@asmlift/core 0.2.0 → 0.4.0

package/src/frontend/frontend.ts

@@ -4,6 +4,7 @@
 // for target→frontend dispatch.
 import type { Fn } from '../ir/core';
 import type { Prototypes } from '../proto';
+import type { SymbolMap } from '../symbols';
 import type { TargetDescription } from '../target';
 import type { AsmData } from './asmdata';
 import type { AsmTextFormat } from './format';
@@ -17,6 +18,15 @@ export interface Frontend {
   /** decode one function's assembly into an L1 Fn. `prototypes` supplies callee arities
    *  (and any other header facts the frontend needs); an empty map is valid. `asmData` is the
    *  OPTIONAL Regime-B side-table (data-section jump tables + relocations); absent ⇒ a
-   *  dense-switch dispatch declines/loud-fails. */
-  lift(name: string, asm: string, target: TargetDescription, prototypes: Prototypes, asmData?: AsmData): Fn;
+   *  dense-switch dispatch declines/loud-fails. `symbols` is the OPTIONAL address→symbol map
+   *  (symbols.ts); today only the Thumb frontend consumes it (numeric-pool promotion) — the
+   *  MIPS/PPC objdump dialect already carries symbol names in the asm text. */
+  lift(
+    name: string,
+    asm: string,
+    target: TargetDescription,
+    prototypes: Prototypes,
+    asmData?: AsmData,
+    symbols?: SymbolMap,
+  ): Fn;
 }

package/src/frontend/mips.ts

@@ -19,7 +19,7 @@
 // compares (`sltu`/`sltiu`) lower to `icmp_ult`; recover types their operands u32 so the backend
 // re-emits `sltu` (the operator is the same `<` — the signedness lives in the operand types).
 import { Fn, Op, Successor, Value, mkOp, mkValue } from '../ir/core';
-import type { Opcode } from '../ir/opcodes';
+import { NEGATED_ICMP, type Opcode } from '../ir/opcodes';
 import { T } from '../ir/types';
 import type { Prototypes } from '../proto';
 import type { TargetDescription } from '../target';
@@ -47,19 +47,6 @@ const COND_Z: Record<string, Opcode> = {
   bgez: 'icmp_sge',
 };
 const COND_RR: Record<string, Opcode> = { beq: 'icmp_eq', bne: 'icmp_ne' };
-// Negated icmp opcode (for the `slt …; beqz` "branch when false" fold).
-const NEG_ICMP: Record<string, Opcode> = {
-  icmp_slt: 'icmp_sge',
-  icmp_sge: 'icmp_slt',
-  icmp_sgt: 'icmp_sle',
-  icmp_sle: 'icmp_sgt',
-  icmp_ult: 'icmp_uge',
-  icmp_uge: 'icmp_ult',
-  icmp_ugt: 'icmp_ule',
-  icmp_ule: 'icmp_ugt',
-  icmp_eq: 'icmp_ne',
-  icmp_ne: 'icmp_eq',
-};
 
 const isZero = (r: string) => r === 'zero' || r === '$0';
 // The stack pointer (`$29`). A `sw/lw` through it is not a store/load through a data pointer — it
@@ -604,6 +591,18 @@ export function lift(
       }
       return readVar(r, bi);
     };
+    // `slt`-family results, so a following `beqz`/`bnez` can fold into one compare.
+    //
+    // Keyed by the SSA VALUE the compare produced, never by its register. Keying by register is the
+    // bug: `slt v0,a0,a1; xori v0,v0,1; beqz v0,L` (a materialised `a0 >= a1` that a branch then
+    // tests — IDO's spelling, and a live benchmark row) redefines v0, and a register-keyed record
+    // folds the branch against the DEAD `slt`, silently emitting the INVERTED condition. A value
+    // cannot go stale that way: `condValue` resolves the branch's register to whatever value reaches
+    // it and looks THAT up, so a redefinition simply misses and the honest `icmp_eq(rX, 0)` is
+    // emitted. It also needs no invalidation discipline to be maintained by every future writer —
+    // which matters, because `write` is NOT the only path that redefines a register (`lui
+    // rD,%hi(SYM)` deliberately reassigns rD's meaning without it).
+    const cmpDef = new Map<Value, { opcode: string; lhs: Value; rhs: Value }>();
     const write = (r: string, v: Value) => {
       // Writing a register clears any pending `%hi` it held — the high-half address is gone once the
       // register is reassigned (e.g. `lw rHi, %lo(SYM)(rHi)` reuses the base as the load dest). A
@@ -626,13 +625,11 @@ export function lift(
     // DELIBERATELY (unlike divState): a cross-block `mult`/`mflo` pair has no observed inhabitant,
     // and the miss degrades to a LOUD opaque, never silence.
     let mulState: { rs: Value; rt: Value; signed: boolean } | null = null;
-    // `slt`-family results, so a following `beqz`/`bnez` can fold into one compare.
-    const cmpDef = new Map<string, { value: Value; opcode: string; lhs: Value; rhs: Value }>();
     const emitCmp = (opc: Opcode, d: string, lhs: Value, rhs: Value) => {
       const v = mkValue(T.unk(32));
       ops.push(mkOp(opc, { operands: [lhs, rhs], results: [v] }));
       write(d, v);
-      cmpDef.set(d, { value: v, opcode: opc, lhs, rhs });
+      cmpDef.set(v, { opcode: opc, lhs, rhs });
     };
 
     const decode = (ins: Instr) => {
@@ -1053,7 +1050,7 @@ function condValue(
   ops: Op[],
   read: (r: string) => Value,
   constVal: (n: number) => Value,
-  cmpDef: Map<string, { value: Value; opcode: string; lhs: Value; rhs: Value }>,
+  cmpDef: Map<Value, { opcode: string; lhs: Value; rhs: Value }>,
 ): Value {
   const mk = (opc: Opcode, l: Value, r: Value): Value => {
     const v = mkValue(T.unk(32));
@@ -1064,15 +1061,19 @@ function condValue(
     return mk(COND_RR[br.mnemonic], read(br.ops[0]), read(br.ops[1]));
   }
   // *z forms compare a register against zero — except beqz/bnez may fold a preceding `slt`.
-  const rs = br.ops[0];
-  const folded = cmpDef.get(rs);
+  // Resolve the register to its reaching VALUE first: that is the fold's key (so a redefinition
+  // between the compare and the branch misses instead of folding stale), and it is also what
+  // routes the operand through `read`'s loud guards (sp / `%hi` / `gp` used as data) on every
+  // path — the fold used to bypass them by never reading the register at all.
+  const rsv = read(br.ops[0]);
+  const folded = cmpDef.get(rsv);
   if (folded && br.mnemonic === 'bnez') {
-    return folded.value;
+    return rsv;
   } // branch when slt is true
   if (folded && br.mnemonic === 'beqz') {
-    return mk(NEG_ICMP[folded.opcode], folded.lhs, folded.rhs);
+    return mk(NEGATED_ICMP[folded.opcode], folded.lhs, folded.rhs);
   } // …when false
-  return mk(COND_Z[br.mnemonic], read(rs), constVal(0));
+  return mk(COND_Z[br.mnemonic], rsv, constVal(0));
 }
 
 /** The MIPS-II / IDO frontend, registered for the `mips` target. */

package/src/frontend/opaque.ts

@@ -7,6 +7,37 @@
 // This module owns only the POLICY (which token is the destination, which are register sources).
 // The frontend still owns the SSA plumbing (how to `read` a source and `write`/emit the result),
 // because that is block-local state the policy must not touch.
+//
+// ─── A NOTE ON ALTERNATIVE MNEMONIC SPELLINGS ──────────────────────────────────────────────────
+//
+// Every ISA here accepts more than one spelling for some instructions, and the frontends handle
+// that in two DIFFERENT ways on purpose. Which one is right is decided by the operands, not by
+// taste:
+//
+//   * PURE SYNONYM — same operands, same semantics, different name. Normalise it in a name→name
+//     table at the parse site, so every consumer of the mnemonic sees one name. Thumb does this
+//     for `ldsh`/`ldrsh`, `ldsb`/`ldrsb`, `ldm`/`ldmfd`/`ldmia`, `stm`/`stmea`/`stmia`, which
+//     ARM DDI 0029G Figure 1-6 gives a single encoding apiece.
+//
+//     The table is the right shape THERE because the mnemonic is read by more than the decode
+//     switch — Thumb's `classifyXfer` matches it to tell a return from an indirect jump, the
+//     `storeClass` below matches it to decide whether an unmodelled op may be skipped, and the
+//     instruction-size walk tests it for `bl`. An alias arm on one `case` fixes one of those.
+//
+//   * EXTENDED MNEMONIC / PSEUDO-INSTRUCTION — different operand GRAMMAR, so no rename can
+//     express it. Give it its own decode arm. MIPS `move rD,rS` (2 operands) is `addu rD,rS,zero`
+//     (3); PPC `mr rD,rS` is `or rD,rS,rS`; PPC `slwi rD,rS,n` (3) is `rlwinm rD,rS,n,mb,me` (5,
+//     with mask fields computed from n). Routing these through a table would be a category error.
+//
+// There is deliberately NO shared alias helper. As of writing, MIPS and PPC have no pure-synonym
+// gap at all — every `unmodelled instruction` decline they produce across the whole benchmark is
+// a genuinely unmodelled opcode (`lwc1`, `fmuls`, `fctiwz`, `subfe`, …), not a spelling — so such
+// a helper would have exactly one caller. The bar for extracting one is the bar this module itself
+// met: several frontends hand-copying the same policy AND observed drift between the copies.
+//
+// One thing that IS shared, and should stay shared: `display` below. A frontend that normalises
+// spellings must still REPORT the one its input actually used, or a decline sends the reader
+// looking for an instruction their disassembly does not contain.
 import { FrontendUnsupportedError } from './errors';
 
 export interface OpaquePolicy {
@@ -27,6 +58,11 @@ export interface OpaquePolicy {
   storeClass?: RegExp;
   /** attribution for thrown declines: the function being lifted (optionally "+ site"). */
   context?: string;
+  /** How to SPELL the mnemonic in messages, when that differs from the name used to classify it.
+   *  A frontend that normalises legacy spellings (Thumb `ldsh` -> `ldrsh`) classifies on the
+   *  canonical name but must report the one the input file actually contains — otherwise a decline
+   *  names an instruction the reader cannot find in their own .s. Defaults to `mnemonic`. */
+  display?: string;
   /** Mnemonics PROVABLY effect-free — or deliberately transparent (Thumb push/pop frame ops) —
    *  in this ISA: the ONLY unmodelled no-destination instructions that may be skipped. Any other
    *  no-destination unmodelled instruction THROWS: a side-effect-only instruction (swi, syscall,
@@ -54,13 +90,14 @@ export interface OpaqueDest {
  *  reaches structuring as the sentinel `?` and trips `assertResolved` — the loud failure the
  *  contract requires, instead of a stale/absent value surfacing as confidently-wrong source. */
 export function opaqueDest(mnemonic: string, ops: string[], policy: OpaquePolicy): OpaqueDest | null {
+  const shown = policy.display ?? mnemonic;
   if (policy.storeClass?.test(mnemonic)) {
     // `context` names the function (and, where the ISA has addresses, the site) — this message
     // lands verbatim in annotate-mode stub headers, where an un-attributed decline is
     // unactionable in a multi-function run.
     const where = policy.context ? `cannot lift '${policy.context}': ` : '';
     throw new FrontendUnsupportedError(
-      `${where}unmodelled store-class instruction '${mnemonic}' — a memory write cannot be skipped or degraded to a register opaque`,
+      `${where}unmodelled store-class instruction '${shown}' — a memory write cannot be skipped or degraded to a register opaque`,
     );
   }
   const norm = policy.normalize ?? ((s) => s);
@@ -71,7 +108,7 @@ export function opaqueDest(mnemonic: string, ops: string[], policy: OpaquePolicy
     } // explicitly transparent for this ISA
     const where = policy.context ? `cannot lift '${policy.context}': ` : '';
     throw new FrontendUnsupportedError(
-      `${where}unmodelled effect instruction '${mnemonic}' — no register destination to degrade, and skipping it would silently delete its effect`,
+      `${where}unmodelled effect instruction '${shown}' — no register destination to degrade, and skipping it would silently delete its effect`,
     );
   }
   if (policy.isZero?.(dst)) {

package/src/frontend/ssa.ts

@@ -3,11 +3,20 @@
 // CFG (predecessors per block) and, per block, emits ops through `readVar`/`writeVar`; this
 // module materialises block-argument phis at joins and back-edges.
 //
+// `preds` is an EDGE list, not a block list: it carries one entry per CFG edge, so a `switch_br`
+// with several case values reaching one block appears there several times. Both readings are
+// needed and they are not interchangeable — phi wiring wants the distinct predecessor BLOCKS (one
+// value each), while the args it appends belong to the EDGES (every one of them). `distinctPreds`
+// names the first; `appendSuccessorArg` walks the second. (ir/core.ts `predecessors` and
+// structure.ts `predecessorBlocks` have the same duality, and structure.ts already dedups ad hoc
+// at its two join sites.)
+//
 // Protocol: create the builder, then fill blocks in index order. For each block, emit its
 // computation via read/writeVar, push its terminator op last (successors referencing
 // `irBlocks`, args left empty — phi wiring appends them), then call `markFilled(b)`. When all
 // blocks are filled, call `finish()` to remove trivial phis.
-import { Block, Fn, Successor, Value, mkValue, replaceAllUsesWith } from '../ir/core';
+import { Block, Fn, Value, mkValue } from '../ir/core';
+import { simplifyTrivialPhis } from '../ir/simplify';
 import { T } from '../ir/types';
 
 export interface SsaBuilder {
@@ -27,6 +36,7 @@ export interface SsaBuilder {
   finish(): void;
 }
 
+/** `preds` is per-EDGE (see the module header): one entry per CFG edge into each block. */
 export function makeSsaBuilder(name: string, blockCount: number, preds: number[][]): SsaBuilder {
   const irBlocks: Block[] = Array.from({ length: blockCount }, () => ({ params: [] as Value[], ops: [] }));
   const fn: Fn = { name, blocks: irBlocks };
@@ -38,6 +48,9 @@ export function makeSsaBuilder(name: string, blockCount: number, preds: number[]
   const phiBlock = new Map<Value, number>();
   const paramReg = new Map<Value, string>();
 
+  // `preds` lists an entry per CFG EDGE; these are the distinct predecessor BLOCKS.
+  const distinctPreds = (b: number): number[] => [...new Set(preds[b])];
+
   const writeVar = (reg: string, b: number, v: Value) => defs[b].set(reg, v);
   const readVar = (reg: string, b: number): Value => defs[b].get(reg) ?? readRecursive(reg, b);
 
@@ -55,7 +68,10 @@ export function makeSsaBuilder(name: string, blockCount: number, preds: number[]
       incompletePhis[b].set(reg, phi);
       return phi;
     }
-    const ps = preds[b];
+    // DISTINCT predecessor blocks: a switch_br reaching this block on several case values is one
+    // predecessor with several edges, and it supplies ONE value — counting the edges instead would
+    // manufacture a join (and a phi) where there is none.
+    const ps = distinctPreds(b);
     if (ps.length === 0) {
       // live-in with no predecessor: an incoming argument register → function parameter.
       const p = mkValue(T.unk(32));
@@ -75,16 +91,24 @@ export function makeSsaBuilder(name: string, blockCount: number, preds: number[]
     return phi;
   };
   const addPhiOperands = (reg: string, b: number) => {
-    for (const p of preds[b]) {
+    for (const p of distinctPreds(b)) {
       appendSuccessorArg(p, b, readVar(reg, p));
     }
   };
-  // Append `arg` to predecessor p's terminator successor that targets block b.
+  // Append `arg` to EVERY successor edge of predecessor p that targets block b.
+  //
+  // A predecessor normally has one edge to a given successor, but a `switch_br` has as many as it
+  // has case values, and two cases sharing a body (`case 1: case 2:`) is ordinary C. Block args
+  // belong to the EDGE, so each of those edges needs its own copy: appending to just the first (a
+  // `find`) left the others short, while `preds` listing the block once per edge made the loop run
+  // k times and pile k copies onto that same first edge. Both halves of that — every edge, once per
+  // predecessor BLOCK — have to hold together, which is why they are fixed in one place.
   const appendSuccessorArg = (p: number, b: number, arg: Value) => {
     const term = irBlocks[p].ops[irBlocks[p].ops.length - 1];
-    const s = term.successors.find((su) => su.block === irBlocks[b]);
-    if (s) {
-      s.args.push(arg);
+    for (const s of term.successors) {
+      if (s.block === irBlocks[b]) {
+        s.args.push(arg);
+      }
     }
   };
   const sealBlock = (b: number) => {
@@ -128,7 +152,7 @@ export function makeSsaBuilder(name: string, blockCount: number, preds: number[]
       filled[b] = true;
       sealReadyBlocks();
     },
-    finish: () => simplifyTrivialPhis(fn, phiBlock),
+    finish: () => simplifyTrivialPhis(fn, (p) => phiBlock.delete(p)),
   };
 }
 
@@ -167,48 +191,3 @@ export function abiSortEntryParams(
   }
   entry.params.sort((x, y) => rank(x) - rank(y));
 }
-
-// Remove block-parameters that are really trivial phis: those whose incoming operands (across
-// every predecessor edge, ignoring self-references from a back-edge) are all the same single
-// value. Such a parameter carries no join information — a loop-invariant register or a value
-// defined before the join — so it is replaced by that value and the corresponding argument
-// dropped from each predecessor's terminator. Iterated to fixpoint because removing one phi
-// can make another trivial.
-function simplifyTrivialPhis(fn: Fn, phiBlock: Map<Value, number>): void {
-  const edgesTo = (b: Block): Successor[] => {
-    const out: Successor[] = [];
-    for (const pb of fn.blocks) {
-      for (const op of pb.ops) {
-        for (const s of op.successors) {
-          if (s.block === b) {
-            out.push(s);
-          }
-        }
-      }
-    }
-    return out;
-  };
-  let changed = true;
-  while (changed) {
-    changed = false;
-    for (const b of fn.blocks) {
-      const incoming = edgesTo(b);
-      for (let i = b.params.length - 1; i >= 0; i--) {
-        const param = b.params[i];
-        const operands = incoming.map((s) => s.args[i]);
-        const distinct = [...new Set(operands.filter((v) => v !== param))];
-        if (distinct.length !== 1) {
-          continue;
-        } // a genuine join (or unreachable) — keep it
-        const v = distinct[0];
-        replaceAllUsesWith(fn, param, v);
-        b.params.splice(i, 1);
-        for (const s of incoming) {
-          s.args.splice(i, 1);
-        }
-        phiBlock.delete(param);
-        changed = true;
-      }
-    }
-  }
-}