@asmlift/core 0.4.0 → 0.5.0

package/src/frontend/ssa.ts

@@ -15,9 +15,10 @@
 // computation via read/writeVar, push its terminator op last (successors referencing
 // `irBlocks`, args left empty — phi wiring appends them), then call `markFilled(b)`. When all
 // blocks are filled, call `finish()` to remove trivial phis.
-import { Block, Fn, Value, mkValue } from '../ir/core';
+import { Block, Fn, Op, Value, mkValue } from '../ir/core';
 import { simplifyTrivialPhis } from '../ir/simplify';
 import { T } from '../ir/types';
+import { FrontendUnsupportedError } from './errors';
 
 export interface SsaBuilder {
   fn: Fn;
@@ -28,15 +29,44 @@ export interface SsaBuilder {
   writeVar(reg: string, b: number, v: Value): void;
   /** Mark block `b` fully emitted (terminator pushed); seals any now-ready successors. */
   markFilled(b: number): void;
-  /** Live-in parameter value → the ABI register it arrived on (for calling-convention order). */
+  /** Live-in parameter value → the key it arrived on (for calling-convention order). Usually an
+   *  ABI register name, but a frontend's virtual key (see the module header) ranks here too. */
   paramReg: Map<Value, string>;
+  /** Assert that block `b` takes a parameter for `key`, whether or not anything reads it.
+   *
+   *  `readVar` cannot express this. It asks "what value does `key` hold here?", so a key the block
+   *  DEFINES before any read answers with that local definition and no parameter is created — to it
+   *  "never read" and "written before first read" are the same thing. When a calling convention
+   *  proves an argument exists, that is an obligation on the SIGNATURE, independent of whether the
+   *  body happens to use it, so it needs its own verb.
+   *
+   *  Never touches the block's definitions: the parameter is added and left unused, so any local
+   *  value already flowing keeps flowing. Only meaningful on a block with no predecessors —
+   *  elsewhere a parameter is a phi whose position is aligned with its predecessors' terminator
+   *  args, and appending an unpaired one would corrupt that. */
+  ensureParam(key: string, b: number): void;
   /** Whether `reg` has a definition reaching block `b` (best-effort call-arity heuristic). */
   hasReachingDef(reg: string, b: number, seen?: Set<number>): boolean;
-  /** Remove trivial phis; call once every block is filled. */
+  /** Record that block `b` makes a call HERE: the ABI's caller-saved registers stop being ones the
+   *  caller set up. Call it AFTER `recordGuessedCall` for the same instruction, and before writing
+   *  the call's own result. */
+  noteCall(b: number): void;
+  /** Register a `call` op whose arity was GUESSED (no prototype), so `finish` can cut it back to the
+   *  argument registers that were actually set up on every path (see {@link trimClobberedCallArgs}).
+   *  `argRegs` is the target's argument-register order. */
+  recordGuessedCall(op: Op, b: number, argRegs: string[]): void;
+  /** Remove trivial phis and enforce the frontend's postconditions; call once every block is
+   *  filled. Throws FrontendUnsupportedError if a stack slot escaped as an entry parameter. */
   finish(): void;
 }
 
 /** `preds` is per-EDGE (see the module header): one entry per CFG edge into each block. */
+// VARIABLE NAMES ARE NOT ALWAYS MACHINE REGISTERS. `readVar`/`writeVar` key on an arbitrary string,
+// and frontends mint VIRTUAL keys for storage the ISA has no register for — MIPS `sp@<off>` for a
+// stack slot (frontend/mips.ts), Thumb `@sarg<k>` for an incoming stack argument (frontend/thumb.ts).
+// A virtual key must be outside its ISA's register grammar so it cannot collide with a real one, and
+// a key read with no reaching def becomes a function PARAMETER by the live-in path below — which is
+// how both of those capabilities get their parameters without a new opcode or pass.
 export function makeSsaBuilder(name: string, blockCount: number, preds: number[][]): SsaBuilder {
   const irBlocks: Block[] = Array.from({ length: blockCount }, () => ({ params: [] as Value[], ops: [] }));
   const fn: Fn = { name, blocks: irBlocks };
@@ -46,18 +76,43 @@ export function makeSsaBuilder(name: string, blockCount: number, preds: number[]
   const filled: boolean[] = irBlocks.map(() => false);
   const incompletePhis: Array<Map<string, Value>> = irBlocks.map(() => new Map());
   const phiBlock = new Map<Value, number>();
+  // The key each phi stands for. `paramReg` covers live-ins only, so without this a slot that
+  // arrives as a PHI — which is what happens when the entry block is itself a loop header — is
+  // invisible to the escape check below. Braun's construction gives no other way to tell.
+  const phiKey = new Map<Value, string>();
   const paramReg = new Map<Value, string>();
+  // Parameters created by ensureParam that nothing has read yet. They are deliberately NOT in
+  // `defs`: a parameter asserted because a calling convention proves it exists is not evidence that
+  // a VALUE reaches anything, and writing one into `defs` would say it does. That distinction is
+  // load-bearing — `hasReachingDef` feeds `fallbackArgc`, so a def here silently raises the guessed
+  // arity of every prototype-less call in the function, making it pass registers the calling block
+  // never set up (`unknown(1)` became `unknown(1, a1, a2, a3)`). The first read adopts the value
+  // from here instead of minting a second parameter for the same key.
+  const obligedParams: Array<Map<string, Value>> = irBlocks.map(() => new Map());
 
   // `preds` lists an entry per CFG EDGE; these are the distinct predecessor BLOCKS.
   const distinctPreds = (b: number): number[] => [...new Set(preds[b])];
 
-  const writeVar = (reg: string, b: number, v: Value) => defs[b].set(reg, v);
+  // CALLER-SAVED CLOBBER, for guessed call arities (see trimClobberedCallArgs). Tracked HERE
+  // because every register write in every frontend already goes through `writeVar`: a frontend
+  // that gathered this itself would be sound only while it remembered to route each write past a
+  // wrapper, and a MISSED write under-counts an arity — which drops a real argument silently.
+  const writtenSinceCall: Array<Set<string>> = irBlocks.map(() => new Set());
+  const callsIn = new Set<number>();
+  const guessedCalls: GuessedCallSite[] = [];
+  let argRegsSeen: string[] = [];
+
+  const writeVar = (reg: string, b: number, v: Value) => {
+    writtenSinceCall[b].add(reg);
+    defs[b].set(reg, v);
+  };
   const readVar = (reg: string, b: number): Value => defs[b].get(reg) ?? readRecursive(reg, b);
 
   const newPhi = (reg: string, b: number): Value => {
     const phi = mkValue(T.unk(32));
     irBlocks[b].params.push(phi);
     phiBlock.set(phi, b);
+    phiKey.set(phi, reg);
     defs[b].set(reg, phi); // set before wiring operands to break cycles
     return phi;
   };
@@ -74,6 +129,14 @@ export function makeSsaBuilder(name: string, blockCount: number, preds: number[]
     const ps = distinctPreds(b);
     if (ps.length === 0) {
       // live-in with no predecessor: an incoming argument register → function parameter.
+      // If one was already asserted for this key (ensureParam), adopt it — minting a second
+      // parameter for the same key would put the key in the signature twice.
+      const obliged = obligedParams[b].get(reg);
+      if (obliged !== undefined) {
+        obligedParams[b].delete(reg);
+        defs[b].set(reg, obliged);
+        return obliged;
+      }
       const p = mkValue(T.unk(32));
       irBlocks[b].params.push(p);
       defs[b].set(reg, p);
@@ -130,6 +193,25 @@ export function makeSsaBuilder(name: string, blockCount: number, preds: number[]
   };
   sealReadyBlocks(); // seals the entry (no predecessors) up front
 
+  // See the interface docs. Two cases, and the split is the whole point: when nothing defines the
+  // key, the ordinary live-in path already does exactly the right thing; when something does, a
+  // parameter still has to exist for the signature, and it must be added WITHOUT redirecting the
+  // dataflow to it.
+  const ensureParam = (key: string, b: number): void => {
+    if (preds[b].length > 0) {
+      return; // a parameter here is a phi; see the precondition on the interface
+    }
+    for (const p of irBlocks[b].params) {
+      if (paramReg.get(p) === key) {
+        return; // already a parameter, however it got there
+      }
+    }
+    const p = mkValue(T.unk(32));
+    irBlocks[b].params.push(p);
+    paramReg.set(p, key); // ranked by the ABI sort like any other parameter
+    obligedParams[b].set(key, p);
+  };
+
   const hasReachingDef = (reg: string, b: number, seen = new Set<number>()): boolean => {
     if (defs[b].has(reg)) {
       return true;
@@ -147,12 +229,71 @@ export function makeSsaBuilder(name: string, blockCount: number, preds: number[]
     readVar,
     writeVar,
     paramReg,
+    ensureParam,
     hasReachingDef,
+    noteCall: (b: number) => {
+      callsIn.add(b);
+      writtenSinceCall[b] = new Set(); // the callee clobbers the caller-saved registers
+    },
+    recordGuessedCall: (op: Op, b: number, argRegs: string[]) => {
+      argRegsSeen = argRegs;
+      guessedCalls.push({
+        block: b,
+        op,
+        freshBefore: new Set(writtenSinceCall[b]),
+        afterCallInBlock: callsIn.has(b), // `noteCall` runs after this, so this means an EARLIER call
+      });
+    },
     markFilled: (b: number) => {
       filled[b] = true;
       sealReadyBlocks();
     },
-    finish: () => simplifyTrivialPhis(fn, (p) => phiBlock.delete(p)),
+    finish: () => {
+      // Guessed arities counted argument registers by reaching definition alone; now that every
+      // block's calls are known, drop the ones an intervening call had already clobbered.
+      if (guessedCalls.length) {
+        trimClobberedCallArgs({
+          argRegs: argRegsSeen,
+          preds,
+          freshAtEnd: writtenSinceCall,
+          callsIn,
+          sites: guessedCalls,
+        });
+      }
+      simplifyTrivialPhis(fn, (p) => {
+        phiBlock.delete(p);
+        phiKey.delete(p);
+      });
+      // A STACK SLOT MAY NEVER LEAVE AS AN ENTRY PARAMETER. A slot is memory the function itself
+      // allocated, so its value can only come from a store the function made; arriving as a live-in
+      // instead means it was read on a path that never stored it, and the signature has grown an
+      // argument the function does not take, standing in for uninitialised stack.
+      //
+      // Checked here, of the FINISHED function, rather than as a precondition at each read. The
+      // per-read test available during construction (`hasReachingDef`) asks whether a store reaches
+      // on SOME path, which a diamond defeats; strengthening it to "every path" is not answerable
+      // mid-fill, because a loop's back-edge predecessor is not filled yet and the query would
+      // report "unassigned" for a slot initialised before the loop — the commonest real shape.
+      // Asking about the symptom instead costs one pass and cannot be defeated by fill order.
+      //
+      // It is total because in Braun's construction a value undefined on some path can surface only
+      // as a live-in of a block with no predecessors — and BOTH spellings of that are checked:
+      // `paramReg` for the live-in path, `phiKey` for the case where the entry block is itself a
+      // loop header and the fabricated value arrives as a phi instead. Missing the second is what
+      // let this survive on MIPS.
+      //
+      // In `finish()` and not a helper each frontend remembers to call: this is the frontend's only
+      // semantic postcondition, and a postcondition enforced by convention is not enforced.
+      for (const p of irBlocks[0].params) {
+        const key = paramReg.get(p) ?? phiKey.get(p);
+        if (key?.startsWith(SLOT_PREFIX)) {
+          throw new FrontendUnsupportedError(
+            `cannot lift '${name}': stack slot ${key} is read on a path that never stores it ` +
+              `(partially-initialised local) — not modelled`,
+          );
+        }
+      }
+    },
   };
 }
 
@@ -174,6 +315,109 @@ export function fallbackArgc(
   return n;
 }
 
+/** One call site whose arity was GUESSED by {@link fallbackArgc}, with what the lifting scan saw
+ *  of its own block up to that instruction. */
+export interface GuessedCallSite {
+  block: number;
+  /** the `call` op — its operands are the guessed arguments, in argument-register order */
+  op: Op;
+  /** argument registers written between the last call in this block (or the block's start) and here */
+  freshBefore: Set<string>;
+  /** did this block already make a call before this one? */
+  afterCallInBlock: boolean;
+}
+
+export interface CallArgTrim {
+  argRegs: string[];
+  /** one entry per CFG edge, as passed to {@link makeSsaBuilder} */
+  preds: number[][];
+  /** per block: the keys written since its LAST call (since its start if it makes none). Indexed by
+   *  block, and it holds every key the builder saw, not only argument registers. */
+  freshAtEnd: Array<Set<string>>;
+  /** blocks that make at least one call */
+  callsIn: Set<number>;
+  sites: GuessedCallSite[];
+}
+
+/** Cut a GUESSED call arity down by the ABI's caller-saved clobber.
+ *
+ *  `fallbackArgc` counts argument registers that merely have a reaching definition. A call clobbers
+ *  r0..r3, so a definition the call sits between cannot be an argument the caller set up — correct
+ *  compiled code would have re-materialized it. Counting it anyway INVENTS arguments
+ *  (`m4aSongNumStart(0x89, 30, x, &g)` for a one-argument callee) — a hard compile error where the
+ *  project's own header is in scope, and silently wrong code where C89's implicit declaration
+ *  covers for it.
+ *
+ *  SCOPE: this closes the arguments an intervening CALL disproves, which is the common case in real
+ *  code. It does not close the rest — a dead value the compiler happened to leave in the next
+ *  argument register with no call in between still reads as an argument, and nothing about the
+ *  register file can say otherwise. Only a declared prototype closes those.
+ *
+ *  A must-analysis: a register is FRESH at a point iff on EVERY path reaching it, it was written
+ *  after the last call. The entry block starts all-fresh (those are the caller's own arguments).
+ *  The result only ever SHRINKS an arity — a register the analysis cannot prove clobbered stays an
+ *  argument — so no real argument can be dropped by it.
+ *
+ *  Frontend-agnostic: the caller supplies what its own lifting scan observed, so nothing here
+ *  re-derives which instruction writes which register. */
+export function trimClobberedCallArgs(inp: CallArgTrim): void {
+  const { argRegs, preds, freshAtEnd, callsIn, sites } = inp;
+  const blockCount = freshAtEnd.length;
+  const all = () => new Set(argRegs);
+  const localEnd = (b: number) => freshAtEnd[b] ?? new Set<string>();
+  // freshOut[b]: registers fresh where b ends. A block that calls forgets everything before its
+  // last call; one that does not passes its input through, plus what it wrote.
+  const freshOut: Set<string>[] = Array.from({ length: blockCount }, () => all());
+  const freshIn: Set<string>[] = Array.from({ length: blockCount }, () => all());
+  const inOf = (b: number): Set<string> => {
+    // A block with NO predecessors is the function entry (or unreachable): its argument registers
+    // are the ones the caller set up. An entry that DOES have predecessors — an entry that is also
+    // a loop header — gets the ordinary intersection instead, because on the back edge the caller's
+    // setup is long gone and an intervening call may have clobbered it.
+    const ps = [...new Set(preds[b] ?? [])];
+    if (ps.length === 0) {
+      return all();
+    }
+    const acc = new Set(freshOut[ps[0]]);
+    for (const p of ps.slice(1)) {
+      for (const r of [...acc]) {
+        if (!freshOut[p].has(r)) {
+          acc.delete(r);
+        }
+      }
+    }
+    return acc;
+  };
+  for (let changed = true; changed;) {
+    changed = false;
+    for (let b = 0; b < blockCount; b++) {
+      const fin = inOf(b);
+      const fout = callsIn.has(b) ? localEnd(b) : new Set([...fin, ...localEnd(b)]);
+      if (fout.size !== freshOut[b].size || [...fout].some((r) => !freshOut[b].has(r))) {
+        changed = true;
+      }
+      freshIn[b] = fin;
+      freshOut[b] = fout;
+    }
+  }
+  for (const s of sites) {
+    const fresh = s.afterCallInBlock ? s.freshBefore : new Set([...freshIn[s.block], ...s.freshBefore]);
+    let n = 0;
+    while (n < argRegs.length && fresh.has(argRegs[n])) {
+      n++;
+    }
+    if (n < s.op.operands.length) {
+      s.op.operands.length = n;
+    }
+  }
+}
+
+/** The stack-slot key both the MIPS and Thumb frontends use for a word-sized local in the
+ *  function's own frame. Shared so the two spell it identically and `assertNoSlotEscaped` can
+ *  recognise either frontend's slots. See the virtual-key note in the module header. */
+const SLOT_PREFIX = 'sp@';
+export const stackSlotKey = (off: number): string => `${SLOT_PREFIX}${off}`;
+
 /** Order the TRUE entry block's parameters by ABI argument register, so downstream naming
  *  (`a0`, `a1`, …) matches the calling convention, not first-read order (a callee-saved copy can
  *  read a later argument register first). No-op when the entry has predecessors — a loop