@asmlift/core 0.10.0 → 0.11.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@asmlift/core",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "license": "MIT",
   "type": "module",
   "description": "Match decompile an assembly function to C or Pascal",

package/src/backend/c.ts

@@ -14,6 +14,7 @@ export const cBackend: LanguageBackend = {
   id: 'c',
   spellsSwitchFallthrough: true,
   spellsSwitchBreak: true,
+  spellsEarlyReturn: true,
   emit(fn: SFn): string {
     // The SAME declarator placement the local list and the struct-field printer use, so one
     // function cannot spell the `*` on the type in its signature and on the declarator in its

package/src/backend/cfamily.ts

@@ -12,7 +12,7 @@
 // too, shared with the scoring layer's synthesized declarations so the two cannot drift).
 import { doubleLiteral } from '../ir/float-bits';
 import { IrType, T, scalarTypeForAccess, typeEquals, typeToString } from '../ir/types';
-import { BinOp, Expr, InitAddress, SFn, SStatic, Stmt, dotBase } from '../l3/ast';
+import { BinOp, Expr, InitAddress, SFn, SStatic, Stmt, caseGotoViolation, dotBase } from '../l3/ast';
 import { foldConstantImages } from '../l3/constinit';
 import { legalizePointerCells } from '../l3/ptrcell';
 import { orderSlotLocals } from '../l3/slotorder';
@@ -29,6 +29,7 @@ import {
   writesNonPointerIntoPointer,
 } from '../l3/typing';
 import { spellableType } from '../proto';
+import { append } from './lines';
 
 // C operator precedence (lower binds tighter). Used to emit MINIMAL parentheses. Shared: C++ has
 // the same precedence for these operators.
@@ -524,12 +525,12 @@ function printStmt(s: Stmt, indent: string, vt: PrintEnv, leaf?: LeafHook): stri
       }
       const out = [`${indent}if (${cond}) {`];
       for (const t of s.then) {
-        out.push(...printStmt(t, indent + '    ', vt, leaf));
+        append(out, printStmt(t, indent + '    ', vt, leaf));
       }
       if (s.else.length) {
         out.push(`${indent}} else {`);
         for (const e of s.else) {
-          out.push(...printStmt(e, indent + '    ', vt, leaf));
+          append(out, printStmt(e, indent + '    ', vt, leaf));
         }
       }
       out.push(`${indent}}`);
@@ -539,7 +540,7 @@ function printStmt(s: Stmt, indent: string, vt: PrintEnv, leaf?: LeafHook): stri
       refuseMisboundBreak(s.body, 'loop');
       const out = [`${indent}while (${pe(s.cond, 99)}) {`];
       for (const t of s.body) {
-        out.push(...printStmt(t, indent + '    ', vt, leaf));
+        append(out, printStmt(t, indent + '    ', vt, leaf));
       }
       out.push(`${indent}}`);
       return out;
@@ -548,7 +549,7 @@ function printStmt(s: Stmt, indent: string, vt: PrintEnv, leaf?: LeafHook): stri
       refuseMisboundBreak(s.body, 'loop');
       const out = [`${indent}do {`];
       for (const t of s.body) {
-        out.push(...printStmt(t, indent + '    ', vt, leaf));
+        append(out, printStmt(t, indent + '    ', vt, leaf));
       }
       out.push(`${indent}} while (${pe(s.cond, 99)});`);
       return out;
@@ -559,18 +560,27 @@ function printStmt(s: Stmt, indent: string, vt: PrintEnv, leaf?: LeafHook): stri
       // and strips its trailing `;` so it sits inside the header (`i = 0; c; i = i + 1`). A multi-line
       // statement (an `if`/nested loop) would render mangled — but the recognizer never builds one here.
       refuseMisboundBreak(s.body, 'loop');
+      // An identity init (`i = i`, structure.ts `forPlanAt`: the name already holds the entry value)
+      // is the empty clause.
       const clause = (st: Stmt) => printStmt(st, '', vt, leaf).join(' ').replace(/;\s*$/, '').trim();
-      const out = [`${indent}for (${clause(s.init)}; ${pe(s.cond, 99)}; ${clause(s.inc)}) {`];
+      const identity = s.init.k === 'assign' && s.init.value.k === 'var' && s.init.value.name === s.init.name;
+      const out = [`${indent}for (${identity ? '' : clause(s.init)}; ${pe(s.cond, 99)}; ${clause(s.inc)}) {`];
       for (const t of s.body) {
-        out.push(...printStmt(t, indent + '    ', vt, leaf));
+        append(out, printStmt(t, indent + '    ', vt, leaf));
       }
       out.push(`${indent}}`);
       return out;
     }
+    // A labelled `break` is the end of a switch arm a case-end `goto` lands on (l3/ast.ts).
     case 'break':
-      return [`${indent}break;`];
+      return s.label === undefined ? [`${indent}break;`] : [`${indent}${s.label}:`, `${indent}break;`];
     case 'continue':
       return [`${indent}continue;`];
+    // Where it may sit is the tree's contract (l3/ast.ts `caseGotoViolation`), which `emitCFamily`
+    // asks of the whole function before printing any of it.
+    case 'goto':
+    case 'caseEndGoto':
+      return [`${indent}goto ${s.label};`];
     case 'switch':
       return printSwitchStmt(s, indent, vt, leaf);
   }
@@ -616,7 +626,7 @@ function printSwitchStmt(s: Extract<Stmt, { k: 'switch' }>, indent: string, vt:
   const printDefault = (): void => {
     out.push(`${ci}default:`);
     for (const t of s.default!) {
-      out.push(...printStmt(t, bi, vt, leaf));
+      append(out, printStmt(t, bi, vt, leaf));
     }
     // A default that is NOT last would otherwise fall into the case below it — the mirror of the
     // rule for cases. The last one needs no `break;` because there is nothing under it.
@@ -639,8 +649,13 @@ function printSwitchStmt(s: Extract<Stmt, { k: 'switch' }>, indent: string, vt:
     for (const v of c.values) {
       out.push(`${ci}case ${v}:`);
     }
+    // The label a `goto` of this switch lands on, after the arm's case labels: entering it there
+    // runs exactly what falling into the arm runs.
+    if (c.label !== undefined) {
+      out.push(`${ci}${c.label}:`);
+    }
     for (const t of c.body) {
-      out.push(...printStmt(t, bi, vt, leaf));
+      append(out, printStmt(t, bi, vt, leaf));
     }
     // A case whose body ends in `return`/`break` (a terminated arm) needs no `break;`; only an
     // open non-fall-through arm gets one. `fallsThrough` omits it so control drops to the next case.
@@ -685,6 +700,8 @@ function endsTerminated(body: Stmt[]): boolean {
     (last.k === 'return' ||
       last.k === 'break' ||
       last.k === 'continue' ||
+      last.k === 'goto' ||
+      last.k === 'caseEndGoto' ||
       (last.k === 'if' && endsTerminated(last.then) && last.else.length > 0 && endsTerminated(last.else)))
   );
 }
@@ -769,7 +786,7 @@ function cFamilyBody(fn0: SFn, leaf: LeafHook | undefined, designators: boolean)
   const vt: PrintEnv = printEnv(fn);
   const lines: string[] = [];
   for (const st of fn.statics ?? []) {
-    lines.push(...staticDefinition(st));
+    append(lines, staticDefinition(st));
   }
   for (const l of fn.locals) {
     // Both facts render at the PREFIX position, where C's declarator grammar reads them
@@ -785,7 +802,7 @@ function cFamilyBody(fn0: SFn, leaf: LeafHook | undefined, designators: boolean)
     );
   }
   for (const s of fn.body) {
-    lines.push(...printStmt(s, '    ', vt, leaf));
+    append(lines, printStmt(s, '    ', vt, leaf));
   }
   return lines;
 }
@@ -901,6 +918,10 @@ export function emitCFamily(signature: string, fn0: SFn, leaf?: LeafHook, design
   // …and the compiler's anonymous constant images folded into the initializers of the locals
   // their copies fill (l3/constinit.ts), which the tree keeps as copies until here.
   const fn = orderSlotLocals(legalizePointerCells(foldConstantImages(fn0)));
+  const stray = caseGotoViolation(fn.body);
+  if (stray !== null) {
+    throw new Error(`c backend: ${stray}`);
+  }
   const decls = structDecls(fn);
   const preamble = decls.length ? decls.join('\n') + '\n' : '';
   return (

package/src/backend/cpp.ts

@@ -139,6 +139,7 @@ export function cppBackend(spec: CppFnSpec, floatSlots: FloatSlots | undefined):
     id: 'cpp',
     spellsSwitchFallthrough: true,
     spellsSwitchBreak: true,
+    spellsEarlyReturn: true,
     emit(fn: SFn): string {
       // Map each lifted param var → its C++ meaning: `this` (bare member access) or a named param
       // (a pointer-to-class param uses `->`). A pointer-to-known-class param is a member receiver.

package/src/backend/lines.ts

@@ -0,0 +1,10 @@
+/** `out.push(...lines)` without the spread: a spread passes every line as an ARGUMENT, and V8 throws
+ *  "Maximum call stack size exceeded" past about 120k of them (120,000 print, 130,000 throw, node
+ *  24). A structuring with a long arm reaches that at a nesting depth of a few dozen, so the throw
+ *  reads as deep recursion when it is only size. Every printer appends a child's lines with this,
+ *  so the limit binds no backend (the C family and Pascal alike). */
+export function append(out: string[], lines: readonly string[]): void {
+  for (const line of lines) {
+    out.push(line);
+  }
+}

package/src/backend/pascal.ts

@@ -12,6 +12,7 @@ import { IrType, typeToString } from '../ir/types';
 import { BinOp, Expr, LanguageBackend, SFn, Stmt, isLoop } from '../l3/ast';
 import { orderSlotLocals } from '../l3/slotorder';
 import { type VarTypes, declaredTypes, derefStrideOk, exprCType, writesNonPointerIntoPointer } from '../l3/typing';
+import { append } from './lines';
 
 // Infix operators IDO Pascal spells directly.
 const OP: Partial<Record<BinOp, string>> = {
@@ -215,10 +216,10 @@ function makePrinter(vt: VarTypes) {
             : [`${ind}begin`, ...list(stmts, ind + '  ', tail), `${ind}end`];
         // Pascal: no `;` before `else`; the branch statements already carry their own.
         const out = [`${indent}if ${cond} then`];
-        out.push(...block(s.then, indent + '  ', s.else.length > 0));
+        append(out, block(s.then, indent + '  ', s.else.length > 0));
         if (s.else.length) {
           out.push(`${indent}else`);
-          out.push(...block(s.else, indent + '  '));
+          append(out, block(s.else, indent + '  '));
         }
         return out;
       }
@@ -255,6 +256,13 @@ function makePrinter(vt: VarTypes) {
         throw new Error('pascal backend: `break` has no IDO Pascal spelling');
       case 'continue':
         throw new Error('pascal backend: `continue` has no IDO Pascal spelling');
+      // A jump into another arm of a `case-of` has no Pascal spelling: an arm is a statement, and a
+      // label may not be entered from outside the statement that holds it.
+      case 'goto':
+        throw new Error('pascal backend: a `goto` into a case arm has no IDO Pascal spelling');
+      // A jump to an arm's end lands on a `break`, which Pascal has none of either.
+      case 'caseEndGoto':
+        throw new Error('pascal backend: a `goto` to the end of a case arm has no IDO Pascal spelling');
       case 'switch': {
         // IDO/SGI Pascal `case E of L: S; … otherwise S end`. There is NO fall-through in Pascal case-of,
         // so a `fallsThrough` arm has no faithful spelling → loud-fail (mirrors the `field`/`cast`/`%`
@@ -284,14 +292,15 @@ function makePrinter(vt: VarTypes) {
           if (c.fallsThrough) {
             throw new Error('pascal backend: switch fall-through has no faithful IDO Pascal case-of spelling');
           }
-          out.push(`${indent}  ${c.values.join(', ')}:`, ...arm(c.body, indent + '  '));
+          out.push(`${indent}  ${c.values.join(', ')}:`);
+          append(out, arm(c.body, indent + '  '));
         }
         // A C `switch` with no `default` runs on past a value it does not list; IDO Pascal's
         // `case` raises a run-time `caseerror` there instead. So the clause is always printed, an
         // empty one when the source had no default.
         out.push(`${indent}  otherwise`);
         if (s.default?.length) {
-          out.push(...arm(s.default, indent + '  '));
+          append(out, arm(s.default, indent + '  '));
         }
         out.push(`${indent}end;`);
         return out;
@@ -311,6 +320,9 @@ export const pascalBackend: LanguageBackend = {
   // Nor has Pascal a `break`, so recovery must not mint a switch's mid-arm one either: a closed arm
   // that leaves early spells as nested `if`s that copy the arm's tail into each path.
   spellsSwitchBreak: false,
+  // Nor an early `return` (the `return` case below loud-fails one not in tail position), so
+  // structuring reads the return-tail copies rather than the join past early returns.
+  spellsEarlyReturn: false,
   emit(fn0: SFn): string {
     // The declaration list is put into the target's own frame order HERE, as the C family does it
     // in its shared assembler — owned by `emit`, never by a `.emit(` call site (l3/slotorder.ts).
@@ -351,7 +363,7 @@ export const pascalBackend: LanguageBackend = {
       lines.push('var', ...fn.locals.map((l) => `  ${l.name}: ${pasType(l.type)};`));
     }
     lines.push('begin');
-    fn.body.forEach((s, i) => lines.push(...ps(fn.name, s, '  ', i === fn.body.length - 1)));
+    fn.body.forEach((s, i) => append(lines, ps(fn.name, s, '  ', i === fn.body.length - 1)));
     lines.push('end;');
     return lines.join('\n') + '\n';
   },

package/src/cdecl/parse.ts

@@ -369,6 +369,27 @@ class Parser {
     if (specifiers === null) {
       return null;
     }
+    // C89's implicit `int` ahead of a declarator list: `extern gN, gM;` and `static gA[4];` read the
+    // first name as a type word, and in valid C no type is followed by `,`, `=` or `[`. The word goes
+    // back to being the first declarator. A lone `extern gN;` is a statement this cannot tell from
+    // an unknown type declaring nothing; `proto-context.ts` reads that one against the types the
+    // context declares.
+    const { storage, type, unknownWords } = specifiers;
+    const next = this.t.char(this.i);
+    if (
+      !this.cxx &&
+      (storage.includes('extern') || storage.includes('static')) &&
+      type.kind === 'words' &&
+      type.words.length === 1 &&
+      !BASIC.has(type.words[0]) &&
+      unknownWords.length === 0 &&
+      (next === COMMA || next === EQUALS || next === OPEN_BRACKET) &&
+      this.t.text(this.i - 1) === type.words[0]
+    ) {
+      this.i--;
+      specifiers.type = { kind: 'words', words: ['int'] };
+      specifiers.spelling = 'int';
+    }
     const declarators: Declarator[] = [];
     if (this.t.char(this.i) === SEMICOLON) {
       this.i++;

package/src/contracts.ts

@@ -9,7 +9,7 @@ import { placedAt } from './ir/discipline';
 import { MEM_BASE_OPS } from './ir/opcodes';
 import { type IrType, memberOf, typeToString } from './ir/types';
 import { cellAddress, qualifiedBase } from './l3/address';
-import { type BinOp, type Expr, type SFn, type Stmt, calleeOf } from './l3/ast';
+import { type BinOp, type Expr, type SFn, type Stmt, calleeOf, caseGotoViolation, switchArmSuccessors } from './l3/ast';
 import {
   assignsIn,
   exprChildren,
@@ -285,13 +285,15 @@ function dotSelectedAccess(e: Access): Access {
 }
 
 /** The executions on the paths through a statement list, split by how each path LEAVES it: falling off
- *  the end, or by a `return`, `break` or `continue`. Null when no path leaves that way. Each is the
+ *  the end, or by a `return`, `break`, `continue` or case-end `goto` (`end`, which leaves every loop
+ *  up to its switch arm and then the switch). Null when no path leaves that way. Each is the
  *  per-name maximum over the paths of that kind. */
 interface PathCounts {
   through: EffectCounts | null;
   ret: EffectCounts | null;
   brk: EffectCounts | null;
   cont: EffectCounts | null;
+  end: EffectCounts | null;
 }
 
 const sum = (a: EffectCounts, b: EffectCounts): EffectCounts => combine(a, b, (x, y) => x + y);
@@ -303,6 +305,7 @@ const after = (c: EffectCounts, p: PathCounts): PathCounts => ({
   ret: p.ret && sum(c, p.ret),
   brk: p.brk && sum(c, p.brk),
   cont: p.cont && sum(c, p.cont),
+  end: p.end && sum(c, p.end),
 });
 /** `a` then `b`: only a path that falls off the end of `a` reaches `b` */
 const seq = (a: PathCounts, b: PathCounts): PathCounts =>
@@ -313,6 +316,7 @@ const seq = (a: PathCounts, b: PathCounts): PathCounts =>
         ret: most(a.ret, b.ret && sum(a.through, b.ret)),
         brk: most(a.brk, b.brk && sum(a.through, b.brk)),
         cont: most(a.cont, b.cont && sum(a.through, b.cont)),
+        end: most(a.end, b.end && sum(a.through, b.end)),
       };
 /** whichever of the alternatives runs */
 const either = (...ps: PathCounts[]): PathCounts => ({
@@ -320,14 +324,18 @@ const either = (...ps: PathCounts[]): PathCounts => ({
   ret: most(...ps.map((p) => p.ret)),
   brk: most(...ps.map((p) => p.brk)),
   cont: most(...ps.map((p) => p.cont)),
+  end: most(...ps.map((p) => p.end)),
 });
-const falls = (c: EffectCounts): PathCounts => ({ through: c, ret: null, brk: null, cont: null });
+const falls = (c: EffectCounts): PathCounts => ({ through: c, ret: null, brk: null, cont: null, end: null });
 
 /** `total` = every occurrence in the tree; `paths` = the most any single syntactic path executes,
  *  by how it leaves `stmts`. A path that leaves by `return` runs nothing after it, so two sequenced
  *  `if (…) { f(); return; }` arms are one call on any path, not two. `unreached` collects every
  *  statement that follows one no path falls past: the path count skips it, so the caller refuses it
- *  rather than let a duplicated region hide there. */
+ *  rather than let a duplicated region hide there. A labelled `break;` no path falls into is not
+ *  one of them while a case-end `goto` in an earlier statement of the list is still leaving
+ *  (`paths.end`): the goto lands on it, or on a labelled `break;` further out that this one's
+ *  `break` reaches too, so it is reached, and it holds no code a region could hide in. */
 function countEffects(
   stmts: Stmt[],
   ctx: TreeContext,
@@ -336,7 +344,7 @@ function countEffects(
   let total: EffectCounts = new Map();
   let paths = falls(new Map());
   for (const s of stmts) {
-    if (paths.through === null) {
+    if (paths.through === null && !(s.k === 'break' && s.label !== undefined && paths.end !== null)) {
       unreached.push(s);
     }
     const own: EffectCounts = new Map();
@@ -354,31 +362,64 @@ function countEffects(
       total = arms.reduce((acc, a) => sum(acc, a.total), sum(total, dflt.total));
       // A fall-through arm continues into the NEXT one emitted (the last into `default`), so a
       // path through arm i runs the chain starting at i — the shape the fall-through round's
-      // CRITICAL took. Built from the end; `chain[i]` is that arm's paths.
-      const chain: PathCounts[] = new Array(arms.length);
-      for (let i = arms.length - 1; i >= 0; i--) {
-        const next = i + 1 < arms.length ? chain[i + 1] : dflt.paths;
-        chain[i] = s.cases[i].fallsThrough ? seq(arms[i].paths, next) : arms[i].paths;
-      }
-      // No `default` is one more alternative: no arm runs. A `break` leaves the switch, so it
-      // continues after it as a fall-off-the-end does.
-      const inner = either(...chain, s.default ? dflt.paths : falls(new Map()));
-      here = after(own, { through: most(inner.through, inner.brk), ret: inner.ret, brk: null, cont: inner.cont });
+      // CRITICAL took. `chain[i]` is that arm's paths. An arm that ends `goto L;` continues into
+      // the arm labelled L instead (`switchArmSuccessors`): the goto is its body's last top-level
+      // statement (`assertCaseGotosNarrow`), so the paths that fall off its end are the goto's,
+      // counted below as `through` (a `goto` ends nothing of its own). Memoised, since a goto may
+      // name an arm above it; a chain that comes back to an arm it already runs is no tree the
+      // structurer builds. The `default` is node `cases.length`.
+      const next = switchArmSuccessors(s);
+      const bodies = [...arms, dflt];
+      const chain: (PathCounts | undefined)[] = new Array(bodies.length);
+      const onChain = new Set<number>();
+      const chainAt = (i: number): PathCounts => {
+        const known = chain[i];
+        if (known !== undefined) {
+          return known;
+        }
+        if (onChain.has(i)) {
+          throw new ContractError('a switch whose arms fall or jump round in a cycle');
+        }
+        onChain.add(i);
+        const to = next[i];
+        const then = to === undefined ? undefined : chainAt(to);
+        onChain.delete(i);
+        return (chain[i] = then === undefined ? bodies[i].paths : seq(bodies[i].paths, then));
+      };
+      const dfltChain = chainAt(arms.length);
+      // No `default` is one more alternative: no arm runs. A `break` or a case-end `goto` leaves the
+      // switch, so it continues after it as a fall-off-the-end does.
+      const inner = either(...arms.map((_, i) => chainAt(i)), s.default ? dfltChain : falls(new Map()));
+      here = after(own, {
+        through: most(inner.through, inner.brk, inner.end),
+        ret: inner.ret,
+        brk: null,
+        cont: inner.cont,
+        end: null,
+      });
     } else if (stmtChildren(s).length > 0) {
       // A loop: its sequenced children (a body, a `for`'s init/inc) counted ONCE — a loop's dynamic
       // trip count is not a syntactic occurrence, and the IR side is static too. A `break` or
       // `continue` in the body lands after the loop or at its test, and the test may exit without
-      // running the body.
+      // running the body. A case-end `goto` leaves the loop for its switch's end.
       const body = countEffects(stmtChildren(s), ctx, unreached);
       total = sum(total, body.total);
       const p = body.paths;
-      here = after(own, { through: most(p.through, p.brk, p.cont, new Map()), ret: p.ret, brk: null, cont: null });
+      here = after(own, {
+        through: most(p.through, p.brk, p.cont, new Map()),
+        ret: p.ret,
+        brk: null,
+        cont: null,
+        end: p.end,
+      });
     } else if (s.k === 'return') {
-      here = { through: null, ret: own, brk: null, cont: null };
+      here = { through: null, ret: own, brk: null, cont: null, end: null };
     } else if (s.k === 'break') {
-      here = { through: null, ret: null, brk: own, cont: null };
+      here = { through: null, ret: null, brk: own, cont: null, end: null };
     } else if (s.k === 'continue') {
-      here = { through: null, ret: null, brk: null, cont: own };
+      here = { through: null, ret: null, brk: null, cont: own, end: null };
+    } else if (s.k === 'caseEndGoto') {
+      here = { through: null, ret: null, brk: null, cont: null, end: own };
     } else {
       here = falls(own);
     }
@@ -387,12 +428,24 @@ function countEffects(
   return { total, paths };
 }
 
+/** Every `goto` keeps one of the two forms L3 allows it (l3/ast.ts `caseGotoViolation`): the last
+ *  statement of a switch arm's own body naming a case label of that switch, or a case-end goto
+ *  naming a labelled `break;` that ends the arm it sits in. The effect count below reads a goto
+ *  that way, so a tree outside it is refused before it is counted. */
+export function assertCaseGotosNarrow(sfn: SFn): void {
+  const why = caseGotoViolation(sfn.body);
+  if (why !== null) {
+    throw new ContractError(`'${sfn.name}': ${why}`);
+  }
+}
+
 /**
  * Post structuring: every call and pinned access the asm makes is emitted, and none of those or of
  * its declared volatile reads is emitted more times than the asm makes it on any one path. See the
  * note above for what this deliberately does not cover.
  */
 export function assertEffectsPreserved(fn: Fn, sfn: SFn): void {
+  assertCaseGotosNarrow(sfn);
   // Reachable blocks only: an unreachable block's call is legitimately never emitted.
   const seen = reachableBlocks(fn);
   const irCalls: EffectCounts = new Map();

package/src/frontend/arm-body.ts

@@ -0,0 +1,155 @@
+// asmlift — what a straight-line ARM (A32) body reads of its argument registers, and the Thumb
+// interworking veneer that reaches one.
+//
+// A GBA callee written in ARM is reached from Thumb through a veneer (`bx pc; nop` then ARM `b sym`),
+// and the Thumb frontend lifts no ARM, so the callee-body bound (frontend/callee-body.ts) has nothing
+// to lift. Where the body is straight-line, though, what it reads needs no lift: one pass over its
+// instruction words, in order, says which argument register it reads before writing it.
+//
+// THE SCAN ANSWERS ONLY WHERE EVERY PATH IS THE ONE IT READ. It reads instruction words from the
+// entry to the first `bx lr`, and answers nothing (undefined) on:
+//   - any instruction whose condition is not AL: a conditional one makes the body two paths;
+//   - any branch, call or other write of pc but that final `bx lr` (`b`, `bl`, `bx` of another
+//     register, `mov pc, …`, `ldr pc, …`, `ldm`/`stm`): the body is no longer the words that follow;
+//   - any write of lr, which makes the final `bx lr` go somewhere else;
+//   - any use of sp: a stack argument read is a fifth word, and a frame is no straight-line scratch;
+//   - any instruction it does not model (coprocessor, swi, status register moves, swap, long
+//     multiply, the halfword forms ARMv4T leaves undefined), and running out of words before `bx lr`.
+// What it answers is the number of argument words read: one past the highest of r0-r3 that some
+// instruction reads before any instruction writes it, and the final `bx lr` reads r0 where nothing
+// wrote it, since r0 is the return register and holds the caller's first argument there (`void
+// *id(void *p) { return p; }` is a lone `bx lr`), unless the callee is declared to return nothing.
+// That is an UPPER bound on what the body reads of its arguments, as the callee-body bound is.
+// KNOWN GAP: a return in r0:r1 that nothing declares counts r0 only.
+
+/** The registers the scan counts argument words in, in order: the A32 procedure call standard's. */
+export const ARM_ARGUMENT_REGISTERS: readonly string[] = ['r0', 'r1', 'r2', 'r3'];
+
+/** Whether the scan's count is a count of `target`'s argument words: where the target passes its
+ *  arguments in the registers it counts, so the caller's argument word k is the register the scan
+ *  reads as k. Read off the ABI's `argRegs`, the datum the callers of the bound index it by. */
+export function scansArgumentsOf(target: { readonly argRegs: readonly string[] }): boolean {
+  return (
+    target.argRegs.length === ARM_ARGUMENT_REGISTERS.length &&
+    target.argRegs.every((r, k) => r === ARM_ARGUMENT_REGISTERS[k])
+  );
+}
+
+/** The argument words a straight-line ARM body reads at most, or undefined (see the header). `words`
+ *  are its instruction words from the entry, in order; `returnsValue` is false only where the
+ *  callee is declared to return nothing, so that its `bx lr` reads no r0. */
+export function armArgumentWords(words: readonly number[], returnsValue = true): number | undefined {
+  const written = new Set<number>();
+  let reads = 0;
+  for (const w of words) {
+    if (w >>> 28 !== 0xe) {
+      return undefined;
+    }
+    if (w >>> 0 === 0xe12fff1e) {
+      return returnsValue && !written.has(0) ? Math.max(reads, 1) : reads; // bx lr, which returns r0
+    }
+    const effect = decode(w >>> 0);
+    if (effect === undefined) {
+      return undefined;
+    }
+    const regs = [...effect.reads, ...effect.writes];
+    if (regs.includes(SP) || effect.writes.includes(LR) || effect.writes.includes(PC)) {
+      return undefined;
+    }
+    for (const r of effect.reads) {
+      if (r < 4 && !written.has(r)) {
+        reads = Math.max(reads, r + 1);
+      }
+    }
+    effect.writes.forEach((r) => written.add(r));
+  }
+  return undefined;
+}
+
+const SP = 13;
+const LR = 14;
+const PC = 15;
+
+interface Effect {
+  reads: number[];
+  writes: number[];
+}
+
+const reg = (w: number, at: number): number => (w >>> at) & 0xf;
+
+/** The registers one unconditional ARMv4T instruction reads and writes, or undefined for one this
+ *  scan does not model. */
+function decode(w: number): Effect | undefined {
+  // MUL / MLA: 0000 00AS dddd nnnn ssss 1001 mmmm
+  if ((w & 0x0fc000f0) === 0x00000090) {
+    const accumulate = (w >>> 21) & 1;
+    const reads = [reg(w, 0), reg(w, 8), ...(accumulate ? [reg(w, 12)] : [])];
+    return { reads, writes: [reg(w, 16)] };
+  }
+  // LDRH / STRH / LDRSB / LDRSH: 000P UIWL nnnn dddd oooo 1SH1 mmmm, SH ≠ 00
+  if ((w & 0x0e000090) === 0x00000090) {
+    const sh = (w >>> 5) & 3;
+    const load = (w >>> 20) & 1;
+    if (sh === 0 || (!load && sh !== 1)) {
+      return undefined; // swap, or a store form ARMv4T leaves undefined
+    }
+    const immediate = (w >>> 22) & 1;
+    return transfer(w, load === 1, immediate === 1 ? [] : [reg(w, 0)]);
+  }
+  // data processing: 00I oooo S nnnn dddd operand2
+  if ((w & 0x0c000000) === 0) {
+    const op = (w >>> 21) & 0xf;
+    const setsFlags = (w >>> 20) & 1;
+    const compare = op >= 8 && op <= 11;
+    if (compare && !setsFlags) {
+      return undefined; // MRS, MSR, BX and the rest of that space
+    }
+    const reads: number[] = [];
+    if (op !== 13 && op !== 15) {
+      reads.push(reg(w, 16)); // every op but MOV and MVN reads Rn
+    }
+    if (((w >>> 25) & 1) === 0) {
+      reads.push(reg(w, 0));
+      if ((w >>> 4) & 1) {
+        reads.push(reg(w, 8)); // shift by a register
+      }
+    }
+    return { reads, writes: compare ? [] : [reg(w, 12)] };
+  }
+  // LDR / STR / LDRB / STRB: 01I PUBW L nnnn dddd offset
+  if ((w & 0x0c000000) === 0x04000000) {
+    const registerOffset = (w >>> 25) & 1;
+    if (registerOffset && (w >>> 4) & 1) {
+      return undefined; // the undefined-instruction space
+    }
+    return transfer(w, ((w >>> 20) & 1) === 1, registerOffset ? [reg(w, 0)] : []);
+  }
+  return undefined;
+}
+
+/** A single load or store: it reads its base and `offset`, a store its source too; a load writes
+ *  its destination, and a post-indexed or write-back form its base. */
+function transfer(w: number, load: boolean, offset: number[]): Effect | undefined {
+  const base = reg(w, 16);
+  const data = reg(w, 12);
+  const writeBack = ((w >>> 24) & 1) === 0 || ((w >>> 21) & 1) === 1;
+  if (data === PC || (writeBack && base === PC)) {
+    return undefined;
+  }
+  return {
+    reads: [base, ...offset, ...(load ? [] : [data])],
+    writes: [...(load ? [data] : []), ...(writeBack ? [base] : [])],
+  };
+}
+
+/** Where a Thumb interworking veneer at a word-aligned `entry` branches to: its two halfwords are
+ *  `bx pc` (0x4778) and `nop` (`mov r8, r8`, 0x46c0), which enter ARM state at `entry + 4`, and the
+ *  ARM word there is an unconditional `b`. Undefined for anything else: the veneer is then some
+ *  other code, and nothing here reads it. */
+export function thumbToArmVeneerTarget(entry: number, h0: number, h1: number, armWord: number): number | undefined {
+  if (entry % 4 !== 0 || h0 !== 0x4778 || h1 !== 0x46c0 || (armWord & 0xff000000) >>> 0 !== 0xea000000) {
+    return undefined;
+  }
+  const offset = ((armWord & 0x00ffffff) << 8) >> 6; // sign-extended, in bytes
+  return (entry + 4 + 8 + offset) >>> 0;
+}

package/src/frontend/asmdata.ts

@@ -45,7 +45,8 @@ export interface AsmSymbol {
   index: number;
 }
 
-const readU32 = (b: Uint8Array, off: number, big: boolean): number =>
+/** The word at byte `off` of `b`, in the object's byte order. */
+export const readU32 = (b: Uint8Array, off: number, big: boolean): number =>
   big
     ? ((b[off] << 24) | (b[off + 1] << 16) | (b[off + 2] << 8) | b[off + 3]) >>> 0
     : ((b[off + 3] << 24) | (b[off + 2] << 16) | (b[off + 1] << 8) | b[off]) >>> 0;