@asmlift/core 0.3.0 → 0.5.0

package/src/frontend/ssa.ts

@@ -3,12 +3,22 @@
 // CFG (predecessors per block) and, per block, emits ops through `readVar`/`writeVar`; this
 // module materialises block-argument phis at joins and back-edges.
 //
+// `preds` is an EDGE list, not a block list: it carries one entry per CFG edge, so a `switch_br`
+// with several case values reaching one block appears there several times. Both readings are
+// needed and they are not interchangeable — phi wiring wants the distinct predecessor BLOCKS (one
+// value each), while the args it appends belong to the EDGES (every one of them). `distinctPreds`
+// names the first; `appendSuccessorArg` walks the second. (ir/core.ts `predecessors` and
+// structure.ts `predecessorBlocks` have the same duality, and structure.ts already dedups ad hoc
+// at its two join sites.)
+//
 // Protocol: create the builder, then fill blocks in index order. For each block, emit its
 // computation via read/writeVar, push its terminator op last (successors referencing
 // `irBlocks`, args left empty — phi wiring appends them), then call `markFilled(b)`. When all
 // blocks are filled, call `finish()` to remove trivial phis.
-import { Block, Fn, Successor, Value, mkValue, replaceAllUsesWith } from '../ir/core';
+import { Block, Fn, Op, Value, mkValue } from '../ir/core';
+import { simplifyTrivialPhis } from '../ir/simplify';
 import { T } from '../ir/types';
+import { FrontendUnsupportedError } from './errors';
 
 export interface SsaBuilder {
   fn: Fn;
@@ -19,14 +29,44 @@ export interface SsaBuilder {
   writeVar(reg: string, b: number, v: Value): void;
   /** Mark block `b` fully emitted (terminator pushed); seals any now-ready successors. */
   markFilled(b: number): void;
-  /** Live-in parameter value → the ABI register it arrived on (for calling-convention order). */
+  /** Live-in parameter value → the key it arrived on (for calling-convention order). Usually an
+   *  ABI register name, but a frontend's virtual key (see the module header) ranks here too. */
   paramReg: Map<Value, string>;
+  /** Assert that block `b` takes a parameter for `key`, whether or not anything reads it.
+   *
+   *  `readVar` cannot express this. It asks "what value does `key` hold here?", so a key the block
+   *  DEFINES before any read answers with that local definition and no parameter is created — to it
+   *  "never read" and "written before first read" are the same thing. When a calling convention
+   *  proves an argument exists, that is an obligation on the SIGNATURE, independent of whether the
+   *  body happens to use it, so it needs its own verb.
+   *
+   *  Never touches the block's definitions: the parameter is added and left unused, so any local
+   *  value already flowing keeps flowing. Only meaningful on a block with no predecessors —
+   *  elsewhere a parameter is a phi whose position is aligned with its predecessors' terminator
+   *  args, and appending an unpaired one would corrupt that. */
+  ensureParam(key: string, b: number): void;
   /** Whether `reg` has a definition reaching block `b` (best-effort call-arity heuristic). */
   hasReachingDef(reg: string, b: number, seen?: Set<number>): boolean;
-  /** Remove trivial phis; call once every block is filled. */
+  /** Record that block `b` makes a call HERE: the ABI's caller-saved registers stop being ones the
+   *  caller set up. Call it AFTER `recordGuessedCall` for the same instruction, and before writing
+   *  the call's own result. */
+  noteCall(b: number): void;
+  /** Register a `call` op whose arity was GUESSED (no prototype), so `finish` can cut it back to the
+   *  argument registers that were actually set up on every path (see {@link trimClobberedCallArgs}).
+   *  `argRegs` is the target's argument-register order. */
+  recordGuessedCall(op: Op, b: number, argRegs: string[]): void;
+  /** Remove trivial phis and enforce the frontend's postconditions; call once every block is
+   *  filled. Throws FrontendUnsupportedError if a stack slot escaped as an entry parameter. */
   finish(): void;
 }
 
+/** `preds` is per-EDGE (see the module header): one entry per CFG edge into each block. */
+// VARIABLE NAMES ARE NOT ALWAYS MACHINE REGISTERS. `readVar`/`writeVar` key on an arbitrary string,
+// and frontends mint VIRTUAL keys for storage the ISA has no register for — MIPS `sp@<off>` for a
+// stack slot (frontend/mips.ts), Thumb `@sarg<k>` for an incoming stack argument (frontend/thumb.ts).
+// A virtual key must be outside its ISA's register grammar so it cannot collide with a real one, and
+// a key read with no reaching def becomes a function PARAMETER by the live-in path below — which is
+// how both of those capabilities get their parameters without a new opcode or pass.
 export function makeSsaBuilder(name: string, blockCount: number, preds: number[][]): SsaBuilder {
   const irBlocks: Block[] = Array.from({ length: blockCount }, () => ({ params: [] as Value[], ops: [] }));
   const fn: Fn = { name, blocks: irBlocks };
@@ -36,15 +76,43 @@ export function makeSsaBuilder(name: string, blockCount: number, preds: number[]
   const filled: boolean[] = irBlocks.map(() => false);
   const incompletePhis: Array<Map<string, Value>> = irBlocks.map(() => new Map());
   const phiBlock = new Map<Value, number>();
+  // The key each phi stands for. `paramReg` covers live-ins only, so without this a slot that
+  // arrives as a PHI — which is what happens when the entry block is itself a loop header — is
+  // invisible to the escape check below. Braun's construction gives no other way to tell.
+  const phiKey = new Map<Value, string>();
   const paramReg = new Map<Value, string>();
+  // Parameters created by ensureParam that nothing has read yet. They are deliberately NOT in
+  // `defs`: a parameter asserted because a calling convention proves it exists is not evidence that
+  // a VALUE reaches anything, and writing one into `defs` would say it does. That distinction is
+  // load-bearing — `hasReachingDef` feeds `fallbackArgc`, so a def here silently raises the guessed
+  // arity of every prototype-less call in the function, making it pass registers the calling block
+  // never set up (`unknown(1)` became `unknown(1, a1, a2, a3)`). The first read adopts the value
+  // from here instead of minting a second parameter for the same key.
+  const obligedParams: Array<Map<string, Value>> = irBlocks.map(() => new Map());
+
+  // `preds` lists an entry per CFG EDGE; these are the distinct predecessor BLOCKS.
+  const distinctPreds = (b: number): number[] => [...new Set(preds[b])];
 
-  const writeVar = (reg: string, b: number, v: Value) => defs[b].set(reg, v);
+  // CALLER-SAVED CLOBBER, for guessed call arities (see trimClobberedCallArgs). Tracked HERE
+  // because every register write in every frontend already goes through `writeVar`: a frontend
+  // that gathered this itself would be sound only while it remembered to route each write past a
+  // wrapper, and a MISSED write under-counts an arity — which drops a real argument silently.
+  const writtenSinceCall: Array<Set<string>> = irBlocks.map(() => new Set());
+  const callsIn = new Set<number>();
+  const guessedCalls: GuessedCallSite[] = [];
+  let argRegsSeen: string[] = [];
+
+  const writeVar = (reg: string, b: number, v: Value) => {
+    writtenSinceCall[b].add(reg);
+    defs[b].set(reg, v);
+  };
   const readVar = (reg: string, b: number): Value => defs[b].get(reg) ?? readRecursive(reg, b);
 
   const newPhi = (reg: string, b: number): Value => {
     const phi = mkValue(T.unk(32));
     irBlocks[b].params.push(phi);
     phiBlock.set(phi, b);
+    phiKey.set(phi, reg);
     defs[b].set(reg, phi); // set before wiring operands to break cycles
     return phi;
   };
@@ -55,9 +123,20 @@ export function makeSsaBuilder(name: string, blockCount: number, preds: number[]
       incompletePhis[b].set(reg, phi);
       return phi;
     }
-    const ps = preds[b];
+    // DISTINCT predecessor blocks: a switch_br reaching this block on several case values is one
+    // predecessor with several edges, and it supplies ONE value — counting the edges instead would
+    // manufacture a join (and a phi) where there is none.
+    const ps = distinctPreds(b);
     if (ps.length === 0) {
       // live-in with no predecessor: an incoming argument register → function parameter.
+      // If one was already asserted for this key (ensureParam), adopt it — minting a second
+      // parameter for the same key would put the key in the signature twice.
+      const obliged = obligedParams[b].get(reg);
+      if (obliged !== undefined) {
+        obligedParams[b].delete(reg);
+        defs[b].set(reg, obliged);
+        return obliged;
+      }
       const p = mkValue(T.unk(32));
       irBlocks[b].params.push(p);
       defs[b].set(reg, p);
@@ -75,16 +154,24 @@ export function makeSsaBuilder(name: string, blockCount: number, preds: number[]
     return phi;
   };
   const addPhiOperands = (reg: string, b: number) => {
-    for (const p of preds[b]) {
+    for (const p of distinctPreds(b)) {
       appendSuccessorArg(p, b, readVar(reg, p));
     }
   };
-  // Append `arg` to predecessor p's terminator successor that targets block b.
+  // Append `arg` to EVERY successor edge of predecessor p that targets block b.
+  //
+  // A predecessor normally has one edge to a given successor, but a `switch_br` has as many as it
+  // has case values, and two cases sharing a body (`case 1: case 2:`) is ordinary C. Block args
+  // belong to the EDGE, so each of those edges needs its own copy: appending to just the first (a
+  // `find`) left the others short, while `preds` listing the block once per edge made the loop run
+  // k times and pile k copies onto that same first edge. Both halves of that — every edge, once per
+  // predecessor BLOCK — have to hold together, which is why they are fixed in one place.
   const appendSuccessorArg = (p: number, b: number, arg: Value) => {
     const term = irBlocks[p].ops[irBlocks[p].ops.length - 1];
-    const s = term.successors.find((su) => su.block === irBlocks[b]);
-    if (s) {
-      s.args.push(arg);
+    for (const s of term.successors) {
+      if (s.block === irBlocks[b]) {
+        s.args.push(arg);
+      }
     }
   };
   const sealBlock = (b: number) => {
@@ -106,6 +193,25 @@ export function makeSsaBuilder(name: string, blockCount: number, preds: number[]
   };
   sealReadyBlocks(); // seals the entry (no predecessors) up front
 
+  // See the interface docs. Two cases, and the split is the whole point: when nothing defines the
+  // key, the ordinary live-in path already does exactly the right thing; when something does, a
+  // parameter still has to exist for the signature, and it must be added WITHOUT redirecting the
+  // dataflow to it.
+  const ensureParam = (key: string, b: number): void => {
+    if (preds[b].length > 0) {
+      return; // a parameter here is a phi; see the precondition on the interface
+    }
+    for (const p of irBlocks[b].params) {
+      if (paramReg.get(p) === key) {
+        return; // already a parameter, however it got there
+      }
+    }
+    const p = mkValue(T.unk(32));
+    irBlocks[b].params.push(p);
+    paramReg.set(p, key); // ranked by the ABI sort like any other parameter
+    obligedParams[b].set(key, p);
+  };
+
   const hasReachingDef = (reg: string, b: number, seen = new Set<number>()): boolean => {
     if (defs[b].has(reg)) {
       return true;
@@ -123,12 +229,71 @@ export function makeSsaBuilder(name: string, blockCount: number, preds: number[]
     readVar,
     writeVar,
     paramReg,
+    ensureParam,
     hasReachingDef,
+    noteCall: (b: number) => {
+      callsIn.add(b);
+      writtenSinceCall[b] = new Set(); // the callee clobbers the caller-saved registers
+    },
+    recordGuessedCall: (op: Op, b: number, argRegs: string[]) => {
+      argRegsSeen = argRegs;
+      guessedCalls.push({
+        block: b,
+        op,
+        freshBefore: new Set(writtenSinceCall[b]),
+        afterCallInBlock: callsIn.has(b), // `noteCall` runs after this, so this means an EARLIER call
+      });
+    },
     markFilled: (b: number) => {
       filled[b] = true;
       sealReadyBlocks();
     },
-    finish: () => simplifyTrivialPhis(fn, phiBlock),
+    finish: () => {
+      // Guessed arities counted argument registers by reaching definition alone; now that every
+      // block's calls are known, drop the ones an intervening call had already clobbered.
+      if (guessedCalls.length) {
+        trimClobberedCallArgs({
+          argRegs: argRegsSeen,
+          preds,
+          freshAtEnd: writtenSinceCall,
+          callsIn,
+          sites: guessedCalls,
+        });
+      }
+      simplifyTrivialPhis(fn, (p) => {
+        phiBlock.delete(p);
+        phiKey.delete(p);
+      });
+      // A STACK SLOT MAY NEVER LEAVE AS AN ENTRY PARAMETER. A slot is memory the function itself
+      // allocated, so its value can only come from a store the function made; arriving as a live-in
+      // instead means it was read on a path that never stored it, and the signature has grown an
+      // argument the function does not take, standing in for uninitialised stack.
+      //
+      // Checked here, of the FINISHED function, rather than as a precondition at each read. The
+      // per-read test available during construction (`hasReachingDef`) asks whether a store reaches
+      // on SOME path, which a diamond defeats; strengthening it to "every path" is not answerable
+      // mid-fill, because a loop's back-edge predecessor is not filled yet and the query would
+      // report "unassigned" for a slot initialised before the loop — the commonest real shape.
+      // Asking about the symptom instead costs one pass and cannot be defeated by fill order.
+      //
+      // It is total because in Braun's construction a value undefined on some path can surface only
+      // as a live-in of a block with no predecessors — and BOTH spellings of that are checked:
+      // `paramReg` for the live-in path, `phiKey` for the case where the entry block is itself a
+      // loop header and the fabricated value arrives as a phi instead. Missing the second is what
+      // let this survive on MIPS.
+      //
+      // In `finish()` and not a helper each frontend remembers to call: this is the frontend's only
+      // semantic postcondition, and a postcondition enforced by convention is not enforced.
+      for (const p of irBlocks[0].params) {
+        const key = paramReg.get(p) ?? phiKey.get(p);
+        if (key?.startsWith(SLOT_PREFIX)) {
+          throw new FrontendUnsupportedError(
+            `cannot lift '${name}': stack slot ${key} is read on a path that never stores it ` +
+              `(partially-initialised local) — not modelled`,
+          );
+        }
+      }
+    },
   };
 }
 
@@ -150,6 +315,109 @@ export function fallbackArgc(
   return n;
 }
 
+/** One call site whose arity was GUESSED by {@link fallbackArgc}, with what the lifting scan saw
+ *  of its own block up to that instruction. */
+export interface GuessedCallSite {
+  block: number;
+  /** the `call` op — its operands are the guessed arguments, in argument-register order */
+  op: Op;
+  /** argument registers written between the last call in this block (or the block's start) and here */
+  freshBefore: Set<string>;
+  /** did this block already make a call before this one? */
+  afterCallInBlock: boolean;
+}
+
+export interface CallArgTrim {
+  argRegs: string[];
+  /** one entry per CFG edge, as passed to {@link makeSsaBuilder} */
+  preds: number[][];
+  /** per block: the keys written since its LAST call (since its start if it makes none). Indexed by
+   *  block, and it holds every key the builder saw, not only argument registers. */
+  freshAtEnd: Array<Set<string>>;
+  /** blocks that make at least one call */
+  callsIn: Set<number>;
+  sites: GuessedCallSite[];
+}
+
+/** Cut a GUESSED call arity down by the ABI's caller-saved clobber.
+ *
+ *  `fallbackArgc` counts argument registers that merely have a reaching definition. A call clobbers
+ *  r0..r3, so a definition the call sits between cannot be an argument the caller set up — correct
+ *  compiled code would have re-materialized it. Counting it anyway INVENTS arguments
+ *  (`m4aSongNumStart(0x89, 30, x, &g)` for a one-argument callee) — a hard compile error where the
+ *  project's own header is in scope, and silently wrong code where C89's implicit declaration
+ *  covers for it.
+ *
+ *  SCOPE: this closes the arguments an intervening CALL disproves, which is the common case in real
+ *  code. It does not close the rest — a dead value the compiler happened to leave in the next
+ *  argument register with no call in between still reads as an argument, and nothing about the
+ *  register file can say otherwise. Only a declared prototype closes those.
+ *
+ *  A must-analysis: a register is FRESH at a point iff on EVERY path reaching it, it was written
+ *  after the last call. The entry block starts all-fresh (those are the caller's own arguments).
+ *  The result only ever SHRINKS an arity — a register the analysis cannot prove clobbered stays an
+ *  argument — so no real argument can be dropped by it.
+ *
+ *  Frontend-agnostic: the caller supplies what its own lifting scan observed, so nothing here
+ *  re-derives which instruction writes which register. */
+export function trimClobberedCallArgs(inp: CallArgTrim): void {
+  const { argRegs, preds, freshAtEnd, callsIn, sites } = inp;
+  const blockCount = freshAtEnd.length;
+  const all = () => new Set(argRegs);
+  const localEnd = (b: number) => freshAtEnd[b] ?? new Set<string>();
+  // freshOut[b]: registers fresh where b ends. A block that calls forgets everything before its
+  // last call; one that does not passes its input through, plus what it wrote.
+  const freshOut: Set<string>[] = Array.from({ length: blockCount }, () => all());
+  const freshIn: Set<string>[] = Array.from({ length: blockCount }, () => all());
+  const inOf = (b: number): Set<string> => {
+    // A block with NO predecessors is the function entry (or unreachable): its argument registers
+    // are the ones the caller set up. An entry that DOES have predecessors — an entry that is also
+    // a loop header — gets the ordinary intersection instead, because on the back edge the caller's
+    // setup is long gone and an intervening call may have clobbered it.
+    const ps = [...new Set(preds[b] ?? [])];
+    if (ps.length === 0) {
+      return all();
+    }
+    const acc = new Set(freshOut[ps[0]]);
+    for (const p of ps.slice(1)) {
+      for (const r of [...acc]) {
+        if (!freshOut[p].has(r)) {
+          acc.delete(r);
+        }
+      }
+    }
+    return acc;
+  };
+  for (let changed = true; changed;) {
+    changed = false;
+    for (let b = 0; b < blockCount; b++) {
+      const fin = inOf(b);
+      const fout = callsIn.has(b) ? localEnd(b) : new Set([...fin, ...localEnd(b)]);
+      if (fout.size !== freshOut[b].size || [...fout].some((r) => !freshOut[b].has(r))) {
+        changed = true;
+      }
+      freshIn[b] = fin;
+      freshOut[b] = fout;
+    }
+  }
+  for (const s of sites) {
+    const fresh = s.afterCallInBlock ? s.freshBefore : new Set([...freshIn[s.block], ...s.freshBefore]);
+    let n = 0;
+    while (n < argRegs.length && fresh.has(argRegs[n])) {
+      n++;
+    }
+    if (n < s.op.operands.length) {
+      s.op.operands.length = n;
+    }
+  }
+}
+
+/** The stack-slot key both the MIPS and Thumb frontends use for a word-sized local in the
+ *  function's own frame. Shared so the two spell it identically and `assertNoSlotEscaped` can
+ *  recognise either frontend's slots. See the virtual-key note in the module header. */
+const SLOT_PREFIX = 'sp@';
+export const stackSlotKey = (off: number): string => `${SLOT_PREFIX}${off}`;
+
 /** Order the TRUE entry block's parameters by ABI argument register, so downstream naming
  *  (`a0`, `a1`, …) matches the calling convention, not first-read order (a callee-saved copy can
  *  read a later argument register first). No-op when the entry has predecessors — a loop
@@ -167,48 +435,3 @@ export function abiSortEntryParams(
   }
   entry.params.sort((x, y) => rank(x) - rank(y));
 }
-
-// Remove block-parameters that are really trivial phis: those whose incoming operands (across
-// every predecessor edge, ignoring self-references from a back-edge) are all the same single
-// value. Such a parameter carries no join information — a loop-invariant register or a value
-// defined before the join — so it is replaced by that value and the corresponding argument
-// dropped from each predecessor's terminator. Iterated to fixpoint because removing one phi
-// can make another trivial.
-function simplifyTrivialPhis(fn: Fn, phiBlock: Map<Value, number>): void {
-  const edgesTo = (b: Block): Successor[] => {
-    const out: Successor[] = [];
-    for (const pb of fn.blocks) {
-      for (const op of pb.ops) {
-        for (const s of op.successors) {
-          if (s.block === b) {
-            out.push(s);
-          }
-        }
-      }
-    }
-    return out;
-  };
-  let changed = true;
-  while (changed) {
-    changed = false;
-    for (const b of fn.blocks) {
-      const incoming = edgesTo(b);
-      for (let i = b.params.length - 1; i >= 0; i--) {
-        const param = b.params[i];
-        const operands = incoming.map((s) => s.args[i]);
-        const distinct = [...new Set(operands.filter((v) => v !== param))];
-        if (distinct.length !== 1) {
-          continue;
-        } // a genuine join (or unreachable) — keep it
-        const v = distinct[0];
-        replaceAllUsesWith(fn, param, v);
-        b.params.splice(i, 1);
-        for (const s of incoming) {
-          s.args.splice(i, 1);
-        }
-        phiBlock.delete(param);
-        changed = true;
-      }
-    }
-  }
-}