@asmlift/core 0.10.0 → 0.11.0

package/src/frontend/frontend.ts

@@ -8,6 +8,7 @@ import type { ContextGlobals } from '../proto-context';
 import type { SymbolMap } from '../symbols';
 import type { TargetDescription } from '../target';
 import type { AsmData } from './asmdata';
+import type { CalleeBodyBound, CalleeStackWords, EntryStackWords } from './callee-body';
 import type { AsmTextFormat } from './format';
 
 export interface Frontend {
@@ -34,6 +35,10 @@ export interface Frontend {
     context?: ContextGlobals,
     options?: LiftOptions,
   ): Fn;
+  /** how many incoming stack words the straight-line entry of a callee, in a text of this
+   *  frontend's input format, loads (frontend/callee-body.ts `CalleeStackWords`), asked of a callee
+   *  whose body does not lift; absent where this frontend reads no entry */
+  entryStackWords?: EntryStackWords;
 }
 
 /** THE FUNCTION'S OWN DECLARATION, as a call lowering reads it (frontend/call-plan.ts
@@ -90,4 +95,19 @@ export interface LiftOptions {
   /** Called when the lift met such a slot, whichever way it answered: what rank.ts asks before
    *  enumerating `/kept-slot` at all. */
   onTailSlot?: () => void;
+  /** The argument words a callee's own body in the same input can read at most
+   *  (frontend/callee-body.ts), asked of a call whose arity no declaration states. pipeline.ts
+   *  `liftStamped` supplies it on every lift; absent, nothing is bounded. */
+  calleeBodyBound?: CalleeBodyBound;
+  /** The incoming stack words a callee's own body, in the input or handed in, is proven to load
+   *  (frontend/callee-body.ts `CalleeStackWords`), asked of a call no declaration lays out that
+   *  stages words in the outgoing area. pipeline.ts `liftStamped` supplies it on every lift. */
+  calleeStackWords?: CalleeStackWords;
+  /** Told of each call nothing declares that the lift laid out at every argument register and the
+   *  stack words its callee's body loads (`calleeStackWords`), with that word count. */
+  stackSized?: (callee: string, words: number) => void;
+  /** The callees whose calls are taken at every argument register that may still hold this
+   *  function's own incoming value at the call, where no declaration lays the call out: how
+   *  frontend/callee-body.ts lifts a callee's body to bound what it reads. Absent, none is. */
+  entryReadCalls?: ReadonlySet<string>;
 }

package/src/frontend/jump-table.ts

@@ -215,11 +215,12 @@ export interface ElidedDispatch {
 
 /** A MARKER ({@link staleMarker}): what the idiom left in `reg` that no C expression spells, and
  *  whether the dispatch that left it was kept (its block lifted, holding the code the compiler
- *  placed in it) or elided. A read of one declines ({@link refuseStaleIdiomReads}). */
+ *  placed in it) or elided — or, `narrow`, the copy of sp a Thumb narrow slot reload read through,
+ *  which is not lifted either. A read of one declines ({@link refuseStaleIdiomReads}). */
 export interface StaleMarker {
   kind: 'marker';
   reg: string;
-  form: 'kept' | 'elided';
+  form: 'kept' | 'elided' | 'narrow';
   /** Whether the marker stands for the register on EVERY path that brings it ({@link parkedIn}): a
    *  kept dispatch's, and an EXACT target's. A MIXED target's marker also replaced what the other
    *  paths into it brought, so it is read like any value, and its read declines. */
@@ -388,7 +389,10 @@ export const scaledIndexIn =
  *  address, none of which a C expression spells. Run on the filled SSA, before `finish` collapses a
  *  join of an undefined value into its other argument: a marker some operand demands, directly or
  *  through the joins that carry it, declines. A `ret` operand demands nothing under a declared
- *  `void` return, which drops it (pipeline.ts `dropVoidReturnOperands`). A MIXED target's scaled
+ *  `void` return, which drops it (pipeline.ts `dropVoidReturnOperands`). A narrow reload's marker
+ *  (form `narrow`) is held to the drop itself, `dropsVoidReturn`: pipeline.ts drops the operand only
+ *  for a STATED void entry, and under the context's own `void` alone the lifted `ret` still reads
+ *  the register, so the marker would print as `return uninit_r0`. A MIXED target's scaled
  *  index is settled first ({@link unsettledScaledIndices}): one that does not stand is a marker,
  *  read or not. `fail` is the frontend's own refusal. Last, `calls` refuses a guessed arity's
  *  trailing pass-through where the function lifts only through this modelling: a parked ceiling that
@@ -402,6 +406,7 @@ export function refuseStaleIdiomReads(
   own: FnProto | undefined,
   fail: FrontendRefusal,
   calls: Pick<CallDeclarations, 'refuseDispatchUnlockedPassThrough'>,
+  dropsVoidReturn: boolean = declaresVoidReturn(own),
 ): void {
   if (stale.size === 0) {
     return;
@@ -418,32 +423,42 @@ export function refuseStaleIdiomReads(
     }
   }
   const unsettled = unsettledScaledIndices(irBlocks, stale, incoming, ssa);
-  const demanded = new Set<Value>();
-  const work: Value[] = [];
-  const demand = (v: Value) => {
-    if (!demanded.has(v)) {
-      demanded.add(v);
-      work.push(v);
+  // what the ops demand, a void return's operand aside; then what that operand alone demands
+  const demandedBy = (roots: (op: Op) => boolean): Set<Value> => {
+    const demanded = new Set<Value>();
+    const work: Value[] = [];
+    const demand = (v: Value) => {
+      if (!demanded.has(v)) {
+        demanded.add(v);
+        work.push(v);
+      }
+    };
+    irBlocks.forEach((blk) => blk.ops.filter(roots).forEach((op) => op.operands.forEach(demand)));
+    while (work.length > 0) {
+      (incoming.get(work.pop()!) ?? []).forEach(demand);
     }
+    return demanded;
   };
   const voidReturn = declaresVoidReturn(own);
-  for (const blk of irBlocks) {
-    for (const op of blk.ops) {
-      if (!(op.opcode === 'ret' && voidReturn)) {
-        op.operands.forEach(demand);
-      }
-    }
-  }
-  while (work.length > 0) {
-    (incoming.get(work.pop()!) ?? []).forEach(demand);
-  }
+  const demanded = demandedBy((op) => !(op.opcode === 'ret' && voidReturn));
+  const keptRet =
+    voidReturn && !dropsVoidReturn && [...stale.values()].some((s) => s.kind === 'marker' && s.form === 'narrow')
+      ? demandedBy((op) => op.opcode === 'ret')
+      : new Set<Value>();
   const read = [...stale].flatMap(([v, s]) =>
-    demanded.has(v) && (s.kind === 'marker' || unsettled.has(v))
+    (demanded.has(v) || (s.kind === 'marker' && s.form === 'narrow' && keptRet.has(v))) &&
+    (s.kind === 'marker' || unsettled.has(v))
       ? [s.kind === 'marker' ? s : { reg: s.reg, form: 'elided' as const }]
       : [],
   )[0];
   if (read !== undefined) {
     const { reg, form } = read;
+    if (form === 'narrow') {
+      fail(
+        `cannot lift '${name}': address-taken stack local — ${reg} is read past the narrow slot reload that read ` +
+          'through it, and the lift does not model the copy of sp it holds there',
+      );
+    }
     const why =
       "which the unlifted dispatch idiom wrote — the lift would read the value from before the dispatch, not the table's " +
       'index, address or target';

package/src/frontend/mips.ts

@@ -28,8 +28,9 @@ import { type Prototypes, declaresVoidReturn, ownReturnWidth, wordsOf } from '..
 import type { ContextGlobals } from '../proto-context';
 import type { SymbolMap } from '../symbols';
 import { O32_REGISTER_ALIASES, type TargetDescription } from '../target';
-import { type AsmData, readJumpTable, textRelocAt } from './asmdata';
+import { type AsmData, readJumpTable, readU32, textRelocAt } from './asmdata';
 import { callDeclarations, foldByValueArgs } from './call-plan';
+import { asksCalleeBody } from './callee-body';
 import { pinDeadReads } from './dead-reads';
 import { pinDeviceAccesses } from './device-pins';
 import {
@@ -61,6 +62,7 @@ import {
   type FrameObjectRelift,
   type FrameRange,
   areaAboveOutgoing,
+  keptInRelift,
   landsOnArea,
   liftWithRelift,
   nameMergedSretObjects,
@@ -94,7 +96,14 @@ import {
   stackArgSlots,
   stackSlotKey,
 } from './ssa';
-import { makeSsaBuilder, refuseSavedRegisterLeaks, registerLiveIns, unifyRegisterSpellings } from './ssa';
+import {
+  makeSsaBuilder,
+  recordAsmLayout,
+  refuseSavedRegisterLeaks,
+  registerLiveIns,
+  unifyRegisterSpellings,
+} from './ssa';
+import { bodyBlockAgrees } from './stackargs';
 
 type Instr = DisasmInstr;
 
@@ -313,8 +322,31 @@ function attachMipsRelocs(name: string, instrs: Instr[], ad: AsmData, freed: Rea
           `0x${ins.addr.toString(16)}): '${ins.reloc.type} ${ins.reloc.sym}' and '${r.type} ${r.sym}'`,
       );
     }
-    ins.reloc = { type: r.type, sym: r.sym, addend: 0 };
+    ins.reloc = {
+      type: r.type,
+      sym: ins.mnemonic === 'jal' ? (textCallee(r.sym, r.offset, ad) ?? r.sym) : r.sym,
+      addend: 0,
+    };
+  }
+}
+
+/** THE FUNCTION A `jal` RELOCATED AGAINST `.text` ITSELF ENTERS, by name. gcc 2.7.2 and KMC relocate a
+ *  call to a function of the same object against the section, not the function's symbol (`jal 0
+ *  <rnd>` over `R_MIPS_26 .text`), so the record names no callee. MIPS objects are REL: the jump's
+ *  26-bit field holds the addend, the target's offset in the section shifted right by two. The
+ *  symbol table names the function at that offset. Undefined, and the call keeps its section
+ *  callee, which refuses: where `.text`'s bytes or the word are not in the dump, or where no one
+ *  name, or more than one, starts there. Only a `jal`'s: gcc 2.7.2 and KMC relocate a `j` against
+ *  `.text` too, and a leaf loop whose head is the entry jumps to its own function's first word, so
+ *  naming that `j` would read the loop's back edge as a tail call. */
+function textCallee(sym: string, offset: number, ad: AsmData): string | undefined {
+  const text = ad.sections.get('.text');
+  if (sym !== '.text' || text === undefined || offset + 4 > text.length) {
+    return undefined;
   }
+  const at = (readU32(text, offset, ad.bigEndian) & 0x03ffffff) * 4;
+  const names = [...ad.symbols].filter(([n, s]) => s.section === '.text' && s.value === at && /^[A-Za-z_]\w*$/.test(n));
+  return names.length === 1 ? names[0][0] : undefined;
 }
 
 interface MipsBlock {
@@ -1628,6 +1660,16 @@ function liftOnce(
     liveIns.globalRegs,
   );
   const { irBlocks, readVar, writeVar, paramReg } = ssa;
+  // Where the compiler put each block (ir/core.ts `AsmLayout`). A delay slot runs in its branch's
+  // block, so it is part of the body; a branch-likely's slot is a block of its own already.
+  ssa.fn.asmLayout = recordAsmLayout(
+    irBlocks,
+    blocks.map((b) => ({
+      body: b.delay ? [...b.body, b.delay] : b.body,
+      endsInJump: b.branch !== null && isUncond(b.branch),
+      isCall: (ins) => isCallInstr(ins as Instr),
+    })),
+  );
   const RET = target.returnReg;
   // Whether this function's own declaration says its return fits one word (`v1MayHoldLowWord`):
   // void, or a scalar or pointer no wider than 32 bits. An aggregate says nothing here. A declared
@@ -1717,6 +1759,9 @@ function liftOnce(
     { pairs: false, memoryReturn: true, stackArgs: true, voidReturn: true, argRegisterBoundsArity: false },
     fail,
     () => ownDeclarationOf(name, prototypes, options.contextOwnProto),
+    options.calleeBodyBound,
+    options.entryReadCalls,
+    options.stackSized,
   );
   // The first instruction naming the FPU's file, a data register or the control register. A call
   // in a function that has one refuses: which floating-point registers a callee reads, returns in
@@ -1767,6 +1812,63 @@ function liftOnce(
   // epilogue restore in any block.
   const saveSlots = new Map<number, string>();
   const valueSlots = new Set<number>();
+  // WHETHER EACH OUTGOING-AREA WORD IS PENDING, per block, as lowered so far: a store to it
+  // (`emitStore`) makes it pending, and a call that took it as a stack argument (`lowerJal`'s
+  // `stackWord`) ends it, so it is pending for no later call until it is stored again. Kept per
+  // STORE, not per value: a value one call took and that is stored again for a later call, at the
+  // same word or another, is staged for that call all the same, and keyed by the value it would
+  // hide a word the call is handed (frontend/stackargs.ts ends its pending words per offset too).
+  const outgoingWordState: Map<number, 'stored' | 'taken'>[] = blocks.map(() => new Map());
+  // Whether the state of word `off` some path brings into this point of block `b` is `want`: the
+  // walk `ssa.hasReachingDef` makes, over this state, so a block not filled yet is passed through.
+  // `here` is `b`'s state at this point (its state so far, by default); met again round a loop, `b`
+  // is its state at its end, which a back edge brings.
+  const outgoingWordReaches = (
+    off: number,
+    b: number,
+    want: 'stored' | 'taken',
+    here: ReadonlyMap<number, 'stored' | 'taken'> = outgoingWordState[b],
+  ): boolean => {
+    const seen = new Set<number>();
+    const walk = (at: number, own: 'stored' | 'taken' | undefined): boolean => {
+      if (own !== undefined) {
+        return own === want;
+      }
+      if (seen.has(at)) {
+        return false;
+      }
+      seen.add(at);
+      return preds[at].some((p) => walk(p, outgoingWordState[p].get(off)));
+    };
+    return walk(b, here.get(off));
+  };
+  // EACH CALL ITS CALLEE'S BODY LICENSED, judged again once every block is filled: while a call is
+  // lowered, a block not filled yet — a loop's latch, or the call's own block met round a back
+  // edge — holds no state, so a word the call itself takes is not seen reaching its loop head and a
+  // word staged once before the loop passes for every iteration's. Judged again on the finished
+  // state (frontend/stackargs.ts reaches the same answer by its fixpoint), a word of the block some
+  // path brings in taken, or a word past it some path brings in stored, refuses the lift.
+  const bodyLicences = new Map<
+    Instr,
+    { bi: number; here: ReadonlyMap<number, 'stored' | 'taken'>; n: number; callee: string }
+  >();
+  // EACH CALL A DECLARATION SIZED, AND THE STACK WORDS IT TOOK, judged again the same way: its
+  // arity is the declaration's, so a word past its block says nothing, but a word it takes that
+  // some path brings in already taken by an earlier call — licensed or declared — is a word the
+  // earlier callee owned and may have written, not the value stored there (frontend/stackargs.ts
+  // ends a pending word at the call that takes it for either kind of call).
+  const declaredTakes = new Map<
+    Instr,
+    { bi: number; here: ReadonlyMap<number, 'stored' | 'taken'>; offs: number[]; callee: string }
+  >();
+  const refuseTakenWord = (callee: string, addr: number, off: number): never => {
+    throw new FrontendUnsupportedError(
+      `cannot lift '${name}': outgoing stack arguments not modelled — the call to '${callee}' at ` +
+        `0x${addr.toString(16)} takes the word at ${off}(sp) as a stack argument, but it reaches the call on ` +
+        'some path already taken by an earlier call and not stored again, so what the earlier callee left there ' +
+        'is not known',
+    );
+  };
   const restores = new Map<Value, { reg: string; addr: number }>();
   // Each `lw` that restores a save, and the register it restores: a save holds only while every path
   // restores it after its last write (`refuseSavedRegisterLeaks`).
@@ -1863,7 +1965,12 @@ function liftOnce(
           `local area, sp+${frame.area.from} up to sp+${frame.area.to} — part memory, part slot`,
       );
     }
-    return true;
+    // …and in a relift, only the bytes the first audit asked to keep as one object are memory: a
+    // word of the area outside them is one it handed back to the slot model (`keptInRelift`)
+    return (
+      oneObject === undefined ||
+      keptInRelift(oneObject, off, width, () => `'${ins.mnemonic}' at 0x${ins.addr.toString(16)}`, name)
+    );
   };
 
   // SOUNDNESS GUARD. The word stack-slot model (emitLoad/emitStore) is safe ONLY when every
@@ -1905,11 +2012,21 @@ function liftOnce(
   //     must run at the frame's own depth, save the incoming stack words that are keyed `@sarg<k>`.
   // The caller's home `[frameSize, frameSize + 16)` is in no range, so a def-less read there still
   // refuses. Sub-word frame traffic turns the slot model off (`spSlotSafe`) and claims nothing.
+  //
+  // A RELIFT takes a frame address by construction, and claims the local area alone: there the
+  // bytes kept as one object are memory and key no slot, and every word outside them is one the
+  // first audit handed back (`reliftRange`) only where no escape is unbounded, no copy reaches it
+  // and no index runs, so nothing but its own direct accesses reaches it. kmc homes `u32 r; if (i)
+  // r = gA[9]; … if (i) gA[10] = r;` in such a word beside two copied arrays, and reads it on the
+  // path that never stored it.
   let ownedMemo: { range: { from: number; to: number } | undefined } | undefined;
   const ownedFrame = (): { from: number; to: number } | undefined =>
     (ownedMemo ??= { range: measureOwnedFrame() }).range;
   const measureOwnedFrame = (): { from: number; to: number } | undefined => {
-    if (frameSize === undefined || depthAt === null || !spSlotSafe || code.some(takesFrameAddress)) {
+    if (frameSize === undefined || depthAt === null || !spSlotSafe) {
+      return undefined;
+    }
+    if (oneObject === undefined ? code.some(takesFrameAddress) : frame === null) {
       return undefined;
     }
     for (const ins of code) {
@@ -1935,7 +2052,9 @@ function liftOnce(
       }
       throw e;
     }
-    return outgoing.widest < frameSize ? { from: outgoing.widest, to: frameSize } : undefined;
+    const from = Math.max(outgoing.widest, oneObject === undefined || frame === null ? 0 : frame.area.from);
+    const to = oneObject === undefined || frame === null ? frameSize : Math.min(frameSize, frame.area.to);
+    return from < to ? { from, to } : undefined;
   };
   ownedFrameOf = ownedFrame;
 
@@ -1950,6 +2069,8 @@ function liftOnce(
   // The frame offset each `laddr` this lift emitted names, and the deferred `sp + index` sums
   // (`emitLaddr`, `materialize`) — function-scoped, since a register holding one crosses blocks.
   const laddrAt = new Map<Value, number>();
+  // …and of those, the ones a direct `off(sp)` access in the local area was lowered to, not a capture
+  const directAccesses = new Set<Value>();
   const frameSums = new Map<Value, FrameSum>();
   // Every capture this lift moved into another (`addiu rD,rCapture,k` re-minted as the `laddr` of
   // the sum, or `addu` deferring one into a `FrameSum`), handed to the audit as Thumb hands its
@@ -2714,7 +2835,9 @@ function liftOnce(
             `cannot lift '${name}': address-taken stack local — '${ins.mnemonic}' at 0x${ins.addr.toString(16)} saves the caller's ${stored} inside the local area, a frame this does not describe`,
           );
         }
-        return emitLaddr(off);
+        const at = emitLaddr(off);
+        directAccesses.add(at);
+        return at;
       }
       const raw = rawFrame(base);
       const sum = raw === undefined ? undefined : frameSums.get(raw);
@@ -2845,7 +2968,11 @@ function liftOnce(
         refuseMixedSlot(ins, mem, off, 'value');
         valueSlots.add(off);
         // an assignment to an incoming stack parameter is that parameter's SSA variable
-        writeVar(incomingStackKey(ins, off) ?? stackSlot(off), bi, read(srcReg));
+        const incoming = incomingStackKey(ins, off);
+        writeVar(incoming ?? stackSlot(off), bi, read(srcReg));
+        if (incoming === undefined) {
+          outgoingWordState[bi].set(off, 'stored');
+        }
         return;
       }
       ops.push(mkOp('store', { operands: [read(base), read(srcReg)], attrs: { off, width } }));
@@ -2857,6 +2984,8 @@ function liftOnce(
     // argument k ≥ 4 lives, and the guess that cannot see past a3.
     const lowerJal = (ins: Instr) => {
       const at = `0x${ins.addr.toString(16)}`;
+      // this block's outgoing words as the call is reached, before it takes any
+      const wordsHere = new Map(outgoingWordState[bi]);
       const callee = jalCallee(ins, splat);
       if (callee?.startsWith('.')) {
         throw new FrontendUnsupportedError(
@@ -2883,12 +3012,64 @@ function liftOnce(
             'where its outgoing stack arguments end is not known',
         );
       }
+      // A CALL NOTHING DECLARES TAKES THE WORDS ITS CALLEE'S BODY LOADS, where exactly those reach
+      // it staged (frontend/stackargs.ts, "THE CALLEE'S BODY": the same rule, `bodyBlockAgrees`,
+      // asked here of SSA's reaching definitions, which O32 has when its calls are lowered):
+      // the body loads incoming word n-1, so the call takes at least n stack words, and a word past
+      // them that nothing staged is no argument. Licensed only where the words `[16, 16+4n)` are
+      // written on every path to the call beneath the loaded-word bound and inside the frame, and
+      // no other word of the area there reaches it; asked only once a word does. KNOWN GAP: a
+      // frame with a local area (`frame`) is not licensed, since that area is partitioned off the
+      // DECLARED widest call before any call is lowered (`stackWordsOf` above), so such a call keeps
+      // the refusals below.
+      // A word an earlier call took as its stack argument is pending for no later one until it is
+      // stored again (`outgoingWordState`), as frontend/stackargs.ts's dataflow ends it at the call
+      // whose block held it. A block not filled yet holds no state, so each licence is judged again
+      // once every block is (`bodyLicences`).
+      const licensedStackWords = (): number | undefined => {
+        if (frame !== null || !asksCalleeBody(Object.hasOwn(prototypes, callee) ? prototypes[callee] : undefined)) {
+          return undefined;
+        }
+        const reaching = [...valueSlots].filter(
+          (off) =>
+            off >= STACK_ARGS_AT &&
+            off < frameSize &&
+            off < loadedWordBound &&
+            ssa.hasReachingDef(stackSlot(off), bi) &&
+            outgoingWordReaches(off, bi, 'stored', wordsHere),
+        );
+        if (reaching.length === 0) {
+          return undefined;
+        }
+        // O32 can skip an argument register for an 8-aligned argument, so the plan's count — every
+        // register, then the block — holds only where each register is one this call sets up: a
+        // register still at its entry value on some path may be the skipped word, and taken as an
+        // argument it is a parameter this function does not have. (The callee's half of the same
+        // proof is frontend/callee-body.ts `readsEveryArgReg`.)
+        if (ARG_REGS.some((r) => !ssa.writtenOnEveryPath(r, bi, () => false))) {
+          return undefined;
+        }
+        const n = options.calleeStackWords?.(callee) ?? 0;
+        return bodyBlockAgrees(
+          n,
+          reaching.map((off) => off - STACK_ARGS_AT),
+          (o) =>
+            ssa.writtenOnEveryPath(stackSlot(STACK_ARGS_AT + o), bi, () => false) &&
+            !outgoingWordReaches(STACK_ARGS_AT + o, bi, 'taken', wordsHere),
+        )
+          ? (bodyLicences.set(ins, { bi, here: wordsHere, n, callee }), n)
+          : undefined;
+      };
+      const took: number[] = [];
       calls.lower({
         callee,
         ssa,
         bi,
         read,
         write,
+        get stackWords() {
+          return licensedStackWords();
+        },
         // ARGUMENT WORD k ≥ 4 travels in `16+4(k-4)(sp)`, inside the one frame this function pushed
         stackWord: (k) => {
           const off = STACK_ARGS_AT + 4 * (k - ARG_REGS.length);
@@ -2904,6 +3085,13 @@ function liftOnce(
                 `${off}(sp), and no value stored there reaches the call`,
             );
           }
+          // a word an earlier call took is the earlier callee's, not the value stored there, on the
+          // blocks filled so far; the rest are judged once every block is (`declaredTakes`)
+          if (outgoingWordReaches(off, bi, 'taken', wordsHere)) {
+            refuseTakenWord(callee, ins.addr, off);
+          }
+          took.push(off);
+          outgoingWordState[bi].set(off, 'taken');
           return readVar(stackSlot(off), bi);
         },
         // a pending `%hi` half and a table base are no argument
@@ -2970,6 +3158,9 @@ function liftOnce(
           },
         },
       });
+      if (took.length > 0 && !bodyLicences.has(ins)) {
+        declaredTakes.set(ins, { bi, here: wordsHere, offs: took, callee });
+      }
       // hi and lo are the callee's to overwrite
       divState = null;
       mulState = null;
@@ -3126,6 +3317,32 @@ function liftOnce(
     fillBlock(b, bi);
     ssa.markFilled(bi);
   });
+  for (const [ins, { bi, here, n, callee }] of bodyLicences) {
+    for (const off of valueSlots) {
+      if (off < STACK_ARGS_AT || off >= (frameSize ?? 0) || off >= loadedWordBound) {
+        continue;
+      }
+      const taken = off < STACK_ARGS_AT + 4 * n;
+      if (outgoingWordReaches(off, bi, taken ? 'taken' : 'stored', here)) {
+        throw new FrontendUnsupportedError(
+          `cannot lift '${name}': outgoing stack arguments not modelled — the call to '${callee}' at ` +
+            `0x${ins.addr.toString(16)} takes the ${n} stack ` +
+            `word(s) its callee's body loads, but ${
+              taken
+                ? `the word at ${off}(sp) reaches it on some path already taken by a call and not stored again`
+                : `the word at ${off}(sp), past them, reaches it stored on some path`
+            } — the block staged for it is not the same on every path, so its arguments are not known`,
+        );
+      }
+    }
+  }
+  for (const [ins, { bi, here, offs, callee }] of declaredTakes) {
+    for (const off of offs) {
+      if (outgoingWordReaches(off, bi, 'taken', here)) {
+        refuseTakenWord(callee, ins.addr, off);
+      }
+    }
+  }
   refuseSavedRegisterLeaks(
     name,
     blocks.map((b) => ({
@@ -3197,6 +3414,7 @@ function liftOnce(
       loadedWords: loadedFrom === undefined ? undefined : { from: loadedFrom, bound: loadedWordBound },
       capturedObjectIsTheWholeFrame: false,
       movedCaptures,
+      directAccesses,
       returnsWithoutHiddenPointer: calls.returnsWithoutHiddenPointer,
       symbols,
       target,

package/src/frontend/ppc.ts

@@ -70,6 +70,7 @@ import type { SymbolMap } from '../symbols';
 import type { TargetDescription } from '../target';
 import { type AsmData, readJumpTable } from './asmdata';
 import { type CallDeclarations, type ParamClass, callDeclarations } from './call-plan';
+import type { CalleeBodyBound } from './callee-body';
 import {
   type Declarations,
   computedOnlyToReturn,
@@ -1335,6 +1336,8 @@ function liftPrelude(
   prototypes: Prototypes,
   jts: Map<number, PpcJT>,
   ownDeclaration?: () => OwnDeclaration | undefined,
+  calleeBodyBound?: CalleeBodyBound,
+  entryReadCalls?: ReadonlySet<string>,
 ) {
   const recoveredBctr = new Set([...jts.values()].map((j) => j.bctrAddr));
   // TRUSTWORTHINESS: fail loud on an unmodelled control transfer rather than dropping it (which
@@ -1383,7 +1386,16 @@ function liftPrelude(
   }
   const r1At = r1Displacements(blocks, succIdx);
   const saves = prologueSavedRegs(entryBody, target, r1At, blocks);
-  const calls = callDeclarations(name, target, prototypes, PPC_CALL_LOWERING, ppcRefusal, ownDeclaration);
+  const calls = callDeclarations(
+    name,
+    target,
+    prototypes,
+    PPC_CALL_LOWERING,
+    ppcRefusal,
+    ownDeclaration,
+    calleeBodyBound,
+    entryReadCalls,
+  );
   // THE LOCAL AREA, where a function takes a frame address, reaches its frame below a word, or
   // keeps a dead local there (`measurePpcFrame`, `compilerBehaviors.linkageLocalArea`): every r1
   // access inside it, any width, is MEMORY through an `laddr` the shared frame-object audit then
@@ -1435,7 +1447,12 @@ function liftOnce(
   asmData: AsmData | undefined,
   declarations: Declarations,
   oneObject: FrameRange | undefined,
-  { contextOwnWords, contextOwnProto }: Pick<LiftOptions, 'contextOwnWords' | 'contextOwnProto'>,
+  {
+    contextOwnWords,
+    contextOwnProto,
+    calleeBodyBound,
+    entryReadCalls,
+  }: Pick<LiftOptions, 'contextOwnWords' | 'contextOwnProto' | 'calleeBodyBound' | 'entryReadCalls'>,
 ): Fn | FrameObjectRelift {
   assertInputFormat('ppc', 'objdump', asm);
   const instrs = parseDisasm(sliceSymbol(asm, name)); // ONE function only — an absent symbol declines loud
@@ -1516,6 +1533,8 @@ function liftOnce(
     prototypes,
     jts,
     () => (!ownDeclared ? undefined : ownDeclarationOf(name, prototypes, contextOwnProto)),
+    calleeBodyBound,
+    entryReadCalls,
   );
   const lrUnproven = linkRegisterProof(blocks, succIdx, r1At, target);
 
@@ -2770,6 +2789,11 @@ function liftOnce(
               // of the parameter area (mwcc 2.3.3 builds `g(1, 2, 3, 4, 5, 6, 7, x)` with `long long x`
               // that way). A single word there cannot be an argument after seven: the eighth word would
               // have gone in r10.
+              //
+              // KNOWN GAP: the callee's body is not asked how many stack words it loads, as the
+              // Thumb and O32 frontends ask it (frontend/callee-body.ts `CalleeStackWords`): this
+              // frontend passes no stack word to any call, and `measurePpcFrame` refuses even a
+              // declared one that takes some, so a body would have nothing to license here.
               refuse: (argc) => {
                 if (argc < ARG_REGS.length - 1) {
                   return;