknown elevated signature encoding: {slot}{elevation}")
+ };
+
+ // The slot layout alone does not imply alignment, so the resolved type must supply it:
+ // a 16-byte 8-aligned struct is spelled 'S16', not 'l2'.
+ int slotSize = slot == 'l' ? 8 : 16;
+ Debug.Assert(((DefType)type).InstanceFieldSize.AsInt == slotSize * elevation);
+ Debug.Assert(((DefType)type).InstanceFieldAlignment.AsInt == slotSize * elevation);
+
+ return type;
+
+ TypeDesc InstantiateOverByte(ReadOnlySpan<byte> name) =>
+ ((MetadataType)SystemModule.GetType("System.Runtime.Intrinsics"u8, name))
+ .MakeInstantiatedType(GetWellKnownType(WellKnownType.Byte));
+ }
+
  /// <summary>
  /// Gets the first empty struct type encountered during lowering, or null if none has been seen.
  /// Used by RaiseSignature to produce a roundtrippable type for the 'e' encoding.
@@ -65,10 +106,40 @@ public void CacheStructBySize(TypeDesc type)
  }
 
  /// <summary>
- /// Gets a previously cached struct type of the specified byte size.
- /// Returns null if no struct of that size has been cached.
- /// Used by RaiseSignature to produce a roundtrippable type for the 'S&lt;N&gt;' encoding.
+ /// Caches a struct return type by size. Kept apart from the parameter cache because the two
+ /// classes are not interchangeable: a multi-slot type spells <c>S&lt;N&gt;</c> as a return but
+ /// re-lowers to its slot form as a parameter, so letting one answer for the other would give
+ /// an ordinary same-sized struct that type's larger alignment.
+ /// </summary>
+ public void CacheReturnStructBySize(TypeDesc type)
+ {
+ int size = type.GetElementSize().AsInt;
+ if (size <= 0)
+ return;
+
+ lock (_structCacheLock)
+ {
+ _returnStructsBySize.TryAdd(size, type);
+ }
+ }
+
+ /// <summary>
+ /// Gets a previously cached struct return type of the specified byte size, falling back to a
+ /// parameter of that size. Returns null if neither has been cached.
  /// </summary>
+ public TypeDesc GetCachedReturnStructOfSize(int size)
+ {
+ lock (_structCacheLock)
+ {
+ if (_returnStructsBySize.TryGetValue(size, out TypeDesc result))
+ {
+ return result;
+ }
+ }
+
+ return GetCachedStructOfSize(size);
+ }
+
  public TypeDesc GetCachedStructOfSize(int size)
  {
  lock (_structCacheLock)

src/coreclr/tools/Common/JitInterface/CorInfoImpl.cs

@@ -4027,6 +4027,15 @@ private CorInfoWasmType getWasmLowering(CORINFO_CLASS_STRUCT_* structHnd)
  }
 #endif
 
+ // A type split across several wasm parameters reports the slot type it splits into;
+ // the JIT derives the count from the struct's size.
+ if (WasmLowering.TryGetMultiSegmentLayout(type, out WasmValueType multiSlotType, out _))
+ {
+ return multiSlotType == WasmValueType.I64
+ ? CorInfoWasmType.CORINFO_WASM_TYPE_I64
+ : CorInfoWasmType.CORINFO_WASM_TYPE_V128;
+ }
+
  TypeDesc abiType = WasmLowering.LowerToAbiType(type);
 
  if (abiType == null)