@asmlift/core 0.10.0 → 0.11.0

package/src/structure/analysis.ts

@@ -28,6 +28,7 @@ import {
   defOpMap,
   dominators,
   mergeClasses,
+  opShape,
   predecessors,
   successorsOf,
 } from '../ir/core';
@@ -1006,12 +1007,18 @@ function makeMemWriteBetween(deps: {
     if (wDirty(b.ops, oi + 1, b.ops.length) || wDirty(render.blk.ops, 0, render.idx)) {
       return true;
     }
-    for (const x of reachAvoiding(b, b)) {
-      if (x === render.blk && !reachAvoiding(render.blk, b).has(render.blk)) {
-        continue; // acyclic render block: head checked
-      }
-      if (x !== render.blk && !reachAvoiding(x, b).has(render.blk)) {
-        continue; // not on a def→render path
+    // The between-blocks: every `x` the def's block reaches without re-crossing it from which the
+    // render block is reached again in at least one step, by the same def-avoiding walk. The render
+    // block itself counts only where it reaches itself so (its head is checked above); any other
+    // block only where it lies on a def→render path.
+    const forward = reachAvoiding(b, b);
+    if (!forward.has(render.blk)) {
+      return false; // every block on a def→render path is one the def's block reaches
+    }
+    const onPath = blocksReaching(forward, render.blk, b);
+    for (const x of forward) {
+      if (!successorsOf(x).some((s) => s !== b && onPath.has(s))) {
+        continue; // not on a def→render path (or, for the render block, acyclic: head checked)
       }
       if (wDirty(x.ops, 0, x.ops.length)) {
         return true;
@@ -1021,6 +1028,49 @@ function makeMemWriteBetween(deps: {
   };
 }
 
+/** The blocks of `within` that reach `target` in zero or more steps without passing `avoid`,
+ *  `target` included: one backward walk over `within`'s own edges.
+ *
+ *  `makeMemWriteBetween` asks, for each block `x` the def's block reaches, whether `target` is in
+ *  `reachAvoiding(x, avoid)`. That is a forward walk per `x`, quadratic in the function's size per
+ *  question, and the question is asked per op `analyze` names (`nameAccess`): Klonoa's
+ *  sub_0800D188 (1,783 blocks) spent most of its structuring in those walks. `target` is in
+ *  `reachAvoiding(x, avoid)` exactly where some successor of `x` other than `avoid` is in this set,
+ *  since every block on such a path after `x` is in `within` (`within` being everything the def's
+ *  block reaches without passing `avoid`, from which `x` was drawn). */
+function blocksReaching(within: ReadonlySet<Block>, target: Block, avoid: Block): Set<Block> {
+  const into = new Map<Block, Block[]>();
+  for (const y of within) {
+    if (y === avoid) {
+      continue;
+    }
+    for (const s of successorsOf(y)) {
+      if (s !== avoid && within.has(s)) {
+        const list = into.get(s);
+        if (list === undefined) {
+          into.set(s, [y]);
+        } else {
+          list.push(y);
+        }
+      }
+    }
+  }
+  const out = new Set<Block>();
+  if (target === avoid) {
+    return out;
+  }
+  out.add(target);
+  for (const work = [target]; work.length;) {
+    for (const y of into.get(work.pop()!) ?? []) {
+      if (!out.has(y)) {
+        out.add(y);
+        work.push(y);
+      }
+    }
+  }
+  return out;
+}
+
 /** INTERDEPENDENT PARALLEL-COPY ARGS. A terminator's successor args are ONE parallel copy
  *  (argAssigns), whose every read means the PRE-copy value. An arg whose def-tree reads a SIBLING
  *  arg of the same edge cannot read it by name there — so the sibling's whole expression is
@@ -2284,10 +2334,6 @@ function isBarrier(rules: MaterializeRules, materialize: ReadonlySet<Op>, access
 
 const COMMUTATIVE_OPS: ReadonlySet<string> = new Set(['add', 'mul', 'and', 'or', 'xor']);
 
-/** One op's identity apart from its operands: opcode, result count and attributes, keys sorted. */
-const opShape = (op: Op): string =>
-  `${op.opcode}/${op.results.length}/${JSON.stringify(Object.entries(op.attrs).sort(([a], [b]) => a.localeCompare(b)))}`;
-
 /** Do two values name the same address: one value, or two `gaddr`s of one symbol? */
 function sameAddress(defOf: Map<Value, Op>, a: Value, b: Value): boolean {
   if (a === b) {

package/src/structure/cross-jumped-tail.ts

@@ -0,0 +1,216 @@
+// THE LAYOUT OF A CROSS-JUMPED RETURN TAIL: does the asm show that the compiler merged a return
+// tail the source wrote into every arm, where the structurer took the join past early returns?
+//
+// A compiler that cross-jumps return tails (target.ts `crossJumpsReturnTails`, gcc 2.x jump.c)
+// leaves the same CFG for `if (a) { x = 1; tail(); return; } ... tail();` and for `if (a) x = 1;
+// ... tail();`: one copy of the tail, which every arm reaches. The two spellings differ in WHERE
+// that copy sits and in WHICH arms became one block, because `do_cross_jump` keeps the copy of
+// the LATER jumping arm and jumps the earlier one to a new label before it. That label stops
+// further merging (`INSN_UID (JUMP_LABEL (insn)) < max_uid`). So the copies spelling leaves one of
+// three marks in the object:
+//
+//   (A) THE TAIL IS NOT LAST. The surviving copy ends in an unconditional jump (A1), and a block of
+//       the construct that never reaches the tail is laid out after it (A2). That is an arm that
+//       did not use the tail, left where the source wrote it. The join writes the tail after the
+//       whole construct, where it falls into what follows it. A bare return block does not count
+//       for A2: the epilogue an early `return` reaches is laid out last under either spelling.
+//       The copy can survive split over two blocks: an arm's own jump enters it part-way, so the
+//       join falls into the rest of the tail, and that rest ends in the jump. So A1 reads the end
+//       of the join's run of fall-throughs, not the join block alone.
+//   (B) IDENTICAL ARMS STAYED APART. Two arms that reach the tail and nothing else, each by an
+//       unconditional jump, have the same instructions. Under the join, each such arm jumps to the
+//       join's one original label, and jump2's search of the other jumps to that label merges
+//       identical bodies. Under the copies, the first cross-jump made a new label, and that search
+//       never ran. An arm that FALLS into the join is not one of them: it is tried only against
+//       the code before the label, which a call ending it defeats (flow.c's use-nop), so agbcc
+//       keeps a falling `g(2)` apart from a jumping `g(2)` under the join too
+//       (`probe-rettail-pd-join.c`).
+//   (C) A CALL CUT FROM ITS ARGUMENTS. The join starts with a call, and two predecessors that reach
+//       only the join each hold one same instruction after their own last call. `do_cross_jump`
+//       compares backward from each jump, one instruction at a time, and stops at the first pair
+//       that differs; arms that set the call's arguments in different orders, or where one arm
+//       finds an argument already in its register, differ just above the call. So the merge cuts
+//       the call from its argument setup, and leaves a copy of that setup in each arm. The join
+//       writes the setup once, after its label, and an instruction both arms hold in the same
+//       place would have been merged up into it.
+//
+// Bodies are compared as the frontend recorded them, the relocated symbol included
+// (frontend/ssa.ts `recordAsmLayout`): in a relocatable MIPS object `gT = c` and `gW = c` are the
+// same two instructions, and only the relocation names the global (`probe-rettail-pc-join.c`).
+//
+// A MARK IS EVIDENCE, NOT PROOF. jump2 cross-jumps any shared code, not only a return tail: two
+// identical arms of a join-written `if`, or a call both arms end in, merge the same way, and leave
+// the merged block ending in a jump with an early-return arm laid out after it (A). Both readings
+// of such a site are verified readings of the asm, and on the hand probes neither matches. So a
+// mark moves which reading is the DEFAULT, never what is lifted, and its worth is measured, not
+// derived.
+//
+// MEASURED. Over the 620 real functions where the join re-spells the default (2026-11-05), each
+// reading really compiled: the bound plus (A1 & A2) | B gives MATCH 44, against 35 for the copies
+// everywhere and 40 for the size bound alone, with no match lost. A and B were chosen on those 620.
+// The split tail of A1 and mark C were read off held-out sources instead: 160 generated functions
+// written WITH the copies, early returns between the arms (2026-11-06). There the size bound with A
+// and B alone loses 7 of the copies' matches on agbcc, 9 on gcc2.7.2kmc and 2 on gcc2.7.2; with the
+// split tail and C it loses 2, 3 and 1, and gains as many as before (5, 5, 2). Over 300 paired
+// functions, half written each way, the two lose no match; 3 join-written ones on each GCC 2.7.2
+// lane move to the copies and score further. On the 620 they move 3 functions, all to the copies'
+// own spelling: 2 closer, 1 further, MATCH still 44. What no layout read recovers: a tie the two
+// spellings leave in the same layout, where only the register allocation differs, and a call merged
+// across arms that pass it different arguments. The probe pairs in cross-jumped-tail.test.ts check
+// each mark and each shape that is no mark.
+//
+// READ BY NO DEFAULT. Over held-out real functions (pokeemerald, 2026-11-06) the size bound with
+// these marks still loses 9 of the copies' matches on agbcc, none of them marked; over the 160
+// generated functions (2026-11-09) it still loses 3 on gcc2.7.2kmc and 1 on gcc2.7.2. So both
+// compilers that cross-jump default to the copies outright (they leave out target.ts
+// `joinPastReturnsByDefault`), and the probe pairs still pin each mark.
+//
+// Read only from the frontend's layout record (ir/core.ts `AsmLayout`). A block with no entry, such
+// as one a raise pass made up, is no evidence either way. A function with no record (parsed IR)
+// has no mark.
+import type { AsmLayout, Block, Fn } from '../ir/core';
+import type { JoinPastReturnsSite } from './structure';
+
+const succsOf = (b: Block): Block[] => [...new Set(b.ops[b.ops.length - 1]?.successors.map((s) => s.block) ?? [])];
+
+/** Every block reachable from `from`, `from` included, never entering `avoid`. */
+function reach(from: Block, avoid?: Block): Set<Block> {
+  const seen = new Set<Block>();
+  const stack = [from];
+  while (stack.length) {
+    const x = stack.pop()!;
+    if (x === avoid || seen.has(x)) {
+      continue;
+    }
+    seen.add(x);
+    stack.push(...succsOf(x));
+  }
+  return seen;
+}
+
+const isBareReturn = (b: Block): boolean => b.ops.length === 1 && b.ops[0].opcode === 'ret';
+
+/** Does `site` show either mark of a cross-jumped return tail in `fn`'s asm layout? */
+export function crossJumpedTail(fn: Fn, site: JoinPastReturnsSite): boolean {
+  const layout: AsmLayout | undefined = fn.asmLayout;
+  const at = layout?.get(site.join);
+  if (layout === undefined || at === undefined) {
+    return false;
+  }
+  return (
+    (tailEndsInJump(layout, site.join) && armLaidOutAfter(fn, layout, site, at.index)) ||
+    identicalArms(fn, layout, site.join) ||
+    callCutFromArguments(fn, layout, site.join)
+  );
+}
+
+/** (A1): the tail from the join, followed through its fall-throughs, ends in an unconditional jump. */
+function tailEndsInJump(layout: AsmLayout, join: Block): boolean {
+  const seen = new Set<Block>();
+  for (let b: Block = join; ;) {
+    const at = layout.get(b);
+    if (at === undefined || seen.has(b)) {
+      return false;
+    }
+    if (at.endsInJump) {
+      return true;
+    }
+    seen.add(b);
+    // a fall-through is the next block in the asm; anything else is no run of the tail
+    const next = succsOf(b);
+    if (next.length !== 1 || layout.get(next[0])?.index !== at.index + 1) {
+      return false;
+    }
+    b = next[0];
+  }
+}
+
+/** (C): the join's first instruction is a call, and two of its predecessors, each with the join as
+ *  its only successor, hold a same instruction after their own last call.
+ *
+ *  BLIND TO WHERE IN THE ARM THAT INSTRUCTION SITS, and to what it computes, on purpose. The text
+ *  compared is the instruction as printed, so a shared statement is not needed: on MIPS the address
+ *  half of a relocated global (`lui at,0x0 <gT>`) and a store from a register that holds a different
+ *  value in each arm (`sw v0,0(at) <gT>`) read the same. So any two call-free arms that write one
+ *  global fire it when the join opens with a call (`if (a == 0) { gV = b; gT = 1; } else if (a ==
+ *  1) { gV = c; gT = 2; } ... k(a);`, 26 lines off as copies, 0 as the join, on both MIPS GCC lanes),
+ *  and it publishes the copies there, which do not match. Counting only
+ *  an instruction that sets up a register the join reads (an argument of its call, or a saved
+ *  register read past it) clears that case, and loses two matches the copies have: on
+ *  `probe-rettail-pc-copies` the arms keep `gV = a` above the cut call, a store that sets up no
+ *  register, and the join then scores 23 lines off on gcc2.7.2 and 30 on gcc2.7.2kmc, really
+ *  compiled (2026-11-06). A mark that fires wrongly publishes the copies, the default before the
+ *  join, and one that misses can lose a match the copies had; so C stays wide. */
+function callCutFromArguments(fn: Fn, layout: AsmLayout, join: Block): boolean {
+  if (layout.get(join)?.calls[0] !== 0) {
+    return false;
+  }
+  const seen = new Set<string>();
+  for (const p of predecessors(fn).get(join) ?? []) {
+    const at = layout.get(p);
+    if (at === undefined || succsOf(p).length !== 1) {
+      continue;
+    }
+    const setup = new Set(at.body.slice((at.calls[at.calls.length - 1] ?? -1) + 1));
+    if ([...setup].some((ins) => seen.has(ins))) {
+      return true;
+    }
+    for (const ins of setup) {
+      seen.add(ins);
+    }
+  }
+  return false;
+}
+
+/** (A2): a block of the construct, reached from its branch short of the join, that never reaches
+ *  the join and is laid out after it. A bare return does not count. */
+function armLaidOutAfter(fn: Fn, layout: AsmLayout, site: JoinPastReturnsSite, joinIndex: number): boolean {
+  const fromJoin = reach(site.join);
+  const reachesJoin = new Set<Block>([site.join]);
+  const preds = predecessors(fn);
+  const stack = [site.join];
+  while (stack.length) {
+    for (const p of preds.get(stack.pop()!) ?? []) {
+      if (!reachesJoin.has(p)) {
+        reachesJoin.add(p);
+        stack.push(p);
+      }
+    }
+  }
+  for (const x of reach(site.branch, site.join)) {
+    const xi = layout.get(x)?.index;
+    if (xi !== undefined && xi > joinIndex && !fromJoin.has(x) && !reachesJoin.has(x) && !isBareReturn(x)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/** (B): two predecessors of the join, each with the join as its only successor and each ending in an
+ *  unconditional jump to it, whose asm bodies are the same non-empty instructions. */
+function identicalArms(fn: Fn, layout: AsmLayout, join: Block): boolean {
+  const seen = new Set<string>();
+  for (const p of predecessors(fn).get(join) ?? []) {
+    const at = layout.get(p);
+    if (at === undefined || !at.endsInJump || at.body.length === 0 || succsOf(p).length !== 1) {
+      continue;
+    }
+    const body = at.body;
+    const key = body.join('\n');
+    if (seen.has(key)) {
+      return true;
+    }
+    seen.add(key);
+  }
+  return false;
+}
+
+function predecessors(fn: Fn): Map<Block, Block[]> {
+  const preds = new Map<Block, Block[]>(fn.blocks.map((b) => [b, []]));
+  for (const b of fn.blocks) {
+    for (const s of succsOf(b)) {
+      preds.get(s)?.push(b);
+    }
+  }
+  return preds;
+}

package/src/structure/globalaccess.ts

@@ -75,6 +75,42 @@ export function globalByteBase(e: Expr): { name: string; residual: Expr } | null
   return null;
 }
 
+/** {@link globalOf} with the address any number of `+` down — FOR THE BARE-ARRAY SPELLING ONLY, the
+ *  one consumer whose declaration says what the residual indexes. An interior address the lift
+ *  rewrote as the object's plus a constant before the index was added (IDO's `addiu t, sp, 0x58`
+ *  for the second of two copied arrays reaches the lift as `(u32)sp56 + 32 + v8`) has its object
+ *  one `+` further down than globalByteBase looks. The sum's terms are flattened, exactly one of
+ *  them an address, and the rest are the residual: its runtime terms in order and its constants
+ *  summed into one trailing term (`v8 + 32`). Not for the cast forms, which keep the sum as written
+ *  (`*(s8 *)((u32)sp0 + 3 + a0)`). `off` is the access's own displacement, summed into the same
+ *  trailing constant. */
+export function nestedGlobalOf(e: Expr, width: number, off: number): { name: string; idx: Expr } | null {
+  const terms: Expr[] = [];
+  const flatten = (x: Expr): void => {
+    if (x.k === 'bin' && x.op === '+') {
+      flatten(x.l);
+      flatten(x.r);
+    } else {
+      terms.push(x);
+    }
+  };
+  flatten(e);
+  const at = terms.filter((x) => addrIn(x) !== null);
+  if (at.length !== 1) {
+    return null;
+  }
+  const rest = terms.filter((x) => x !== at[0]);
+  const bias = rest.reduce((n, x) => (x.k === 'const' ? n + x.value : n), off);
+  const runtime = rest
+    .filter((x) => x.k !== 'const')
+    .reduce<Expr | null>((l, r) => (l === null ? r : { k: 'bin', op: '+', l, r }), null);
+  if (bias % width !== 0) {
+    return null;
+  }
+  const idx = runtime === null ? { k: 'const' as const, value: 0 } : elementIndex(runtime, width);
+  return idx === null ? null : { name: addrIn(at[0])!.name, idx: addOffset(idx, bias / width) };
+}
+
 // THE one gate on the BARE-NAME array-global spelling (`gSym[i]` rather than `((T *)&gSym)[i]`),
 // shared by the constant-offset and variable-index access paths so the two cannot disagree.
 // Returns the `index` node's `lead` fragment when the bare form is spellable, or null to fall
@@ -93,10 +129,19 @@ export function globalByteBase(e: Expr): { name: string; residual: Expr } | null
 // inner extent) gets no bare form at all; `((T *)&gSym)[i]` is byte-identical and valid under ANY
 // declaration, which is why it is the safe fallback. See symbols.ts arrayInnerExtents for why an
 // ABSENT rank is read as 1 rather than as unknown.
-export function bareArrayLead(si: SymbolInfo, width: number, signed: boolean): { lead?: Expr[] } | null {
+//
+// …and a CONSTANT subscript must name an element of the declaration, where it states its extent: a
+// subscript past a rank-1 array's end (or before its start) is not an element of it, so it keeps
+// the cast form, which states only the address. A runtime subscript is the access's own business —
+// for a frame part, the audit that split it bounded the reach (frame-objects.ts `provenParts`).
+export function bareArrayLead(si: SymbolInfo, width: number, signed: boolean, idx?: Expr): { lead?: Expr[] } | null {
   if (!bareArrayElement(si, width, signed)) {
     return null;
   }
+  const extent = si.dims?.length === 1 ? si.dims[0] : undefined;
+  if (idx?.k === 'const' && (idx.value < 0 || (typeof extent === 'number' && idx.value >= extent))) {
+    return null;
+  }
   const inner = arrayInnerExtents(si);
   return inner === null ? null : inner.length === 0 ? {} : { lead: inner.map((): Expr => ({ k: 'const', value: 0 })) };
 }