rubycc 1.0.0 → 1.1.0

data/lib/rubycc/driver.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "rbconfig"
+require_relative "diagnostics"
 require_relative "compile_error"
 require_relative "compiler"
 require_relative "preprocess/preprocessor"
@@ -67,7 +68,12 @@ module Rubycc
     end
 
     def initialize(argv, stdout: $stdout, stderr: $stderr)
-      @argv = argv
+      # The command line crosses into rubycc here, so it is re-tagged as bytes
+      # (lib/rubycc.rb): every option is spelled in ASCII and every operand is a
+      # path or a macro spelling, none of which this driver reads as text. The
+      # array is rebuilt rather than mutated, since an in-process caller (rmake's
+      # executor) owns the one it passes.
+      @argv = argv.map { |arg| arg.encoding == Encoding::BINARY ? arg : arg.b }
       @out = stdout
       @err = stderr
       @inputs = []          # [{ path:, kind: }] in command-line order
@@ -83,13 +89,18 @@ module Rubycc
       @system_includes = true  # -nostdinc clears this
       @default_libs = true     # -nodefaultlibs clears this
       @target = nil            # -target/--target; defaults to the host CPU
+      @warnings = true         # -w clears this
     end
 
     def run
       return print_version if version_requested?
 
       parse
-      dispatch
+      # Compiler warnings (Diagnostics.warn, today only #warning) follow this
+      # invocation's error stream, so an in-process caller that injected one —
+      # rmake running the Driver inside a step worker — captures them with
+      # everything else this run reports. `-w` discards them instead.
+      Diagnostics.to(@warnings ? @err : nil) { dispatch }
       0
     rescue UsageError => e
       @err.puts "#{PROG}: error: #{e.message}"
@@ -145,6 +156,7 @@ module Rubycc
       when "-fvisibility=default"                 then @default_visibility = :default; i + 1
       when "-fvisibility=internal"                then @default_visibility = :internal; i + 1
       when "-fvisibility=protected"               then @default_visibility = :protected; i + 1
+      when "-w"                                  then @warnings = false; i + 1
       when "-nostdinc"                           then @system_includes = false; i + 1
       when "-nodefaultlibs"                       then @default_libs = false; i + 1
       when "-target", "--target" then @target = normalize_target(value(arg, i)); i + 2
@@ -186,9 +198,35 @@ module Rubycc
     # Whether `arg` is a documented gcc flag family this toolchain does not model
     # but accepts without complaint: the optimization (`-O*`), debug (`-g*`),
     # warning (`-W*`) and remaining code-generation (`-f*`) switches, the language-standard
-    # selector (`-std=…`), and the fixed bare set above. A machine switch (`-m*`)
-    # is deliberately excluded — it names a target capability this toolchain does
-    # not honor, so it is warned about like any other unmodelled option.
+    # selector (`-std=…`), and the fixed bare set above.
+    #
+    # The warning switches deserve their decision spelled out, now that there is
+    # a warning to switch (Diagnostics.warn, reached today only by `#warning`):
+    #
+    # * `-w` (suppress all warnings) **is honored** — see #handle_arg. It costs
+    #   one flag and cannot change what compiles, only what is printed, and it
+    #   was not even in the ignore list before (lowercase, so the `-W*` family
+    #   regex misses it): a build passing `-w` drew "unknown option '-w'
+    #   ignored", which is itself noise of the kind `-w` asks to be spared.
+    #   It silences the compiler's diagnostics only, not this driver's own
+    #   "PROG: warning: …" lines, which is where gcc draws the same line
+    #   (measured 2026-08-19, gcc 13.3.0: `gcc -w -c a.c b.o` prints no #warning
+    #   but still prints "gcc: warning: b.o: linker input file unused …").
+    # * `-Werror` (and `-Werror=…`) **is not honored**: it stays accepted and
+    #   ignored. Honoring it would mean failing a build over the one warning
+    #   rubycc happens to implement while staying silent about the hundreds gcc
+    #   would have raised on the same source — a promotion of an arbitrary
+    #   subset, which is worse than not promoting at all. It would also aim
+    #   straight at what this channel was built for: a portability header's
+    #   `#warning "unrecognized compiler"` would go back to killing the build,
+    #   the very failure #warning support exists to end. Revisit if rubycc ever
+    #   grows a warning set worth calling a set.
+    # * The individual `-Wfoo` / `-Wno-foo` selectors are likewise accepted and
+    #   ignored: rubycc has no warning categories to select between yet.
+    #
+    # A machine switch (`-m*`) is deliberately excluded — it names a target
+    # capability this toolchain does not honor, so it is warned about like any
+    # other unmodelled option.
     def silently_ignored?(arg)
       SILENT_IGNORE_EXACT.include?(arg) ||
         arg.match?(/\A-(?:O|g|W|f)/) || arg.start_with?("-std=")
@@ -389,7 +427,8 @@ module Rubycc
     end
 
     def compile_source(input)
-      Compiler.new.compile(File.read(input[:path]), filename: input[:path],
+      # Bytes, not locale-encoded text: see Preprocess::Scanner's class comment.
+      Compiler.new.compile(File.binread(input[:path]), filename: input[:path],
                            include_paths: @include_paths, pic: @pic, defines: @defines,
                            system_includes: @system_includes, target: target, libc: libc,
                            default_visibility: @default_visibility)
@@ -404,12 +443,12 @@ module Rubycc
     # byte-faithful copy of gcc's `-E` output; it is enough for a probe that only
     # needs macros expanded and headers included. Non-source inputs are ignored.
     def preprocess_only
-      text = +""
+      text = +"".b
       @inputs.each do |input|
         next unless input[:kind] == :source
 
         tokens = preprocessor_for_target.preprocess(
-          File.read(input[:path]), filename: input[:path],
+          File.binread(input[:path]), filename: input[:path],
           include_paths: @include_paths, defines: @defines,
           system_includes: @system_includes
         )
@@ -437,7 +476,7 @@ module Rubycc
     end
 
     def render_preprocessed(tokens)
-      out = +""
+      out = +"".b
       previous = nil
       tokens.each do |token|
         if previous.nil?
@@ -447,13 +486,30 @@ module Rubycc
         elsif token.space_before
           out << " "
         end
-        out << token.text
+        out << token_bytes(token.text)
         previous = token
       end
       out << "\n" unless out.empty?
       out
     end
 
+    # A token's spelling as bytes. Almost every token comes from the scanner and
+    # is ASCII-8BIT already (see Preprocess::Scanner); the exceptions are the
+    # ones the preprocessor synthesizes rather than scans, and __FILE__ is the
+    # one that matters — it expands to a string literal spelled with the file
+    # name this driver was handed, which carries the locale's encoding. Appending
+    # such a string to a buffer that already holds raw bytes (a UTF-8 string
+    # literal out of the source) is an Encoding::CompatibilityError: -E would
+    # abort with a Ruby backtrace instead of printing the text it was asked for.
+    # Re-tagging is not transcoding — the bytes are the same either way — and it
+    # costs an allocation only for the strings that are actually mixed, since a
+    # spelling that is already bytes, or is pure ASCII, is compatible as it is.
+    def token_bytes(text)
+      return text if text.encoding == Encoding::BINARY || text.ascii_only?
+
+      text.b
+    end
+
     # --- diagnostics -------------------------------------------------------
 
     def warning(message)

data/lib/rubycc/front/ast.rb

@@ -12,9 +12,11 @@ module Rubycc
       IntLit = Data.define(:value, :token, :type)
 
       # Floating-point literal. `value` is a Ruby Float and `type` its
-      # Rubycc::Type — Type::Float for an f/F-suffixed constant, Type::Double
-      # otherwise (a plain or l/L-suffixed one) — fixed by the parser from the
-      # constant's suffix (6.4.4.2).
+      # Rubycc::Type — Type::Float for an f/F-suffixed constant,
+      # Type::LongDouble for an l/L-suffixed one and Type::Double for an
+      # unsuffixed one — fixed by the parser from the constant's suffix
+      # (6.4.4.2). `value` is a double in every case: Type::LongDouble names a
+      # double's representation under a different type name (see Type).
       FloatLit = Data.define(:value, :type, :token)
 
       # String literal. `value` is the escape-resolved bytes as an ASCII-8BIT
@@ -394,14 +396,23 @@ module Rubycc
       # produces no code and no side effects.
       BuiltinConstantP = Data.define(:expr, :token)
 
-      # "__builtin_ctz/ctzll/clz/clzll ( x )": counts the trailing (ctz) or
-      # leading (clz) zero bits of an integer, typed int. `operand` is the value
-      # scanned, `direction` is :forward for ctz or :reverse for clz, and `width`
-      # is the operand's byte width (4 for the plain form, 8 for the "ll" form).
+      # "__builtin_ctz/ctzl/ctzll/clz/clzl/clzll ( x )": counts the trailing
+      # (ctz) or leading (clz) zero bits of an integer, typed int. `operand` is
+      # the value scanned, `direction` is :forward for ctz or :reverse for clz,
+      # and `width` is the operand's byte width (4 for the plain form, 8 for the
+      # "l" and "ll" ones — `long` and `long long` are both 8 bytes here).
       # `x == 0` is undefined behavior (gcc), so no zero handling is implied.
       # `token` is the builtin keyword.
       BuiltinBitScan = Data.define(:operand, :direction, :width, :token)
 
+      # "__builtin_popcount/popcountl/popcountll ( x )": counts the set bits of
+      # an integer, typed int. `operand` is the value counted and `width` its
+      # byte width (4 for the plain form, 8 for the "l" and "ll" ones, `long`
+      # and `long long` being the same width on both targets). Unlike a bit
+      # scan this is total: a zero operand counts zero bits, as in gcc. `token`
+      # is the builtin keyword.
+      BuiltinPopcount = Data.define(:operand, :width, :token)
+
       # "__builtin_add/sub/mul_overflow ( a , b , res )": computes "a op b" with
       # infinite precision, stores the result converted to the type `res` points
       # at (wrapping or truncating like any integer conversion), and yields int 1

data/lib/rubycc/front/constant_evaluator.rb

@@ -151,6 +151,8 @@ module Rubycc
           evaluate_builtin_constant_p(node)
         when AST::BuiltinBitScan
           evaluate_builtin_bit_scan(node)
+        when AST::BuiltinPopcount
+          evaluate_builtin_popcount(node)
         else
           # Every other node — VariableRef, Call, Assignment,
           # CompoundAssignment, IncDec, MemberAccess, Subscript, StringLit,
@@ -621,6 +623,16 @@ module Rubycc
         end
       end
 
+      # __builtin_popcount(x) folds to the number of set bits in a constant
+      # operand, over its `width`-byte value — the same mask a bit scan applies,
+      # which is what makes __builtin_popcount(-1) the 32 gcc gives (the operand
+      # is counted as an unsigned int) rather than an infinite run of sign bits.
+      # There is no undefined case to leave unfolded: zero counts zero bits.
+      def evaluate_builtin_popcount(node)
+        value = evaluate(node.operand) & ((1 << (node.width * 8)) - 1)
+        value.to_s(2).count("1")
+      end
+
       # Whether `type` is an incomplete tagged type with no size or alignment: a
       # struct/union never completed, or an incomplete (forward-referenced) enum.
       def incomplete_aggregate?(type)

data/lib/rubycc/front/lexeme_reader.rb

@@ -39,7 +39,9 @@ module Rubycc
                     __builtin_va_start __builtin_va_arg __builtin_va_end __builtin_va_copy
                     __builtin_expect __builtin_alloca __builtin_offsetof
                     __builtin_constant_p __builtin_choose_expr
-                    __builtin_ctz __builtin_ctzll __builtin_clz __builtin_clzll
+                    __builtin_ctz __builtin_ctzl __builtin_ctzll
+                    __builtin_clz __builtin_clzl __builtin_clzll
+                    __builtin_popcount __builtin_popcountl __builtin_popcountll
                     __builtin_unreachable __builtin_memcpy
                     __builtin_add_overflow __builtin_sub_overflow __builtin_mul_overflow
                     __atomic_load_n __atomic_store_n __atomic_exchange_n

data/lib/rubycc/front/parser.rb

@@ -739,8 +739,9 @@ module Rubycc
       # left out — type `int`, located at the identifier itself (6.9.1p6). C90
       # spelled that default out; C11 instead requires every identifier to be
       # declared, but gcc keeps accepting the omission with a -Wimplicit-int
-      # warning (measured), and a warning is not a channel this compiler has, so
-      # the older, permissive reading is the one implemented.
+      # warning (measured), and this compiler warns about nothing in the front
+      # end (Diagnostics.warn carries only #warning so far), so the older,
+      # permissive reading is the one implemented.
       def old_style_parameters(identifier_list, declared)
         identifier_list.names.map do |name_tok|
           type, const, decl_tok = declared[name_tok.value]
@@ -865,9 +866,8 @@ module Rubycc
         else
           # An init attribute on an object has nothing to register — there is no
           # function to call — so it is refused here. gcc only warns ("attribute
-          # ignored"), but a warning this compiler has no channel for would be a
-          # silent drop, and a dropped initializer is invisible until the program
-          # misbehaves at run time.
+          # ignored"), but this parser emits no warnings, and a silently dropped
+          # initializer is invisible until the program misbehaves at run time.
           reject_init_attributes(attributes)
           register_visibility_attributes(name_tok.value, attributes)
           parse_global_declarator(type, name_tok, pointer_quals, spec_info)
@@ -1282,15 +1282,19 @@ module Rubycc
         return normalize_standalone(Type::Void, "void", specs, tok) if counts["void"].positive?
         return normalize_standalone(Type::Bool, "_Bool", specs, tok) if counts["_Bool"].positive?
         return normalize_standalone(Type::Float, "float", specs, tok) if counts["float"].positive?
-        # `double` stands alone or pairs with a single `long` ("long double",
-        # treated as `double` here); any other keyword, a second `double` or a
-        # second `long` is an ill-formed combination.
+        # `double` stands alone or pairs with a single `long` ("long double");
+        # any other keyword, a second `double` or a second `long` is an
+        # ill-formed combination. The two are separate types here even though
+        # they share a representation: a `long double` handed to a variadic
+        # function must be converted to the target's own long-double format, and
+        # the only way the generator can know to do that is for the name to
+        # survive the declaration (see Type::LongDouble).
         if counts["double"].positive?
           non_long = specs.reject { |s| s == "long" }
           unless non_long == ["double"] && counts["long"] <= 1
             error_at(tok, "cannot combine 'double' with other type specifiers")
           end
-          return Type::Double
+          return counts["long"].positive? ? Type::LongDouble : Type::Double
         end
 
         # `__int128` (a GNU keyword) stands alone or pairs with a single
@@ -1552,7 +1556,7 @@ module Rubycc
       # The run-order number of a constructor/destructor. The window and its
       # wording follow gcc's measured behavior (see MAX_INIT_PRIORITY); the
       # 0..100 range gcc reserves for the implementation is accepted here, since
-      # gcc only warns about it and this compiler has no warning channel.
+      # gcc only warns about it and this parser emits no warnings.
       def parse_init_priority_argument(name)
         expr = parse_parenthesized_constant
         value = evaluate_constant_expression(expr, "'#{name}' attribute argument is not an integer constant",
@@ -3407,12 +3411,16 @@ module Rubycc
             parse_builtin_choose_expr
           elsif peek.keyword?("__builtin_ctz")
             parse_builtin_bit_scan(:forward, 4)
-          elsif peek.keyword?("__builtin_ctzll")
+          elsif peek.keyword?("__builtin_ctzl") || peek.keyword?("__builtin_ctzll")
             parse_builtin_bit_scan(:forward, 8)
           elsif peek.keyword?("__builtin_clz")
             parse_builtin_bit_scan(:reverse, 4)
-          elsif peek.keyword?("__builtin_clzll")
+          elsif peek.keyword?("__builtin_clzl") || peek.keyword?("__builtin_clzll")
             parse_builtin_bit_scan(:reverse, 8)
+          elsif peek.keyword?("__builtin_popcount")
+            parse_builtin_popcount(4)
+          elsif peek.keyword?("__builtin_popcountl") || peek.keyword?("__builtin_popcountll")
+            parse_builtin_popcount(8)
           elsif peek.keyword?("__builtin_unreachable")
             parse_builtin_unreachable
           elsif peek.keyword?("__builtin_memcpy")
@@ -3631,10 +3639,15 @@ module Rubycc
         selector.zero? ? when_false : when_true
       end
 
-      # "__builtin_ctz/ctzll/clz/clzll ( assignment-expression )": one integer
-      # operand whose trailing (`:forward`) or leading (`:reverse`) zero bits are
-      # counted over `width` bytes. The generator settles the operand's integer
-      # type check and lowers the bit scan; the result is int.
+      # "__builtin_ctz/clz ( assignment-expression )", in any of their three
+      # spellings: one integer operand whose trailing (`:forward`) or leading
+      # (`:reverse`) zero bits are counted over `width` bytes. The generator
+      # settles the operand's integer type check and lowers the bit scan; the
+      # result is int.
+      #
+      # The "l" spelling shares the "ll" one's width because `long` and `long
+      # long` are both 8 bytes on every target rubycc emits for; a target where
+      # they differed would have to split them here.
       def parse_builtin_bit_scan(direction, width)
         keyword_tok = advance # the "__builtin_ctz"/... keyword
         expect_punct("(")
@@ -3643,6 +3656,18 @@ module Rubycc
         AST::BuiltinBitScan.new(operand, direction, width, keyword_tok)
       end
 
+      # "__builtin_popcount/popcountl/popcountll ( assignment-expression )": one
+      # integer operand whose set bits are counted over `width` bytes, the width
+      # coming from the spelling exactly as it does for a bit scan. The generator
+      # checks the operand's type and lowers the count; the result is int.
+      def parse_builtin_popcount(width)
+        keyword_tok = advance # the "__builtin_popcount"/... keyword
+        expect_punct("(")
+        operand = parse_assignment_expression
+        expect_punct(")")
+        AST::BuiltinPopcount.new(operand, width, keyword_tok)
+      end
+
       # "__builtin_add/sub/mul_overflow ( a , b , res )": exactly three arguments,
       # parsed as an ordinary argument list so a wrong count is an arity
       # diagnostic. The keyword decides only the operator; the operand types are
@@ -3837,8 +3862,16 @@ module Rubycc
         elsif tok.type == :float
           advance
           # The suffix (from the lexer) fixes the constant's type: "f"/"F" is
-          # float, everything else (plain, or "l"/"L" long double) is double.
-          type = tok.suffix == "f" ? Type::Float : Type::Double
+          # float, "l"/"L" long double, and no suffix double. A long-double
+          # constant carries only a double's value and precision (that is what
+          # Type::LongDouble models), but it must keep the name so that
+          # "printf(\"%Lg\", 1.5L)" passes the argument in the long-double form
+          # the callee reads.
+          type = case tok.suffix
+                 when "f" then Type::Float
+                 when "l" then Type::LongDouble
+                 else Type::Double
+                 end
           AST::FloatLit.new(tok.value, type, tok)
         elsif tok.type == :string
           advance

data/lib/rubycc/ir/analysis.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+require_relative "ir"
+require_relative "simplify"
+
+module Rubycc
+  module IR
+    # One function's instruction list, counted once and handed to everyone who
+    # needs the count.
+    #
+    # Three consumers ask the same questions of the same flat list: IR::Simplify
+    # decides its rewrites from how often each virtual register is read and
+    # written, IR::Promotion decides which registers are worth a machine
+    # register from the same counts plus the transient set, and a backend needs
+    # that transient set again on every store it emits. Each of them used to
+    # walk the list for itself — the census three times over, the transient set
+    # twice, the "is every op one we recognize?" test four times — so a function
+    # was scanned a dozen times to answer four questions.
+    #
+    # This object is that answer, computed once on the way through and passed
+    # along: IR::Analysis.simplified runs the rewrites and keeps the census they
+    # maintained, and Compiler hands the result straight to the backend. Nothing
+    # here decides anything — every rule still lives in Simplify and Promotion —
+    # and nothing is cached that the list could invalidate, because a rewritten
+    # list gets an object of its own.
+    class Analysis
+      # `function` is the list this census describes (the *rewritten* one, where
+      # a rewrite happened), and `known` says whether every op in it is one
+      # IR::Simplify can enumerate the reads of. When it is false the counts are
+      # not to be trusted and every consumer refuses the function outright,
+      # which is the same fail-safe #run applies.
+      attr_reader :function, :insts, :param_count, :vreg_count, :reads, :writes
+
+      # The census of a function nothing has rewritten — what a backend handed a
+      # function directly (a test, or any caller that skips the pass) has to
+      # fall back on.
+      def self.of(function)
+        reads, writes = Simplify.census(function.insts, function.vreg_count)
+        new(function, reads, writes)
+      end
+
+      # IR::Simplify.run, plus the census the rewrites kept true as they went.
+      def self.simplified(function)
+        rewritten, reads, writes = Simplify.run_counted(function)
+        new(rewritten, reads, writes)
+      end
+
+      def initialize(function, reads, writes)
+        @function = function
+        @insts = function.insts
+        @param_count = function.param_count
+        @vreg_count = function.vreg_count
+        @reads = reads
+        @writes = writes
+      end
+
+      # Whether every op in the list is one whose reads IR::Simplify can
+      # enumerate. A function containing anything else is refused whole, by the
+      # pass and by every consumer of this object.
+      def known?
+        !@reads.nil?
+      end
+
+      # The transient virtual registers (IR::Simplify#transient_flags), as an
+      # array indexed by register number. Computed on first ask and kept, which
+      # is what stops IR::Promotion and the backend from computing it twice for
+      # the same list.
+      def transient
+        @transient ||=
+          if known?
+            Simplify.transient_flags(@insts, @param_count, @reads, @writes, @vreg_count)
+          else
+            EMPTY_FLAGS
+          end
+      end
+
+      # The answer for a function with no transient at all. Frozen and shared:
+      # every read of it is an index that finds nothing.
+      EMPTY_FLAGS = [].freeze
+    end
+  end
+end

data/lib/rubycc/ir/call_convention.rb

@@ -7,8 +7,8 @@ module Rubycc
     # One piece of a by-value aggregate as its convention moves it: the byte
     # `offset` within the aggregate the piece is read from (and written back to
     # at the far end), the `size` of that access, and the `kind` of place it
-    # travels in (:gp an integer register, :sse4/:sse8 a vector one, :mem a
-    # stack eightbyte).
+    # travels in (:gp an integer register, :sse4/:sse8/:sse16 a vector one, :mem
+    # a stack eightbyte).
     #
     # An aggregate is never moved as a whole — the generator takes it apart into
     # these pieces, loads each into a virtual register and hands the backend one
@@ -22,6 +22,14 @@ module Rubycc
     # single-precision registers on aarch64.
     AbiPiece = Data.define(:offset, :size, :kind)
 
+    # The piece kinds that consume a vector register, so that a placer counting
+    # a request's demand on the vector file names them in one place. :sse4 and
+    # :sse8 carry a single and a double; :sse16 carries a whole 16-byte value in
+    # one register (AAPCS64's quad-precision `long double`) and, unlike the
+    # other two, names the *address* of that value rather than the value itself,
+    # since no 8-byte virtual-register slot could hold it.
+    FP_KINDS = %i[sse4 sse8 sse16].freeze
+
     # How a convention passes one aggregate by value:
     #   :registers    — `pieces` names each register-borne piece;
     #   :memory       — the value is laid into the caller's stack argument area
@@ -120,6 +128,28 @@ module Rubycc
         raise NotImplementedError
       end
 
+      # The target's `long double` format, which decides the 16-byte image the
+      # generator builds for a variadic `long double` argument:
+      # :x87_extended80 (an explicit-integer-bit 64-bit significand plus a
+      # sign/15-bit-exponent halfword, occupying the low ten of sixteen bytes)
+      # or :binary128 (IEEE 754 quadruple precision). Both are supersets of
+      # binary64, so the conversion from the double rubycc actually holds is
+      # exact; see IR::Generator#emit_long_double_image.
+      def long_double_format
+        raise NotImplementedError
+      end
+
+      # How that 16-byte image travels in a variadic call's variable part, as an
+      # AggregatePlan over the image (not over Type::LongDouble, whose #size is
+      # the 8 bytes rubycc computes in). The two targets disagree completely:
+      # System V gives `long double` the X87/X87UP classes, which no register
+      # can carry, so the image goes in the stack argument area; AAPCS64 makes
+      # it an ordinary quad-precision value that rides one whole vector
+      # register. Both align its stack slot to 16 bytes, hence align16.
+      def long_double_plan
+        raise NotImplementedError
+      end
+
       # A fresh running placement of one argument list (see the Placer classes).
       def placer
         raise NotImplementedError
@@ -174,6 +204,20 @@ module Rubycc
         Placer.new(self)
       end
 
+      # psABI 3.2.3: `long double` is the 80-bit x87 extended format, classified
+      # X87 (its low eightbyte) and X87UP (its high one). Neither class has a
+      # register to be handed out in an argument list, so the value always
+      # passes in memory, in a 16-byte slot the psABI aligns to 16 (measured:
+      # gcc 13 reserves a pad eightbyte ahead of it when the stack argument
+      # area has reached an odd offset).
+      def long_double_format
+        :x87_extended80
+      end
+
+      def long_double_plan
+        AggregatePlan.new(mode: :memory, pieces: CallConvention.memory_pieces(16), align16: true)
+      end
+
       private
 
       # Whether any scalar field of `type`, placed at absolute byte offset
@@ -285,7 +329,7 @@ module Rubycc
         def place(request)
           @pad_stack = 0
           need_gp = request.kinds.count(:gp)
-          need_sse = request.kinds.count { |kind| kind == :sse4 || kind == :sse8 }
+          need_sse = request.kinds.count { |kind| FP_KINDS.include?(kind) }
           spills = request.kinds.all?(:mem) ||
                    !(@next_gp + need_gp <= @convention.gp_registers &&
                      @next_sse + need_sse <= @convention.fp_registers)
@@ -356,6 +400,24 @@ module Rubycc
         Placer.new(self)
       end
 
+      # AAPCS64 6.4.2: `long double` is IEEE 754 binary128, a Quad-precision
+      # Floating-point type, and stage C.1 gives one to the next free SIMD&FP
+      # register whole — v[NSRN], read as a 16-byte q register. The rule is the
+      # same in the variable part of a variadic call on this ABI (measured:
+      # gcc 13 puts the ninth argument of "printf(fmt, 1.0..7.0, ld, 9)" in q7),
+      # unlike the Apple variant, which stacks every anonymous argument.
+      # An overflowing quad spills to an NSAA the standard rounds up to the
+      # type's 16-byte natural alignment (stage C.13), hence align16.
+      def long_double_format
+        :binary128
+      end
+
+      def long_double_plan
+        AggregatePlan.new(mode: :registers,
+                          pieces: [AbiPiece.new(offset: 0, size: 16, kind: :sse16)],
+                          align16: true)
+      end
+
       private
 
       # Whether `type` is built entirely out of one floating type, and of how
@@ -438,8 +500,8 @@ module Rubycc
         def place(request)
           @pad_gp = 0
           @pad_stack = 0
-          need_fp = request.kinds.count { |kind| kind == :sse4 || kind == :sse8 }
-          return place_fp(need_fp, request.mem_eightbytes) if need_fp.positive?
+          need_fp = request.kinds.count { |kind| FP_KINDS.include?(kind) }
+          return place_fp(need_fp, request.align16, request.mem_eightbytes) if need_fp.positive?
 
           need_gp = request.kinds.count(:gp)
           return place_gp(need_gp, request.align16, request.mem_eightbytes) if need_gp.positive?
@@ -451,13 +513,18 @@ module Rubycc
 
         private
 
-        def place_fp(count, mem_eightbytes)
+        # A spilled vector argument aligns NSAA to its own natural alignment the
+        # way an integer-register aggregate does; only a quad ever asks for 16
+        # (align16), since a single or a double is 8-aligned and a stack slot
+        # already is.
+        def place_fp(count, align16, mem_eightbytes)
           if @nsrn + count <= @convention.fp_registers
             @nsrn += count
             :registers
           else
             @nsrn = @convention.fp_registers
-            @nsaa += mem_eightbytes
+            @pad_stack = 1 if align16 && @nsaa.odd?
+            @nsaa += @pad_stack + mem_eightbytes
             :stack
           end
         end