@asmlift/core 0.8.0 → 0.9.0

package/src/backend/cfamily.ts

@@ -10,8 +10,10 @@
 // below the signature is this file's: declarations, statements, expressions, precedence, the
 // legalizing casts, and the recovered-struct declaration spelling (which is why that lives here
 // too, shared with the scoring layer's synthesized declarations so the two cannot drift).
-import { IrType, T, scalarTypeForAccess, typeToString } from '../ir/types';
-import { BinOp, Expr, SFn, Stmt, dotBase } from '../l3/ast';
+import { doubleLiteral } from '../ir/float-bits';
+import { IrType, T, scalarTypeForAccess, typeEquals, typeToString } from '../ir/types';
+import { BinOp, Expr, SFn, SStatic, Stmt, dotBase } from '../l3/ast';
+import { legalizePointerCells } from '../l3/ptrcell';
 import { orderSlotLocals } from '../l3/slotorder';
 import {
   type PrintEnv,
@@ -20,6 +22,7 @@ import {
   declaredTypes,
   derefStrideOk,
   exprCType,
+  exprIntWidth,
   printEnv,
   renderedIntSignedness,
   writesNonPointerIntoPointer,
@@ -28,6 +31,10 @@ import {
 // C operator precedence (lower binds tighter). Used to emit MINIMAL parentheses. Shared: C++ has
 // the same precedence for these operators.
 const PREC: Record<BinOp, number> = {
+  'f*': 3,
+  'f/': 3,
+  'f+': 4,
+  'f-': 4,
   '*': 3,
   '/': 3,
   '/u': 3, // the unsigned twins spell as C's `/` and `%` (see C_SPELLING) — same precedence
@@ -64,17 +71,32 @@ const C_SPELLING: Partial<Record<BinOp, { token: string; signed: boolean }>> = {
   '%u': { token: '%', signed: false },
 };
 
+/** The float operators (l3/ast.ts BinOp) spell as C's own tokens and take no operand pin: C's
+ *  arithmetic over two floats is the IEEE operation the machine did. */
+const FLOAT_TOKEN: Partial<Record<BinOp, string>> = { 'f+': '+', 'f-': '-', 'f*': '*', 'f/': '/' };
+
 /** Spell a recovered type in the decomp C-family typedef vocabulary (`s32`/`u32`/`u8`/`T *`). */
 export function cType(t: IrType): string {
   if (t.kind === 'ptr') {
     return `${cType(t.to)} *`;
   }
   if (t.kind === 'struct') {
-    return `struct ${t.name}`;
+    return t.declared ?? `struct ${t.name}`;
+  }
+  // Declared inline, where the struct member that holds it is declared (ir/types.ts).
+  if (t.kind === 'union') {
+    return `union { ${t.members.map((m) => `${cDeclare(m.type, m.name)};`).join(' ')} }`;
   }
   if (t.kind === 'array') {
     return `${cType(t.elem)}[${t.count}]`;
   } // ill-formed as a prefix; use cDeclare
+  // The C89 KEYWORDS, not the `f32`/`f64` typedefs a decomp project declares: the candidate prelude
+  // (`C_TYPEDEFS`) holds the integer family only, and a keyword needs no declaration in any
+  // translation unit — so no project context that already typedefs `f32` can collide with it.
+  // A float of no stated precision compiles the same under either keyword; `float` is its spelling.
+  if (t.kind === 'float') {
+    return t.width === 64 ? 'double' : 'float';
+  }
   return typeToString(t); // s32 / u32 / u8 / unk32 (treated as s32 upstream)
 }
 
@@ -83,7 +105,7 @@ export function cType(t: IrType): string {
  *  the prefix `cType name`. A NESTED array spells every extent after the name in declaration
  *  order (`u8 unk8[6][8]`) — one declarator, not an element type that is itself an array, which
  *  C has no syntax for and `cType` marks ill-formed as a prefix. */
-function cDeclare(t: IrType, name: string): string {
+export function cDeclare(t: IrType, name: string): string {
   if (t.kind === 'array') {
     const extents: number[] = [];
     let e: IrType = t;
@@ -113,10 +135,11 @@ export interface StructFieldDecl {
   bits?: number;
 }
 
-/** THE struct-declaration spelling — every `struct N { ... };` asmlift prints comes from here,
- *  so the backend's recovered-struct decls and the scoring layer's synthesized decls cannot
- *  drift apart. One line, fields in caller order (the type is self-describing: padding is the
- *  caller's discipline, already present as real fields). */
+/** THE struct-declaration spelling — every `struct N { ... };` asmlift recovers or synthesizes
+ *  comes from here, so the backend's recovered-struct decls and the scoring layer's synthesized
+ *  decls cannot drift apart. A struct the headers own is transcribed from their declaration
+ *  instead (declare.ts `declaredStructDecl`). One line, fields in caller order (the type is
+ *  self-describing: padding is the caller's discipline, already present as real fields). */
 export function renderStructDecl(name: string, fields: StructFieldDecl[]): string {
   const one = (f: StructFieldDecl) =>
     `${f.volatile ? 'volatile ' : ''}${cDeclare(f.type, f.name)}${f.bits !== undefined ? ` : ${f.bits}` : ''};`;
@@ -166,18 +189,23 @@ function legalizedIndexBase(ix: Extract<Expr, { k: 'index' }>, vt: PrintEnv): Ex
       };
 }
 
-/** The 32-bit integer cast that PINS an operand's signedness.
+/** The integer cast that PINS an operand's signedness, AT THE OPERAND'S OWN RANK.
  *
- *  An existing 32-bit integer cast is REPLACED rather than wrapped — `(u32)(s32)&g` and `(u32)&g`
- *  are the same bytes, and the arithmetic rules upstream do emit that inner cast (intifyAddr).
- *  The replacement CARRIES the qualifier: re-typing a `volatile` cast without it drops an
- *  assertion the differ cannot referee the loss of, which is why l3/initfirst.ts's
- *  `stripWideIntCast` refuses the same peel one pass over. */
-function recast32(x: Expr, signed: boolean): Expr {
-  const replaced = x.k === 'cast' && x.to.kind === 'int' && x.to.width === 32 ? x : undefined;
+ *  The width is not a constant: `(s32)a / (s32)b` over two `s64`s does not pin a signedness, it
+ *  truncates the operation to 32 bits and calls a different helper than the machine did. So the
+ *  rank comes from `exprIntWidth`, which is total and answers 64 only where it can prove it.
+ *
+ *  An existing integer cast AT THE SAME WIDTH is REPLACED rather than wrapped — `(u32)(s32)&g` and
+ *  `(u32)&g` are the same bytes, and the arithmetic rules upstream do emit that inner cast
+ *  (intifyAddr). A cast at a DIFFERENT width is a narrowing the source wrote and must be kept. The
+ *  replacement CARRIES the qualifier: re-typing a `volatile` cast without it drops an assertion the
+ *  differ cannot referee the loss of, which is why l3/initfirst.ts's `stripWideIntCast` refuses the
+ *  same peel one pass over. */
+function recastInt(x: Expr, signed: boolean, width: 32 | 64): Expr {
+  const replaced = x.k === 'cast' && x.to.kind === 'int' && x.to.width === width ? x : undefined;
   return {
     k: 'cast',
-    to: T.int(32, signed),
+    to: T.int(width, signed),
     ...(replaced?.volatile === true ? { volatile: true as const } : {}),
     e: replaced ? replaced.e : x,
   };
@@ -205,14 +233,65 @@ function recast32(x: Expr, signed: boolean): Expr {
  *  the division unsigned. Verified by compiling: `((u32)a / b) / 7` calls `__udivsi3` twice,
  *  `(s32)((u32)a / b) / 7` calls `__udivsi3` then `__divsi3`. */
 function pinnedOperands(e0: Extract<Expr, { k: 'bin' }>, wantSigned: boolean, vt: PrintEnv): [Expr, Expr] {
+  // A shift reads its LEFT operand's rank; a divide reads the wider of the two, which is what the
+  // usual arithmetic conversions make the operation's own rank.
   if (e0.op === '>>' || e0.op === '>>>') {
-    return [renderedIntSignedness(e0.l, vt.type) === wantSigned ? e0.l : recast32(e0.l, wantSigned), e0.r];
+    const w = exprIntWidth(e0.l, vt.type);
+    return [renderedIntSignedness(e0.l, vt.type) === wantSigned ? e0.l : recastInt(e0.l, wantSigned, w), e0.r];
   }
   if (arithConversionSignedness(e0.l, e0.r, vt.type) === wantSigned) {
     return [e0.l, e0.r];
   }
-  const pinSigned = (x: Expr): Expr => (renderedIntSignedness(x, vt.type) === true ? x : recast32(x, true));
-  return wantSigned ? [pinSigned(e0.l), pinSigned(e0.r)] : [recast32(e0.l, false), e0.r];
+  const w = exprIntWidth(e0.l, vt.type) === 64 || exprIntWidth(e0.r, vt.type) === 64 ? 64 : 32;
+  const pinSigned = (x: Expr): Expr => (renderedIntSignedness(x, vt.type) === true ? x : recastInt(x, true, w));
+  return wantSigned ? [pinSigned(e0.l), pinSigned(e0.r)] : [recastInt(e0.l, false, w), e0.r];
+}
+
+/** Does passing `a` to a parameter declared `to` take a conversion C++ will not make implicitly?
+ *  Three do, and C makes each of them implicitly, so the cast spells the conversion C would have
+ *  made and the compiled code is C's: an object pointer to a pointer of another pointee (a conversion
+ *  to `void *`, or one that only adds a qualifier, is implicit in C++ too), an integer to a pointer
+ *  (the literal `0` is the one integer that converts), and a pointer to an integer. Only reached on a
+ *  function compiled as C++ (`SFn.dialect`). */
+function argConversion(a: Expr, to: string, vt: PrintEnv): boolean {
+  const from = exprCType(a, vt.type);
+  // qualifiers never decide it: a `T * const` parameter is a pointer parameter
+  const bare = to
+    .replace(/\b(?:const|volatile)\b/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim();
+  if (bare.endsWith('*')) {
+    if (a.k === 'const' && a.value === 0) {
+      return false;
+    }
+    if (from?.kind !== 'ptr') {
+      return true;
+    }
+    return bare !== 'void *' && bare !== cType(from).replace(/\s+/g, ' ').trim();
+  }
+  return from?.kind === 'ptr';
+}
+
+/** The unqualified pointer a `const` static's address is spelled as where it reaches a place that
+ *  converts it implicitly — an argument, an assigned or stored value, a returned one — or null for
+ *  any other expression. The static is `const` because the target holds it in read-only data, not
+ *  because the source's pointer types say so: mwcc rejects the implicit `const u8[4]` → `u8 *` a
+ *  bare `g(tbl)` makes (compiled), and a pointer cast changes no instruction. */
+function constEscape(e: Expr, vt: PrintEnv): IrType | null {
+  if (e.k === 'addr' && vt.constStatic(e.name)) {
+    const t = vt.type(e.name);
+    return t === undefined ? null : T.ptr(t.kind === 'array' ? t.elem : t);
+  }
+  if (e.k === 'bin' && (e.op === '+' || e.op === '-')) {
+    return constEscape(e.l, vt) ?? (e.op === '+' ? constEscape(e.r, vt) : null);
+  }
+  return null;
+}
+
+/** `e` printed where C converts it implicitly, with a `const` static's address cast (constEscape). */
+function printConverted(e: Expr, vt: PrintEnv, leaf?: LeafHook): string {
+  const to = constEscape(e, vt);
+  return to === null ? printExpr(e, 99, vt, leaf) : `(${cType(to)})${printExpr(e, 2, vt, leaf)}`;
 }
 
 function printExpr(e: Expr, parentPrec: number, vt: PrintEnv, leaf?: LeafHook): string {
@@ -228,14 +307,51 @@ function printExpr(e: Expr, parentPrec: number, vt: PrintEnv, leaf?: LeafHook):
       return e.name;
     case 'const':
       return String(e.value);
+    // a negative literal is a prefix `-`, and parenthesizes where one would (`un` below)
+    case 'fconst': {
+      const s = doubleLiteral(e.bits);
+      return parentPrec < 2 && s.startsWith('-') ? `(${s})` : s;
+    }
     case 'addr': {
-      // `&gSym` — the address of a named global. A prefix operator; parenthesizes under a POSTFIX
-      // parent like the other prefix forms.
+      // `&gSym` — the address of a named global or of a frame-local object. A prefix operator;
+      // parenthesizes under a POSTFIX parent like the other prefix forms.
+      //
+      // AN ARRAY DECAYS INSTEAD, and the declared type is what says so, which is why the decision
+      // is here rather than on the node: `&` on `u8 sp0[16]` spells a `u8 (*)[16]` — a different
+      // type for the same byte, which every typed pointer parameter rejects (`passing arg 1 from
+      // incompatible pointer type`) — where the bare name is the `u8 *` the machine produced.
+      // Compiled both ways, the object is identical, so the `&` buys a diagnostic and nothing
+      // else. An identifier binds tighter than every parent, so the decayed form never
+      // parenthesizes. A name this env cannot type keeps the `&`: an unknown shape is not an
+      // array, and dropping the operator on a scalar would spell its value.
+      if (vt.type(e.name)?.kind === 'array') {
+        return e.name;
+      }
       const g = `&${e.name}`;
       return parentPrec < 2 ? `(${g})` : g;
     }
-    case 'call':
-      return `${e.fn}(${e.args.map((a) => rec(a, 99)).join(', ')})`;
+    case 'call': {
+      if (typeof e.fn !== 'string') {
+        // An unprototyped pointer to a function returning the call's own rank: C passes each
+        // argument as its promoted self, which is what a call with no declaration passes.
+        const ret = cType(T.int(e.wide64 ? 64 : 32, true));
+        return `((${ret} (*)())${rec(e.fn, 2)})(${e.args.map((a) => printConverted(a, vt, leaf)).join(', ')})`;
+      }
+      if (e.sret !== undefined) {
+        throw new Error(`the call to '${e.fn}' returns a struct through memory and is spelled only as a statement`);
+      }
+      const declared = vt.declaredArgs(e.fn);
+      return `${e.fn}(${e.args
+        .map((a, i) => {
+          const to = declared?.[i];
+          return to !== undefined && argConversion(a, to, vt) ? `(${to})${rec(a, 2)}` : printConverted(a, vt, leaf);
+        })
+        .join(', ')})`;
+    }
+    // `v++` / `v--`. Postfix over a bare identifier, so it binds tighter than every parent and
+    // never self-parenthesizes.
+    case 'postincr':
+      return `${e.name}${e.by === 1 ? '++' : '--'}`;
     case 'index': {
       // `*base` for the zero offset (a PREFIX operator, so a prefix-shaped base like a cast needs
       // no parens: `*(u8 *)p` — but the whole form must self-parenthesize under a POSTFIX parent:
@@ -306,7 +422,8 @@ function printExpr(e: Expr, parentPrec: number, vt: PrintEnv, leaf?: LeafHook):
       // A prefix operator: parenthesize under a POSTFIX parent (`(-a)[1]`), and parenthesize a
       // same-op nested `-` (`-(-a)`, never `--a` — C lexes that as predecrement).
       const inner = rec(e.e, 2);
-      const s = `${e.op}${e.op === '-' && inner.startsWith('-') ? `(${inner})` : inner}`;
+      const op = e.op === 'f-' ? '-' : e.op;
+      const s = `${op}${op === '-' && inner.startsWith('-') ? `(${inner})` : inner}`;
       return parentPrec < 2 ? `(${s})` : s;
     }
     // A gap marker spells as a call to the UNDEFINED macro ASMLIFT_ERROR("reason", args…) — the
@@ -331,25 +448,41 @@ function printExpr(e: Expr, parentPrec: number, vt: PrintEnv, leaf?: LeafHook):
       // operand cast that says which of the pair it is.
       const pair = C_SPELLING[e.op];
       const [l, r] = pair ? pinnedOperands(e, pair.signed, vt) : [e.l, e.r];
-      const s = `${rec(l, p)} ${pair ? pair.token : e.op} ${rec(r, p - 1)}`;
+      const s = `${rec(l, p)} ${pair ? pair.token : (FLOAT_TOKEN[e.op] ?? e.op)} ${rec(r, p - 1)}`;
       return p > parentPrec ? `(${s})` : s;
     }
   }
 }
 
+/** `dest = fn(args)` for a call whose `args[0]` is the address of the struct it returns: a local
+ *  declared with that struct type, named by its address. Any other destination has no spelling
+ *  that hands the callee the same pointer — compiled, `*(struct Blob64 *)&gDst = makeblob(gBlob);`
+ *  is a frame temp and a `memcpy`, where `gDst = makeblob(gBlob);` hands over `&gDst` itself. */
+function structReturnCall(call: Extract<Expr, { k: 'call' }>, vt: PrintEnv, leaf?: LeafHook): string {
+  const [dest, ...rest] = call.args;
+  const declared = dest?.k === 'addr' ? vt.type(dest.name) : undefined;
+  if (dest?.k !== 'addr' || declared === undefined || !typeEquals(declared, call.sret!)) {
+    throw new Error(`the call to '${call.fn}' returns a struct into something other than a local of its type`);
+  }
+  return `${dest.name} = ${printExpr({ k: 'call', fn: call.fn, args: rest }, 99, vt, leaf)}`;
+}
+
 function printStmt(s: Stmt, indent: string, vt: PrintEnv, leaf?: LeafHook): string[] {
   const pe = (e: Expr, p: number) => printExpr(e, p, vt, leaf);
   switch (s.k) {
     case 'assign':
-      return [`${indent}${s.name} = ${pe(s.value, 99)};`];
+      return [`${indent}${s.name} = ${printConverted(s.value, vt, leaf)};`];
     case 'store':
       // The lvalue is a full Expr (`index` or `field`), so the leaf hook spells a member write
       // (`this->x = …`) exactly as it spells a member read.
-      return [`${indent}${pe(s.lval, 2)} = ${pe(s.value, 99)};`];
+      return [`${indent}${pe(s.lval, 2)} = ${printConverted(s.value, vt, leaf)};`];
     case 'exprstmt':
+      if (s.value.k === 'call' && s.value.sret !== undefined) {
+        return [`${indent}${structReturnCall(s.value, vt, leaf)};`];
+      }
       return [`${indent}${pe(s.value, 99)};`];
     case 'return':
-      return [`${indent}return${s.value ? ' ' + pe(s.value, 99) : ''};`];
+      return [`${indent}return${s.value ? ' ' + printConverted(s.value, vt, leaf) : ''};`];
     case 'if': {
       const cond = pe(s.cond, 99);
       if (s.then.length === 1 && s.else.length === 0 && s.then[0].k !== 'if') {
@@ -519,8 +652,12 @@ function endsTerminated(body: Stmt[]): boolean {
 // traversal-vocabulary exemption.)
 function legalizePointerWrites(fn: SFn): SFn {
   const vt = declaredTypes(fn);
+  // …and the mirror: a rendered pointer into an INTEGER slot takes the slot's type. A cast keeps
+  // the sum it wraps, so the bytes are the uncast write's; CodeWarrior rejects that write outright.
   const castTo = (t: IrType | undefined, e: Expr): Expr =>
-    writesNonPointerIntoPointer(t, e, vt) ? { k: 'cast', to: t, e } : e;
+    writesNonPointerIntoPointer(t, e, vt) || (t?.kind === 'int' && exprCType(e, vt)?.kind === 'ptr')
+      ? { k: 'cast', to: t, e }
+      : e;
   const fix = (s: Stmt): Stmt => {
     switch (s.k) {
       case 'assign':
@@ -562,13 +699,18 @@ function cFamilyBody(fn0: SFn, leaf?: LeafHook): string[] {
   // reader will see.
   const vt: PrintEnv = printEnv(fn);
   const lines: string[] = [];
+  for (const st of fn.statics ?? []) {
+    lines.push(...staticDefinition(st));
+  }
   for (const l of fn.locals) {
     // Both facts render at the PREFIX position, where C's declarator grammar reads them
     // differently: on a scalar the qualifier binds to the object (`volatile u16 sp0`), on a
     // pointer declarator to the pointee — the INNERMOST one for a multi-level pointer
-    // (`volatile u16 ** p`). An object-volatile POINTER (`u16 *volatile p`) has no inhabitant —
-    // no variation or recognizer produces one.
-    lines.push(`    ${l.volatile || l.pointeeVolatile ? 'volatile ' : ''}${cType(l.type)} ${l.name};`);
+    // (`volatile u16 **p`). An object-volatile POINTER (`u16 *volatile p`) has no inhabitant —
+    // no variation or recognizer produces one. The NAME is placed by `cDeclare`, the one
+    // placement every declaration position in this backend uses: a local can carry an array type
+    // — the storage extent a frame object pins — and C puts those extents after the name.
+    lines.push(`    ${l.volatile || l.pointeeVolatile ? 'volatile ' : ''}${cDeclare(l.type, l.name)};`);
   }
   for (const s of fn.body) {
     lines.push(...printStmt(s, '    ', vt, leaf));
@@ -576,6 +718,62 @@ function cFamilyBody(fn0: SFn, leaf?: LeafHook): string[] {
   return lines;
 }
 
+/** One initial element: hex from 10 up, a negative one with its sign, so a byte table reads as the
+ *  bytes and a signed one as its values. */
+const initElement = (v: number): string =>
+  Math.abs(v) < 10 ? `${v}` : `${v < 0 ? '-' : ''}0x${Math.abs(v).toString(16)}`;
+
+/** A byte array's initial elements as a string literal: printable characters as themselves, every
+ *  other byte in three-digit octal (which no following digit can extend), and a `?` after a `?`
+ *  escaped so no trigraph forms. The trailing zeros are left to the declared size, which C fills
+ *  with zeros. */
+function stringLiteral(init: readonly number[]): string {
+  let end = init.length;
+  while (end > 0 && (init[end - 1] & 0xff) === 0) {
+    end--;
+  }
+  let out = '';
+  for (const v of init.slice(0, end)) {
+    const b = v & 0xff;
+    const c = String.fromCharCode(b);
+    out +=
+      b < 0x20 || b > 0x7e || c === '"' || c === '\\' || (c === '?' && out.endsWith('?'))
+        ? `\\${b.toString(8).padStart(3, '0')}`
+        : c;
+  }
+  return `"${out}"`;
+}
+
+/** A function-scope static's definition, as the first lines of the body. An array's elements are
+ *  laid out eight to a line; an alignment the type does not give is an attribute, which gcc and
+ *  mwcc both read after the declarator. */
+function staticDefinition(st: SStatic): string[] {
+  const aligned = st.align === undefined ? '' : ` __attribute__((aligned(${st.align})))`;
+  const head = `    static ${st.const ? 'const ' : ''}${cDeclare(st.type, st.name)}${aligned}`;
+  if (st.init === undefined) {
+    return [`${head};`];
+  }
+  if (st.string) {
+    return [`${head} = ${stringLiteral(st.init)};`];
+  }
+  if (st.type.kind !== 'array') {
+    return [`${head} = ${initElement(st.init[0])};`];
+  }
+  if (st.init.length <= 8) {
+    return [`${head} = { ${st.init.map(initElement).join(', ')} };`];
+  }
+  const rows: string[] = [];
+  for (let i = 0; i < st.init.length; i += 8) {
+    rows.push(
+      `        ${st.init
+        .slice(i, i + 8)
+        .map(initElement)
+        .join(', ')},`,
+    );
+  }
+  return [`${head} = {`, ...rows, '    };'];
+}
+
 /** Struct declarations this function references, one `struct N { ... };` per recovered aggregate.
  *  The struct type is SELF-DESCRIBING: any padding needed to seat fields at their exact offsets is
  *  already present as real `u8[N]` pad fields — both raise/struct-arrays.ts (element strides) and
@@ -587,10 +785,11 @@ function structDecls(fn: SFn): string[] {
 
 /** Assemble a full C-family function from a caller-supplied signature line and the shared body. */
 export function emitCFamily(signature: string, fn0: SFn, leaf?: LeafHook): string {
-  // The declaration list is put into the target's own frame order HERE — in the shared C-family
-  // assembler, reached only from `cBackend.emit` and `cppBackend(...).emit`, so both C-family
-  // backends order and no `.emit(` call site does (l3/slotorder.ts says why `emit` owns it).
-  const fn = orderSlotLocals(fn0);
+  // The declaration list is put into the target's own frame order, and a pointer cell's integer
+  // uses converted (l3/ptrcell.ts), HERE — in the shared C-family assembler, reached only from
+  // `cBackend.emit` and `cppBackend(...).emit`, so both C-family backends print them and no `.emit(`
+  // call site does (l3/slotorder.ts says why `emit` owns it).
+  const fn = orderSlotLocals(legalizePointerCells(fn0));
   const decls = structDecls(fn);
   const preamble = decls.length ? decls.join('\n') + '\n' : '';
   return preamble + [`${signature} {`, ...cFamilyBody(fn, leaf), '}'].join('\n') + '\n';

package/src/backend/cpp.ts

@@ -13,10 +13,14 @@
 // Scope: free functions and non-virtual member functions with scalar/pointer params and named
 // field access. Virtual dispatch, references, and constructors/destructors are deliberately not
 // built ahead of an inhabitant.
-import { Expr, LanguageBackend, SFn } from '../l3/ast';
-import { type CppType, mangle, spellType } from '../mangle';
+import { Expr, LanguageBackend, SFn, walkExprs } from '../l3/ast';
+import { type CppType, declareCpp, mangle, spellType } from '../mangle';
+import type { TargetDescription } from '../target';
 import { LeafHook, cComment, emitCFamily } from './cfamily';
 
+/** How the target's argument slots hold floats (`TargetDescription.fpu`). */
+type FloatSlots = NonNullable<TargetDescription['fpu']>['slots'];
+
 export interface CppClass {
   fields: { name: string; type: CppType }[];
 } // field i at word offset i
@@ -33,9 +37,104 @@ export function cppSymbol(spec: CppFnSpec): string {
   return mangle({ name: spec.method, cls: spec.cls, params: spec.params.map((p) => p.type) });
 }
 
-/** Build a C++ backend for one function, parameterized by its recovered C++ signature. The lifted
- *  SFn params are positional: for a member function SFn.params[0] is `this`, the rest are `params`. */
-export function cppBackend(spec: CppFnSpec): LanguageBackend {
+/** The lifted parameter each EXPLICIT spec parameter is (its SFn name), for a member function after
+ *  `this` (SFn.params[0]). How depends on the target's float slot model (`TargetDescription.fpu`),
+ *  because the lifted order is the ABI sort's (frontend/fpu.ts `fpuArgSlots`):
+ *   - `'separate'` (PowerPC EABI): by register FILE, then by position within it. The files count
+ *     independently and every float argument sorts after the integers, so `float g(float x, int n)`
+ *     lifts as `(s32 a0, float a1)`. A float the body never reads leaves no hole, so the spec may
+ *     have MORE floats than the lift (`int m(int n, float x)` lifts as `(s32 a0)`), never fewer.
+ *   - `'leading'` (MIPS o32), and a target with no float file: by POSITION. The lifted order is the
+ *     slot order, which is the source order, and an unread leading float is minted as an integer
+ *     hole — so binding by file would hand `int k(float x, int n)`'s `n` the hole `a0`.
+ *  NULL when the two contradict: a lifted float the spec has no float for, or has one of the other
+ *  precision for. No binding of the rest is then trustworthy. The precision is part of the
+ *  contradiction because the body is spelled over the spec's types: a lifted `double` bound to a
+ *  `float a, float b` prints `a + b`, which is a single-precision add where the machine did a
+ *  double one.
+ *
+ *  THE PRECISION IS AN OPERATION'S, so only a parameter the body reads has one to contradict. A
+ *  frontend types every float register of a function at the function's one precision
+ *  (frontend/fpu.ts `fpPrecision`), and that includes an argument slot the body never reads, which
+ *  it mints only to hold the later arguments' places: `float f1(double a, float b){ return b + b; }`
+ *  is `fadds f1,f2,f2`, and its `a` is a single-precision hole that nothing states the width of. So
+ *  is a lifted float of no stated precision (`T.fUnstated`) anywhere. Either binds a spec float of
+ *  both widths, and the spec's is the one to print.
+ *
+ *  EXCEPT WHERE THE HOLE'S WIDTH PLACED THE PARAMETERS AFTER IT. Under `'leading'` a float takes one
+ *  integer slot for a single and two for a double, counted at the function's precision
+ *  (`fpuArgSlots`), so an unread hole of the other width than the spec's moves every integer after
+ *  it: `float m2(double a, float b, int *p, int *q){ *p = 0; return b + b; }` (gcc2.7.2kmc) is
+ *  `sw zero,0(a3)` with `a` laid out as ONE slot, and binding by position would name `a3` `q`. So
+ *  there an unread float followed by an integer parameter keeps its precision.
+ *
+ *  A spec `double` bound to a lifted NON-float is the same misplacement. A double takes two integer
+ *  slots under o32 and on a target with no float file (agbcc passes one in r0:r1), so a body that
+ *  reads no FPU register mints it as two 32-bit holes: `void n1(double d, int *p, int *q){ *p = 0; }`
+ *  (gcc2.7.2kmc) is `sw zero,0(a2)` and lifts as `(s32 a0, s32 a1, s32 *a2)`, where binding by
+ *  position would name `a2` `q`. Only a lifted 64-bit parameter holds both slots, so a spec double
+ *  over a narrower one refuses when a lifted parameter follows it, and when the body reads it — a
+ *  read half would print as the whole double (agbcc `int u1(int a, double d)` returning the word
+ *  `((int *)&d)[0]` is `add r0,r1,#0`). A lifted parameter after it is not a refusal when the double
+ *  is the spec's last and the body reads none of the slots from it on, which is IDO homing a
+ *  trailing double it never uses (`int o1(int a, double d){ return a; }` spills `a2`/`a3`): nothing
+ *  then binds past it. */
+export function bindSpecParams(
+  spec: Pick<CppFnSpec, 'cls' | 'params'>,
+  lifted: Pick<SFn, 'params' | 'body'>,
+  floatSlots: FloatSlots | undefined,
+): (string | undefined)[] | null {
+  const floatBits = (t: CppType) => (t.ptr !== 0 ? null : t.base === 'float' ? 32 : t.base === 'double' ? 64 : null);
+  const isFloat = (t: CppType) => floatBits(t) !== null;
+  const read = new Set<string>();
+  for (const e of walkExprs(lifted.body)) {
+    if (e.k === 'var') {
+      read.add(e.name);
+    }
+  }
+  const clashes = (p: SFn['params'][number], t: CppType | undefined, laysOut: boolean) =>
+    p.type.kind === 'float' &&
+    (t === undefined ||
+      floatBits(t) === null ||
+      (p.type.width !== null && (laysOut || read.has(p.name)) && floatBits(t) !== p.type.width));
+  const explicit = lifted.params.slice(spec.cls ? 1 : 0);
+  const lastAndUnread = (i: number) =>
+    i === spec.params.length - 1 && explicit.slice(i).every((p) => !read.has(p.name));
+  if (floatSlots !== 'separate') {
+    const clash = explicit.some((p, i) => {
+      const t = spec.params[i]?.type;
+      const later = explicit.slice(i + 1);
+      const oneSlot = p.type.kind !== 'float' && !('width' in p.type && p.type.width === 64);
+      return (
+        clashes(
+          p,
+          t,
+          later.some((q) => q.type.kind !== 'float'),
+        ) ||
+        (t !== undefined &&
+          floatBits(t) === 64 &&
+          oneSlot &&
+          (later.length > 0 || read.has(p.name)) &&
+          !lastAndUnread(i))
+      );
+    });
+    return clash ? null : spec.params.map((_, i) => explicit[i]?.name);
+  }
+  const floats = explicit.filter((p) => p.type.kind === 'float');
+  const others = explicit.filter((p) => p.type.kind !== 'float');
+  const specFloats = spec.params.filter((p) => isFloat(p.type));
+  if (specFloats.length < floats.length || floats.some((p, i) => clashes(p, specFloats[i].type, false))) {
+    return null;
+  }
+  let f = 0;
+  let o = 0;
+  return spec.params.map((p) => (isFloat(p.type) ? floats[f++] : others[o++])?.name);
+}
+
+/** Build a C++ backend for one function, parameterized by its recovered C++ signature and the float
+ *  slot model of the target it was lifted for. For a member function SFn.params[0] is `this`; the
+ *  rest bind to `params` by `bindSpecParams`. */
+export function cppBackend(spec: CppFnSpec, floatSlots: FloatSlots | undefined): LanguageBackend {
   return {
     id: 'cpp',
     spellsSwitchFallthrough: true,
@@ -43,15 +142,21 @@ export function cppBackend(spec: CppFnSpec): LanguageBackend {
       // Map each lifted param var → its C++ meaning: `this` (bare member access) or a named param
       // (a pointer-to-class param uses `->`). A pointer-to-known-class param is a member receiver.
       const thisVar = spec.cls ? fn.params[0]?.name : undefined;
-      const explicitStart = spec.cls ? 1 : 0;
       const rename = new Map<string, string>(); // lifted var → C++ name
       const recv = new Map<string, { cls: string; via: 'this' | string }>(); // var → member receiver
       if (thisVar) {
         rename.set(thisVar, 'this');
         recv.set(thisVar, { cls: spec.cls!, via: 'this' });
       }
+      const bound = bindSpecParams(spec, fn, floatSlots);
+      if (!bound) {
+        throw new Error(
+          `cpp backend: the spec's floating-point parameters do not match the lifted function's — ` +
+            `supply a signature whose float and integer parameters are the ones it takes`,
+        );
+      }
       spec.params.forEach((p, i) => {
-        const v = fn.params[explicitStart + i]?.name;
+        const v = bound[i];
         if (!v) {
           return;
         }
@@ -115,7 +220,7 @@ export function cppBackend(spec: CppFnSpec): LanguageBackend {
         return null;
       };
 
-      const paramList = spec.params.map((p) => `${spellType(p.type)} ${p.name}`).join(', ');
+      const paramList = spec.params.map((p) => declareCpp(p.type, p.name)).join(', ');
       const decls = classDecls(spec, paramList);
       const signature = `${spellType(spec.retType)} ${spec.cls ? spec.cls + '::' : ''}${spec.method}(${paramList})`;
       return (decls ? decls + '\n' : '') + emitCFamily(signature, fn, leaf);
@@ -140,7 +245,7 @@ function typeWidth(t: CppType): number {
 function classDecls(spec: CppFnSpec, paramList: string): string {
   const out: string[] = [];
   for (const [cname, cdef] of Object.entries(spec.classes ?? {})) {
-    const fields = cdef.fields.map((f) => `${spellType(f.type)} ${f.name};`).join(' ');
+    const fields = cdef.fields.map((f) => `${declareCpp(f.type, f.name)};`).join(' ');
     const method = cname === spec.cls ? ` ${spellType(spec.retType)} ${spec.method}(${paramList});` : '';
     out.push(`struct ${cname} { ${fields}${method} };`);
   }