@asmlift/core 0.8.0 → 0.9.0

package/src/l3/tailmerge.ts

@@ -53,37 +53,24 @@
 //     lifts alike. What no arm of the fan spells is the third form, the hidden statement merged
 //     while KEEPING the record's order.
 //
-// SCOPE. Only `assign`/`store`/`exprstmt` merge, compared structurally through `exprEquals`.
+// SCOPE. Only `assign`/`store`/`exprstmt` merge, compared structurally through `stmtEquals`.
 // Control flow (`break`/`continue`/`return`) is excluded: moving one out of an arm changes which
-// statements the arm can still reach. Nested `if`/loop/`switch` statements are excluded because
-// comparing them needs a full `Stmt` congruence, and there is no second inhabitant for one — the
-// `Expr`-level comparison is the part that already exists, is tested, and is all this needs.
+// statements the arm can still reach. Nested `if`/loop/`switch` statements are excluded: merging
+// one needs a congruence over loops and `switch` too, which `stmtEquals` does not have, and there
+// is no second inhabitant for one.
 //
 // An `ASMLIFT_ERROR` marker ending both arms merges like anything else. The gap stays loud (the
 // artifact still refuses to compile) but `collectMarkers` then reports it once rather than twice,
 // which is accurate — it is one gap that ran on both paths.
 import type { SFn, Stmt } from './ast';
-import { exprEquals } from './ast';
+import { stmtEquals } from './ast';
 
 /** Statements this pass may move. Deliberately narrow — see SCOPE. */
 type Mergeable = Extract<Stmt, { k: 'assign' } | { k: 'store' } | { k: 'exprstmt' }>;
 const isMergeable = (s: Stmt): s is Mergeable => s.k === 'assign' || s.k === 'store' || s.k === 'exprstmt';
 
 /** Do these two statements write the same thing from the same expression? */
-function sameStmt(a: Stmt, b: Stmt): boolean {
-  if (!isMergeable(a) || !isMergeable(b) || a.k !== b.k) {
-    return false;
-  }
-  if (a.k === 'assign' && b.k === 'assign') {
-    return a.name === b.name && exprEquals(a.value, b.value);
-  }
-  if (a.k === 'store' && b.k === 'store') {
-    return exprEquals(a.lval, b.lval) && exprEquals(a.value, b.value);
-  }
-  const av = (a as Extract<Stmt, { k: 'exprstmt' }>).value;
-  const bv = (b as Extract<Stmt, { k: 'exprstmt' }>).value;
-  return exprEquals(av, bv);
-}
+const sameStmt = (a: Stmt, b: Stmt): boolean => isMergeable(a) && isMergeable(b) && stmtEquals(a, b);
 
 /** Rewrite one statement, then the list it lives in. */
 function rewrite(s: Stmt): Stmt[] {

package/src/l3/typing.ts

@@ -17,8 +17,8 @@
 // Callers choose their conservative direction: the emission guard treats `undefined` as "not
 // provably a pointer" (adds a cast — valid C either way); the deref contract treats `undefined`
 // as "not provably wrong" (no error).
-import { IrType, T, scalarTypeForAccess } from '../ir/types';
-import { type Expr, type SFn, exprChildren } from './ast';
+import { IrType, T, memberOf, scalarTypeForAccess } from '../ir/types';
+import { type BinOp, type Expr, type SFn, exprChildren } from './ast';
 
 /** The declared type of a printed variable — the env `exprCType` judges rendered C against.
  *  THE one copy of the SFn→env derivation — printers, contracts and L3 respell variations alike: each
@@ -31,6 +31,9 @@ export function declaredTypes(fn: SFn): VarTypes {
   for (const g of fn.globals ?? []) {
     m.set(g.name, g.type);
   }
+  for (const st of fn.statics ?? []) {
+    m.set(st.name, st.type);
+  }
   for (const p of fn.params) {
     m.set(p.name, p.type);
   }
@@ -55,6 +58,11 @@ export function ptrElemBytes(to: IrType): number {
 export interface PrintEnv {
   readonly type: VarTypes;
   readonly volatilePointee: (name: string) => boolean;
+  /** a callee's declared parameter types, on a function compiled as C++ (`SFn.declaredArgs`,
+   *  `SFn.dialect`) */
+  readonly declaredArgs: (callee: string) => readonly (string | undefined)[] | undefined;
+  /** a function-scope static this function defines `const` (`SFn.statics`) */
+  readonly constStatic: (name: string) => boolean;
 }
 
 export function printEnv(fn: SFn): PrintEnv {
@@ -63,7 +71,16 @@ export function printEnv(fn: SFn): PrintEnv {
   const vol = new Set(
     fn.locals.filter((l) => l.type.kind === 'ptr' && (l.pointeeVolatile || l.volatile)).map((l) => l.name),
   );
-  return { type: declaredTypes(fn), volatilePointee: (n) => vol.has(n) };
+  const constStatics = new Set((fn.statics ?? []).filter((s) => s.const).map((s) => s.name));
+  return {
+    type: declaredTypes(fn),
+    volatilePointee: (n) => vol.has(n),
+    declaredArgs: (callee) =>
+      fn.dialect === 'c++' && fn.declaredArgs && Object.hasOwn(fn.declaredArgs, callee)
+        ? fn.declaredArgs[callee]
+        : undefined,
+    constStatic: (n) => constStatics.has(n),
+  };
 }
 
 /** Does anything under `e` assert a VOLATILE POINTEE? The two spellings that carry the qualifier
@@ -103,15 +120,81 @@ export function derefStrideOk(rt: IrType | undefined, width: number, signed: boo
   return false;
 }
 
-/** The USUAL ARITHMETIC CONVERSIONS over two rendered operands: at equal rank, unsigned wins.
- *  Either side unknown leaves the result unknown — EXCEPT when the known side is unsigned, which
- *  already decides it.
+/** The INTEGER RANK a rendered expression carries, as a width in bits: 64 only where it can be
+ *  PROVEN, 32 everywhere else. The complement of `renderedIntSignedness` — that one models the
+ *  signedness `exprCType` reports uniformly as `s32`, this one models the width it reports the same
+ *  way — and the two together are what the usual arithmetic conversions need.
+ *
+ *  THE COMPLEMENT PARTS COMPANY WITH `exprCType` AT ONE NODE, AND IT IS `call`. There `exprCType`
+ *  is UNINFORMED by design and answers `undefined`, while this reads the `wide64` stamp the
+ *  structurer put on the node and can answer 64. A reader who reaches for `exprCType` on a call
+ *  will be told the information does not exist; it does, and it is here.
+ *
+ *  ITS SOUNDNESS IS AN ENUMERATION OF THE PRODUCERS, so here is the enumeration. A 64-bit value
+ *  reaches a rendered expression in exactly four ways:
+ *    1. a `var`/`postincr` whose DECLARED type is 64 bits wide — read off `varType`;
+ *    2. a `cast` to a 64-bit type — read off the node;
+ *    3. a `call` the structurer STAMPED `wide64` — read off the node, and it is the one case where
+ *       the rank cannot be derived from anything visible here: a callee's return type comes from a
+ *       prototype outside the emitted function, which is why `exprCType` answers `undefined` for a
+ *       call and why the stamp exists (l3/ast.ts carries what it means);
+ *    4. an arithmetic node over one of those — the recursion below.
+ *  It does NOT arrive through MEMORY, because `contracts.ts` `SCALAR_WIDTHS` is {1,2,4} and there
+ *  is no 64-bit global; nor through a `const`, because a 64-bit literal only folds inside C `int`
+ *  range, where 32 is the right answer for the literal's own type.
+ *
+ *  AN UNSTAMPED CALL IS 32 AND THAT IS THE SAFE ANSWER, not a claim: it is what C makes of a callee
+ *  nobody declared, and every consumer of this rank takes a cast on a 32 it doubts and takes none on
+ *  a 64 — so the direction that would be wrong silently is the one this never guesses.
+ *
+ *  A SHIFT takes the rank of its left operand alone; every other ARITHMETIC node takes the wider of
+ *  the two. That is C, and it is also why this is not simply `exprCType(e).width`.
+ *
+ *  THE NODES THAT ARE NOT ARITHMETIC ONES are the same list `renderedIntSignedness` enumerates, and
+ *  they yield `int` however wide their operands: a comparison, a logical connective, and `!`. `-`
+ *  and `~` are not in it, because each carries the promoted type of its operand. */
+export function exprIntWidth(e: Expr, varType: VarTypes): 32 | 64 {
+  const wide = (t: IrType | undefined): boolean => t?.kind === 'int' && t.width === 64;
+  switch (e.k) {
+    case 'var':
+    case 'postincr':
+    case 'cast':
+    case 'index':
+    case 'field':
+      return wide(exprCType(e, varType)) ? 64 : 32;
+    case 'call':
+      return e.wide64 === true ? 64 : 32;
+    case 'un':
+      return e.op === '!' ? 32 : exprIntWidth(e.e, varType);
+    case 'bin':
+      if (INT_RESULT_BINOPS.has(e.op)) {
+        return 32;
+      }
+      if (e.op === '<<' || e.op === '>>' || e.op === '>>>') {
+        return exprIntWidth(e.l, varType);
+      }
+      return exprIntWidth(e.l, varType) === 64 || exprIntWidth(e.r, varType) === 64 ? 64 : 32;
+    default:
+      return 32;
+  }
+}
+
+/** The float operators (l3/ast.ts BinOp): their result is the float their operands are, never an
+ *  integer, so none of the integer conversion rules below applies to one. */
+export const FLOAT_BINOPS: ReadonlySet<BinOp> = new Set<BinOp>(['f+', 'f-', 'f*', 'f/']);
+
+/** The binary operators whose RESULT is a C `int` whatever their operands are — read by both
+ *  halves of the conversion model, which is the point of naming them once. */
+const INT_RESULT_BINOPS = new Set<BinOp>(['<', '<=', '>', '>=', '==', '!=', '&&', '||']);
+
+/** The USUAL ARITHMETIC CONVERSIONS over two rendered operands.
  *
- *  That exception is the one place this returns a DEFINITE answer from an unknown operand, and it
- *  is sound only because every integer here is rank `int`: at UNEQUAL rank C converts to the wider
- *  type first, so `unsigned int & long long` is SIGNED. Core has no 64-bit integer type at all
- *  (the decomp typedef vocabulary stops at 32 — see contracts.ts SCALAR_WIDTHS), so the
- *  unequal-rank case cannot arise. Adding one would invalidate this.
+ *  AT EQUAL RANK, unsigned wins, and either side unknown leaves the result unknown — EXCEPT when
+ *  the known side is unsigned, which already decides it. AT UNEQUAL RANK C converts to the wider
+ *  type first, so the WIDER side's signedness decides outright: `unsigned int / long long` is
+ *  SIGNED, and taking the equal-rank shortcut there would spell an unsigned divide over a signed
+ *  one. `exprIntWidth` is what tells the two cases apart, and it is TOTAL, so the rank is always
+ *  known and only the signedness can be undetermined.
  *
  *  Exported because two consumers ask it about an operator whose own rendering they are deciding,
  *  so they cannot ask `renderedIntSignedness` about the node: the C-family backend's operand pin,
@@ -119,6 +202,11 @@ export function derefStrideOk(rt: IrType | undefined, width: number, signed: boo
 export function arithConversionSignedness(l: Expr, r: Expr, varType: VarTypes): boolean | undefined {
   const ls = renderedIntSignedness(l, varType);
   const rs = renderedIntSignedness(r, varType);
+  const lw = exprIntWidth(l, varType);
+  const rw = exprIntWidth(r, varType);
+  if (lw !== rw) {
+    return lw > rw ? ls : rs;
+  }
   if (ls === false || rs === false) {
     return false;
   }
@@ -158,10 +246,16 @@ export function arithConversionSignedness(l: Expr, r: Expr, varType: VarTypes):
 export function renderedIntSignedness(e: Expr, varType: VarTypes): boolean | undefined {
   const rec = (x: Expr): boolean | undefined => renderedIntSignedness(x, varType);
   // an lvalue-ish leaf: its C type is a declaration / an explicit cast / a carried access width
+  // Anything narrower than `int` promotes and comes out SIGNED whatever it was declared. `int` and
+  // `long long` keep their own signedness, because no promotion applies to either. A width that is
+  // NEITHER is not a C type at all — an `index` node carries a struct STRIDE as its width — and
+  // stays undetermined, which is what every consumer already takes a cast on.
   const promoted = (t: IrType | undefined): boolean | undefined =>
-    t?.kind !== 'int' ? undefined : t.width < 32 ? true : t.width === 32 ? t.signed : undefined;
+    t?.kind !== 'int' ? undefined : t.width < 32 ? true : t.width === 32 || t.width === 64 ? t.signed : undefined;
   switch (e.k) {
     case 'var':
+    // `v++` renders the value the local held, so it promotes exactly as the bare name does.
+    case 'postincr':
     case 'cast':
     case 'index':
     case 'field':
@@ -174,10 +268,16 @@ export function renderedIntSignedness(e: Expr, varType: VarTypes): boolean | und
     // folded to a shift — where `a / (s32)-2147483648` calls `__divsi3`.
     case 'const':
       return e.value > -2147483648 && e.value <= 2147483647;
-    // `-x` / `~x` carry the PROMOTED type of the operand; `!x` is `int`.
+    case 'fconst':
+      return undefined;
+    // `-x` / `~x` carry the PROMOTED type of the operand; `!x` is `int`. A float has no integer
+    // signedness at all.
     case 'un':
-      return e.op === '!' ? true : rec(e.e);
+      return e.op === 'f-' ? undefined : e.op === '!' ? true : rec(e.e);
     case 'bin': {
+      if (FLOAT_BINOPS.has(e.op)) {
+        return undefined;
+      }
       // The SIGNEDNESS-CARRYING pairs — the ops the tower keeps apart because C spells each pair
       // with one token and picks between them from the operand types (l3/ast.ts BinOp). The
       // C-family backend PINS their operands, so what gets printed renders as the op says
@@ -194,8 +294,8 @@ export function renderedIntSignedness(e: Expr, varType: VarTypes): boolean | und
       if (e.op === '<<') {
         return rec(e.l);
       }
-      // Comparisons and the logical connectives yield `int`.
-      if (['<', '<=', '>', '>=', '==', '!=', '&&', '||'].includes(e.op)) {
+      // Comparisons and the logical connectives yield `int`, which is signed.
+      if (INT_RESULT_BINOPS.has(e.op)) {
         return true;
       }
       return arithConversionSignedness(e.l, e.r, varType);
@@ -257,17 +357,25 @@ export function exprCType(e: Expr, varType: (name: string) => IrType | undefined
   const rec = (x: Expr): IrType | undefined => exprCType(x, varType);
   switch (e.k) {
     case 'var':
+    case 'postincr':
       return varType(e.name);
     // An integer literal spells as a plain C `int` — NEVER a pointer, whatever the value's
     // recovered type was. This is the exact gap the emission guard exists to bridge.
     case 'const':
       return T.s(32);
+    case 'fconst':
+      return T.f64();
     case 'cast':
       return e.to;
-    // `-`/`~` yield the promoted integer; `!` yields int. None yields a pointer.
+    // `-`/`~` yield the promoted integer; `!` yields int. None yields a pointer. A float negation
+    // yields the float it negates.
     case 'un':
-      return T.s(32);
+      return e.op === 'f-' ? rec(e.e) : T.s(32);
     case 'bin': {
+      // Both operands are one float type (ir/verify.ts holds the IR op to that), so the left names it.
+      if (FLOAT_BINOPS.has(e.op)) {
+        return rec(e.l);
+      }
       if (e.op === '+' || e.op === '-') {
         const l = rec(e.l);
         const r = rec(e.r);
@@ -291,7 +399,14 @@ export function exprCType(e: Expr, varType: (name: string) => IrType | undefined
       return T.s(32);
     }
     // A callee's C return type comes from a prototype OUTSIDE the emitted function (the
-    // project ctx / C89 implicit int) — not statically knowable here.
+    // project ctx / C89 implicit int) — not derivable from the tree here.
+    //
+    // THE NODE MAY STILL CARRY ITS RANK, and that is a different question from its TYPE:
+    // `exprIntWidth` reads the `wide64` stamp and answers 64 for a call whose callee the frontend
+    // was told returns a pair. Nothing is read off it here, because the stamp is a width and this
+    // owes its callers a full `IrType` — signedness included, which no source states. Widening
+    // this to answer `s64` from the stamp would be a signedness claim nobody made, over the one
+    // node every rendered function has; the rank-only reader is the honest half.
     case 'call':
       return undefined;
     case 'index': {
@@ -319,13 +434,10 @@ export function exprCType(e: Expr, varType: (name: string) => IrType | undefined
       return scalarTypeForAccess(e.width, e.signed);
     }
     case 'field': {
-      // `base->name` (base: ptr-to-struct) or `base.name` (base: struct value, an array element).
+      // `base->name` (base: ptr-to-struct) or `base.name` (base: struct value, an array element,
+      // or a union member's view).
       const bt = rec(e.base);
-      const st = bt?.kind === 'ptr' ? bt.to : bt;
-      if (st?.kind !== 'struct') {
-        return undefined;
-      }
-      return st.fields.find((f) => f.name === e.name)?.type;
+      return memberOf(bt?.kind === 'ptr' ? bt.to : bt, e.name)?.type;
     }
     case 'marker':
       return undefined;

package/src/l3/unreduce.ts

@@ -440,10 +440,10 @@ function arithScale(t: IrType | undefined): number | null {
  *  refusal.
  *
  *  MEASURED, so this is a stated zero and not an assumption: instrumented at the deletion site, it
- *  fires on none of the three agbcc rows that spill AND lift — `spillorder`, `dma_fill_uninit`,
- *  `uninit_spill` — so the clause costs no candidate today. (`spill10` spills too but declines in the
- *  Thumb frontend, so it never reaches this pass and its zero says nothing.) It is here for the day
- *  one does. */
+ *  fires on none of the agbcc rows that spill AND lift — `spillorder`, `dma_fill_uninit`,
+ *  `uninit_spill`, `spill10`, `spillarg` — so the clause costs no candidate today. (The last two
+ *  bring no local to these gates at all, so their zero says nothing.) It is here for the day one
+ *  does. */
 function declarationPins(l: SFn['locals'][number]): boolean {
   return (
     l.volatile !== undefined ||

package/src/l3/volstore.ts

@@ -92,9 +92,10 @@
 // both configurations and with any window. No row demands the read spelling, and a variation with no
 // inhabitant is what "earn the level" forbids.
 import { type IrType, T, scalarTypeForAccess } from '../ir/types';
-import { cellAddress, inRange } from './address';
-import { type Expr, type SFn, type Stmt, stmtChildren } from './ast';
+import { cellAddress, inRange, qualifiedBase } from './address';
+import { type Expr, type SFn, type Stmt, dotBase, stmtChildren } from './ast';
 import { type Gate, firstRejection } from './gates';
+import { derefStrideOk } from './typing';
 
 /** One STORE lvalue as the gates read it. */
 interface AccessCtx {
@@ -141,9 +142,6 @@ export const VOL_STORE_GATES: readonly Gate<AccessCtx>[] = [
   },
 ];
 
-/** Does this base already assert volatility — a `volatile` cast at any depth of the cast chain? */
-const qualifiedBase = (e: Expr): boolean => e.k === 'cast' && (e.volatile === true || qualifiedBase(e.e));
-
 /** The pointee the deref cast carries: the access's own scalar type. */
 const pointee = (ix: Extract<Expr, { k: 'index' }>): IrType => scalarTypeForAccess(ix.width, ix.signed);
 
@@ -169,8 +167,17 @@ function qualify(lval: Expr, window: readonly [number, number] | undefined): Exp
   if (firstRejection(VOL_STORE_GATES, ctx) !== null) {
     return lval;
   }
-  // An existing scalar pointer cast takes the qualifier in place; a bare const gets one minted,
-  // exactly the node backend/cfamily.ts's own deref legalization would have synthesized.
+  return qualifiedAccess(lval);
+}
+
+/** An indexed access with `volatile` on the pointee of its deref cast. An existing scalar pointer
+ *  cast takes the qualifier in place; a bare base gets one minted, exactly the node
+ *  backend/cfamily.ts's own deref legalization would have synthesized. Also how
+ *  {@link qualifiedMemoryAccess} spells an indexed access the lift marked `volatile`. */
+export function qualifiedAccess(lval: Extract<Expr, { k: 'index' }>): Extract<Expr, { k: 'index' }> {
+  if (qualifiedBase(lval.base)) {
+    return lval;
+  }
   const base: Expr =
     lval.base.k === 'cast' && lval.base.to.kind === 'ptr'
       ? { ...lval.base, volatile: true }
@@ -178,6 +185,88 @@ function qualify(lval: Expr, window: readonly [number, number] | undefined): Exp
   return { ...lval, base };
 }
 
+/** A memory access the lift marked `volatile` (frontend/device-pins.ts), spelled through a
+ *  `volatile` pointee: an indexed access by {@link qualifiedAccess}; a recovered struct member
+ *  through the struct pointer it is reached by — `((volatile struct S *)0x40000B0)[ch].field_0`,
+ *  `((volatile struct S *)p)->field_0` — whether that pointer is already a cast or a variable
+ *  `typeOf` types as one; and a union view through the member it views. A named global — `gSym`,
+ *  `gSym.field` — is returned unchanged, since its declaration owns its qualifiers. Null when the
+ *  pointer the access is reached by has no type to cast it to, for the caller to refuse rather
+ *  than drop the qualifier. */
+export function qualifiedMemoryAccess(e: Expr, typeOf: (x: Expr) => IrType | undefined): Expr | null {
+  if (e.k === 'index') {
+    return qualifiedAccess(e);
+  }
+  if (e.k !== 'field') {
+    return e;
+  }
+  const element = dotBase(e);
+  if (element !== undefined) {
+    const base = qualifiedPointer(element.base, typeOf);
+    return base === null ? null : { ...e, base: { ...element, base } };
+  }
+  if (e.dot === true) {
+    if (e.base.k !== 'field') {
+      return e;
+    }
+    const member = qualifiedMemoryAccess(e.base, typeOf);
+    return member === null ? null : { ...e, base: member };
+  }
+  const base = qualifiedPointer(e.base, typeOf);
+  return base === null ? null : { ...e, base };
+}
+
+/** Does this access reach the object it names through a pointer cast — one the tree spells,
+ *  `((struct T *)&gSym)->f`, or one the C-family printer puts on a base that does not stride the
+ *  access as spelled (backend/cfamily.ts `legalizedIndexBase`), `((u16 *)&gSym)[3]` — rather than
+ *  through the object's own name, element or member? The pointee of such a cast carries none of the
+ *  object's declared qualifiers unless it says so itself. `typeOf` is the rendered C type the
+ *  printer judges a base by. */
+export function castOffDeclaration(e: Expr, typeOf: (x: Expr) => IrType | undefined): boolean {
+  if (e.k === 'field') {
+    // A dot member over an element prints that element's base as spelled.
+    const element = dotBase(e);
+    if (element !== undefined) {
+      return addressCast(element.base, typeOf);
+    }
+    return e.dot === true ? castOffDeclaration(e.base, typeOf) : addressCast(e.base, typeOf);
+  }
+  if (e.k !== 'index') {
+    return false;
+  }
+  if (addressCast(e.base, typeOf)) {
+    return true;
+  }
+  if (e.lead !== undefined && e.lead.length > 0) {
+    return false; // a multidimensional global's subscript prints its base as spelled
+  }
+  return !derefStrideOk(
+    typeOf(e.base) ?? (e.baseElem !== undefined ? T.ptr(e.baseElem) : undefined),
+    e.width,
+    e.signed,
+  );
+}
+
+/** Is there a cast between this address and the object it is taken from: one on it, under its
+ *  arithmetic, or on the access whose element or member it is? */
+const addressCast = (p: Expr, typeOf: (x: Expr) => IrType | undefined): boolean =>
+  p.k === 'cast' ||
+  (p.k === 'bin' && (addressCast(p.l, typeOf) || addressCast(p.r, typeOf))) ||
+  ((p.k === 'index' || p.k === 'field') && castOffDeclaration(p, typeOf));
+
+/** A pointer expression carrying `volatile` on its pointee: a pointer cast takes it in place, and
+ *  any other pointer is cast to its own type with it. */
+function qualifiedPointer(p: Expr, typeOf: (x: Expr) => IrType | undefined): Expr | null {
+  if (qualifiedBase(p)) {
+    return p;
+  }
+  if (p.k === 'cast' && p.to.kind === 'ptr') {
+    return { ...p, volatile: true };
+  }
+  const t = typeOf(p);
+  return t?.kind === 'ptr' ? { k: 'cast', to: t, volatile: true, e: p } : null;
+}
+
 /** How many stores this tree would qualify — the enumeration gate, so a function with no device
  *  store costs one walk and no candidate.
  *

package/src/mangle.ts

@@ -178,7 +178,17 @@ export function demangledName(sym: string): string | null {
   return null;
 }
 
-/** Spell a CppType as C++ source (`Vec *`, `unsigned int`). */
+/** Spell a CppType as C++ source where no declarator is involved — a return type, a cast
+ *  (`Vec *`, `unsigned int`). */
 export function spellType(t: CppType): string {
   return t.base + (t.ptr ? ' ' + '*'.repeat(t.ptr) : '');
 }
+
+/** Declare a name of a CppType, C declarator rules: a pointer binds its `*` to the declarator
+ *  (`Vec *p`), everything else is the prefix `spellType name`. The C-family backend's `cDeclare`
+ *  says the same of an `IrType`; C++ has its own type vocabulary (`CppType`, from the mangled
+ *  name) and so needs its own declarator, or one function spells its pointers two ways — the type
+ *  prefix in the parameter list and the declarator form in the body. */
+export function declareCpp(t: CppType, name: string): string {
+  return t.ptr > 0 ? `${t.base} ${'*'.repeat(t.ptr)}${name}` : `${t.base} ${name}`;
+}

package/src/pattern/engine.ts

@@ -6,7 +6,8 @@
 // Crucially, rewrites go through replaceAllUsesWith + DCE — never in-place opcode
 // mutation of a live value.
 import { Block, Fn, Op, Value, defOpMap, mkOp, mkValue, replaceAllUsesWith } from '../ir/core';
-import { EFFECTFUL_OPS, NEGATED_ICMP, ORDER_SENSITIVE_OPS, type Opcode, isDceSafe } from '../ir/opcodes';
+import { deletableWhenDead, effectful, orderSensitive } from '../ir/discipline';
+import { NEGATED_ICMP, type Opcode } from '../ir/opcodes';
 import type { IrType } from '../ir/types';
 import { T } from '../ir/types';
 
@@ -589,17 +590,18 @@ function validatePattern(pat: RewritePattern): void {
  *  just its def, and the question has to be asked over the cones: one pure `+ 1` between an effect
  *  and the fold's operand is the difference between `f() % g()` and `(f() + 1) % g()`, and the
  *  second one reorders exactly as the first does. Both cones become operands of ONE expression,
- *  where C leaves their order unspecified. asmlift's inline-at-use model (structure/analysis.ts)
- *  exempts exactly this case — "a sibling effect inlined into the SAME statement is not a reorder,
- *  the recompiling compiler orders unsequenced operands of one expression exactly as it originally
- *  chose to". That premise holds only when the expression asmlift re-spells is the one the source
- *  wrote. A fold INVENTS an expression, so it must check.
+ *  where C leaves their order unspecified. asmlift's inline-at-use model (structure/analysis.ts,
+ *  the barrier scan) keeps two operands of one statement inline only in the order every corpus
+ *  compiler gives back — a call before the reads beside it — but it judges the program the fold
+ *  leaves, after the idiom's own ops are gone. The fold INVENTS the expression, so it checks the
+ *  cones it joins itself.
  *
- *  A cone's members are weighed by ORDER_SENSITIVE_OPS, not EFFECTFUL_OPS: a memory read answers
+ *  A cone's members are weighed by `orderSensitive`, not `effectful`: a memory read answers
  *  whichever stores ran before it, so hoisting a `load` over a `call` — one asmlift may itself be
  *  passing the loaded pointer to — changes the answer as surely as swapping two calls. Two READS
- *  are the exception and commute, the same fact the structurer states as "a load never bars a
- *  load", so a hazard needs an EFFECT on at least one side; `*p % *q` is admitted.
+ *  are the exception and commute, the same fact the structurer states as "a plain load never bars
+ *  a load", so a hazard needs an EFFECT on at least one side; `*p % *q` is admitted. Two `volatile`
+ *  device reads do not commute, and the structurer names the first of them itself.
  *
  *  Refuses only what it must — the alternative spelling (the idiom written out) names the operands
  *  and states the order, so a refusal is a loud, correct, slightly-worse-scoring answer. */
@@ -654,20 +656,18 @@ function reordersUnsequenced(
     return cone;
   };
   const [lc, rc] = names.map(coneOf);
-  const sensitive = (c: Set<Op>) => [...c].filter((o) => ORDER_SENSITIVE_OPS.has(o.opcode));
+  const sensitive = (c: Set<Op>) => [...c].filter(orderSensitive);
   for (const l of sensitive(lc)) {
     for (const r of sensitive(rc)) {
       // One op standing in BOTH cones is one evaluation and cannot be sequenced against itself; two
       // READS commute; and a right-cone op the machine ALREADY runs first loses nothing.
-      if (l === r || at.get(l)! >= at.get(r)! || !(EFFECTFUL_OPS.has(l.opcode) || EFFECTFUL_OPS.has(r.opcode))) {
+      if (l === r || at.get(l)! >= at.get(r)! || !(effectful(l) || effectful(r))) {
         continue;
       }
       // The left one runs first, so an inlined `A op B` would swap them — UNLESS a sibling effect
       // stands between, which the inline-at-use model refuses to cross, forcing a named temp at the
       // def's own position. A cone member is no sibling: it is inlined into this very expression.
-      if (
-        !blk.ops.slice(at.get(l)! + 1, at.get(r)!).some((o) => EFFECTFUL_OPS.has(o.opcode) && !lc.has(o) && !rc.has(o))
-      ) {
+      if (!blk.ops.slice(at.get(l)! + 1, at.get(r)!).some((o) => effectful(o) && !lc.has(o) && !rc.has(o))) {
         return true;
       }
     }
@@ -794,7 +794,8 @@ export function applyPattern(fn: Fn, pat: RewritePattern, target: PatternTarget)
 }
 
 /** Remove effect-free ops whose single result is unused, to a fixed point. Deletability is
- *  derived from the ONE effect table in ir/opcodes.ts. */
+ *  ir/discipline.ts `deletableWhenDead`, which keeps a read the lift pinned `volatile`: the machine
+ *  made it, so the recompile has to. */
 export function dce(fn: Fn): void {
   let changed = true;
   while (changed) {
@@ -813,7 +814,9 @@ export function dce(fn: Fn): void {
       }
     }
     for (const b of fn.blocks) {
-      const kept = b.ops.filter((op) => !(isDceSafe(op.opcode) && op.results.length === 1 && !used.has(op.results[0])));
+      const kept = b.ops.filter(
+        (op) => !(deletableWhenDead(op) && op.results.length === 1 && !used.has(op.results[0])),
+      );
       if (kept.length !== b.ops.length) {
         b.ops = kept;
         changed = true;