@asmlift/core 0.2.0 → 0.4.0

package/src/l3/coalesce.ts

@@ -0,0 +1,146 @@
+import { typeToString } from '../ir/types';
+import type { Expr, SFn, Stmt } from './ast';
+import { exprChildren, mapExprChildren, stmtChildren, stmtExprs } from './ast';
+
+function namesIn(e: Expr, out: Set<string>): void {
+  // `addr` names a GLOBAL, never a local — collected anyway. A name reaching BOTH forms would
+  // otherwise get a span that ignores its `addr` mentions, and a SHORT span is a clobber while a
+  // long one is only a missed merge. `structure.ts` keeps locals to /^[vt]\d+$/ and excludes global
+  // names, so this cannot fire today; collecting is the direction that stays safe if that changes.
+  if (e.k === 'var' || e.k === 'addr') out.add(e.name);
+  for (const c of exprChildren(e)) namesIn(c, out);
+}
+
+/** Does `e` mention `n` anywhere? */
+function mentions(e: Expr, n: string): boolean {
+  const seen = new Set<string>();
+  namesIn(e, seen);
+  return seen.has(n);
+}
+interface Span {
+  first: number;
+  last: number;
+  inLoop: boolean;
+  constFed: boolean;
+  /** the local's FIRST mention is a write, not a read */
+  firstIsWrite: boolean;
+}
+function spans(body: Stmt[]): Map<string, Span> {
+  const out = new Map<string, Span>();
+  let at = 0;
+  const walk = (list: Stmt[], inLoop: boolean): void => {
+    for (const s of list) {
+      at++;
+      const here = new Set<string>();
+      if (s.k === 'assign') here.add(s.name);
+      for (const e of stmtExprs(s)) namesIn(e, here);
+      for (const n of here) {
+        const sp = out.get(n) ?? {
+          first: at,
+          last: at,
+          inLoop,
+          constFed: true,
+          // an assign that ALSO READS the name (`b = g(b)`) is not a pure write; treating it as one
+          // let `g` receive the absorbed value
+          firstIsWrite: s.k === 'assign' && s.name === n && !stmtExprs(s).some((e) => mentions(e, n)),
+        };
+        sp.last = at;
+        sp.inLoop ||= inLoop;
+        if (s.k === 'assign' && s.name === n && s.value.k !== 'const') sp.constFed = false;
+        out.set(n, sp);
+      }
+      walk(stmtChildren(s), inLoop || s.k === 'while' || s.k === 'dowhile' || s.k === 'for');
+    }
+  };
+  walk(body, false);
+  return out;
+}
+function rename(body: Stmt[], from: string, to: string): Stmt[] {
+  const inExpr = (e: Expr): Expr =>
+    e.k === 'var' && e.name === from ? { ...e, name: to } : mapExprChildren(e, inExpr);
+  const inStmt = (s: Stmt): Stmt => {
+    const r = { ...s } as Record<string, unknown>;
+    if (s.k === 'assign' && s.name === from) r.name = to;
+    for (const key of ['value', 'lval', 'cond', 'scrutinee'] as const) {
+      const v = (s as Record<string, unknown>)[key];
+      if (v !== undefined) r[key] = inExpr(v as Expr);
+    }
+    for (const key of ['then', 'else', 'body', 'default'] as const) {
+      const v = (s as Record<string, unknown>)[key];
+      if (Array.isArray(v)) r[key] = (v as Stmt[]).map(inStmt);
+    }
+    if (s.k === 'for') {
+      r.init = inStmt(s.init);
+      r.inc = inStmt(s.inc);
+    }
+    if (s.k === 'switch') r.cases = s.cases.map((c) => ({ ...c, body: c.body.map(inStmt) }));
+    return r as Stmt;
+  };
+  return body.map(inStmt);
+}
+/** Every legal single merge, each as its own tree — NOT one committed choice.
+ *
+ *  Which pair a register allocator coalesced is not derivable from the L3 tree, and first-fit gets
+ *  it wrong: on kleod:UpdateHUDCounterDisplay the two legal merges score 18 and 40 against a
+ *  no-merge baseline of 21, and declaration order picks the 40. `rank.ts` already has the idiom for
+ *  exactly this — `/regcopy`'s "the tail choice is allocator-ambiguous, so both are ranked" — so
+ *  every candidate is emitted and the differ referees.
+ *
+ *  GATES:
+ *   - a local mentioned inside a loop BODY is excluded. SOUND-critical: it is what makes preorder
+ *     statement order a sufficient approximation of liveness. Preorder is a topological order of the
+ *     CFG except where a later-indexed statement can run before an earlier one, and the positions
+ *     that do that — a `for`'s `init`/`inc`, and everything in any loop body — are inside a loop, so
+ *     the gate covers them. A loop's own CONDITION is NOT covered: it is visited at the loop
+ *     statement's own index with the ENCLOSING loop flag. That is safe only because a condition
+ *     cannot WRITE, so it can extend a read range but never reorder a definition — an earlier
+ *     version of this comment claimed the gate covered conditions too, which it does not.
+ *     Differential fuzzing supports this: removing the gate produces clobbers immediately, leaving
+ *     it on produces none. No such harness is committed, so nothing here re-checks it.
+ *   - both must be CONSTANT-fed. A codegen heuristic, not soundness — removing it stayed
+ *     clobber-free under the same (uncommitted) fuzz and simply scored worse, because a load-fed
+ *     local is one the compiler had a reason to keep where it was. It is also what currently BOUNDS
+ *     candidate growth: merges are `L(L-1)/2` in the local count, each a distinct source and so a
+ *     distinct compile, and nothing else caps that. Corpus-wide today: 2 rows, 13 kept sources.
+ *   - the survivor's first mention must be an ASSIGN THAT DOES NOT ALSO READ IT. `b = g(b)` is a
+ *     write and a read in one statement; counting it as a pure write let `g` receive the absorbed
+ *     value. These two gates are NOT independent: `constFed` also rejects a self-reading assign
+ *     (its value is not a literal), so it masks this one. No committed test isolates it — this is
+ *     defence-in-depth for the day `constFed` is relaxed, which the note above makes plausible.
+ *
+ *  ACCEPTED, NOT FIXED: a survivor assigned only on SOME paths still absorbs the other's value on
+ *  the paths that skip it. The original read an uninitialized local there, so both spellings are
+ *  ill-defined rather than one being wrong — but this is a real difference and the differ, not this
+ *  gate, is what keeps it from faking a match. */
+export function coalesceCandidates(sfn: SFn): { merged: string; sfn: SFn }[] {
+  if (sfn.locals.length < 2) {
+    return [];
+  }
+  const params = new Set(sfn.params.map((p) => p.name));
+  const typeOf = new Map(sfn.locals.map((l) => [l.name, typeToString(l.type)]));
+  const sp = spans(sfn.body);
+  const out: { merged: string; sfn: SFn }[] = [];
+  for (const a of sfn.locals.map((l) => l.name)) {
+    for (const b of sfn.locals.map((l) => l.name)) {
+      const x = sp.get(a);
+      const y = sp.get(b);
+      if (a === b || !x || !y || params.has(a) || params.has(b)) {
+        continue;
+      }
+      if (typeOf.get(a) !== typeOf.get(b) || x.inLoop || y.inLoop || !x.constFed || !y.constFed) {
+        continue;
+      }
+      if (x.last >= y.first || !y.firstIsWrite) {
+        continue;
+      }
+      // Labelled by the PAIR, not by an index into enumeration order: an index silently re-points
+      // at a different merge if `sfn.locals` ordering ever changes, leaving a recorded provenance
+      // that is wrong but plausible.
+      out.push({
+        merged: `${a}-${b}`,
+        sfn: { ...sfn, body: rename(sfn.body, a, b), locals: sfn.locals.filter((l) => l.name !== a) },
+      });
+    }
+  }
+  return out;
+}

package/src/l3/dce.ts

@@ -22,7 +22,7 @@
 // unresolved `?` value trips the contract first and never reaches DCE; `mustKeep` treating `?` as
 // keep is defense-in-depth for any future caller that skips that check.
 import type { Expr, SFn, Stmt } from './ast';
-import { exprChildren, stmtChildren, stmtExprs } from './ast';
+import { exprChildren, negateCond, stmtChildren, stmtExprs } from './ast';
 
 /** Accumulate every LOCAL-eligible `var` name read anywhere in `e` (recurses all sub-exprs). An
  *  `addr` node names a global, not a local, so it is not a local read. */
@@ -70,27 +70,6 @@ function allReadsInto(stmts: Stmt[], out: Set<string>): void {
   }
 }
 
-/** Negate a condition, flipping a relational operator directly (`!= → ==`, `< → >=`, …) so an
- *  empty-then flip reads cleanly; anything else wraps in `!( … )`. Both forms are semantically
- *  exact over C's total integer order. */
-function negate(cond: Expr): Expr {
-  if (cond.k === 'bin') {
-    const table: Record<string, '==' | '!=' | '<' | '<=' | '>' | '>='> = {
-      '==': '!=',
-      '!=': '==',
-      '<': '>=',
-      '>=': '<',
-      '>': '<=',
-      '<=': '>',
-    };
-    const f = table[cond.op];
-    if (f) {
-      return { k: 'bin', op: f, l: cond.l, r: cond.r };
-    }
-  }
-  return { k: 'un', op: '!', e: cond };
-}
-
 /** Backward live-variable walk over one block. `liveOut` is the set of locals live on exit;
  *  returns the rewritten block and the set live on entry. */
 function dceBlock(
@@ -171,7 +150,7 @@ function dceBlock(
             rev.push({ k: 'exprstmt', value: s.cond });
           }
         } else if (t.out.length === 0) {
-          rev.push({ k: 'if', cond: negate(s.cond), then: e.out, else: [] });
+          rev.push({ k: 'if', cond: negateCond(s.cond), then: e.out, else: [] });
         } else {
           rev.push({ k: 'if', cond: s.cond, then: t.out, else: e.out });
         }

package/src/l3/hoist.ts

@@ -0,0 +1,65 @@
+// L3 — the naming MECHANISM shared by every pass that hoists a value into a fresh local.
+//
+// Two passes name bases today (`basecse.ts` hoists a REUSED base; `argbase.ts` names a call's
+// argument bases), and they differ in POLICY — which bases are eligible, and when it is worth
+// doing — but not in how a name is chosen. That half was copied, and the copy silently lost a
+// safety guard: basecse added the callee-name exclusion in its own audit precisely so a hoist
+// local could not shadow a called function, and the second implementation did not have it. A third
+// hoisting pass would lose it again, so the mechanism lives here and the policy stays with each
+// caller.
+import type { Expr, SFn, Stmt } from './ast';
+import { mapExprChildren, stmtChildren, stmtExprs } from './ast';
+
+/** Every identifier a hoist name must not collide with, anywhere in `sfn`.
+ *
+ *  Wider than "the declared locals" on purpose, and each addition is a real collision:
+ *   - params and locals, obviously;
+ *   - every `var`/`addr` mentioned — a GLOBAL is referenced by bare name, so a local shadowing one
+ *     silently redirects every later mention of it;
+ *   - every CALL TARGET — a local named like a callee shadows the function;
+ *   - every assignment target, which includes names no declaration list carries. */
+function takenNames(sfn: SFn): Set<string> {
+  const taken = new Set<string>([...sfn.params.map((p) => p.name), ...sfn.locals.map((l) => l.name)]);
+  const visit = (e: Expr): void => {
+    if (e.k === 'var' || e.k === 'addr') {
+      taken.add(e.name);
+    }
+    if (e.k === 'call') {
+      taken.add(e.fn);
+    }
+    mapExprChildren(e, (c) => {
+      visit(c);
+      return c;
+    });
+  };
+  const walk = (stmts: Stmt[]): void => {
+    for (const s of stmts) {
+      if (s.k === 'assign') {
+        taken.add(s.name);
+      }
+      stmtExprs(s).forEach(visit);
+      walk(stmtChildren(s));
+    }
+  };
+  walk(sfn.body);
+  return taken;
+}
+
+/**
+ * A generator of fresh `p<n>` hoist names for `sfn`, colliding with nothing already in it.
+ *
+ * Returned as a closure over one `taken` set so successive calls cannot collide with each OTHER
+ * either — the failure a caller re-deriving the set per name would hit.
+ */
+export function nameAllocator(sfn: SFn): () => string {
+  const taken = takenNames(sfn);
+  return () => {
+    let n = 0;
+    while (taken.has(`p${n}`)) {
+      n++;
+    }
+    const nm = `p${n}`;
+    taken.add(nm);
+    return nm;
+  };
+}

package/src/l3/reindex.ts

@@ -163,10 +163,17 @@ function reindexExpr(e: Expr, walk: WalkLoop, iv: string): Expr | null {
     if (mentionsVar(e.idx, walk.p)) {
       return null; // a p-dependent element offset — beyond the v1 shape
     }
+    if (e.lead && e.lead.length > 0) {
+      return null; // leading subscripts (a multidim array global) — the rebuild below would drop
+      // them, turning an element access into a row's. Decline rather than reindex.
+    }
     const idx: Expr =
       e.idx.k === 'const' && e.idx.value === 0
         ? { k: 'var', name: iv }
         : { k: 'bin', op: '+', l: { k: 'var', name: iv }, r: e.idx };
+    // NOTE: this rebuilds the node from parts, so any field not named here is DROPPED. `lead` is
+    // declined above (the deref side); it cannot arrive on the base side either, since `walk.base`
+    // is a local pointer and structuring only ever puts `lead` on an array GLOBAL's own name.
     return { k: 'index', base: { k: 'var', name: walk.base }, idx, width: e.width, signed: e.signed };
   }
   let failed = false;