fjit: only unit-served callees stay out of a batch (fetch asks executable of every byte)

1cf4e76f counted every function-table address, the JIT's own resume
points inside functions too, and instruction fetch consults the same
predicate: hu15 decoded libxcb's cmovle at _xcb_in_read_block+0x30 as
illegal (SIGILL, status 132).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_1896c5b302a54696aaa92c5f4047f20b

shims/browser/src/cgen.rs

@@ -1065,6 +1065,13 @@ pub(crate) fn index_of(addr: u64) -> Option<u32> {
     ftab(|m| m.get(addr).map(|f| f.idx))
 }
 
+/// Whether a unit built ahead of time (or a provider) serves the function at
+/// `addr`: not the JIT's own functions, whose resume points are published
+/// at addresses inside functions.
+pub(crate) fn unit_serves(addr: u64) -> bool {
+    ftab(|m| m.get(addr).is_some_and(|f| m.install(f.install).tier == Tier::Unit))
+}
+
 /// How many units are published: a Worker installs up to this many.
 #[no_mangle]
 pub extern "C" fn gex_cgen_count() -> u32 {

shims/browser/src/fjit.rs

@@ -217,13 +217,16 @@ pub(crate) fn translate(addr: u64) -> Option<u32> {
     // An address an ELF provider holds is not code to translate (cgen::elfprov).
     // With `?fjitlibs=` rules, callees outside them are not brought in either.
     let rules = !lock(&LIBS).is_empty();
-    // A callee some unit (or an earlier translation) already serves is not
-    // brought into the batch: the call reaches it through the table. Without
-    // this, a miss in UnityPlayer (a function its unit lacks) re-translated up
-    // to 63 of the unit's own functions with it -- 3,667 functions and 36 MiB
-    // of wasm by HK's menu (ht3), JIT code shadowing clang's.
+    // A callee a unit already serves is not brought into the batch: the call
+    // reaches it through the table. Without this, a miss in UnityPlayer (a
+    // function its unit lacks) re-translated up to 63 of the unit's own
+    // functions with it -- 3,667 functions and 36 MiB of wasm by HK's menu
+    // (ht3), JIT code shadowing clang's. Only the unit tier: `executable` is
+    // also what instruction fetch asks of every byte, and the JIT publishes
+    // resume points inside functions, so counting its own entries made it
+    // decode `cmovle` in libxcb's `_xcb_in_read_block` as illegal (hu15).
     let served_memo = std::cell::RefCell::new(std::collections::HashMap::<u64, bool>::new());
-    let served = |a: u64| a != addr && *served_memo.borrow_mut().entry(a).or_insert_with(|| crate::cgen::index_of(a).is_some());
+    let served = |a: u64| a != addr && *served_memo.borrow_mut().entry(a).or_insert_with(|| crate::cgen::unit_serves(a));
     let executable = |a: u64| {
         exec.iter().any(|&(s, e)| a >= s && a < e)
             && !crate::cgen::elfprov::provided(a)