@asmlift/core 0.3.0 → 0.5.0

package/src/frontend/mips.ts

@@ -19,7 +19,7 @@
 // compares (`sltu`/`sltiu`) lower to `icmp_ult`; recover types their operands u32 so the backend
 // re-emits `sltu` (the operator is the same `<` — the signedness lives in the operand types).
 import { Fn, Op, Successor, Value, mkOp, mkValue } from '../ir/core';
-import type { Opcode } from '../ir/opcodes';
+import { NEGATED_ICMP, type Opcode } from '../ir/opcodes';
 import { T } from '../ir/types';
 import type { Prototypes } from '../proto';
 import type { TargetDescription } from '../target';
@@ -31,7 +31,7 @@ import { assertInputFormat } from './format';
 import type { Frontend } from './frontend';
 import { opaqueDest } from './opaque';
 import { isSplatMips, parseSplatMips } from './splat';
-import { abiSortEntryParams } from './ssa';
+import { abiSortEntryParams, stackSlotKey } from './ssa';
 import { makeSsaBuilder } from './ssa';
 
 type Instr = DisasmInstr;
@@ -47,19 +47,6 @@ const COND_Z: Record<string, Opcode> = {
   bgez: 'icmp_sge',
 };
 const COND_RR: Record<string, Opcode> = { beq: 'icmp_eq', bne: 'icmp_ne' };
-// Negated icmp opcode (for the `slt …; beqz` "branch when false" fold).
-const NEG_ICMP: Record<string, Opcode> = {
-  icmp_slt: 'icmp_sge',
-  icmp_sge: 'icmp_slt',
-  icmp_sgt: 'icmp_sle',
-  icmp_sle: 'icmp_sgt',
-  icmp_ult: 'icmp_uge',
-  icmp_uge: 'icmp_ult',
-  icmp_ugt: 'icmp_ule',
-  icmp_ule: 'icmp_ugt',
-  icmp_eq: 'icmp_ne',
-  icmp_ne: 'icmp_eq',
-};
 
 const isZero = (r: string) => r === 'zero' || r === '$0';
 // The stack pointer (`$29`). A `sw/lw` through it is not a store/load through a data pointer — it
@@ -67,7 +54,7 @@ const isZero = (r: string) => r === 'zero' || r === '$0';
 const isStackPtr = (r: string) => r === 'sp' || r === '$sp' || r === '$29';
 // SSA-variable name for the stack slot at a constant `sp`-offset. Distinct namespace from the
 // register names (which are alphabetic / `$N`), so it never collides with a real register var.
-const stackSlot = (off: number) => `sp@${off}`;
+const stackSlot = stackSlotKey; // shared spelling: frontend/ssa.ts
 // Sub-word memory mnemonics (widths 1 and 2). Used by the `spSlotSafe` guard in `lift`: a sub-word
 // `sp`-relative access means the word stack-slot model is unsafe for that function.
 const SUBWORD_MEM = new Set(['lb', 'lbu', 'lh', 'lhu', 'sb', 'sh']);
@@ -604,6 +591,18 @@ export function lift(
       }
       return readVar(r, bi);
     };
+    // `slt`-family results, so a following `beqz`/`bnez` can fold into one compare.
+    //
+    // Keyed by the SSA VALUE the compare produced, never by its register. Keying by register is the
+    // bug: `slt v0,a0,a1; xori v0,v0,1; beqz v0,L` (a materialised `a0 >= a1` that a branch then
+    // tests — IDO's spelling, and a live benchmark row) redefines v0, and a register-keyed record
+    // folds the branch against the DEAD `slt`, silently emitting the INVERTED condition. A value
+    // cannot go stale that way: `condValue` resolves the branch's register to whatever value reaches
+    // it and looks THAT up, so a redefinition simply misses and the honest `icmp_eq(rX, 0)` is
+    // emitted. It also needs no invalidation discipline to be maintained by every future writer —
+    // which matters, because `write` is NOT the only path that redefines a register (`lui
+    // rD,%hi(SYM)` deliberately reassigns rD's meaning without it).
+    const cmpDef = new Map<Value, { opcode: string; lhs: Value; rhs: Value }>();
     const write = (r: string, v: Value) => {
       // Writing a register clears any pending `%hi` it held — the high-half address is gone once the
       // register is reassigned (e.g. `lw rHi, %lo(SYM)(rHi)` reuses the base as the load dest). A
@@ -626,13 +625,11 @@ export function lift(
     // DELIBERATELY (unlike divState): a cross-block `mult`/`mflo` pair has no observed inhabitant,
     // and the miss degrades to a LOUD opaque, never silence.
     let mulState: { rs: Value; rt: Value; signed: boolean } | null = null;
-    // `slt`-family results, so a following `beqz`/`bnez` can fold into one compare.
-    const cmpDef = new Map<string, { value: Value; opcode: string; lhs: Value; rhs: Value }>();
     const emitCmp = (opc: Opcode, d: string, lhs: Value, rhs: Value) => {
       const v = mkValue(T.unk(32));
       ops.push(mkOp(opc, { operands: [lhs, rhs], results: [v] }));
       write(d, v);
-      cmpDef.set(d, { value: v, opcode: opc, lhs, rhs });
+      cmpDef.set(v, { opcode: opc, lhs, rhs });
     };
 
     const decode = (ins: Instr) => {
@@ -869,8 +866,8 @@ export function lift(
       }
     };
     // TRUSTWORTHINESS GUARD (mirrors the PPC frontend): an unmodelled instruction must not silently
-    // drop its destination register — emit an honest `opaque`: dead ⇒ it vanishes; live ⇒
-    // assertResolved fails LOUD (see frontend/opaque.ts for the policy).
+    // drop its destination register — emit an honest `opaque`, which fails LOUD at assertResolved
+    // whether or not anything reads that register (see frontend/opaque.ts for the policy).
     const emitOpaqueDest = (ins: Instr) => {
       // A `%hi`/`%lo` operand on an instruction NOT modelled as a global consumer — an FP load/store
       // (`lwc1`/`ldc1`), or any unmodelled op — reaches here (the modelled consumers handle their own
@@ -892,8 +889,8 @@ export function lift(
       const od = opaqueDest(ins.mnemonic, ins.ops, {
         isReg: isMipsReg,
         isZero,
-        storeClass: /^(sb|sh|sw|swl|swr|sc|sd|sdl|sdr|swc1|sdc1)$/,
-        skipSafe: /^(nop|ssnop|break)$/,
+        storeClass: /^(sb|sh|sw|swl|swr|sc|sd|sdl|sdr|swc1|sdc1)$/i,
+        skipSafe: /^(nop|ssnop|break)$/i,
         context: `${name} @0x${ins.addr.toString(16)}`,
       });
       if (!od) {
@@ -941,6 +938,13 @@ export function lift(
         // incoming STACK-PASSED argument (5th+ param, O32) or an uninitialised local — neither modelled.
         // Without this, readVar would FABRICATE a phantom entry parameter for the slot, silently emitting a
         // function of wrong arity that returns the wrong argument. Loud-fail instead of miscompiling.
+        //
+        // Those two cases are SEPARABLE, and the Thumb frontend now separates them (frontend/thumb.ts,
+        // incomingArgIndex): a slot at or above the callee's own frame cannot have been written by this
+        // function, so it is an incoming argument; below the frame top it is a local. Doing the same here
+        // needs O32's own frame rule — the 16-byte home area means a stack argument is NOT simply "above
+        // the frame", so the Thumb arithmetic does not carry over — plus ssa.ensureParam for the register
+        // half. Until then this stays one loud decline for both.
         if (!ssa.hasReachingDef(stackSlot(off), bi)) {
           throw new FrontendUnsupportedError(
             `cannot lift '${name}': load from stack slot sp@${off} that was never stored ` +
@@ -1053,7 +1057,7 @@ function condValue(
   ops: Op[],
   read: (r: string) => Value,
   constVal: (n: number) => Value,
-  cmpDef: Map<string, { value: Value; opcode: string; lhs: Value; rhs: Value }>,
+  cmpDef: Map<Value, { opcode: string; lhs: Value; rhs: Value }>,
 ): Value {
   const mk = (opc: Opcode, l: Value, r: Value): Value => {
     const v = mkValue(T.unk(32));
@@ -1064,15 +1068,19 @@ function condValue(
     return mk(COND_RR[br.mnemonic], read(br.ops[0]), read(br.ops[1]));
   }
   // *z forms compare a register against zero — except beqz/bnez may fold a preceding `slt`.
-  const rs = br.ops[0];
-  const folded = cmpDef.get(rs);
+  // Resolve the register to its reaching VALUE first: that is the fold's key (so a redefinition
+  // between the compare and the branch misses instead of folding stale), and it is also what
+  // routes the operand through `read`'s loud guards (sp / `%hi` / `gp` used as data) on every
+  // path — the fold used to bypass them by never reading the register at all.
+  const rsv = read(br.ops[0]);
+  const folded = cmpDef.get(rsv);
   if (folded && br.mnemonic === 'bnez') {
-    return folded.value;
+    return rsv;
   } // branch when slt is true
   if (folded && br.mnemonic === 'beqz') {
-    return mk(NEG_ICMP[folded.opcode], folded.lhs, folded.rhs);
+    return mk(NEGATED_ICMP[folded.opcode], folded.lhs, folded.rhs);
   } // …when false
-  return mk(COND_Z[br.mnemonic], read(rs), constVal(0));
+  return mk(COND_Z[br.mnemonic], rsv, constVal(0));
 }
 
 /** The MIPS-II / IDO frontend, registered for the `mips` target. */

package/src/frontend/opaque.ts

@@ -7,6 +7,37 @@
 // This module owns only the POLICY (which token is the destination, which are register sources).
 // The frontend still owns the SSA plumbing (how to `read` a source and `write`/emit the result),
 // because that is block-local state the policy must not touch.
+//
+// ─── A NOTE ON ALTERNATIVE MNEMONIC SPELLINGS ──────────────────────────────────────────────────
+//
+// Every ISA here accepts more than one spelling for some instructions, and the frontends handle
+// that in two DIFFERENT ways on purpose. Which one is right is decided by the operands, not by
+// taste:
+//
+//   * PURE SYNONYM — same operands, same semantics, different name. Normalise it in a name→name
+//     table at the parse site, so every consumer of the mnemonic sees one name. Thumb does this
+//     for `ldsh`/`ldrsh`, `ldsb`/`ldrsb`, `ldm`/`ldmfd`/`ldmia`, `stm`/`stmea`/`stmia`, which
+//     ARM DDI 0029G Figure 1-6 gives a single encoding apiece.
+//
+//     The table is the right shape THERE because the mnemonic is read by more than the decode
+//     switch — Thumb's `classifyXfer` matches it to tell a return from an indirect jump, the
+//     `storeClass` below matches it to decide whether an unmodelled op may be skipped, and the
+//     instruction-size walk tests it for `bl`. An alias arm on one `case` fixes one of those.
+//
+//   * EXTENDED MNEMONIC / PSEUDO-INSTRUCTION — different operand GRAMMAR, so no rename can
+//     express it. Give it its own decode arm. MIPS `move rD,rS` (2 operands) is `addu rD,rS,zero`
+//     (3); PPC `mr rD,rS` is `or rD,rS,rS`; PPC `slwi rD,rS,n` (3) is `rlwinm rD,rS,n,mb,me` (5,
+//     with mask fields computed from n). Routing these through a table would be a category error.
+//
+// There is deliberately NO shared alias helper. As of writing, MIPS and PPC have no pure-synonym
+// gap at all — every `unmodelled instruction` decline they produce across the whole benchmark is
+// a genuinely unmodelled opcode (`lwc1`, `fmuls`, `fctiwz`, `subfe`, …), not a spelling — so such
+// a helper would have exactly one caller. The bar for extracting one is the bar this module itself
+// met: several frontends hand-copying the same policy AND observed drift between the copies.
+//
+// One thing that IS shared, and should stay shared: `display` below. A frontend that normalises
+// spellings must still REPORT the one its input actually used, or a decline sends the reader
+// looking for an instruction their disassembly does not contain.
 import { FrontendUnsupportedError } from './errors';
 
 export interface OpaquePolicy {
@@ -15,8 +46,9 @@ export interface OpaquePolicy {
   /** token cleanup before classification — e.g. Thumb strips `[`/`]` off a memory operand.
    *  Default: identity. */
   normalize?: (s: string) => string;
-  /** true iff the register is hardwired-zero (MIPS `$zero`/`$0`): writing it is a no-op, so it is
-   *  NOT a real destination and the instruction is safe to skip. Default: nothing is zero. */
+  /** true iff the register is hardwired-zero (MIPS `$zero`/`$0`). It is then not a real
+   *  destination — so there is nothing to degrade and the instruction is REFUSED, not skipped
+   *  (`teq zero, zero` is a trap). Default: nothing is zero. */
   isZero?: (r: string) => boolean;
   /** Mnemonics that WRITE MEMORY in this ISA: the "no register destination ⇒ safe to fall
    *  through" premise is FALSE for stores — skipping one silently deletes the write (Thumb
@@ -27,10 +59,15 @@ export interface OpaquePolicy {
   storeClass?: RegExp;
   /** attribution for thrown declines: the function being lifted (optionally "+ site"). */
   context?: string;
-  /** Mnemonics PROVABLY effect-free — or deliberately transparent (Thumb push/pop frame ops) —
-   *  in this ISA: the ONLY unmodelled no-destination instructions that may be skipped. Any other
-   *  no-destination unmodelled instruction THROWS: a side-effect-only instruction (swi, syscall,
-   *  sync, cache…) skipped silently is a deleted effect — a silent miscompile. Default: none. */
+  /** How to SPELL the mnemonic in messages, when that differs from the name used to classify it.
+   *  A frontend that normalises legacy spellings (Thumb `ldsh` -> `ldrsh`) classifies on the
+   *  canonical name but must report the one the input file actually contains — otherwise a decline
+   *  names an instruction the reader cannot find in their own .s. Defaults to `mnemonic`. */
+  display?: string;
+  /** Mnemonics PROVABLY effect-free — or deliberately transparent (Thumb push/pop frame ops) — in
+   *  this ISA: the only unmodelled instructions that may be skipped at all. Anything else with no
+   *  degradable destination THROWS, because a side-effect-only instruction (swi, syscall, sync,
+   *  cache…) skipped silently is a deleted effect. Default: none. */
   skipSafe?: RegExp;
 }
 
@@ -43,40 +80,53 @@ export interface OpaqueDest {
 
 /** Decide the opaque destination + register source operands for an unmodelled instruction
  *  `mnemonic` with operand list `ops` (operands in objdump order — destination first). Returns
- *  `null` only when the instruction is provably skippable: a write to a hardwired-zero register,
- *  or a policy.skipSafe mnemonic. An unmodelled STORE-CLASS instruction (policy.storeClass)
- *  throws loud (a skipped memory write is a silent miscompile) — and so does any OTHER
- *  no-destination instruction not in skipSafe: with no register to degrade to a live-`?`
- *  sentinel, skipping would silently delete a side effect (swi/syscall/sync/cache).
+ *  `null` only for a policy.skipSafe mnemonic. An unmodelled STORE-CLASS instruction
+ *  (policy.storeClass) throws loud (a skipped memory write is a silent miscompile), and so does any
+ *  instruction with no degradable destination: with no register to carry the live-`?` sentinel,
+ *  skipping would silently delete a side effect (swi/syscall/sync/cache).
  *
  *  When non-null, the caller MUST emit an `opaque` op that writes `dst` and consumes `srcRegs`
- *  (read through the frontend's own SSA): a DEAD opaque is DCE'd away harmlessly, while a LIVE one
- *  reaches structuring as the sentinel `?` and trips `assertResolved` — the loud failure the
- *  contract requires, instead of a stale/absent value surfacing as confidently-wrong source. */
+ *  (read through the frontend's own SSA). It reaches structuring as the sentinel `?` and trips
+ *  `assertResolved` — the loud failure the contract requires — WHETHER OR NOT anything reads `dst`;
+ *  `opaque` carries `effects: true` (ir/opcodes.ts) for the same reason `call` does.
+ *
+ *  Two properties of `ops[0]` read as permission to skip and are not. Both describe the
+ *  DESTINATION, while the risk is everything else the instruction does:
+ *    - nobody reads it — a dead register says nothing about a memory or system effect;
+ *    - it is hardwired zero — MIPS `teq zero, zero` is a conditional TRAP.
+ *  So `skipSafe`, a short per-ISA list of provably transparent mnemonics, is the only way an
+ *  unmodelled instruction leaves no trace.
+ *
+ *  `storeClass` is not load-bearing for soundness — a missed store degrades loudly like anything
+ *  else — but it throws naming the memory write instead of an unresolvable value, and it catches
+ *  the shape where `ops[0]` is a SOURCE (MIPS `swl rt, off(base)`) before a `dst` is fabricated
+ *  from it. It and `skipSafe` match case-INSENSITIVELY: mnemonic case is a property of the
+ *  disassembler, not of the instruction. */
 export function opaqueDest(mnemonic: string, ops: string[], policy: OpaquePolicy): OpaqueDest | null {
+  const shown = policy.display ?? mnemonic;
   if (policy.storeClass?.test(mnemonic)) {
     // `context` names the function (and, where the ISA has addresses, the site) — this message
     // lands verbatim in annotate-mode stub headers, where an un-attributed decline is
     // unactionable in a multi-function run.
     const where = policy.context ? `cannot lift '${policy.context}': ` : '';
     throw new FrontendUnsupportedError(
-      `${where}unmodelled store-class instruction '${mnemonic}' — a memory write cannot be skipped or degraded to a register opaque`,
+      `${where}unmodelled store-class instruction '${shown}' — a memory write cannot be skipped or degraded to a register opaque`,
     );
   }
   const norm = policy.normalize ?? ((s) => s);
   const dst = norm(ops[0] ?? '');
-  if (!policy.isReg(dst)) {
+  // No DEGRADABLE destination: `ops[0]` is not a register, or it is the hardwired zero. Same answer
+  // for both — a zero write is a genuine no-op only for a MODELLED instruction, and by construction
+  // nothing modelled reaches here.
+  if (!policy.isReg(dst) || policy.isZero?.(dst)) {
     if (policy.skipSafe?.test(mnemonic)) {
       return null;
     } // explicitly transparent for this ISA
     const where = policy.context ? `cannot lift '${policy.context}': ` : '';
     throw new FrontendUnsupportedError(
-      `${where}unmodelled effect instruction '${mnemonic}' — no register destination to degrade, and skipping it would silently delete its effect`,
+      `${where}unmodelled effect instruction '${shown}' — no register destination to degrade, and skipping it would silently delete its effect`,
     );
   }
-  if (policy.isZero?.(dst)) {
-    return null;
-  } // writes hardwired zero → a genuine no-op
   const srcRegs = ops.slice(1).map(norm).filter(policy.isReg);
   return { dst, srcRegs };
 }

package/src/frontend/ppc.ts

@@ -24,7 +24,7 @@
 //    the result against 0; that implicit compare is wired so a following `beq`/`bne` fuses.
 //
 // TRUSTWORTHINESS: an unmodelled instruction with a register destination emits an `opaque` value
-// (dead ⇒ vanishes, live ⇒ fails LOUD downstream); an unmodelled CONTROL TRANSFER throws
+// that fails LOUD downstream read or not; an unmodelled CONTROL TRANSFER throws
 // PpcUnsupportedError in `lift`. Never plausible-but-wrong C.
 //
 // Scope: straight-line + `if`/diamond integer functions (incl. the conditional-return idiom),
@@ -480,15 +480,15 @@ export function lift(
     const constVal = kit.cnst;
     const emit = kit.emit;
     // TRUSTWORTHINESS GUARD: an unmodelled instruction must not silently drop its destination —
-    // emit an honest `opaque` instead: dead ⇒ DCE'd; live ⇒ assertResolved fails LOUD (see
-    // frontend/opaque.ts for the policy).
+    // emit an honest `opaque` instead, which fails LOUD at assertResolved whether or not anything
+    // reads that register (see frontend/opaque.ts for the policy).
     const emitOpaqueDest = (ins: Instr) => {
       // storeClass: every PPC store mnemonic is st* — an unmodelled one (`stwbrx`, `sthbrx`, …)
       // must throw, never skip (its first token is the SOURCE register).
       const od = opaqueDest(ins.mnemonic, ins.ops, {
         isReg,
-        storeClass: /^st/,
-        skipSafe: /^nop$/,
+        storeClass: /^st/i,
+        skipSafe: /^nop$/i,
         context: `${name} @0x${ins.addr.toString(16)}`,
       });
       if (!od) {
@@ -567,12 +567,23 @@ export function lift(
         // (anything live across the call has already been moved to a callee-saved register).
         case 'bl': {
           const sym = ins.sym ?? 'func';
-          const argc = protoArity(prototypes[sym]) ?? fallbackArgc(bi);
+          const declared = protoArity(prototypes[sym]);
+          const argc = declared ?? fallbackArgc(bi);
           const args: Value[] = [];
           for (let k = 0; k < argc; k++) {
             args.push(read(ARG_REGS[k]));
           }
-          emit('call', RET, args, { target: sym });
+          // Pushed with `tmp` rather than `emit` so the result register is written AFTER the clobber
+          // is recorded — the order matters: r3.. are volatile under the EABI, so a GUESSED arity
+          // that counted a register set up before an intervening call passes an argument the caller
+          // never set up (`finish()` cuts those back — frontend/ssa.ts), while the call's OWN result
+          // must stay fresh for the next call (`bar(foo())`).
+          const res = kit.tmp('call', args, { target: sym });
+          if (declared === undefined) {
+            ssa.recordGuessedCall(ops[ops.length - 1], bi, ARG_REGS);
+          }
+          ssa.noteCall(bi);
+          write(RET, res);
           break;
         }
         // Stack-frame + link-register bookkeeping. `stwu r1,-N(r1)` / `addi r1,r1,N` adjust the frame