@asmlift/core 0.6.0 → 0.8.0

package/src/raise/structs.ts

@@ -23,7 +23,7 @@
 //   base @ aload(index)        -> array  (variable index — untouched)
 //
 // This recovery is USUALLY BYTE-NEUTRAL — `->field_N` and `[idx]` mostly compile identically, so it
-// is a representation upgrade driven by access evidence rather than a scored lever. TWO
+// is a representation upgrade driven by access evidence rather than a scored variation. TWO
 // MEASUREMENTS SAY "USUALLY" IS THE RIGHT WORD, and both were made on agbcc against a real target
 // object, each pair differing in ONE token:
 //   • THE SPELLING. `synthetic:dmanest`'s reference compiles from `((struct Elem0 *)K)[a1].field_4`
@@ -34,9 +34,9 @@
 //     `void *` rather than `s32` changes agbcc's alias set and lets a loop-invariant load leave the
 //     loop: `synthetic:dmaptrsrc` matches with the pointer declaration and diffs by 35 without it
 //     (its own fan: `/vol-store/unreduce/ptr-field` 0, `/vol-store/unreduce` 35).
-//     That is what `l3/ptrfield.ts` offers as a differ-ranked lever.
+//     That is what `l3/ptrfield.ts` offers as a differ-ranked variation.
 // So the neutrality claim is CONDITIONAL, and nothing here says on what. Until it does, read it as
-// "no candidate is enumerated for this axis", not as "the differ could not referee one" — the
+// "no candidate is enumerated for this question", not as "the differ could not referee one" — the
 // second reading is the one both measurements above falsify. GAPS between accessed
 // offsets (unaccessed leading/interior fields) are filled with `u8[N]` PAD fields so the declared
 // struct reproduces the observed offsets byte-for-byte and is self-describing (the same
@@ -64,7 +64,7 @@ interface Access {
 // is a DIFFERENT operation: this pass is ALIGNMENT-AWARE (no explicit pad when C's own inter-field
 // padding already lands the field) and carries NO trailing pad / struct `size` (a recovered struct
 // here is only ever a `struct S *` pointee accessed by named field — never an array element or a
-// by-value param, so sizeof is never taken). If the two are ever unified, PARAMETERIZE those axes
+// by-value param, so sizeof is never taken). If the two are ever unified, PARAMETERIZE those dimensions
 // — a naive merge would break the natural-alignment golden or silently mislay a struct that later
 // becomes an element / ABI value.
 const sizeAlign = (width: number): number => width;

package/src/raise/tailsink.ts

@@ -0,0 +1,141 @@
+// asmlift — sink a shared STORE tail back into the paths that branch to it.
+//
+// agbcc's gcse.c PRE finds a trailing store's base partially redundant, INSERTS it at the end of
+// every predecessor of the join, and the arms then cross-jump into one `store; ret`:
+//
+//     if (c) { for (…) …; } else { if (x) { gQ.cur = fnA; return; } }
+//     gQ.cur = fnB;
+//
+// lifts as ONE tail block `^t(v): store gQ.cur, v; ret` that the `fnA` arm and the join the two
+// sides reach both branch to. The structurer can spell that tail once, after the `if`, only if the
+// `fnA` path returns before it — so this duplicates the tail into every path that branches to it.
+// WHICH copy is the tail the source wrote once is not decided here: it is the `ret` reachable from
+// both successors of the `if`, which `structure()`'s `followEarlyReturns` finds and spells after
+// the `if`, with every other copy an early `return;` (`synthetic:gcsetail`). Under `-fno-gcse` the
+// tail/duplicated pairs compile byte-identical, and there is no loop gate: a loop before the join
+// is a sample, not a law.
+//
+// A block that supplies the tail's arguments is a SOURCE: a PURE FORWARDER (`^f(v): br ^t(v)`,
+// reached only by `br`) is seen through to its own predecessors, so the arms that branch into the
+// tail through a shared base reload are sources like any other (`synthetic:gcsefwd`).
+//
+// A LIFT VARIATION, NEVER A DEFAULT: `synthetic:gcsepre` and `synthetic:gcsepredup` compile to
+// different objects (an r4/r5 swap) and lift to byte-identical IR, the first written with the
+// shared tail and the second with the default duplicated into each arm — no IR rule tells them
+// apart, so rank.ts enumerates this beside the unsunk lift and the differ referees.
+//
+// SOUND BY CONSTRUCTION: tail duplication. Each copy runs on exactly the paths that ran the tail,
+// immediately before the same `ret`. A value the tail reads is one of two things. It is a block
+// parameter of the tail OR OF A FORWARDER on the way, and the copy takes the argument that path's
+// edge into that block carried. Or it is defined elsewhere, dominates the tail, and so dominates
+// every source of it. The forwarder's own parameter is not a corner: a tail whose only predecessor
+// is a forwarder loses its parameter to raise's `simplifyTrivialPhis` and reads the forwarder's
+// directly — a jump pad `.L4: b .L6` in front of the store does exactly that — and the forwarder is
+// swept once every source holds its copy. A copy replaces a `br`, the source's only edge. A
+// CONDITIONAL edge cannot carry one — splicing over it would drop the branch's other successor — so
+// the tail stays for the sources that reach it that way; that restriction is the rewrite's own
+// precondition, not a gate.
+//
+// NO GATE: which copy stays shared is the follow's question, and whether a sunk function is worth
+// a candidate is rank.ts's, asked with the follow's own predicate (`hasDivergentSharedRet`) rather
+// than a copy of it here.
+import {
+  type Block,
+  type Fn,
+  type Value,
+  fallThroughOf,
+  mkOp,
+  predecessors,
+  reachableBlocks,
+  terminator,
+} from '../ir/core';
+import { simplifyTrivialPhis } from '../ir/simplify';
+
+/** One edge that supplies the tail its arguments. `resolve` sends a value the tail reads to the
+ *  value it has at the end of `from`: a parameter of the tail or of any forwarder between becomes
+ *  the argument this path's edge into that block carried, and anything else is left alone. */
+interface Source {
+  readonly from: Block;
+  readonly resolve: (v: Value) => Value;
+}
+
+/** A block whose ops are one or more `store`s and then a void `ret`. */
+function isStoreTail(b: Block): boolean {
+  const t = b.ops[b.ops.length - 1];
+  return (
+    b.ops.length >= 2 &&
+    t.opcode === 'ret' &&
+    t.operands.length === 0 &&
+    b.ops.slice(0, -1).every((o) => o.opcode === 'store')
+  );
+}
+
+/** Copy every store tail that two or more sources reach into each source that reaches it by a
+ *  `br`; returns whether anything changed. */
+export function sinkStoreTails(fn: Fn): boolean {
+  let changed = false;
+  for (const tail of [...fn.blocks]) {
+    if (tail === fn.blocks[0] || !fn.blocks.includes(tail) || !isStoreTail(tail)) {
+      continue;
+    }
+    const preds = predecessors(fn);
+    // The sources, seen through pure forwarders. `resolve` sends a value the tail reads to the value
+    // it has on entry to the block being walked; each edge out of a predecessor composes one more
+    // step onto it — `to`'s own parameters, not only the tail's, because the tail may read a
+    // forwarder's parameter directly.
+    const forwarders = new Set<Block>();
+    const sources: Source[] = [];
+    const conditional: Block[] = [];
+    const walk = (to: Block, resolve: (v: Value) => Value) => {
+      for (const p of preds.get(to) ?? []) {
+        const t = terminator(p)!;
+        if (t.opcode !== 'br') {
+          conditional.push(p);
+          continue;
+        }
+        const edge = t.successors[0].args;
+        const through = (v: Value): Value => {
+          const w = resolve(v);
+          const i = to.params.indexOf(w);
+          return i >= 0 ? edge[i] : w;
+        };
+        const isForwarder =
+          p !== fn.blocks[0] &&
+          p.ops.length === 1 &&
+          !forwarders.has(p) &&
+          (preds.get(p) ?? []).every((q) => terminator(q)?.opcode === 'br');
+        if (isForwarder) {
+          forwarders.add(p);
+          walk(p, through);
+        } else {
+          sources.push({ from: p, resolve: through });
+        }
+      }
+    };
+    walk(tail, (v) => v);
+    if (sources.length === 0 || sources.length + conditional.length < 2) {
+      continue;
+    }
+    const body = tail.ops.slice(0, -1);
+    for (const src of sources) {
+      const copies = body.map((o) => mkOp('store', { operands: o.operands.map(src.resolve), attrs: { ...o.attrs } }));
+      // Carry the replaced edge's fall-through fact onto the duplicated `ret`, as `raise/retsink.ts`
+      // does. Only for a source that branches straight to the tail: seen THROUGH a forwarder the path
+      // is several edges and no one of them answers on its own, so the copy is left unmarked and
+      // read as a branch — the side that can never delete a return the object needs.
+      const t = src.from.ops[src.from.ops.length - 1];
+      const attrs = t.successors[0]?.block === tail ? fallThroughOf(t) : {};
+      src.from.ops.splice(src.from.ops.length - 1, 1, ...copies, mkOp('ret', { attrs }));
+    }
+    // By REACHABILITY, not predecessor count: the tail (unless a conditional edge keeps it) and
+    // every forwarder on the way are left unreachable, however long the chain, and a forwarder's
+    // in-edge from another orphan still counts as a predecessor.
+    const live = reachableBlocks(fn);
+    fn.blocks = fn.blocks.filter((b) => live.has(b));
+    changed = true;
+  }
+  if (changed) {
+    simplifyTrivialPhis(fn);
+  }
+  return changed;
+}

package/src/rank-declare.ts

@@ -5,9 +5,9 @@
 // (`bareGlobalAccessFacts`), which names exist at all (`bareGlobalSymbols`), and which of them a
 // declaration must REFUSE to claim (`makeRefCollector`, via `RefusedDeclarationReason`).
 //
-// It knows nothing about axes, levers or ranking: the enumeration driver hands it a dictionary and
+// It knows nothing about variations or ranking: the enumeration driver hands it a dictionary and
 // asks each emitted tree for its references. A SIBLING MODULE, never a `rank/` directory — see the
-// same note on rank-axes.ts.
+// same note on rank-variations.ts.
 import { type Fn, type Value, defOpMap } from './ir/core';
 import type { SFn } from './l3/ast';
 import { type SymbolRef, collectSymbolRefs } from './l3/symbol-refs';
@@ -118,23 +118,21 @@ const DECL_RESERVED = new Set<string>([
 
 /** The emitter's own NAME GRAMMAR for storage it invents: parameters `a0, a1, …` (structure.ts
  *  names them positionally, so no rename can move one) and coalesced/temp locals `v0…`/`t0…`
- *  (structure.ts's `localNames` accepts exactly `/^[vt]\d+$/`). A pool or map symbol with one of
- *  these names cannot be declared beside the C that spells it — see the refusal in `refsOf`, which
- *  is the one that kills the spelling rather than the line.
+ *  (structure.ts's `localNames` accepts exactly `/^[vt]\d+$/`). A global the target names with one
+ *  of these names cannot be declared beside the C that spells it — see the refusal in `refsOf`,
+ *  which is the one that kills the spelling rather than the line.
  *
  *  Checked as a grammar IN ADDITION to the tree's own bound names, because the collision that
  *  matters is the one the tree cannot show: `localNames` DROPS a local whose name a written
  *  global already claims, so where the global is stored `tree.locals` is silent about it. The
- *  price is refusing a real global that happens to be named `v3` in a function that never mints
- *  one — measured at zero: over the benchmark corpus, in each row's own symbol world, no candidate
- *  references such a name, and no vendored symbol map on that sweep's checkouts contained one. The
- *  map's own name total is deliberately not quoted — it is a property of the checkouts the sweep
- *  ran over rather than of this repo, so nothing here can re-derive it. */
+ *  price is refusing a global the target names `v3` in a function that never mints one. A map
+ *  global the target does NOT name pays nothing: Pikmin's map holds `v0` and `v1`, the only
+ *  grammar names in any vendored map, and no Pikmin row references either. */
 const EMITTER_NAME = /^[avt]\d+$/;
 
 /** Why a name the candidate's tree references got NO declaration. Reported rather than silently
  *  applied, because an undeclared name and a REFUSED one produce the same `'x' undeclared` from
- *  the compiler and only the second one is asmlift's own decision. Same argument as `onLeverError`
+ *  the compiler and only the second one is asmlift's own decision. Same argument as `onEnumerationError`
  *  one screen down: a refusal nobody can see is indistinguishable from a capability that was
  *  never there.
  *
@@ -201,10 +199,13 @@ export function makeRefCollector(ctx: {
   accessFacts: ReadonlyMap<string, { width: number; signed: boolean }>;
   /** the project map alone — a name it does NOT know makes the ref a `synthesized` hypothesis */
   mapSymbols: ReadonlyMap<string, SymbolInfo> | undefined;
+  /** the globals the TARGET names — the pool/reloc names and the shapes the asm evidences, before
+   *  the map is unioned in */
+  targetNames: ReadonlySet<string>;
   /** reports a refusal at most once per (name, reason); the caller owns the dedup */
   refuse: (name: string, reason: RefusedDeclarationReason) => void;
 }): (tree: SFn) => { symbolRefs?: SymbolRef[] } {
-  const { declSymbols, accessFacts, mapSymbols, refuse } = ctx;
+  const { declSymbols, accessFacts, mapSymbols, targetNames, refuse } = ctx;
   return (tree: SFn): { symbolRefs?: SymbolRef[] } => {
     // The names THIS tree binds. Computed per tree because the emitter mints local names per
     // spelling — but the test below is NOT `bound` alone, and the difference is a wrong answer.
@@ -223,9 +224,16 @@ export function makeRefCollector(ctx: {
       //     `tree.locals`: every use of the emitter's local binds the extern instead, and the
       //     loop pointer it was holding becomes a store to that global once per iteration.
       // Both compile, both are wrong, and a compiling wrong answer is the one outcome this
-      // project trades nothing for — so the spelling dies here and `fanOut`'s catch reports it.
+      // project trades nothing for — so the spelling dies here and `respellTree`'s catch reports it.
       // If every spelling of every tree dies, the row declines LOUDLY naming the collision.
       if (bound.has(r.name) || EMITTER_NAME.test(r.name)) {
+        // …but only a global the TARGET names can collide. A name that only the MAP supplies is a
+        // project global the function never touches, and the tree's `v0` is its own local: Pikmin
+        // holds `.sdata` statics named `v0` and `v1`, and refusing them killed every spelling of
+        // every function whose emitted C mints those locals.
+        if (!targetNames.has(r.name)) {
+          return [];
+        }
         refuse(r.name, 'emitter-name');
         throw new Error(
           `cannot spell '${tree.name}': the target names a global '${r.name}', which is a name the ` +