julia

00f7b4b6 - cancellation: Revert the `:reset_safe` foreign-call annotation (#64591)

cancellation: Revert the `:reset_safe` foreign-call annotation (#64591) `@assume_effects :reset_safe @ccall ...` kept a caller's compiled reset region published across the foreign call, so that a cancellation delivered meanwhile could abandon the C function. The `julia.reset_safe` tag goes on the call instruction, and that instruction calls through the GOT slot of Julia's own PLT: a `jlplt_` thunk that resolves the symbol on first use (only trim builds emit bare symbol references for the system linker instead; the JIT pre-resolves the slot when it can, images never do). On the first call of a symbol in a process the thunk runs `jl_load_and_lookup`: the `libmap_lock`, `dlopen` of the library, `dlsym`, all with the region published and `gc_state` still unsafe, so a reset delivered there abandons the loader lock or a malloc arena lock with no way to release them. Below that, libraries are opened `RTLD_LAZY`, so the callee's own first calls into its imports run the dynamic linker's resolver from inside the supposedly audited code. The docstring promised that "the Julia runtime will handle properly protecting the symbol lookup itself"; nothing implemented that, and the lazy-binding half cannot be implemented from our side at all. The annotation also bypassed the effect system: the bit was peeled off the effects word before inference saw the foreigncall, so it asserted nothing about the call's effects and was checked against nothing, which is how the in-place `MPZ` mutators came to carry it. With those gone it has no users left, and no sound test can be written for it currently. Remove the spelling, the dedicated bit in the `@ccall_effects` word, the fifth entry of the foreigncall calling-convention tuple, and the metadata codegen attached to the call and to the `cancel_handler=` guard stores, which only existed so a region could reach a guarded call. A foreign call is now always an unsafe point to the cancellation lowering, like any other call. The `cancel_handler=` option is unaffected here. Assisted-by: Claude Code (Fable 5.1)