@asmlift/core 0.10.0 → 0.11.0

package/src/frontend/call-plan.ts

@@ -49,6 +49,7 @@ import { type ContextGlobals, structNamed } from '../proto-context';
 import { floatSidesOf, helperPrototypes, isFloatHelper, isWideHelper, lookupHelper } from '../runtime-helpers';
 import { type SymbolMap, symbolsByName } from '../symbols';
 import { type TargetDescription, argRegisterHoles } from '../target';
+import { type CalleeBodyBound, asksCalleeBody } from './callee-body';
 import { type FrontendRefusal, FrontendUnsupportedError } from './errors';
 import { type OwnDeclaration, ownDeclarationOf } from './frontend';
 import type { HighHalves } from './high-half';
@@ -193,6 +194,10 @@ export interface CallSite {
   write(reg: string, v: Value): void;
   /** argument word `k` past the registers, where this ABI places it (`CallLowering.stackArgs`) */
   stackWord?(k: number): Value;
+  /** the stack words the frontend licensed for a call nothing declares, off its callee's body
+   *  (frontend/stackargs.ts `StackArgsCall.bodyReads`): the call then takes every argument register
+   *  and these words, and its arity is no guess. Absent or 0 where none was licensed. */
+  readonly stackWords?: number;
   /** how this frontend builds and splits a pair (`CallLowering.pairs`) */
   readonly pairs?: CallPairs;
   /** what this frontend defines registers with that is no value and so no argument — a pending
@@ -260,14 +265,24 @@ export function callDeclarations(
   fail: FrontendRefusal,
   /** the function's own declaration, where one binds its body — asked as a call is lowered */
   ownDeclaration: () => OwnDeclaration | undefined = () => ownDeclarationOf(name, prototypes, undefined),
+  /** the argument words a callee's own body reads at most, where it is in the input
+   *  (frontend/callee-body.ts) — asked of a named call no declaration lays out */
+  calleeBodyBound?: CalleeBodyBound,
+  /** the callees taken at every argument register that may still hold its entry value
+   *  (`LiftOptions.entryReadCalls`) */
+  entryReadCalls?: ReadonlySet<string>,
+  /** told of each call laid out at the stack words its callee's body loads (`LiftOptions.stackSized`) */
+  stackSized?: (callee: string, words: number) => void,
 ): CallDeclarations {
   // What a call leaves holding nothing this function can name — checked against `argRegs` there.
   const callClobbers = clobberedByCall(target);
   // `refuseDispatchUnlockedPassThrough`'s two facts, gathered as each call is lowered: whether a
-  // dispatch's marker reached a guessed call's argument registers, and the first guessed count
-  // the bytes cannot tell from another, as its refusal
+  // dispatch's marker reached a guessed call's argument registers, and every guessed count the
+  // bytes cannot tell from another, in the order they were lowered, each with its refusal. `unread`
+  // says the register lies past what the callee's own body reads (frontend/callee-body.ts), which
+  // excuses it: asked only as the gate would refuse, so no body is lifted where it would not.
   let parkedInArgs = false;
-  let passThrough: { call: string; reg: string; why: string } | undefined;
+  const passThrough: Array<{ call: string; reg: string; why: string; unread: () => boolean }> = [];
   // …and what a call to a PAIR-RETURNING helper leaves: the same set minus the high half, because
   // the low half is the return register (already excluded) and `lower` writes the high one itself
   // from the callee's own result. The two arms of one rule: where the callee hands a register back,
@@ -783,7 +798,8 @@ export function callDeclarations(
     if (target.compilerBehaviors.keepsUnusedReads === true || !ssa.writtenSinceCall(set, bi)) {
       return undefined;
     }
-    const v = ssa.readVar(set, bi);
+    // a lookup, not the frontend's read: `leftover` asks what instructions read (`readAfterEveryReachingWrite`)
+    const v = ssa.readGuessedArg(set, bi);
     const def = ssa.irBlocks[bi].ops.find((op) => op.results.includes(v));
     const sig = def === undefined ? undefined : (OPCODES[def.opcode as keyof typeof OPCODES] as OpSig | undefined);
     const readsRefuse = target.compilerBehaviors.discardedReadMayFillArgRegister !== false;
@@ -914,9 +930,144 @@ export function callDeclarations(
     // A DECLARATION HOLDING A SPELLING NOTHING CAN SIZE STATES NO LAYOUT (`proto.ts`
     // `declaredCallArgs`), so `widths` is null for it and this falls to the guess below —
     // the same answer the callee would get with no prototype at all.
-    const { widths, returns } = p;
     // the leading arguments a variadic declaration states, where the rest is guessed
-    const floor = widths === null ? variadicFloor(callee) : 0;
+    const floor = p.widths === null ? variadicFloor(callee) : 0;
+    // WHAT THE CALLEE'S OWN BODY READS, where it is in the input and nothing lays the call out
+    // (frontend/callee-body.ts): at most `bodyWords()` argument words. It answers only a refusal
+    // about registers at or past it — the gap rule's (`fallbackArgc`'s `bound`) and the dispatch
+    // pass-through gate's — since whether those are arguments changes nothing the callee computes.
+    // It never caps the count: it bounds what the callee READS, and a source call passes more
+    // whenever a parameter goes unused or a K&R call hands extra arguments, so a register the caller
+    // set up for the call stays an argument (`tick(5)` to a body that reads none, `rd1(a, b, 7)` to
+    // one that reads r0, whose 7 also proves r0 is the caller's own a passed on). Asked lazily, as a
+    // refusal would fire, so a call no gate questions lifts no body. Only a callee whose entry
+    // states no parameter list is asked: a list nothing here can size, or a variadic one, still
+    // states parameters the call must be handed (`refuseShortOfDeclared`).
+    const stated = callee === undefined ? undefined : known(prototypes, callee);
+    const unstated = callee !== undefined && p.widths === null && asksCalleeBody(stated);
+    let bodyMemo: { words: number | undefined } | undefined;
+    const bodyWords = (): number | undefined =>
+      unstated ? (bodyMemo ??= { words: calleeBodyBound?.(callee!) }).words : undefined;
+    // whether an op lowered so far reads `v`: the call being lowered is not one yet
+    const reads = (o: Op, v: Value): boolean => o.operands.includes(v) || o.successors.some((e) => e.args.includes(v));
+    const readSoFar = (v: Value): boolean => ssa.irBlocks.some((b) => b.ops.some((o) => reads(o, v)));
+    // the function's own incoming value of argument register `r`
+    const incoming = (v: Value, r: string): boolean => ssa.paramReg.get(v) === r && ssa.irBlocks[0].params.includes(v);
+    // WHETHER WHAT ARGUMENT REGISTER `r` HOLDS WAS LEFT THERE BY A WRITE MADE FOR SOMETHING ELSE: a
+    // question about the register's last WRITE, not about its value. `mov r0, #5; strh r0, [r1];
+    // bl rnd` left the store's 5 in r0; `add r1, r5, #0; bl un` is a copy made for the call, though
+    // an earlier call read its value (`g4(a, b, c, d); un(a, b, c, d)`: agbcc and mwcc copy them back
+    // from callee-saved homes). A copy names no new value, so no value-level question tells them apart.
+    //
+    // WHAT READ COUNTS DEPENDS ON WHERE THE WRITE WAS, because a read that lowers to nothing — a copy
+    // into a callee-saved register, a store to a frame home — SAVES a value across the call, and a
+    // saved value may be handed to the call as well:
+    //   - the call's own block wrote it, or nothing in this function did (the incoming value): only a
+    //     lowered op's read since. `un(a); return g2(a);` and `un(); return g2(a);` compile to the
+    //     same caller bytes on agbcc, IDO, gcc 2.7.2, KMC and mwcc (agbcc `add r4, r0, #0; bl un`).
+    //   - another block wrote it: a lowered op's read in the call's block, or a read after EACH write
+    //     that reaches the call, a save included, on ANY path out of it but the ones into the call
+    //     (`SsaBuilder.readAfterEveryReachingWrite`). agbcc's case CSE moves the cases' `i << 3` from
+    //     r0 to r4 at their join (`add r4, r0, #0`) before the call's join, while a value handed to
+    //     the call is copied back for it in the call's block (`add r0, r4, #0; bl rnd`, measured).
+    //     EACH write, because one no read follows was made for the call (`if (c) { t = d + 3; gX = t;
+    //     } else t = d - 9; rnd(t);` at IDO stores one arm's a0). ANY path, because gcc 2.7.2 and KMC
+    //     fill a branch's delay slot with one call's argument (`bnez v0, L; move a0, zero; jal cr`),
+    //     and the 0 reaches `L: jal stat` unread. NOT the call's own block's saves: IDO saves the
+    //     argument it hands a call in the jal's delay slot (`jal rnd; sw a0, 28(sp)`, measured) and
+    //     computes t into v1 where rnd is handed nothing, so that save is evidence FOR the argument.
+    //     An earlier call's result is no such write (sa3 Task_274_8056314: `strb r0` of one arm's
+    //     value, `bl sub_8056408` in the other, then `bl Task_274_8054E38`, whose source takes nothing).
+    const leftover = (r: string): boolean => {
+      const at = ssa.lastWriteOp(r, bi);
+      if (at !== undefined) {
+        const since = ssa.irBlocks[bi].ops.slice(at);
+        return ssa.holdsValue(r, bi, (v) => mayPass(v, r) && since.some((o) => reads(o, v)));
+      }
+      if (ssa.holdsValue(r, bi, (v) => mayPass(v, r) && ssa.irBlocks[bi].ops.some((o) => reads(o, v)))) {
+        return true;
+      }
+      const callResult = (v: Value): boolean =>
+        ssa.irBlocks.some((b) => b.ops.some((o) => o.opcode === 'call' && o.results.includes(v)));
+      // the values a join's phi of `v` merges, through phis of phis, or `undefined` where an edge
+      // into one is not lowered yet
+      const merged = (v: Value, seen = new Set<Value>()): Value[] | undefined => {
+        const at = ssa.irBlocks.find((b) => b.params.includes(v));
+        if (at === undefined) {
+          return [v];
+        }
+        if (seen.has(v)) {
+          return [];
+        }
+        seen.add(v);
+        const k = at.params.indexOf(v);
+        const edges = ssa.irBlocks.flatMap((b) => b.ops.flatMap((o) => o.successors.filter((e) => e.block === at)));
+        const out: Value[] = [];
+        for (const e of edges) {
+          const sub = e.args[k] === undefined ? undefined : merged(e.args[k], seen);
+          if (sub === undefined) {
+            return undefined;
+          }
+          out.push(...sub);
+        }
+        return edges.length > 0 ? out : undefined;
+      };
+      // an earlier call's result on every path in: a join's phi of copies of one (IDO's `move a3,
+      // v0` in a branch's delay slot meets the path that skips the store between)
+      const resultOnEveryPath = (v: Value): boolean => {
+        const vs = merged(v);
+        return vs !== undefined && vs.length > 0 && vs.every(callResult);
+      };
+      return (
+        ssa.readAfterEveryReachingWrite(r, bi, {
+          // an earlier call's result where that call left it is no write this function made, for this
+          // call or another
+          passes: (v) => mayPass(v, r) && !(r === target.returnReg && callResult(v)),
+          accept: (v) => mayPass(v, r) && (!incoming(v, r) || readSoFar(v)),
+          // a path into a block not lowered yet: what its value answers, as the base question did
+          unlowered: (v) => readSoFar(v),
+          // a copy of an earlier call's result into another register, or a reload of one, answers
+          // only where read after: `bl gets; add r1, r0, #0` and `jal gets; move a1, v0` were, by the
+          // loop's loads, while IDO's `lw a3, 28(sp)` of a result saved across a call (af
+          // mCPk_PakPrivateLoad) was not, and says nothing
+          answersIfRead: (v) => resultOnEveryPath(v),
+        }) ??
+        // nothing written here left to judge: what reaches answers by its value, the base question,
+        // a join's phi by the values it merges (af mCPk_PakPrivateLoad compares the result it keeps)
+        ssa.holdsValue(r, bi, (v) => mayPass(v, r) && (readSoFar(v) || (merged(v) ?? []).some(readSoFar)))
+      );
+    };
+    const unreadByBody = (r: string): boolean => {
+      const words = bodyWords();
+      return words !== undefined && target.argRegs.indexOf(r) >= words;
+    };
+    // A CALL THE BODY BOUND READS AT EVERY INCOMING VALUE IT MAY BE HANDED (`entryReadCalls`): up to
+    // the highest argument register that some path into the call leaves unwritten since the entry.
+    // A register a call destroyed on every path holds nothing of this function's arguments, so a
+    // read of it could add nothing to what the body reads of them, and it is not taken: taken, a
+    // callee making two calls that nothing declares would refuse its own lift, and lose its bound.
+    const entryWords =
+      unstated && entryReadCalls?.has(callee!) === true
+        ? target.argRegs.reduce((n, r, k) => (ssa.writtenOnEveryPath(r, bi, () => false) ? n : k + 1), 0)
+        : undefined;
+    // A STACK BLOCK THE CALLEE'S BODY LICENSED states the arity outright: arguments past the
+    // registers are staged only once every register is one, so the call takes all of them and the
+    // block, one word each — what a count of that many words in a prototype would state. That holds
+    // as stated on an ABI that never skips an argument register (agbcc's APCS). One that does
+    // (`evenWordAlignedArgs`: O32 leaves a3 empty before a `long long` passed at 16(sp)) licenses a
+    // block only where the frontend saw the call write every register and the callee's lift read
+    // each (frontend/mips.ts `licensedStackWords`, frontend/callee-body.ts `readsEveryArgReg`).
+    const licensed = unstated && (site.stackWords ?? 0) > 0 ? target.argRegs.length + site.stackWords! : undefined;
+    if (licensed !== undefined) {
+      stackSized?.(callee!, site.stackWords!);
+    }
+    const widths =
+      licensed !== undefined
+        ? Array.from({ length: licensed }, () => 32)
+        : entryWords !== undefined
+          ? Array.from({ length: entryWords }, () => 32)
+          : p.widths;
+    const { returns } = p;
     // the gaps `decideGap` decided: the value that proved each, and the gap's own refusal, owed if
     // that proof fails once the function is lifted
     const decided: Array<{ value: Value; refuse: () => void }> = [];
@@ -929,6 +1080,8 @@ export function callDeclarations(
       widths === null
         ? fallbackArgc(ssa, target.argRegs, bi, {
             accept: mayPass,
+            bound: bodyWords,
+            leftover,
             gap: { name, at: guess.at, fail },
             floor,
             parked: (r) =>
@@ -983,41 +1136,35 @@ export function callDeclarations(
           ssa.hasReachingDef(r, bi, (v) => site.parked?.(v, r) === true || site.scaledIndex?.(v, r) === true),
       );
       parkedInArgs ||= markedAt >= 0;
-      if (passThrough === undefined) {
-        const call = typeof guess.at === 'number' ? `at 0x${guess.at.toString(16)}` : guess.at;
-        const last = target.argRegs[argc - 1];
-        // the blocks since the dispatch on the way to the call: a path stops at a `switch_br`'s block
-        const since = new Set<number>([bi]);
-        const dispatch = (at: number) => ssa.irBlocks[at].ops.some((op) => op.opcode === 'switch_br');
-        const lastWritten = argc <= floor || ssa.writtenOnEveryPath(last, bi, dispatch, (at) => since.add(at));
-        // what an effect those blocks made so far reads
-        const effectReads = new Set(
-          [...since].flatMap((at) =>
-            ssa.irBlocks[at].ops.flatMap((op) =>
-              (OPCODES[op.opcode as keyof typeof OPCODES] as OpSig | undefined)?.effects ? op.operands : [],
-            ),
+      const call = typeof guess.at === 'number' ? `at 0x${guess.at.toString(16)}` : guess.at;
+      const last = target.argRegs[argc - 1];
+      // the blocks since the dispatch on the way to the call: a path stops at a `switch_br`'s block
+      const since = new Set<number>([bi]);
+      const dispatch = (at: number) => ssa.irBlocks[at].ops.some((op) => op.opcode === 'switch_br');
+      const lastWritten = argc <= floor || ssa.writtenOnEveryPath(last, bi, dispatch, (at) => since.add(at));
+      // what an effect those blocks made so far reads
+      const effectReads = new Set(
+        [...since].flatMap((at) =>
+          ssa.irBlocks[at].ops.flatMap((op) =>
+            (OPCODES[op.opcode as keyof typeof OPCODES] as OpSig | undefined)?.effects ? op.operands : [],
           ),
-        );
-        const stored = target.argRegs
-          .slice(floor, argc)
-          .find((r) => ssa.holdsValue(r, bi, (v) => mayPass(v, r) && effectReads.has(v)));
-        const leftIncoming =
-          markedAt < 0 ? undefined : target.argRegs.slice(argc, markedAt).find((r) => ssa.holdsEntryValue(r, bi));
-        if (!lastWritten) {
-          passThrough = {
-            call,
-            reg: last,
-            why: 'the last register the count takes, holds a value some path since the dispatch did not write',
-          };
-        } else if (stored !== undefined) {
-          passThrough = { call, reg: stored, why: 'which the count takes, holds a value an effect of its block uses' };
-        } else if (leftIncoming !== undefined) {
-          passThrough = {
-            call,
-            reg: leftIncoming,
-            why: "which the count leaves out below a dispatch's register, holds its incoming value",
-          };
-        }
+        ),
+      );
+      const stored = target.argRegs
+        .slice(floor, argc)
+        .find((r) => ssa.holdsValue(r, bi, (v) => mayPass(v, r) && effectReads.has(v)));
+      const leftIncoming =
+        markedAt < 0 ? undefined : target.argRegs.slice(argc, markedAt).find((r) => ssa.holdsEntryValue(r, bi));
+      // each the lowest register of its kind, so one past the body's bound has none below it
+      const open = (reg: string, why: string) => passThrough.push({ call, reg, why, unread: () => unreadByBody(reg) });
+      if (!lastWritten) {
+        open(last, 'the last register the count takes, holds a value some path since the dispatch did not write');
+      }
+      if (stored !== undefined) {
+        open(stored, 'which the count takes, holds a value an effect of its block uses');
+      }
+      if (leftIncoming !== undefined) {
+        open(leftIncoming, "which the count leaves out below a dispatch's register, holds its incoming value");
       }
       guess.refuse?.(argc);
       refuseShortOfDeclared(callee, argc);
@@ -1040,11 +1187,14 @@ export function callDeclarations(
     // count, or past the bound a call through an argument register sets, that a value reaches.
     // The gap refusal has already fired on any such register past a guess; past the bound, the
     // register leaves the call silently, and the frontend says whether it knows that one to be an
-    // argument all the same.
+    // argument all the same. A register at or past what the callee's own body reads is no
+    // argument of it whatever it holds, so it is not asked: read only where the count already asked
+    // the body, the one place the bound left a register out (`fallbackArgc`'s `bound`).
     if (site.leftOut !== undefined && (widths === null || bound >= 0)) {
+      const readTo = bodyMemo?.words ?? target.argRegs.length;
       site.leftOut(
         target.argRegs
-          .slice(argc)
+          .slice(argc, Math.max(argc, readTo))
           .filter((r) => r !== indirect?.reg && ssa.hasReachingDef(r, bi, (v) => mayPass(v, r))),
         target.argRegs.slice(0, argc),
       );
@@ -1060,6 +1210,7 @@ export function callDeclarations(
     const guessed = (k: number): Value => {
       const r = target.argRegs[k];
       const v = ssa.readGuessedArg(r, bi);
+      ssa.noteGuessedArgRead(r, bi, v);
       return placeholders ? placeholders.guardRead(name, r, v) : v;
     };
     const args: Value[] = [];
@@ -1230,10 +1381,11 @@ export function callDeclarations(
     lower,
     heldAtUndeclaredCall,
     refuseDispatchUnlockedPassThrough: (caseStateRead) => {
-      if ((parkedInArgs || caseStateRead) && passThrough !== undefined) {
+      const open = parkedInArgs || caseStateRead ? passThrough.find((p) => !p.unread()) : undefined;
+      if (open !== undefined) {
         fail(
-          `cannot lift '${name}': the call ${passThrough.call} has no prototype, and ${passThrough.reg}, ` +
-            `${passThrough.why}, in a function that lifts only through what a jump-table dispatch left in its ` +
+          `cannot lift '${name}': the call ${open.call} has no prototype, and ${open.reg}, ` +
+            `${open.why}, in a function that lifts only through what a jump-table dispatch left in its ` +
             'registers — the arity guessed without a prototype and another compile to the same bytes, so the ' +
             'argument count is not decidable',
         );