@asmlift/core 0.10.0 → 0.11.0

package/src/proto-context.ts

@@ -20,6 +20,7 @@ import { demangledName, implicitArgumentWords } from './mangle';
 import type { AggregateLayout, AggregateMember, FnProto, ParamType, Prototypes } from './proto';
 import {
   declaredCallArgs,
+  declaredSigned,
   declaredWidth,
   declaresAggregateReturn,
   declaresVoidReturn,
@@ -115,8 +116,39 @@ export interface ContextGlobals {
    *  it. Read through `structNamed`, which is how two spellings of one struct are told to be one:
    *  `typedef struct Q {…} Q;` spells the struct `Q`, `struct Q` and every other alias of it. */
   structTypes: ReadonlyMap<string, string>;
+  /** The storage each object of `declared` that is no aggregate and no function is declared with,
+   *  its typedefs resolved (`declaredWidth`, `declaredSigned`): `extern s32 gN;` is a four-byte
+   *  signed integer, `extern u8 *gP;` a four-byte one whose sign nothing reads, `extern float gF;`
+   *  a four-byte float. A bare name reads and writes exactly this, so the structurer spells a
+   *  global bare only where its one access agrees (structure.ts, the declaration-shape override): a
+   *  byte read of `gN` is `*(u8 *)&gN`, never `gN`, and so is a halfword read of `gF`, which
+   *  reinterprets the bytes where the bare name would convert them. A type this cannot read — a
+   *  typedef carrying an attribute, an unexpanded macro, a name it never saw — is `unread`, which
+   *  agrees with no access: the cast states the access whatever the declaration is. A pointer
+   *  behind an attributed typedef is still read as one (`writtenDerivation`). A C++ reference is
+   *  a `reference`, whose cell no spelling names, so the structurer declines a function that
+   *  touches it. */
+  storage: ReadonlyMap<string, DeclaredStorage>;
 }
 
+/** What one declared object that is no aggregate occupies ({@link ContextGlobals.storage}). */
+export type DeclaredStorage =
+  /** an integer or a pointer of `bytes` bytes; `signed` says whether a read sign-extends it, `char`
+   *  for a plain `char`, whose sign is the compiler's (`compilerBehaviors.plainCharSigned`), and
+   *  undefined where nothing reads it (a pointer). A declaration with no type specifier at all
+   *  (`extern gN;`, C89's implicit `int`) is an `int`. */
+  | { kind: 'integer'; bytes: number; signed: boolean | 'char' | undefined }
+  /** an enum, whose size is the compiler's (`compilerBehaviors.enumBytes`), unless `unsized`: one
+   *  `packed` or holding a value an int cannot (`TypeTable.unsizedEnums`) is no size this knows */
+  | { kind: 'enum'; unsized: boolean }
+  /** a `float` (4 bytes) or a `double` (8) */
+  | { kind: 'float'; bytes: number }
+  /** a C++ reference (`extern int &gRef;`): the symbol is a cell holding the referent's address,
+   *  which no C++ spelling names — `gRef` and `&gRef` both name the referent */
+  | { kind: 'reference' }
+  /** a type this cannot read */
+  | { kind: 'unread' };
+
 /** The struct or union `spelling` names, qualifiers aside, by the identity `structTypes` keys it
  *  under: `struct Tag` as written, or what a typedef name stands for. Undefined for any other
  *  spelling, and for a name the context does not resolve to one — which then names no struct this
@@ -142,10 +174,20 @@ export function globalsFromContext(src: string, language: Language): ContextGlob
   const pointeeVolatiles = new Set<string>();
   const declared = new Set<string>();
   const objectTypes = new Map<string, string>();
+  const storage = new Map<string, DeclaredStorage>();
   for (const d of ctx.declarations) {
     if (d.specifiers.typedef || d.body !== undefined) {
       continue;
     }
+    const implicit = language === 'c' ? implicitIntObject(d, table) : undefined;
+    if (implicit !== undefined) {
+      declared.add(implicit);
+      objectTypes.set(implicit, 'int');
+      storage.set(implicit, { kind: 'integer', bytes: 4, signed: true });
+      if (d.specifiers.qualifiers.includes('volatile')) {
+        volatiles.add(implicit);
+      }
+    }
     for (const x of d.declarators) {
       if (x.name === undefined || !WORD.test(x.name)) {
         continue;
@@ -159,6 +201,8 @@ export function globalsFromContext(src: string, language: Language): ContextGlob
       }
       if (isAggregate(t, table, scope.typedefs)) {
         aggregates.add(x.name);
+      } else if (t.derivations[0]?.kind !== 'function') {
+        storage.set(x.name, declaredStorage(t, table, scope.typedefs, ctx.tokens));
       }
       if (hasVolatileStorage(t, scope, 0)) {
         volatiles.add(x.name);
@@ -179,7 +223,97 @@ export function globalsFromContext(src: string, language: Language): ContextGlob
       structTypes.set(name, named);
     }
   }
-  return { aggregates, volatiles, pointeeVolatiles, declared, objectTypes, structTypes };
+  return { aggregates, volatiles, pointeeVolatiles, declared, objectTypes, structTypes, storage };
+}
+
+/** The object a C declaration with a storage class and no type specifier declares, C89's implicit
+ *  `int`: `extern gN;` reads as the type name `gN` with no declarator, since the parser cannot tell
+ *  a name from an unknown type with nothing after it. Only a lone word that names no type the
+ *  context declares and no base type is one. */
+function implicitIntObject(d: Declaration, table: TypeTable): string | undefined {
+  const { storage, type, unknownWords } = d.specifiers;
+  if (d.declarators.length > 0 || unknownWords.length > 0 || type.kind !== 'words' || type.words.length !== 1) {
+    return undefined;
+  }
+  const [w] = type.words;
+  const named =
+    !WORD.test(w) ||
+    table.typedefs.has(w) ||
+    table.enums.has(w) ||
+    table.named.has(w) ||
+    declaredWidth(w) !== undefined ||
+    ['void', 'float', 'double', '_Bool'].includes(w);
+  return !named && (storage.includes('extern') || storage.includes('static')) ? w : undefined;
+}
+
+/** The storage an object of type `t`, no aggregate and no function, is declared with
+ *  ({@link DeclaredStorage}). `written` is every typedef as written, an attributed one included
+ *  (`typedefTypes`), which `writtenDerivation` reads past. */
+function declaredStorage(
+  t: DeclaredType,
+  table: TypeTable,
+  written: ReadonlyMap<string, DeclaredType>,
+  tokens: Tokens,
+): DeclaredStorage {
+  const [first] = t.derivations;
+  if (first?.kind === 'reference') {
+    return { kind: 'reference' };
+  }
+  if (first !== undefined && !isPointer(first)) {
+    return { kind: 'unread' };
+  }
+  const r = resolve(t, table.typedefs, tokens);
+  // the derivation the type reaches, through a typedef the table does not read too
+  const behind = r.derivations[0] ?? writtenDerivation(r, written);
+  if (behind?.kind === 'reference') {
+    return { kind: 'reference' };
+  }
+  const spelled = spellType(r, tokens);
+  const bare = spelled
+    .replace(/\b(?:const|volatile)\b/g, ' ')
+    .trim()
+    .replace(/\s+/g, ' ');
+  const bits = declaredWidth(bare === '' ? 'int' : spelled);
+  if (bits !== undefined) {
+    const signed = bare === 'char' ? 'char' : declaredSigned(bare === '' ? 'int' : spelled);
+    return { kind: 'integer', bytes: bits / 8, signed };
+  }
+  if (r.derivations.length > 0) {
+    return { kind: 'unread' };
+  }
+  if (bare === 'float' || bare === 'double') {
+    return { kind: 'float', bytes: bare === 'float' ? 4 : 8 };
+  }
+  if (table.enums.has(bare) || (r.type.kind === 'tag' && r.type.keyword === 'enum')) {
+    return { kind: 'enum', unsized: table.unsizedEnums.has(bare) };
+  }
+  // A pointer behind a typedef that carries an attribute (`typedef u8 *P8
+  // __attribute__((aligned(4)));`), which the table leaves unread because the attribute may retype
+  // it (`realigns`). No attribute changes a pointer's width on these 32-bit targets — `aligned` and
+  // `__declspec(align)` move its alignment alone, and `mode` takes no pointer mode but the 4-byte
+  // one — so it is a 4-byte pointer, read and written bare as a word. Read `unread`, that word is
+  // cast to an integer, which mwcc refuses wherever it flows into a pointer (`gQ = *(s32 *)&gP;`).
+  return behind !== undefined && isPointer(behind)
+    ? { kind: 'integer', bytes: 4, signed: undefined }
+    : { kind: 'unread' };
+}
+
+/** The first derivation a type with none of its own reaches through the typedefs as written
+ *  (`typedefTypes`), an attributed one and a reference the type table does not read included:
+ *  `P8` over `typedef u8 *P8 __attribute__((aligned(4)));` is a pointer, `IR` over
+ *  `typedef int &IR;` a reference. Undefined where the chain ends at a base type or a name it
+ *  never saw. */
+function writtenDerivation(t: DeclaredType, written: ReadonlyMap<string, DeclaredType>): Derivation | undefined {
+  let cur = t;
+  for (let hops = 0; hops < 16 && cur.derivations.length === 0; hops++) {
+    const name = nameOf(cur);
+    const next = name === undefined ? undefined : written.get(name);
+    if (next === undefined || nameOf(next) === name) {
+      return undefined;
+    }
+    cur = next;
+  }
+  return cur.derivations[0];
 }
 
 /** The struct or union the typedef `name` stands for (`ContextGlobals.structTypes`): its tag where

package/src/raise/const.ts

@@ -72,6 +72,31 @@ export function foldConstPair(opcode: string, a: number, b: number): number | nu
   return f ? f(a, b) : null;
 }
 
+/** Integer opcodes whose const/const form a test can be read on, as int32: `foldConstPair`'s `add`
+ *  and `or`, the rest of the arithmetic and the comparisons. `null` for any other opcode. Shared by
+ *  the reroll's folded top test (`restoreTopTest`) and the `for` whose first test the compiler
+ *  folded away (structure.ts, `forPlanAt`): which opcodes a test folds through is one decision. */
+const EVAL: Readonly<Record<string, (a: number, b: number) => number>> = {
+  add: (a, b) => foldConstPair('add', a, b)!,
+  or: (a, b) => foldConstPair('or', a, b)!,
+  sub: (a, b) => (a - b) | 0,
+  and: (a, b) => a & b,
+  xor: (a, b) => a ^ b,
+  icmp_eq: (a, b) => +(a === b),
+  icmp_ne: (a, b) => +(a !== b),
+  icmp_slt: (a, b) => +(a < b),
+  icmp_sle: (a, b) => +(a <= b),
+  icmp_sgt: (a, b) => +(a > b),
+  icmp_sge: (a, b) => +(a >= b),
+  icmp_ult: (a, b) => +(a >>> 0 < b >>> 0),
+  icmp_ule: (a, b) => +(a >>> 0 <= b >>> 0),
+  icmp_ugt: (a, b) => +(a >>> 0 > b >>> 0),
+  icmp_uge: (a, b) => +(a >>> 0 >= b >>> 0),
+};
+export const evalIntPair = (opcode: string, a: number, b: number): number | null =>
+  opcode in EVAL ? EVAL[opcode](a, b) : null;
+export const isIntPairOpcode = (opcode: string): boolean => opcode in EVAL;
+
 /** Does this opcode's const/const form denote a constant? The membership half of `foldConstPair`,
  *  for callers that must classify an op before they have its operands' values. */
 export const isConstFoldOpcode = (opcode: string): boolean => opcode in FOLD;

package/src/raise/declared-volatile.ts

@@ -84,7 +84,7 @@ function addressThroughJoins(fn: Fn): (v: Value) => Value {
 }
 
 /** Every block parameter's incoming values, one per in-edge (the entry block's excepted). */
-function joinIncoming(fn: Fn): Map<Value, Value[]> {
+export function joinIncoming(fn: Fn): Map<Value, Value[]> {
   const incoming = new Map<Value, Value[]>();
   for (const b of fn.blocks) {
     for (const op of b.ops) {

package/src/raise/divpow2.ts

@@ -40,6 +40,11 @@
 // `2^k - 1` for the SAME k the shift uses, the guard must test the SAME value the arms divide, and
 // the biased arm must be the negative one — the consistency check m2c's `49b5d87` also adds),
 // because every one of those is a way for a superficially similar diamond to mean something else.
+//
+// ir/bits.ts `integerRange` (its `remainderPair`) reads the same SUNK diamond under a remainder,
+// `x - (phi >> k << k)`, as one bounded term. It cannot wait for this pass's `sdiv`: the frontends'
+// frame audit asks those ranges before runPreRecovery runs; and as a bound, not a rewrite, it holds
+// for any bias in [0, 2^k) on any edge, so it does not take this pass's gates.
 import { Block, Fn, Op, Value, defOpMap, mkOp, mkValue, predecessors, replaceAllUsesWith } from '../ir/core';
 import { effectful } from '../ir/discipline';
 import { T } from '../ir/types';
@@ -225,3 +230,190 @@ export function recognizeDivPow2(fn: Fn): boolean {
   }
   return changed;
 }
+
+// ── the signed REMAINDER by a power of two, in IDO's branching form ─────────────────────────
+//
+// `x % 2^k` truncates toward zero, so a negative x with low bits set takes `2^k` off its masked
+// value. IDO masks first and corrects on a two-test branch (modpow2, `a % 16`):
+//
+//	bgez	a0, .L       ; x >= 0: the mask is the remainder
+//	andi	v0, a0, 15   ; (delay slot: runs on both paths)
+//	beqz	v0, .L       ; low bits clear: so is it
+//	nop
+//	addiu	v0, v0, -16  ; else take 2^k off
+//     .L:
+//
+// Two heads and a correction arm reach one merge, so — like the quotient above — it is a shape in
+// the control flow, out of the idiom patterns' reach. Lifted as written it is spelled
+// `if (x < 0 && (x & 15) != 0) v = (x & 15) + -16; else v = x & 15;`, which IDO compiles to other
+// code; `x % 16` compiles back to this diamond. The identity is exact for every signed x — the
+// diamond IS C's `%` — and the round trip is self-verifying for the reason the quotient's is.
+//
+// IDENTITY-OR-DECLINE again: the mask must be exactly `2^k - 1` of the dividend the first test
+// compares against zero, the second test must compare THAT mask against zero, the correction must
+// be exactly `mask - 2^k` (`correctedMask`), and the corrected value must reach the merge only from the arm
+// both tests failed into. The two inner blocks are deleted, so neither may do anything else.
+// agbcc, gcc and kmc COMPILE `%` as a biased floor (`x - (t >> k << k)`), which ir/bits.ts
+// `remainderPair` bounds and this does not touch; mwcc's is branch-free.
+//
+// THE PASS IS NOT GATED BY TARGET: a HAND-WRITTEN diamond of this shape on any compiler is folded
+// to `%` too (agbcc compiles `r = i & 15; if (i < 0 && r != 0) r -= 16;` to the same two-test
+// diamond, which lifts `i % 16`). The identity holds whatever wrote it, so the C is the same value;
+// whether `%` recompiles to the target's bytes there is the bench's question, not this pass's.
+
+/** `and x, const(2^k - 1)` → { x, k }, else null. The and is commutative. */
+function maskOf(defs: Map<Value, Op>, v: Value): { x: Value; k: number } | null {
+  const d = defs.get(v);
+  if (!d || d.opcode !== 'and' || d.operands.length !== 2) {
+    return null;
+  }
+  for (const [a, b] of [
+    [0, 1],
+    [1, 0],
+  ] as const) {
+    const c = defs.get(d.operands[b]);
+    const m = c?.opcode === 'const' ? (c.attrs.value as number) : undefined;
+    if (m !== undefined && m > 0 && (m & (m + 1)) === 0) {
+      return { x: d.operands[a], k: Math.log2(m + 1) };
+    }
+  }
+  return null;
+}
+
+/** The correction arm's value, `mask - 2^k` for the mask's own k, in either spelling the IR carries
+ *  it: an `add` of the constant `-2^k` (IDO's `addiu v0, v0, -2^k`, where it fits an immediate:
+ *  k < 16), or a `sub` of the constant `2^k` (k >= 16, where IDO materialises `2^k` as the mask's
+ *  register plus one in the second test's delay slot, `addiu at, at, 1; subu v0, v0, at`, which
+ *  the constant fold has made `2^k` by now). The identity is the subtraction, not its encoding. */
+function correctedMask(defs: Map<Value, Op>, v: Value): { t: Value; mk: { x: Value; k: number } } | null {
+  const u = defs.get(v);
+  if ((u?.opcode !== 'add' && u?.opcode !== 'sub') || u.operands.length !== 2) {
+    return null;
+  }
+  // a sub's minuend is its first operand; an add's mask may stand on either side
+  const orders =
+    u.opcode === 'sub'
+      ? ([[0, 1]] as const)
+      : ([
+          [0, 1],
+          [1, 0],
+        ] as const);
+  for (const [a, b] of orders) {
+    const c = defs.get(u.operands[b]);
+    const mk = maskOf(defs, u.operands[a]);
+    const want = u.opcode === 'sub' ? 2 ** (mk?.k ?? 0) : -(2 ** (mk?.k ?? 0));
+    if (c?.opcode === 'const' && mk !== null && c.attrs.value === want) {
+      return { t: u.operands[a], mk };
+    }
+  }
+  return null;
+}
+
+/** `icmp <op> v, const 0` → the compare's opcode, else null. */
+function zeroTest(defs: Map<Value, Op>, c: Value, v: Value): string | null {
+  const d = defs.get(c);
+  if (!d || d.operands.length !== 2 || d.operands[0] !== v) {
+    return null;
+  }
+  const z = defs.get(d.operands[1]);
+  return z?.opcode === 'const' && z.attrs.value === 0 ? d.opcode : null;
+}
+
+/**
+ * Fold IDO's branching signed-remainder-by-2^k diamond into `smod x, 2^k`. Returns true if the IR
+ * changed. Leaves the mask, the compares and the correction behind for the driver's DCE.
+ */
+export function recognizeSremPow2(fn: Fn): boolean {
+  let changed = false;
+  let progress = true;
+  while (progress) {
+    progress = false;
+    const defs = defOpMap(fn);
+    const preds = predecessors(fn);
+    const term = (b: Block) => b.ops[b.ops.length - 1];
+    // a result of `blocks`' ops read anywhere outside them, which deleting them would orphan
+    const escapes = (blocks: Block[]): boolean => {
+      const inside = new Set(blocks.flatMap((b) => b.ops.flatMap((op) => op.results)));
+      return fn.blocks
+        .filter((b) => !blocks.includes(b))
+        .some((b) =>
+          b.ops.some(
+            (op) =>
+              op.operands.some((v) => inside.has(v)) || op.successors.some((s) => s.args.some((v) => inside.has(v))),
+          ),
+        );
+    };
+    outer: for (const m of fn.blocks) {
+      // the merge holds the remainder alone and is reached by exactly the diamond's three edges
+      // (the entry block has an invisible edge; see recognizeDivPow2)
+      const mp = preds.get(m) ?? [];
+      if (m.params.length !== 1 || mp.length !== 3 || new Set(mp).size !== 3 || m === fn.blocks[0]) {
+        continue;
+      }
+      for (const fix of mp) {
+        // the CORRECTION arm: `mask - 2^k` to the merge, from the second test alone, nothing else
+        const ft = term(fix);
+        if (ft.opcode !== 'br' || ft.successors[0]?.block !== m || fix === fn.blocks[0] || fix.ops.some(effectful)) {
+          continue;
+        }
+        const n = preds.get(fix) ?? [];
+        if (n.length !== 1 || !mp.includes(n[0]) || n[0] === fn.blocks[0]) {
+          continue;
+        }
+        const inner = n[0];
+        const it = term(inner);
+        const hp = preds.get(inner) ?? [];
+        if (it.opcode !== 'cond_br' || hp.length !== 1 || !mp.includes(hp[0]) || inner.ops.some(effectful)) {
+          continue;
+        }
+        const head = hp[0];
+        const ht = term(head);
+        if (ht.opcode !== 'cond_br' || head === m || head === fix) {
+          continue;
+        }
+        // the corrected value: the mask less `2^k`
+        const corrected = correctedMask(defs, ft.successors[0].args[0]);
+        if (corrected === null || corrected.mk.k < 1 || corrected.mk.k > 30) {
+          continue;
+        }
+        const { t, mk } = corrected;
+        // the first test: x >= 0 to the merge with the mask, else on to the second
+        const [hTaken, hFall] = ht.successors;
+        const hFirst = zeroTest(defs, ht.operands[0], mk.x);
+        const hm = hFirst === 'icmp_sge' ? hTaken : hFirst === 'icmp_slt' ? hFall : null;
+        const hn = hFirst === 'icmp_sge' ? hFall : hFirst === 'icmp_slt' ? hTaken : null;
+        if (hm?.block !== m || hn?.block !== inner || hm.args[0] !== t || hn.args.length !== 0) {
+          continue;
+        }
+        // the second test: the mask == 0 to the merge with the mask, else to the correction
+        const [iTaken, iFall] = it.successors;
+        const iSecond = zeroTest(defs, it.operands[0], t);
+        const im = iSecond === 'icmp_eq' ? iTaken : iSecond === 'icmp_ne' ? iFall : null;
+        const ifx = iSecond === 'icmp_eq' ? iFall : iSecond === 'icmp_ne' ? iTaken : null;
+        if (im?.block !== m || ifx?.block !== fix || im.args[0] !== t || ifx.args.length !== 0) {
+          continue;
+        }
+        if (escapes([inner, fix])) {
+          continue;
+        }
+        // Rewrite: the head computes the remainder and goes straight to the merge.
+        const by = mkValue(T.s());
+        const r = mkValue(T.s());
+        head.ops.splice(
+          head.ops.length - 1,
+          0,
+          mkOp('const', { results: [by], attrs: { value: 2 ** mk.k } }),
+          mkOp('smod', { operands: [mk.x, by], results: [r] }),
+        );
+        head.ops[head.ops.length - 1] = mkOp('br', { successors: [{ block: m, args: [] }] });
+        replaceAllUsesWith(fn, m.params[0], r);
+        m.params = [];
+        fn.blocks = fn.blocks.filter((b) => b !== inner && b !== fix);
+        changed = true;
+        progress = true;
+        break outer;
+      }
+    }
+  }
+  return changed;
+}