@asmlift/core 0.10.0 → 0.11.0

package/src/frontend/register-struct-call.ts

@@ -25,6 +25,7 @@
 // drops the rest, a mask. A function that reads past them — stores the whole word, compares it,
 // returns it where its own declaration says it returns a value — declines; one whose return
 // nothing declares returns no value instead, where that guessed return is the only such reader.
+import { demandedBits } from '../ir/bits';
 import {
   type Block,
   CALL_RETURN_OBJECT,
@@ -396,89 +397,3 @@ function foldFrameHome(fn: Fn, { block, local, size, word, loaded }: Image): voi
 }
 
 const FULL = 0xffffffff;
-
-/** THE BITS OF `v` ANY READER NEEDS, as a mask: a store of W bytes needs the low 8W bits of the
- *  value it stores, a constant mask and the bitwise ops pass their readers' bits through, a shift
- *  by a constant moves them, an add, a subtract or a multiply needs every bit up to its readers'
- *  highest, since a carry only travels up, and a join needs what its parameter's readers need.
- *  Every other reader — a compare, a call, an address — needs all 32, and so does a join that
- *  reaches itself again. A `ret` needs none where the function's own declaration returns nothing. */
-function demandedBits(fn: Fn, root: Value, voidOwn: boolean): number {
-  const defs = defOpMap(fn);
-  const memo = new Map<Value, number>();
-  const constOf = (x: Value): number | undefined => {
-    const d = defs.get(x);
-    return d?.opcode === 'const' && typeof d.attrs.value === 'number' ? d.attrs.value >>> 0 : undefined;
-  };
-  const upTo = (d: number): number => (d === 0 ? 0 : d >= 0x80000000 ? FULL : (2 ** (32 - Math.clz32(d)) - 1) >>> 0);
-  const of = (v: Value): number => {
-    const known = memo.get(v);
-    if (known !== undefined) {
-      return known;
-    }
-    memo.set(v, FULL); // a reader reached again through a join needs everything
-    let need = 0;
-    for (const b of fn.blocks) {
-      for (const op of b.ops) {
-        for (const e of op.successors) {
-          e.args.forEach((a, i) => {
-            if (a === v) {
-              need |= of(e.block.params[i]);
-            }
-          });
-        }
-        if (!op.operands.includes(v)) {
-          continue;
-        }
-        const out = () => (op.results.length === 1 ? of(op.results[0]) : FULL);
-        const imm = typeof op.attrs.imm === 'number' && op.operands.length === 1 ? op.attrs.imm : undefined;
-        const other = op.operands.length === 2 ? op.operands[op.operands[0] === v ? 1 : 0] : undefined;
-        switch (op.opcode) {
-          case 'store':
-            need |=
-              op.operands[0] === v || typeof op.attrs.width !== 'number' || op.attrs.width >= 4
-                ? FULL
-                : (1 << (8 * op.attrs.width)) - 1;
-            break;
-          case 'ret':
-            need |= voidOwn ? 0 : FULL;
-            break;
-          case 'and': {
-            const c = other === undefined || other === v ? undefined : constOf(other);
-            need |= c === undefined ? out() : out() & c;
-            break;
-          }
-          case 'or':
-          case 'xor':
-          case 'not':
-            need |= other === v ? FULL : out();
-            break;
-          case 'add':
-          case 'sub':
-          case 'mul':
-          case 'neg':
-            need |= other === v ? FULL : upTo(out());
-            break;
-          case 'shl':
-            need |= imm === undefined ? FULL : out() >>> imm;
-            break;
-          case 'shr_u':
-            need |= imm === undefined ? FULL : (out() << imm) >>> 0;
-            break;
-          case 'shr_s': {
-            const d = out();
-            need |=
-              imm === undefined ? FULL : ((d << imm) | (imm > 0 && d >>> (32 - imm) !== 0 ? 0x80000000 : 0)) >>> 0;
-            break;
-          }
-          default:
-            need |= FULL;
-        }
-        need >>>= 0;
-      }
-    }
-    memo.set(v, need);
-    return need;
-  };
-  return of(root);
-}

package/src/frontend/ssa.ts

@@ -16,6 +16,7 @@
 // `irBlocks`, args left empty — phi wiring appends them), then call `markFilled(b)`. When all
 // blocks are filled, call `finish()` to remove trivial phis.
 import {
+  type AsmLayout,
   Block,
   Fn,
   Op,
@@ -65,6 +66,11 @@ export interface SsaBuilder {
    *
    *  One of the three call verbs `CallDeclarations.lower` owns ({@link noteCall}). */
   readGuessedArg(reg: string, b: number): Value;
+  /** Record that the call being lowered in block `b` reads `v` from argument register `reg` it
+   *  guessed it takes, for {@link readAfterEveryReachingWrite} alone: the call is an instruction
+   *  reading what the register's last write left there, as a sibling path's call may be, while
+   *  {@link readGuessedArg} makes the read carry no claim for `finish` to judge. */
+  noteGuessedArgRead(reg: string, b: number, v: Value): void;
   /** The value `reg` holds at the END of block `b` once `b` is filled, as the edges out of it carry
    *  it; `null` before. A lookup, not a read: it records no read for `finish` to judge. */
   readAtEnd(reg: string, b: number): Value | null;
@@ -125,6 +131,46 @@ export interface SsaBuilder {
   /** Whether block `b` WROTE `reg` since its last call so far (since its start if it made none).
    *  Only a write counts: a read leaves a definition behind but is not one (`writeVar`). */
   writtenSinceCall(reg: string, b: number): boolean;
+  /** How many ops block `b` held when it last wrote `reg` so far, or `undefined` where `b` has not
+   *  written it: every op at or past that index came after the write. A copy (`add r1, r5, #0`) names
+   *  no new value, so this is how a question about one WRITE of a register is asked, where its value
+   *  was read before the write too (frontend/call-plan.ts `leftover`). */
+  lastWriteOp(reg: string, b: number): number | undefined;
+  /** Whether an instruction READ `reg` after EACH write of it that reaches block `b` and whose value
+   *  `passes`, on ANY path out of that write but the ones into `b`, the first read on that path being
+   *  one whose value `accept` takes. A write no read follows on any path was
+   *  made for `b`'s use, so one is enough to answer no. A call destroying `reg` is no write of this
+   *  function's, and neither is the entry's value where a path from the entry writes neither, so they
+   *  do not answer no; the entry's value read after (as `accept` takes it), or read by a lowered op
+   *  at all (as `unlowered` takes it: no write placed that read), counts as a write read. Where a
+   *  call destroyed `reg` on EVERY path in, it holds what a callee left there and the answer is yes.
+   *  The question is about the write, not its value: a copy (`add r4, r0, #0`) reads `r0` and lowers
+   *  to no op, so no op-level question sees that read, and it counts here; a copy made in an earlier
+   *  block names the value it copies, read before that write too, and is no read of it. Any path out
+   *  of the write, because a MIPS compiler hoists one call's argument into the delay slot of the
+   *  branch that picks it (`bnez v0, L; move a0, zero`), so the write reaches the other call unread
+   *  on the path between. `b`'s own reads are not asked: what a read there that lowers to no op says
+   *  differs by compiler (frontend/call-plan.ts `leftover`). Only the frontend's own reads count
+   *  ({@link readVar}), and a guessed call's argument read the planner records for it
+   *  ({@link noteGuessedArgRead}: a sibling path's call reads the write); a lookup this construction
+   *  makes, or the planner's own probe ({@link readGuessedArg} alone), is none. A block not
+   *  filled yet is passed through looking for the write, as {@link holdsValue} does; a path out of
+   *  a write that reaches one has reads nobody has seen yet, and the write's value answers for it
+   *  as `unlowered` takes it (IDO reloads `lw a0, 24(sp)` in a branch's delay slot for the arm laid
+   *  out after the call). A write of a value `answersIfRead` takes (an earlier call's result, copied
+   *  or reloaded) answers yes where it was read after, and is otherwise none: such a value is the
+   *  callee's, saved across a call as often as handed to one. `undefined` where no write of this
+   *  function's is left to judge and no entry value read: the question has no answer here. */
+  readAfterEveryReachingWrite(
+    reg: string,
+    b: number,
+    ask: {
+      passes: (v: Value) => boolean;
+      accept: (v: Value) => boolean;
+      unlowered: (v: Value) => boolean;
+      answersIfRead: (v: Value) => boolean;
+    },
+  ): boolean | undefined;
   /** Whether EVERY path into this point of block `b` wrote `reg` (or had a call destroy it) after
    *  leaving the last block `stop` names: {@link writtenSinceCall} asked of `b` so far and, where `b`
    *  did not write it, of each predecessor in turn. A path reaching a `stop` block, the entry, or a
@@ -610,6 +656,57 @@ export function clobberedByCall(target: {
   return target.callerSaved.filter((r) => r !== target.returnReg);
 }
 
+/** One asm block as {@link recordAsmLayout} reads it: its instructions without its control transfer,
+ *  and whether that transfer is an unconditional jump to a label. `undefined` for a block the
+ *  frontend made up, which has no place in the asm. An instruction's `reloc` is the relocation that
+ *  fills it, where the operands do not name the symbol (disasm.ts `DisasmInstr.reloc`). */
+export interface AsmBlockText {
+  readonly body: readonly {
+    readonly mnemonic: string;
+    readonly ops: readonly string[];
+    readonly reloc?: { readonly sym: string; readonly addend: number };
+  }[];
+  readonly endsInJump: boolean;
+  /** which instructions of `body` make a call, which only the frontend's ISA knows */
+  readonly isCall: (ins: AsmBlockText['body'][number]) => boolean;
+}
+
+/** One instruction of {@link AsmBlockText} as the layout record spells it: `mnemonic op,op`, then the
+ *  symbol its relocation fills in, if any. In a relocatable object's disassembly the operands of a
+ *  global's load or store, or of a call, read the same whichever symbol it is: gcc 2.7.2's `lui
+ *  at,0x0` / `sw a2,0(at)` for `gT = c` and for `gW = c`, and `jal 0 <f>` for every callee. Spelled
+ *  without the symbol, two arms that store to different globals would read as identical bodies. */
+function layoutText(ins: AsmBlockText['body'][number]): string {
+  const text = ins.ops.length ? `${ins.mnemonic} ${ins.ops.join(',')}` : ins.mnemonic;
+  if (ins.reloc === undefined) {
+    return text;
+  }
+  const addend = ins.reloc.addend === 0 ? '' : `+0x${ins.reloc.addend.toString(16)}`;
+  return `${text} <${ins.reloc.sym}${addend}>`;
+}
+
+/** The layout record (ir/core.ts `AsmLayout`): asm block `i` is `irBlocks[i]`, which is how every
+ *  frontend's builder numbers them, and its index is its position among the blocks that have a
+ *  place in the asm. */
+export function recordAsmLayout(
+  irBlocks: readonly Block[],
+  asmBlocks: readonly (AsmBlockText | undefined)[],
+): AsmLayout {
+  const layout: AsmLayout = new Map();
+  let index = 0;
+  asmBlocks.forEach((ab, i) => {
+    if (ab !== undefined) {
+      layout.set(irBlocks[i], {
+        index: index++,
+        body: ab.body.map(layoutText),
+        calls: ab.body.flatMap((ins, at) => (ab.isCall(ins) ? [at] : [])),
+        endsInJump: ab.endsInJump,
+      });
+    }
+  });
+  return layout;
+}
+
 export function makeSsaBuilder(
   name: string,
   blockCount: number,
@@ -670,6 +767,7 @@ export function makeSsaBuilder(
     slotHomes: undefined,
     paramEvidence: undefined,
     localObjects: undefined,
+    asmLayout: undefined,
   };
 
   const defs: Array<Map<string, Value>> = irBlocks.map(() => new Map());
@@ -696,6 +794,16 @@ export function makeSsaBuilder(
 
   // `preds` lists an entry per CFG EDGE; these are the distinct predecessor BLOCKS.
   const distinctPreds = (b: number): number[] => [...new Set(preds[b])];
+  // the distinct successor blocks of each, built on first ask (`readAfterEveryReachingWrite`)
+  let successorsMemo: number[][] | undefined;
+  const successors = (): number[][] => {
+    if (successorsMemo === undefined) {
+      const succ: number[][] = irBlocks.map(() => []);
+      irBlocks.forEach((_, s) => distinctPreds(s).forEach((p) => succ[p].push(s)));
+      successorsMemo = succ;
+    }
+    return successorsMemo;
+  };
 
   // CALLER-SAVED CLOBBER, for guessed call arities (see trimClobberedCallArgs). Tracked HERE
   // because every register write in every frontend already goes through `writeVar`: a frontend
@@ -744,6 +852,13 @@ export function makeSsaBuilder(
   // every ISA with no frontend code. Per block, because the consumer asks a per-EDGE question.
   const writeCount: number[] = irBlocks.map(() => 0);
   const lastWriteAt: Array<Map<string, number>> = irBlocks.map(() => new Map());
+  // the ops block `b` held at each register's last write in it (`lastWriteOp`)
+  const lastWriteOp: Array<Map<string, number>> = irBlocks.map(() => new Map());
+  // the value an instruction last read of each register block `b` read since its last write or the
+  // last call destroying it there (since the block's start where neither), and the value it first
+  // read of each before writing it or a call destroying it: `readAfterEveryReachingWrite`
+  const readSinceWrite: Array<Map<string, Value>> = irBlocks.map(() => new Map());
+  const readBeforeWrite: Array<Map<string, Value>> = irBlocks.map(() => new Map());
   const writeOrder: WriteOrder = { lastWrite: new Map(), writes: new Map() };
   fn.writeOrder = writeOrder;
 
@@ -935,6 +1050,8 @@ export function makeSsaBuilder(
     decidedLocal[b].add(reg);
     defs[b].set(reg, v);
     lastWriteAt[b].set(reg, writeCount[b]++);
+    lastWriteOp[b].set(reg, irBlocks[b].ops.length);
+    readSinceWrite[b].delete(reg);
   };
   const readVar = (reg: string, b: number): Value => {
     if (globalRegs.has(reg)) {
@@ -948,8 +1065,16 @@ export function makeSsaBuilder(
     }
     const v = readAny(reg, b);
     noteStaleCandidate(reg, b, v);
+    noteRead(reg, b, v);
     return v;
   };
+  // an instruction's read, for `readAfterEveryReachingWrite`
+  const noteRead = (reg: string, b: number, v: Value): void => {
+    readSinceWrite[b].set(reg, v);
+    if (!lastWriteOp[b].has(reg) && !clobberedLocal[b].has(reg) && !readBeforeWrite[b].has(reg)) {
+      readBeforeWrite[b].set(reg, v);
+    }
+  };
   /** The lookup, with no claim attached. The FRONTEND's read is what asserts "this register holds
    *  this value here"; the lookups this construction makes on its own — a single predecessor's
    *  definition, a phi's operand at each in-edge — are how that one read is answered, not further
@@ -1644,6 +1769,7 @@ export function makeSsaBuilder(
     irBlocks,
     readVar,
     readGuessedArg: readAny, // see the interface: the trim is this read's answer, not a refusal
+    noteGuessedArgRead: noteRead,
     readAtEnd: (reg: string, b: number) => (filled[b] ? readAny(reg, b) : null),
     writeVar,
     frameWrites,
@@ -1655,6 +1781,79 @@ export function makeSsaBuilder(
     entryValue,
     holdsEntryValue,
     writtenSinceCall: (reg: string, b: number) => writtenSinceCall[b].has(reg),
+    lastWriteOp: (reg: string, b: number) => lastWriteOp[b].get(reg),
+    readAfterEveryReachingWrite: (reg, b, { passes, accept, unlowered, answersIfRead }) => {
+      const writes = (at: number) => lastWriteOp[at].has(reg) || clobberedLocal[at].has(reg);
+      // the blocks whose last write of `reg` reaches `b`, and whether a path from the entry wrote none.
+      // `b` is judged up to here: met again round a loop, its end is no write that reaches here yet
+      const writers: number[] = [];
+      let fromEntry = false;
+      const back = new Set<number>([b]);
+      const walkBack = (at: number): void => {
+        for (const p of distinctPreds(at)) {
+          if (back.has(p)) {
+            continue;
+          }
+          back.add(p);
+          if (filled[p] && writes(p)) {
+            writers.push(p);
+          } else if (preds[p].length === 0) {
+            fromEntry = true;
+          } else {
+            walkBack(p);
+          }
+        }
+      };
+      walkBack(b);
+      const succs = (at: number): number[] => successors()[at].filter((s) => s !== b);
+      // forward from a write of `written` (none for the entry's): the first read on each path, until
+      // another write ends it
+      const ahead = (from: number, seen: Set<number>, written: Value | undefined): boolean =>
+        succs(from).some((s) => {
+          if (seen.has(s)) {
+            return false;
+          }
+          seen.add(s);
+          if (!filled[s]) {
+            return written !== undefined && unlowered(written);
+          }
+          const read = readBeforeWrite[s].get(reg);
+          if (read !== undefined) {
+            return accept(read);
+          }
+          return !writes(s) && ahead(s, seen, written);
+        });
+      const readAfter = (w: number): boolean => {
+        const read = readSinceWrite[w].get(reg);
+        return read !== undefined ? accept(read) : ahead(w, new Set(), defs[w].get(reg));
+      };
+      // a call's destroying it is no write of this function's: it neither counts nor answers; and a
+      // write of a value `answersIfRead` takes answers only where it was read after
+      const own = writers.filter((w) => {
+        const v = defs[w].get(reg)!;
+        return !clobberedLocal[w].has(reg) && passes(v) && (!answersIfRead(v) || readAfter(w));
+      });
+      // nor does the entry's value unread: nothing wrote it for the call. Read, it answers by its
+      // value too (`unlowered`): no write of this function's made it, so no path out of one places
+      // the read, and a path from the entry into a block not lowered yet holds reads nobody has seen
+      const param = irBlocks[0].params.find((v) => paramReg.get(v) === reg);
+      const entryRead =
+        fromEntry &&
+        ((param !== undefined && unlowered(param)) ||
+          (readBeforeWrite[0].has(reg) ? accept(readBeforeWrite[0].get(reg)!) : ahead(0, new Set(), undefined)));
+      // where a call destroyed it on every path in, it holds what a callee left there and nothing
+      // this function named: no argument, whatever an earlier lookup's phi of the bytes before
+      // those calls says (counted, sbk func_800B6E5C_A6D0C's a1 and a2 would be minted as entry
+      // parameters the trim cuts from the call but leaves in the signature)
+      if (!fromEntry && writers.length > 0 && writers.every((w) => clobberedLocal[w].has(reg))) {
+        return true;
+      }
+      // no write of this function's left to judge, and no entry value read: nothing to answer
+      if (own.length === 0 && !entryRead) {
+        return undefined;
+      }
+      return own.every(readAfter);
+    },
     writtenOnEveryPath: (reg, b, stop, visit) => {
       // `b` is judged up to here on the first visit; met again round a loop, it is the end of `b`,
       // which a back edge brings, and a cycle adds no path the first visit did not judge
@@ -1702,6 +1901,7 @@ export function makeSsaBuilder(
       for (const r of clobbers) {
         clobberedLocal[b].add(r);
         decidedLocal[b].add(r);
+        readSinceWrite[b].delete(r);
       }
       imageLocal[b] = new Set();
     },
@@ -2108,6 +2308,27 @@ export function fallbackArgc(
      *  ahead of the idiom and `bl h; mov r0,#1; bl g` in a case lifts `g(1)` — the gap rule's
      *  `setUp` walks through calls and would count r3's copy, which `h` destroyed. */
     parked?: (reg: string) => boolean;
+    /** how many argument words the callee's own body reads at most (frontend/callee-body.ts),
+     *  asked only where it can answer something. It is an upper bound on what the callee READS, and
+     *  a source call passes more than that whenever a parameter goes unused or a K&R call hands
+     *  extra arguments — `setx(a + 1, 4)` to a body reading only its first, `rd1(a, b, 7)` to one
+     *  reading r0 — so it never caps what the caller set up for the call: such a register stays
+     *  counted, and a value above a gap still decides the gap below it (`decide`). It answers only
+     *  for registers at or past it, whose being arguments changes nothing the callee computes:
+     *    - one that is a `leftover` stops the count: a write something else read since, which the
+     *      call found there (`gH = 5; gA = rnd()` leaves the store's 5 in r0, which the guess took as
+     *      `rnd(5)`). A copy made for the call is none, whatever read its value before
+     *      (`g4(a, b, c, d); un(a, b, c, d)` copies a..d back from their homes for `un`);
+     *    - a gap starting there, under a register that is a leftover or that no proof makes an
+     *      argument, stops the count at the gap rather than refuse.
+     *  A gap BELOW the bound refuses as ever, whatever lies above it: the callee may read it, and it
+     *  holds this function's own incoming value or nothing. `gp = 3; gq = rd1(a)` leaves the store's 3
+     *  in r1 above r0's a, and stopping there would drop the `a` rd1 reads. */
+    bound?: () => number | undefined;
+    /** whether what reaches argument register `reg` was written for something other than the call,
+     *  which read it since, and left there (frontend/call-plan.ts `leftover`). Asked only at or past
+     *  `bound`. */
+    leftover?: (reg: string) => boolean;
   },
 ): number {
   const accept = opts.accept ?? (() => true);
@@ -2121,9 +2342,16 @@ export function fallbackArgc(
   const top = parkedAt < 0 ? argRegs.length : parkedAt;
   // the run of argument registers the caller set up from `from`, each past a declaration's
   // stated words asked whether it still holds the incoming value
+  // whether argument register `k` lies at or past what the callee's own body reads
+  const unread = (k: number): boolean => {
+    const b = opts.bound?.();
+    return b !== undefined && k >= b;
+  };
+  // past the bound, a leftover is no argument (`bound`): leftover first, the cheaper question
+  const notPassed = (k: number): boolean => opts.leftover?.(argRegs[k]) === true && unread(k);
   const run = (from: number): number => {
     let n = from;
-    while (n < top && setUp(n)) {
+    while (n < top && setUp(n) && !notPassed(n)) {
       // PAST A DECLARATION'S STATED WORDS, A REGISTER STILL HOLDING ITS INCOMING VALUE REFUSES. A
       // read of it (a home store, a compare, a store to a global) leaves the entry parameter behind
       // as a definition, so it reads as set up, and it is exactly as undecidable as the gap below: the
@@ -2151,7 +2379,13 @@ export function fallbackArgc(
     }
     return n;
   };
+  // where the run stopped at a register set up but no argument (`bound`), every one above is past
+  // the bound too, and the count ends there
+  const stoppedPast = (n: number): boolean => n < top && setUp(n);
   let n = run(floor);
+  if (stoppedPast(n)) {
+    return n;
+  }
   // A GAP BELOW A REGISTER THAT HOLDS A VALUE refuses, unless the frontend decides it: then the run
   // goes on through the gap and the register above it, and the next gap is asked the same.
   //
@@ -2176,15 +2410,30 @@ export function fallbackArgc(
             `value and ${argRegs[gapAt]} holds none — an argument register left at its incoming value and one ` +
             `the call does not pass look the same here, so the argument count is not decidable`,
         );
+      // the gap and the register above it are past what the callee reads: no argument it can tell
+      // from a missing one, so the count stops below the gap as at a gapless call
+      if (opts.leftover?.(argRegs[k]) === true && unread(gapAt)) {
+        return gapAt;
+      }
       if (!opts.decide?.(argRegs.slice(n, k), argRegs[k], refuse)) {
+        if (unread(gapAt)) {
+          return gapAt;
+        }
         refuse();
       }
       n = run(k);
+      const stopped = stoppedPast(n);
       for (let above = k + 1; above < n; above++) {
         if (!opts.decide?.([], argRegs[above], refuse)) {
+          if (unread(above)) {
+            return above;
+          }
           refuse();
         }
       }
+      if (stopped) {
+        return n;
+      }
       k = n;
     }
   }
@@ -2909,8 +3158,21 @@ export function abiSortEntryParams(
   assertTrueEntry(entryHasPreds);
   const rank = (v: Value): number => slots.slotOf(paramReg.get(v) ?? '') ?? NOT_AN_ARGUMENT;
   entry.params.sort((x, y) => rank(x) - rank(y));
+  for (const v of entry.params) {
+    const r = rank(v);
+    if (r !== NOT_AN_ARGUMENT) {
+      argRanks.set(v, r);
+    }
+  }
 }
 
+/** The ABI argument rank each entry parameter arrived in, as {@link abiSortEntryParams} ranked it. */
+const argRanks = new WeakMap<Value, number>();
+
+/** The argument rank (registers counted, then incoming stack words) entry parameter `v` arrived in,
+ *  or undefined for a live-in that is no argument slot, or a value no entry sort ranked. */
+export const entryArgRank = (v: Value): number | undefined => argRanks.get(v);
+
 function assertTrueEntry(entryHasPreds: boolean): void {
   if (entryHasPreds) {
     throw new Error('internal: the entry-parameter rule needs an entry block with no predecessors');

package/src/frontend/stackargs.ts

@@ -39,8 +39,9 @@ export interface StackArgsEscape {
 /** A call, and what its callee's DECLARATION says it takes on the stack. `declared` is the block
  *  `[0, 4*(n - argRegs))` as an ascending offset list, or null when nothing declares this call —
  *  an indirect call, a callee with no prototype, or one whose arity fits in registers. The code
- *  alone cannot say where a null declaration's block ENDS, so such a call is never handed a stack
- *  word; it lifts only when `loadedWordBound` clears every word that could open one. */
+ *  alone cannot say where a null declaration's block ENDS, so such a call is handed a stack word
+ *  only where its callee's body says where it starts (`bodyReads`); otherwise it lifts only when
+ *  `loadedWordBound` clears every word that could open one. */
 export interface StackArgsCall<C> {
   readonly kind: 'call';
   /** The frontend's own handle for this call — the key of `OutgoingArgs.blocks`. */
@@ -51,6 +52,11 @@ export interface StackArgsCall<C> {
   /** The parameters the declaration lists, for the refusal messages — fewer than its words when a
    *  64-bit parameter takes two or a hidden struct-return pointer takes one. Absent, one per word. */
   readonly params?: number;
+  /** Where nothing declares the call: one past the highest word of its incoming stack area the
+   *  callee's own body is proven to load (frontend/callee-body.ts `CalleeStackWords`), a LOWER bound
+   *  on its stack words — asked, since it may lift the callee, only where [sp,#0] is stored and never
+   *  loaded (`analyzeOutgoingArgs`). Absent, or answering 0 or nothing, the body proves nothing. */
+  readonly bodyReads?: () => number | undefined;
 }
 
 /** One basic block's events. Where control goes afterwards is read out of `preds`, so a block is
@@ -209,8 +215,33 @@ export function loadedWordBound<C>(
 //
 // A LICENSED CALL CONSUMES ITS BLOCK, which is what lets a function make several calls: the
 // callee reads those words, so they stop being pending after it, exactly as a reload would end
-// them. The deletion is driven by the DECLARATION alone, never by the licence, so the fixpoint
-// cannot depend on its own outcome.
+// them. The deletion is driven by the DECLARATION (or the body's reads, below) alone, never by the
+// licence, so the fixpoint cannot depend on its own outcome.
+//
+// THE CALLEE'S BODY STANDS IN FOR A MISSING DECLARATION, on one side only. A compiled callee loads
+// incoming stack word k only as its argument |argRegs|+k, so a body proven to load word n-1
+// (`bodyReads` n) takes at least n stack words — a LOWER bound, as a declaration is, and never an
+// upper one: a parameter it does not load, or one it loads past the straight-line entry it was
+// scanned over, is a word it takes all the same. The CODE closes the block from above: the call is
+// licensed only where what reaches it staged, on every path (must) and on some path (may, beneath
+// the loaded-word bound), is exactly `[0, 4n)` — by CONTIGUITY a conforming caller stores every
+// argument word of a call, so a word past the body's reads that it does not stage is no argument.
+// Anything else is the call it was before the witness existed: unlicensed, and refused by (a) or
+// (b) wherever they refused it — so the witness only ever turns a decline into a lift, and only at
+// a call [sp,#0] reached staged, which (b) refused.
+/** THE BODY'S LICENCE, the one rule both ISAs that stage stack arguments decide by (this file's
+ *  dataflow for Thumb, frontend/mips.ts `lowerJal` for O32 over its SSA reaching definitions): a
+ *  call nothing declares, whose callee's body loads `n` incoming stack words, takes exactly those
+ *  `n` where the words staged for it are exactly `[0, 4n)` from the start of the outgoing area —
+ *  `may` the words that reach it pending on SOME path (beneath the loaded-word bound), and `must`
+ *  whether a word reaches it pending on EVERY path. Pending means stored and not consumed since: a
+ *  load, or an earlier call whose block held the word, ends it. Offsets are relative to the area's
+ *  start (0 on agbcc, 16 on O32). */
+export function bodyBlockAgrees(n: number, may: Iterable<number>, must: (off: number) => boolean): boolean {
+  const staged = [...may].sort((x, y) => x - y);
+  return n > 0 && staged.length === n && staged.every((o, i) => o === 4 * i && must(o));
+}
+
 export function analyzeOutgoingArgs<C>({
   blocks: asmBlocks,
   preds,
@@ -221,6 +252,26 @@ export function analyzeOutgoingArgs<C>({
   loadedWordBound: bound,
 }: StackArgsInput<C>): OutgoingArgs<C> {
   const refuse = (blocker: string): OutgoingArgs<C> => ({ blocker, blocks: new Map(), area: 0 });
+  // the block the callee's body proves it reads into, for an undeclared call (`bodyReads`), asked
+  // only where [sp,#0] is stored and never loaded: every block a licence names starts there, and
+  // a load of it puts the loaded-word bound at 0, so no word reaches any call beneath it. A fact of
+  // the code, not of the dataflow, so the fixpoint below never decides which calls ask.
+  const events = asmBlocks.flatMap((ab) => ab.events);
+  const asksBodies =
+    events.some((e) => e.kind === 'store' && e.off === 0) && !events.some((e) => e.kind === 'load' && e.off === 0);
+  const bodyWords = new Map<StackArgsCall<C>, number[]>();
+  const bodyBlock = (ev: StackArgsCall<C>): number[] => {
+    if (ev.declared !== null || ev.bodyReads === undefined || !asksBodies) {
+      return [];
+    }
+    if (!bodyWords.has(ev)) {
+      bodyWords.set(
+        ev,
+        Array.from({ length: ev.bodyReads() ?? 0 }, (_, i) => 4 * i),
+      );
+    }
+    return bodyWords.get(ev)!;
+  };
   // EVERY block, not the entry-reachable ones: a call in dead code stages nothing, so the
   // dataflow below never finds its block and it refuses — which is the verdict it had before
   // consumption existed. An unreachable `bl` is not evidence about the frame either way, and
@@ -235,6 +286,7 @@ export function analyzeOutgoingArgs<C>({
     return { blocker: null, blocks: new Map(), area: 0 };
   }
   const say = (offs: readonly number[]) => offs.map((o) => `[sp,#${o}]`).join(', ');
+  const sayAll = (offs: readonly number[]) => (offs.length === 0 ? 'none' : say(offs));
   const declaredAs = (ev: StackArgsCall<C>, offs: readonly number[]) => {
     const words = argRegs + offs.length;
     return ev.params === undefined || ev.params === words
@@ -331,7 +383,7 @@ export function analyzeOutgoingArgs<C>({
           mayAt.set(ev, belowBound(may));
           mustAt.set(ev, new Set(must));
           storedAt.set(ev, new Set(stored));
-          for (const o of ev.declared ?? []) {
+          for (const o of ev.declared ?? bodyBlock(ev)) {
             may.delete(o);
             must.delete(o);
           }
@@ -392,6 +444,13 @@ export function analyzeOutgoingArgs<C>({
   for (const ev of calls) {
     const offs = ev.declared;
     if (offs === null) {
+      // the body's witness: licensed on exact agreement, else left to (a) and (b) as before
+      const body = bodyBlock(ev);
+      const must = mustAt.get(ev) ?? new Set<number>();
+      if (bodyBlockAgrees(body.length, mayAt.get(ev) ?? [], (o) => must.has(o))) {
+        blocks.set(ev.call, body);
+        area = Math.max(area, 4 * body.length);
+      }
       continue;
     }
     const may = mayAt.get(ev) ?? new Set<number>();
@@ -429,7 +488,7 @@ export function analyzeOutgoingArgs<C>({
     const clash = offs.find((o) => o >= lowestEscape);
     if (clash !== undefined) {
       return refuse(
-        `callee \`${ev.callee}\` is declared with ${declaredAs(ev, offs)}, so [sp,#${clash}] is its outgoing stack argument — ` +
+        `callee \`${ev.callee}\` ${ev.declared === null ? `loads ${offs.length} incoming stack words in its body` : `is declared with ${declaredAs(ev, offs)}`}, so [sp,#${clash}] is its outgoing stack argument — ` +
           `but the frame address [sp,#${lowestEscape}] escapes this function, so the words from there up are an object's, and the two name the same word`,
       );
     }
@@ -481,6 +540,33 @@ export function analyzeOutgoingArgs<C>({
       );
     }
   }
+  // (b)'s question, asked of one call (see (b) below): the refusal, or null where nothing staged
+  // there could open an argument block. A call the body's witness was asked of and did not license
+  // is asked it BEFORE (a), so its decline names both witnesses; (a) would refuse it anyway, or (b)
+  // would, so only the message moves.
+  const pendingAtUndeclared = (ev: StackArgsCall<C>): string | null => {
+    if (ev.declared !== null || blocks.has(ev.call)) {
+      return null;
+    }
+    const may = mayAt.get(ev) ?? new Set<number>();
+    const stored = storedAt.get(ev) ?? new Set<number>();
+    const body = bodyBlock(ev);
+    const why =
+      body.length === 0
+        ? ''
+        : ` (its body loads ${body.length} incoming stack word${body.length === 1 ? '' : 's'}, ${say(body)}, ` +
+          `but the words staged for it are ${sayAll(asc(may))}, on every path ${sayAll(asc(mustAt.get(ev) ?? []))})`;
+    const k = asc(may).find((o) => prefixStored(o, stored));
+    return k === undefined
+      ? null
+      : `the store to [sp,#${k}] reaches \`bl ${ev.callee}\` unread with its lower slots supplied — it may be that call's outgoing stack argument${why}`;
+  };
+  for (const ev of calls) {
+    const refusal = bodyBlock(ev).length > 0 ? pendingAtUndeclared(ev) : null;
+    if (refusal !== null) {
+      return refuse(refusal);
+    }
+  }
   // (a) — a store never reloaded ANYWHERE, with its lower slots supplied, is an argument's
   // signature: an outgoing argument is read by the CALLEE, never by the caller. Its real theorem
   // is the layout one (the area sits at the BOTTOM of localArea, disjoint from the locals, so no
@@ -504,17 +590,9 @@ export function analyzeOutgoingArgs<C>({
   // histogram keys on, and scanning a Set in insertion order named whichever offset the code stored
   // FIRST instead (pokeemerald's `PickLotteryCornerTicket` stores [sp,#4] before [sp,#0]).
   for (const ev of calls) {
-    if (ev.declared !== null) {
-      continue;
-    }
-    const may = mayAt.get(ev) ?? new Set<number>();
-    const stored = storedAt.get(ev) ?? new Set<number>();
-    for (const k of asc(may)) {
-      if (prefixStored(k, stored)) {
-        return refuse(
-          `the store to [sp,#${k}] reaches \`bl ${ev.callee}\` unread with its lower slots supplied — it may be that call's outgoing stack argument`,
-        );
-      }
+    const refusal = pendingAtUndeclared(ev);
+    if (refusal !== null) {
+      return refuse(refusal);
     }
   }
   // NOTHING LEFT OVER. The exclusion above is per OFFSET, so it would also excuse a store to a