@asmlift/core 0.5.0 → 0.7.0

package/src/l3/ptrfield.ts

@@ -0,0 +1,227 @@
+// L3 respell variation: declare a recovered WORD field a POINTER (`void *field_4;` rather than
+// `s32 field_4;`), and cast at each read.
+//
+// raise/structs.ts recovers a field's type from the ACCESS WIDTH alone — a 4-byte load is `s32`,
+// because that is all a load says. On a 32-bit target `void *` fits the same evidence exactly:
+// the two spellings load the same word with the same instruction, so the asm cannot referee them
+// and the struct recovery's own byte-neutrality note applies to the field TYPE as much as to the
+// `->field_N` vs `[idx]` question it was written about.
+//
+// IT IS NOT NEUTRAL TO THE COMPILER, which is the whole reason to spell it. A pointer and an `s32`
+// are different alias sets, so under strict aliasing the loop optimizer may hoist a pointer field's
+// load past an `s32`-typed store it must otherwise keep behind — and on synthetic:dmaptrsrc that
+// hoist is the difference between a byte-exact match and a 35-point diff, once the accumulator is
+// un-reduced back into the loop (that row's fan: `/vol-store/unreduce/ptr-field` 0,
+// `/vol-store/unreduce` 35). Which side matches is per-field knowledge nothing in the asm
+// carries, so both are enumerated and the differ referees.
+//
+// WHERE THE FLAG IS, because two readers have now looked for `-fstrict-aliasing` in the benchmark's
+// agbcc line and not found it: it is not there, and it does not need to be. `-O2` turns it on
+// (gcc 2.9 sets `flag_strict_aliasing` from `optimize >= 2`), which is why the CITATION is a
+// behaviour rather than a flag. Verified in BOTH directions on this row's own shape, objects
+// compared byte-for-byte:
+//     `void *` field, harness flags        → the field load is HOISTED above the loop label
+//     `s32`    field, harness flags        → it STAYS in the loop body
+//     `void *` field, + -fno-strict-aliasing → byte-IDENTICAL to the `s32` build
+//     `s32`    field, + -fstrict-aliasing    → byte-IDENTICAL to itself (the flag was already on)
+// So adding the flag proves nothing and REMOVING it proves everything, which is the direction a
+// reader checking this note should take. The stores the load is hoisted past are the loop's own
+// `*(volatile s32 *)0x040000D4/D8/DC` device writes — `volatile` restricts what may be done with
+// THOSE accesses and does not merge their type into the pointer's alias set.
+//
+// SEMANTICS ARE PRESERVED BY CONSTRUCTION on a target whose pointers are 32 bits: the declaration
+// changes, and every read is wrapped in a cast back to the field's own recovered integer type, so
+// each use computes the same value it did. Nothing else moves. THE 32-BIT ASSUMPTION IS ASSERTED,
+// NOT CHECKED — there is no pointer-width field on TargetDescription to check it against, and the
+// assumption is already tower-wide (`l3/typing.ts`'s `ptrElemBytes` returns 4 for any pointee). On
+// a 64-bit target this variation would change a struct's LAYOUT rather than only its spelling, so the
+// width field is what that target's first row must add, and this note is where to start.
+//
+// IT FLIPS EVERY ADMITTED FIELD AT ONCE, and its own paragraph above says the knowledge is
+// PER-FIELD — so the subset enumeration `l3/volatileptr.ts` does for exactly this reason
+// (`volatileSubsetCandidates`, capped at three locals) is the shape this variation will eventually
+// want. It is not built yet because nothing demands it: swept over 834 corpus trees, the variation
+// fires on 42, and 34 of those have a single admitted field. The six 2-field trees and the two
+// 4-field ones (`sa3:sa2__sub_8083504` flips Struct0.field_8/12 and Struct2.field_8/12 together)
+// are where 1 of 3 and 1 of 15 non-empty subsets is reachable. A row that needs one of the missing
+// subsets is what earns the enumeration — and it will cost candidates, which is why "it might
+// help" is not enough.
+//
+// GATE (PTR_FIELD_GATES, read once per field): the field's recovered type must be a 32-bit
+// integer; it must never be a store LVALUE (the write side would need a cast on the value, which
+// is a second question); and it must never stand as the BASE of another access (a field the tree
+// already dereferences is one the recovery typed from its own use, not from a width). Nothing
+// qualifying ⇒ decline (null).
+//
+// SCOPE, because both of this table's blind spots look exactly like a gate refusing. First, THERE
+// IS NO PAD RULE, deliberately: `plan` builds a ctx only for fields the tree ACCESSES, so "a field
+// nothing reaches" cannot arise — and a rule for it reads as one, then answers for the 78 corpus
+// WRITE-ONLY fields that `written` owns. Second, a field whose
+// BASE TYPE does not resolve is dropped by `plan` before any gate reads it — 151 of the corpus's
+// 820 field nodes, on 20 trees, all of them `[map]` configurations (kleod:CheckTileCollisionVertical,
+// FreeAllDecompBuffers, TransformSingleEntityToScreen and ConfigureEntityBehavior among them).
+// Declining there is right; being unable to say which of the two happened is the defect.
+import { type IrType, T } from '../ir/types';
+import {
+  type Expr,
+  type SFn,
+  type Stmt,
+  type StructType,
+  mapExprChildren,
+  mapStmtExprs,
+  stmtChildren,
+  walkExprs,
+} from './ast';
+import { type Gate, firstRejection } from './gates';
+import { declaredTypes, exprCType } from './typing';
+
+/** One recovered field as the gates read it — built only for fields the tree accesses. */
+interface FieldCtx {
+  /** the recovered type is a 32-bit integer — the width a pointer also fits */
+  word: boolean;
+  written: boolean;
+  /** the field's value stands as the base of an `index` or another `field` */
+  dereferenced: boolean;
+}
+
+export const PTR_FIELD_GATES: readonly Gate<FieldCtx>[] = [
+  {
+    id: 'not-word',
+    why: 'only a word-wide field fits a pointer as well as it fits an integer',
+    sound: true,
+    guardedBy: 'ptrfield.test.ts: a halfword field declines',
+    rejects: (c) => !c.word,
+  },
+  {
+    id: 'written',
+    why: 'the write side needs a cast on the stored value, which is a separate question',
+    sound: true,
+    guardedBy: 'ptrfield.test.ts: a field the tree stores through declines',
+    rejects: (c) => c.written,
+  },
+  {
+    id: 'dereferenced',
+    why: 'a field the tree already dereferences was typed from its use, not from a width',
+    sound: true,
+    guardedBy: 'ptrfield.test.ts: a field standing as an access base declines',
+    rejects: (c) => c.dereferenced,
+  },
+];
+
+/** the struct a `field` node selects from, or null */
+function structOf(base: Expr, vt: ReturnType<typeof declaredTypes>): Extract<IrType, { kind: 'struct' }> | null {
+  const t = exprCType(base, vt);
+  const st = t?.kind === 'ptr' ? t.to : t;
+  return st?.kind === 'struct' ? st : null;
+}
+
+/** `<struct>.<field>` as one key — two structs may both carry a `field_4`. */
+const keyOf = (structName: string, field: string): string => `${structName}.${field}`;
+
+/** The fields PTR_FIELD_GATES admits, keyed by struct and name, each with the integer type its
+ *  reads cast back to. */
+function plan(sfn: SFn): Map<string, IrType> {
+  const vt = declaredTypes(sfn);
+  const seen = new Map<string, FieldCtx & { type: IrType }>();
+  const note = (base: Expr, name: string, edit: (c: FieldCtx) => void): void => {
+    const st = structOf(base, vt);
+    const declared = st?.fields.find((f) => f.name === name)?.type;
+    if (st === null || declared === undefined) {
+      return;
+    }
+    const key = keyOf(st.name, name);
+    const cur = seen.get(key) ?? {
+      word: declared.kind === 'int' && declared.width === 32,
+      written: false,
+      dereferenced: false,
+      type: declared,
+    };
+    edit(cur);
+    seen.set(key, cur);
+  };
+  for (const e of walkExprs(sfn.body)) {
+    if (e.k === 'field') {
+      note(e.base, e.name, () => {});
+    }
+    // a field standing as an access base is one the recovery typed from its own use
+    const inner = e.k === 'index' ? e.base : e.k === 'field' ? e.base : null;
+    if (inner?.k === 'field') {
+      note(inner.base, inner.name, (c) => (c.dereferenced = true));
+    }
+  }
+  for (const s of stores(sfn.body)) {
+    if (s.lval.k === 'field') {
+      note(s.lval.base, s.lval.name, (c) => (c.written = true));
+    }
+  }
+  const out = new Map<string, IrType>();
+  for (const [key, ctx] of seen) {
+    if (firstRejection(PTR_FIELD_GATES, ctx) === null) {
+      out.set(key, ctx.type);
+    }
+  }
+  return out;
+}
+
+/** Every `store` in the tree. ORDER-FREE by construction, which is what lets it use the shared
+ *  `stmtChildren` (a switch's default sits at `defaultAt`, not last): its one caller only sets
+ *  `written` on entries the preceding `walkExprs` pass already created — `note` builds an entry
+ *  from the DECLARED field type, a function of the key alone, so this loop mints no key. */
+function* stores(body: readonly Stmt[]): Generator<Extract<Stmt, { k: 'store' }>> {
+  for (const s of body) {
+    if (s.k === 'store') {
+      yield s;
+    }
+    yield* stores(stmtChildren(s));
+  }
+}
+
+/** The `/ptr-field` candidate, or null when no field qualifies. Read-only: returns a fresh SFn.
+ *
+ *  The struct type appears TWICE in a tree — inline in each `(struct S *)` cast and again in
+ *  `SFn.structs`, which is what a backend prints — so both are re-typed here. Letting them drift
+ *  would print a declaration the expressions' own types contradict. */
+export function pointerFields(sfn: SFn): SFn | null {
+  const admitted = plan(sfn);
+  if (admitted.size === 0) {
+    return null;
+  }
+  const flipStruct = <S extends { name: string; fields: { name: string; type: IrType }[] }>(st: S): S => ({
+    ...st,
+    fields: st.fields.map((f) => (admitted.has(keyOf(st.name, f.name)) ? { ...f, type: T.ptr(T.void()) } : f)),
+  });
+  const flip = (t: IrType): IrType => {
+    switch (t.kind) {
+      case 'struct':
+        return flipStruct(t);
+      case 'ptr':
+        return T.ptr(flip(t.to));
+      case 'array':
+        return T.array(flip(t.elem), t.count);
+      default:
+        return t;
+    }
+  };
+  const vt = declaredTypes(sfn);
+  const sub = (e: Expr): Expr => {
+    if (e.k === 'field') {
+      const st = structOf(e.base, vt);
+      const back = st === null ? undefined : admitted.get(keyOf(st.name, e.name));
+      const inner = mapExprChildren(e, sub);
+      return back === undefined ? inner : { k: 'cast', to: back, e: inner };
+    }
+    const m = mapExprChildren(e, sub);
+    return m.k === 'cast' ? { ...m, to: flip(m.to) } : m;
+  };
+  return {
+    ...sfn,
+    params: sfn.params.map((p) => ({ ...p, type: flip(p.type) })),
+    locals: sfn.locals.map((l) => ({ ...l, type: flip(l.type) })),
+    ...(sfn.globals ? { globals: sfn.globals.map((g) => ({ ...g, type: flip(g.type) })) } : {}),
+    ...(sfn.structs ? { structs: sfn.structs.map((s): StructType => flipStruct(s)) } : {}),
+    // `mapStmtExprs` already recurses into nested statement lists, so ONE call per top-level
+    // statement rewrites the whole subtree — a second walk over its children would apply `sub`
+    // twice and cast each read back to an integer twice over.
+    body: sfn.body.map((s) => mapStmtExprs(s, sub)),
+  };
+}

package/src/l3/regspell.ts

@@ -1,4 +1,4 @@
-// asmlift L3 — the REGISTER-COPY re-spelling, a differ-ranked representation lever (the fourth,
+// asmlift L3 — the REGISTER-COPY respell variation, differ-ranked like the three before it (the fourth,
 // after signedness / branch sense / walk-vs-index).
 //
 // A compiler's register allocation leaves SOURCE-visible footprints the coalescing structurer
@@ -26,7 +26,7 @@
 //        a bin operand materializes into its own fresh local first (`v = 128 << 9; … v / x …`) —
 //        the register the compiler staged the constant in.
 //   R3 — return assign-back: a non-var return expression lands in a fresh local first
-//        (`r = E; return r`). Emitted as a SEPARATE variant (with/without R3) when R1/R2 fired:
+//        (`r = E; return r`). Emitted as a SEPARATE result (with/without R3) when R1/R2 fired:
 //        which tail the source spelled is itself ambiguous.
 import { IrType, T } from '../ir/types';
 import { Expr, SFn, Stmt, exprEquals, mapExprChildren } from './ast';
@@ -117,9 +117,106 @@ function isConstExpr(e: Expr): boolean {
   }
 }
 
-/** Apply the register-copy re-spelling. Returns 0–2 variant SFns (without/with the R3 tail);
- *  empty when nothing fired. Pure — never mutates the input. */
-export function registerishSpellings(sfn: SFn): SFn[] {
+/** ONE R3 TAIL, NAMED BY WHAT IT DID rather than by where it landed in the list.
+ *
+ *  The tail is the assign-back before the `return`, and there are two spellings of it: reuse R1's
+ *  now-dead value var, or take a fresh one. R1 may not have fired, in which case there is no dead
+ *  var and only the fresh spelling exists — so the tails are a 1- OR 2-element list and the SECOND
+ *  spelling is not at a fixed index.
+ *
+ *  This field exists because the caller names these, and a candidate's variations are the instrument
+ *  every census in this repo reads (a `bench diff` FIELD). Index a `['/regcopy', '/regcopy-ret',
+ *  '/regcopy-ret-fresh']` table by POSITION instead and an R1-less function publishes its fresh
+ *  tail as `/regcopy-ret` — the dead-var-reuse name on the spelling that has no dead var to reuse
+ *  — and a census over the token `/regcopy-ret-fresh` then censuses nothing wherever R1 declines,
+ *  which is most of the corpus. */
+export type RegcopyTail = 'none' | 'reuse' | 'fresh';
+
+export interface RegcopySpelling {
+  /** which R3 tail this result carries — `none` is the un-tailed base */
+  tail: RegcopyTail;
+  sfn: SFn;
+}
+
+interface Diamond {
+  v: string;
+  E: Expr;
+  updArm: 'then' | 'else';
+  upd: Expr;
+  cond: Expr;
+}
+/** `if (cmp) { v = E } else { v = f(E) }` (or arms swapped), f = bin(E, const-ish). */
+function matchDiamond(s: Extract<Stmt, { k: 'if' }>): Diamond | null {
+  if (s.then.length !== 1 || s.else.length !== 1) {
+    return null;
+  }
+  const a = s.then[0];
+  const b = s.else[0];
+  if (a.k !== 'assign' || b.k !== 'assign' || a.name !== b.name) {
+    return null;
+  }
+  const isUpdOf = (upd: Expr, base: Expr): boolean =>
+    upd.k === 'bin' && isPure(upd.r) && exprEq(upd.l, base) && isConstExpr(upd.r);
+  if (isUpdOf(b.value, a.value)) {
+    return { v: a.name, E: a.value, updArm: 'else', upd: b.value, cond: s.cond };
+  }
+  if (isUpdOf(a.value, b.value)) {
+    return { v: a.name, E: b.value, updArm: 'then', upd: a.value, cond: s.cond };
+  }
+  return null;
+}
+/** Does the cond's NON-E operand mention `v`? (The E side becomes the copy; the other side
+ *  must be v-free or the hoisted assignment changes what it compares against.) */
+function condOtherMentions(cond: Expr, E: Expr, v: string): boolean {
+  if (cond.k !== 'bin') {
+    return false;
+  }
+  const other = exprEq(cond.l, E) ? cond.r : exprEq(cond.r, E) ? cond.l : null;
+  const mentions = (e: Expr): boolean => {
+    if (e.k === 'var') {
+      return e.name === v;
+    }
+    let hit = false;
+    mapExprChildren(e, (c) => {
+      hit = hit || mentions(c);
+      return c;
+    });
+    return hit;
+  };
+  return other ? mentions(other) : false;
+}
+/** cond compares E against a pure operand → same comparison reading the named var. */
+function rewriteCond(cond: Expr, E: Expr, name: string): Expr | null {
+  if (cond.k !== 'bin' || !(cond.op in FLIP)) {
+    return null;
+  }
+  if (exprEq(cond.l, E) && isPure(cond.r)) {
+    return { k: 'bin', op: cond.op, l: { k: 'var', name }, r: cond.r };
+  }
+  if (exprEq(cond.r, E) && isPure(cond.l)) {
+    return { k: 'bin', op: cond.op, l: cond.l, r: { k: 'var', name } };
+  }
+  return null;
+}
+function flipCmp(cond: Expr): Expr | null {
+  if (cond.k !== 'bin') {
+    return null;
+  }
+  const op = FLIP[cond.op];
+  return op ? { k: 'bin', op: op as Extract<Expr, { k: 'bin' }>['op'], l: cond.l, r: cond.r } : null;
+}
+/** in `upd`, the occurrence of subtree E replaced by var `name` (E was just assigned to it). */
+function renameSubexpr(e: Expr, E: Expr, name: string): Expr {
+  if (exprEq(e, E)) {
+    return { k: 'var', name };
+  }
+  return mapExprChildren(e, (c) => renameSubexpr(c, E, name));
+}
+
+/** Apply the register-copy re-spelling. Returns 0–3 results — the base, plus the R3 tail in each
+ *  spelling that exists (reuse needs R1 to have fired, fresh always does) — and an EMPTY list when
+ *  nothing fired. Pure — never mutates the input. */
+export function registerishSpellings(sfn: SFn): RegcopySpelling[] {
   const locals = [...sfn.locals];
   const taken = new Set([...sfn.params, ...sfn.locals].map((x) => x.name));
   let fresh = 0;
@@ -150,7 +247,7 @@ export function registerishSpellings(sfn: SFn): SFn[] {
         if (m) {
           const { v, E, updArm, upd, cond } = m;
           // GUARDS BEFORE ALLOCATION (a declined shape must leave no residue — the leaked
-          // dead `w` even perturbed the live-name count this lever exists to reproduce):
+          // dead `w` even perturbed the live-name count this variation exists to reproduce):
           //   • E and the cond pure; the cond's non-E operand must NOT mention v (a clamp's
           //     `if (a < v)` would compare against the POST-assignment v — reproduced);
           //   • the copy w carries E's RENDERED type, not v's declared one (retyping a u32
@@ -188,81 +285,6 @@ export function registerishSpellings(sfn: SFn): SFn[] {
     return out;
   };
 
-  interface Diamond {
-    v: string;
-    E: Expr;
-    updArm: 'then' | 'else';
-    upd: Expr;
-    cond: Expr;
-  }
-  /** `if (cmp) { v = E } else { v = f(E) }` (or arms swapped), f = bin(E, const-ish). */
-  function matchDiamond(s: Extract<Stmt, { k: 'if' }>): Diamond | null {
-    if (s.then.length !== 1 || s.else.length !== 1) {
-      return null;
-    }
-    const a = s.then[0];
-    const b = s.else[0];
-    if (a.k !== 'assign' || b.k !== 'assign' || a.name !== b.name) {
-      return null;
-    }
-    const isUpdOf = (upd: Expr, base: Expr): boolean =>
-      upd.k === 'bin' && isPure(upd.r) && exprEq(upd.l, base) && isConstExpr(upd.r);
-    if (isUpdOf(b.value, a.value)) {
-      return { v: a.name, E: a.value, updArm: 'else', upd: b.value, cond: s.cond };
-    }
-    if (isUpdOf(a.value, b.value)) {
-      return { v: a.name, E: b.value, updArm: 'then', upd: a.value, cond: s.cond };
-    }
-    return null;
-  }
-  /** Does the cond's NON-E operand mention `v`? (The E side becomes the copy; the other side
-   *  must be v-free or the hoisted assignment changes what it compares against.) */
-  function condOtherMentions(cond: Expr, E: Expr, v: string): boolean {
-    if (cond.k !== 'bin') {
-      return false;
-    }
-    const other = exprEq(cond.l, E) ? cond.r : exprEq(cond.r, E) ? cond.l : null;
-    const mentions = (e: Expr): boolean => {
-      if (e.k === 'var') {
-        return e.name === v;
-      }
-      let hit = false;
-      mapExprChildren(e, (c) => {
-        hit = hit || mentions(c);
-        return c;
-      });
-      return hit;
-    };
-    return other ? mentions(other) : false;
-  }
-  /** cond compares E against a pure operand → same comparison reading the named var. */
-  function rewriteCond(cond: Expr, E: Expr, name: string): Expr | null {
-    if (cond.k !== 'bin' || !(cond.op in FLIP)) {
-      return null;
-    }
-    if (exprEq(cond.l, E) && isPure(cond.r)) {
-      return { k: 'bin', op: cond.op, l: { k: 'var', name }, r: cond.r };
-    }
-    if (exprEq(cond.r, E) && isPure(cond.l)) {
-      return { k: 'bin', op: cond.op, l: cond.l, r: { k: 'var', name } };
-    }
-    return null;
-  }
-  function flipCmp(cond: Expr): Expr | null {
-    if (cond.k !== 'bin') {
-      return null;
-    }
-    const op = FLIP[cond.op];
-    return op ? { k: 'bin', op: op as Extract<Expr, { k: 'bin' }>['op'], l: cond.l, r: cond.r } : null;
-  }
-  /** in `upd`, the occurrence of subtree E replaced by var `name` (E was just assigned to it). */
-  function renameSubexpr(e: Expr, E: Expr, name: string): Expr {
-    if (exprEq(e, E)) {
-      return { k: 'var', name };
-    }
-    return mapExprChildren(e, (c) => renameSubexpr(c, E, name));
-  }
-
   // R2: stage const-expressions used as bin operands into fresh locals, at statement level.
   const r2Stmt = (s: Stmt): Stmt[] => {
     const staged: Stmt[] = [];
@@ -305,27 +327,30 @@ export function registerishSpellings(sfn: SFn): SFn[] {
   }
   const base: SFn = { ...sfn, locals: [...locals], body: afterR2 };
 
-  // R3 variants: the tail assign-back — a non-var return lands in a local first. WHICH local is
+  // R3 results: the tail assign-back — a non-var return lands in a local first. WHICH local is
   // itself allocator-ambiguous (gcc 2.9 wanted R1's dead value var — live-name-count sensitive;
   // another allocator may want the fresh one), so BOTH tails are emitted as candidates rather
   // than asserting one compiler's preference; the source dedupe collapses them when identical.
-  const tails: SFn[] = [];
+  const tails: RegcopySpelling[] = [];
   const last = base.body[base.body.length - 1];
-  if (last?.k === 'return' && last.value && last.value.k !== 'var') {
+  if (last?.k === 'return' && last.value !== undefined && last.value.k !== 'var') {
+    // bound here rather than re-read inside `mk`: a PROPERTY's narrowing does not survive into a
+    // closure, and re-asserting it is what the three casts this replaces were doing
+    const retVal: Expr = last.value;
     const mk = (name: string): SFn => ({
       ...base,
       locals: [...locals],
       body: [
         ...base.body.slice(0, -1),
-        { k: 'assign', name, value: (last as Extract<Stmt, { k: 'return' }>).value! } as Stmt,
-        { k: 'return', value: { k: 'var', name } } as Stmt,
+        { k: 'assign', name, value: retVal },
+        { k: 'return', value: { k: 'var', name } },
       ],
     });
     if (deadValueVar) {
-      tails.push(mk(deadValueVar));
+      tails.push({ tail: 'reuse', sfn: mk(deadValueVar) });
     }
-    tails.push(mk(freshVar(T.s(32))));
+    tails.push({ tail: 'fresh', sfn: mk(freshVar(T.s(32))) });
   }
 
-  return [base, ...tails];
+  return [{ tail: 'none', sfn: base }, ...tails];
 }