@asmlift/core 0.8.0 → 0.9.0

package/src/raise/arrays.ts

@@ -20,6 +20,7 @@
 // byte form (`add(base, index)`, elemSize 1) is deferred: without types, base and index are
 // indistinguishable there.
 import { Fn, Op, Value, defOpMap, mkOp, mkValue, replaceAllUsesWith } from '../ir/core';
+import { carryDiscipline } from '../ir/discipline';
 
 // If `addr` is `add(base, shl(index, k))` with `1 << k === width`, return {base, index}.
 // The `add` is commutative, so the scaled side may be either operand.
@@ -62,11 +63,11 @@ export function recognizeArrays(fn: Fn): number {
           operands: [m.base, m.index],
           results: [res],
           // listOrder rides along: an ldmia-expanded load keeps its stream-order caveat as an aload
-          attrs: {
+          attrs: carryDiscipline(op, {
             elemSize: op.attrs.width as number,
             signed: op.attrs.signed as boolean,
             ...(op.attrs.listOrder === true && { listOrder: true }),
-          },
+          }),
         });
         replaceAllUsesWith(fn, op.results[0], res);
         count++;
@@ -77,7 +78,7 @@ export function recognizeArrays(fn: Fn): number {
         }
         b.ops[i] = mkOp('astore', {
           operands: [m.base, m.index, op.operands[1]],
-          attrs: { elemSize: op.attrs.width as number },
+          attrs: carryDiscipline(op, { elemSize: op.attrs.width as number }),
         });
         count++;
       }

package/src/raise/declared-volatile.ts

@@ -0,0 +1,131 @@
+// asmlift — the decider for ir/discipline.ts's `declared` placement: a memory access of an object
+// the project's symbol map declares volatile.
+//
+// The stamp is a function of the IR, the map the function is lifted and structured under, and the
+// compiler, and nothing else: an access whose base reaches a global the map qualifies, at the byte
+// the access names (`declaresVolatile`) — and, for a read, one the compiler could have made of a
+// `volatile` (target.ts `readCouldBeVolatile`, which the device pin asks too). It is put as the
+// lift is made (pipeline.ts `liftStamped`), before the first pass that asks whether a read may be
+// deleted, folded or moved, and re-derived by every pass that changes which object an access names
+// and by structuring. Structuring the same function under another map — the `/raw-globals` setting
+// has none — re-runs it, and an op the new map does not qualify loses the stamp, so a structuring
+// never answers for a map it was not given. The base is read as the structurer will read it: a join
+// whose every edge passes one address is that address (`addressThroughJoins`). A base that reaches
+// no name is a pointer parameter, a raw address or a genuine join: no declaration is in evidence,
+// and the access stays unplaced unless the lift pinned it (`device`).
+//
+// A read structuring stamps that the earlier stamps left plain was plain to every raising pass, and a
+// short-circuit fold may have lifted it out of the arm it ran in. structure.ts declines on such a
+// read in a `&&`/`||`'s guarded operand rather than place it.
+import { globalBaseOf, globalCellOf } from '../ir/alias';
+import { type Fn, type Op, type Value, defOpMap } from '../ir/core';
+import { DECLARED_VOLATILE } from '../ir/discipline';
+import { MEM_BASE_OPS } from '../ir/opcodes';
+import { type SymbolInfo, type SymbolMap, declaresVolatile, symbolsByName } from '../symbols';
+import { type TargetDescription, readCouldBeVolatile } from '../target';
+import { valueNumberOf } from './gvn';
+
+/** The compiler fact the stamp reads. */
+export type StampBehaviors = Pick<TargetDescription['compilerBehaviors'], 'volatileReadsExtendInRegister'>;
+
+/** May this memory access be stamped: a store, or a read the compiler could have made of a
+ *  `volatile`? */
+const stampable = (op: Op, behaviors: StampBehaviors): boolean =>
+  MEM_BASE_OPS.has(op.opcode) &&
+  (op.opcode === 'store' || op.opcode === 'astore' || readCouldBeVolatile(behaviors, op));
+
+/** The address a value stands for once `addrnum` (raise/pre-recovery.ts) has run: a block parameter
+ *  every in-edge of which, a back edge's self-reference aside, passes one value after numbering
+ *  (raise/gvn.ts `valueNumberOf`) is that value, as `simplifyTrivialPhis` collapses it; any other
+ *  value stands for itself. Each arm of an `if` loading `&gVolReg` into the register the join reads
+ *  is such a parameter, and the stamp is put before that pass, so it reads the base the structurer
+ *  will. */
+function addressThroughJoins(fn: Fn): (v: Value) => Value {
+  const incoming = new Map<Value, Value[]>();
+  for (const b of fn.blocks) {
+    for (const op of b.ops) {
+      for (const s of op.successors) {
+        if (s.block === fn.blocks[0]) {
+          continue;
+        }
+        s.block.params.forEach((param, i) => {
+          if (i < s.args.length) {
+            (incoming.get(param) ?? incoming.set(param, []).get(param)!).push(s.args[i]);
+          }
+        });
+      }
+    }
+  }
+  const numberOf = valueNumberOf(fn);
+  const through = (v: Value, onWalk: Set<Value>): Value | null => {
+    const ins = incoming.get(v);
+    if (ins === undefined) {
+      return v;
+    }
+    if (onWalk.has(v)) {
+      return null;
+    }
+    onWalk.add(v);
+    const each = ins.filter((a) => a !== v).map((a) => through(a, onWalk));
+    onWalk.delete(v);
+    const first = each[0];
+    return first !== undefined && first !== null && each.every((a) => a !== null && numberOf(a) === numberOf(first))
+      ? first
+      : null;
+  };
+  return (v) => through(v, new Set()) ?? v;
+}
+
+/** Stamp every memory access of `fn` to an object `symbols` declares volatile — a read only where a
+ *  compiler behaving as `behaviors` says could have made it of one — and clear the stamp from every
+ *  other op. Returns the ops it stamped that were not stamped before. */
+export function stampDeclaredVolatile(
+  fn: Fn,
+  symbols: ReadonlyMap<string, SymbolInfo> | undefined,
+  behaviors: StampBehaviors,
+): Op[] {
+  const added: Op[] = [];
+  const defs = symbols ? defOpMap(fn) : undefined;
+  const addressOf = symbols ? addressThroughJoins(fn) : undefined;
+  for (const b of fn.blocks) {
+    for (const op of b.ops) {
+      const addr = defs && stampable(op, behaviors) ? addressOf!(op.operands[0]) : undefined;
+      const base = addr !== undefined ? globalBaseOf(defs!, addr) : null;
+      // A subscript reaches the object while naming no cell, so only a `load`/`store` asks by byte,
+      // and an access that names no byte is placed only where every byte it could reach is qualified.
+      const cell =
+        base !== null && (op.opcode === 'load' || op.opcode === 'store')
+          ? globalCellOf(defs!, addr!, op.attrs.off as number)
+          : null;
+      const declared = base !== null && declaresVolatile(symbols!.get(base), cell === null ? null : cell.byte);
+      // A fresh record either way: a rebuilder may hand two ops one `attrs` object.
+      if (declared && op.attrs[DECLARED_VOLATILE] !== true) {
+        op.attrs = { ...op.attrs, [DECLARED_VOLATILE]: true };
+        added.push(op);
+      } else if (!declared && DECLARED_VOLATILE in op.attrs) {
+        const { [DECLARED_VOLATILE]: _, ...rest } = op.attrs;
+        op.attrs = rest;
+      }
+    }
+  }
+  return added;
+}
+
+/** {@link stampDeclaredVolatile} under an address-keyed project map, through the name-keyed view
+ *  structuring is handed for the same map (symbols.ts `symbolsByName`), narrowed to the names the
+ *  function's own `gaddr`s carry. */
+export function stampDeclaredVolatileUnder(fn: Fn, map: SymbolMap | undefined, behaviors: StampBehaviors): void {
+  if (map === undefined) {
+    stampDeclaredVolatile(fn, undefined, behaviors);
+    return;
+  }
+  const names = new Set<string>();
+  for (const b of fn.blocks) {
+    for (const op of b.ops) {
+      if (op.opcode === 'gaddr') {
+        names.add(op.attrs.sym as string);
+      }
+    }
+  }
+  stampDeclaredVolatile(fn, symbolsByName(map, names), behaviors);
+}

package/src/raise/divpow2.ts

@@ -41,7 +41,7 @@
 // the biased arm must be the negative one — the consistency check m2c's `49b5d87` also adds),
 // because every one of those is a way for a superficially similar diamond to mean something else.
 import { Block, Fn, Op, Value, defOpMap, mkOp, mkValue, predecessors, replaceAllUsesWith } from '../ir/core';
-import { EFFECTFUL_OPS } from '../ir/opcodes';
+import { effectful } from '../ir/discipline';
 import { T } from '../ir/types';
 
 /** `shr_s v {imm=k}` → k, else null. */
@@ -110,7 +110,7 @@ export function recognizeDivPow2(fn: Fn): boolean {
           continue;
         }
         const bp = preds.get(bias) ?? [];
-        if (bp.length !== 1 || bias.ops.some((op) => EFFECTFUL_OPS.has(op.opcode))) {
+        if (bp.length !== 1 || bias.ops.some(effectful)) {
           continue;
         }
         const h = bp[0];

package/src/raise/errors.ts

@@ -8,3 +8,20 @@ export class RaiseUnsupportedError extends Error {
     this.name = 'RaiseUnsupportedError';
   }
 }
+
+/** The one raise refusal a caller ACTS ON rather than only reporting: raise/structs.ts cannot
+ *  reproduce a layout with a plain struct because two accesses' byte ranges COLLIDE. For a base
+ *  whose address is declared outside the function that is not a reason to decline, since each
+ *  access is spellable on its own; for any other base the overlap is declared as a union member
+ *  where the union can be laid out. A CLASS rather than a substring test on the message, because
+ *  the two facts a caller needs (which refusal this is, and what to tell the reader) would
+ *  otherwise be the same string, and the guard would then fall open the day the message is
+ *  reworded. Every other raise/structs.ts refusal (a packed layout, a union it cannot lay out)
+ *  stays a plain RaiseUnsupportedError and declines: a subclass is minted for a caller that acts
+ *  on it, not for every refusal that wants a name. */
+export class StructOverlapError extends RaiseUnsupportedError {
+  constructor(message: string) {
+    super(message);
+    this.name = 'StructOverlapError';
+  }
+}

package/src/raise/floathelpers.ts

@@ -0,0 +1,243 @@
+// asmlift — the soft-float boundary (L1 recognition): where integer words become floats.
+//
+// Three things cross it. A runtime helper whose op is a float op (`isFloatHelper`) — the peer of
+// `raise/widehelpers.ts`, gated by the target's runtime table rather than a hardware capability.
+// A parameter an ordinary callee declares `double` (the frontend's `doubles` on the call). And a
+// double literal, two constant words, where the target states their order
+// (`TargetDescription.doubleArgWords`) and its compiler reads a literal back
+// (`compilerBehaviors.roundTripsDoubleLiterals`). What sets all three apart from the integer
+// helpers is the value's KIND: the words are bits in integer registers, and the pass re-types them
+// as floats, which only data flow may justify — see the function below.
+import { Fn, Op, Value, mkOp, mkValue, replaceAllUsesWith } from '../ir/core';
+import { doubleBits, doubleOf } from '../ir/float-bits';
+import { T } from '../ir/types';
+import { arrivesAsDeclared, helperOp, isFloatHelper, lookupHelper } from '../runtime-helpers';
+import type { TargetDescription } from '../target';
+import { RaiseUnsupportedError } from './errors';
+import { isArgumentPair } from './pairparams';
+
+/** Rewrite the float-arithmetic helper calls to the float ops, in place, each value at the width its
+ *  helper's signature states, and hand a parameter the callee declares `double` (the frontend's
+ *  `doubles` on the call) a double. Returns whether anything changed.
+ *
+ *  A SOFT-FLOAT VALUE IS BITS IN INTEGER REGISTERS, AND ONLY DATA FLOW MAY READ THEM AS A FLOAT. A
+ *  single travels in one register; a double in the pair a long long travels in, which the frontend
+ *  builds the way it builds a long long's, `concat(lo = r0, hi = r1)` — but agbcc stores a double
+ *  high word first (thumb.h:335 `FLOAT_WORDS_BIG_ENDIAN`): r0 holds the sign and exponent. Moving
+ *  the value whole keeps it right, so a float may come only from where the ABI hands one over
+ *  whole — this function's argument slot, or two consecutive ones for a double, or another of these
+ *  helpers' results — and may go only into another of them, the return, or a parameter a callee
+ *  declares `double`. Anything else refuses, and the call stays for `refuseUnmodelledHelpers` to
+ *  gap:
+ *   - an operand built from a load or two unrelated words, whose halves the int64 naming would put
+ *     in the wrong order. Two CONSTANT words are the exception: they are a literal, read in the
+ *     target's word order into an `fconst` (`a + 1.5` stages `0x3ff80000` in r2, its high word);
+ *   - an argument the function also reads on its own, as a word or as one half of a pair;
+ *   - a result read as a word or a half (`*(int *)&c` is a double's HIGH word, in r0), passed to
+ *     any other call, or carried across an edge.
+ *  A call refused takes every call its result feeds or is fed by with it, so what folds is a closed
+ *  set of floats and verify's float rule holds by construction. */
+export function recognizeFloatHelpers(fn: Fn, target: TargetDescription): boolean {
+  const table = target.runtimeHelpers ?? {};
+  let sites: Op[] = [];
+  const consumers = new Map<Op, readonly number[]>();
+  const def = new Map<Value, Op>();
+  const users = new Map<Value, Array<Op | null>>(); // null: an edge argument
+  const use = (v: Value, by: Op | null) => users.set(v, [...(users.get(v) ?? []), by]);
+  const helperOf = (op: Op) => (op.opcode === 'call' ? lookupHelper(table, String(op.attrs.target)) : undefined);
+  for (const block of fn.blocks) {
+    for (const op of block.ops) {
+      op.results.forEach((r) => def.set(r, op));
+      op.operands.forEach((o) => use(o, op));
+      op.successors.forEach((s) => s.args.forEach((a) => use(a, null)));
+      const helper = helperOf(op);
+      if (
+        helper &&
+        isFloatHelper(helper) &&
+        arrivesAsDeclared(
+          helper,
+          op.operands.map((o) => o.type),
+          op.results.map((r) => r.type),
+        )
+      ) {
+        sites.push(op);
+      } else if (!helper && op.opcode === 'call' && Array.isArray(op.attrs.doubles)) {
+        consumers.set(op, op.attrs.doubles as number[]);
+      }
+    }
+  }
+  if (!sites.length && !consumers.size) {
+    return false;
+  }
+  // A projection nothing reads is not a read of a half: `dce` runs ahead of this pass only after a
+  // fold that changed the IR, so the frontend's split of the result back into its registers may stand.
+  const deadHalf = (u: Op | null) =>
+    u !== null && (u.opcode === 'lo32' || u.opcode === 'hi32') && !users.has(u.results[0]);
+  // A USE THAT TAKES THE VALUE AS A FLOAT: a helper the fold keeps, or a parameter the callee declares
+  // `double` (the frontend's `doubles`) — and only that parameter, so the same value handed to the
+  // same call as a word is a word read.
+  const floatUse = (u: Op | null, v: Value, calls: ReadonlySet<Op>): boolean =>
+    u !== null &&
+    (calls.has(u) || (consumers.has(u) && u.operands.every((o, i) => o !== v || consumers.get(u)!.includes(i))));
+  const floatsOnly = (v: Value, calls: ReadonlySet<Op>) => (users.get(v) ?? []).every((u) => floatUse(u, v, calls));
+  const entry = fn.blocks[0].params;
+  // A `concat` of the same two slots in the same order as `d`: the frontend builds one afresh at each
+  // call it hands the pair to, so `g(x); g(x)` reads one parameter through two of them.
+  const samePair = (u: Op | null, d: Op): u is Op =>
+    u?.opcode === 'concat' && u.operands[0] === d.operands[0] && u.operands[1] === d.operands[1];
+  // The argument slot itself, or the pair of them `isArgumentPair` names, read by nothing but
+  // `concat`s of that pair, each taken as a float; `arrivesAsDeclared` has already held each operand
+  // to its parameter's width.
+  const argument = (v: Value, calls: ReadonlySet<Op>): boolean => {
+    const d = def.get(v);
+    if (d === undefined) {
+      return entry.includes(v) && floatsOnly(v, calls);
+    }
+    return (
+      isArgumentPair(entry, d, (p) => users.get(p)!.filter((u) => !samePair(u, d)).length + 1) &&
+      users.get(d.operands[0])!.every((u) => samePair(u, d) && floatsOnly(u.results[0], calls))
+    );
+  };
+  const fromCall = (v: Value, calls: ReadonlySet<Op>) => {
+    const d = def.get(v);
+    return d !== undefined && calls.has(d);
+  };
+  // A CONSTANT WORD, as a compiler may build one in two instructions: agbcc moves a word that is a
+  // shifted byte as `mov`+`lsl` (thumb.md:66, `thumb_shiftable_const` at thumb.c:61) and one in
+  // -255..-1 as `mov`+`neg` (thumb.md:88), so the high word of 2.0 reaches r3 as `0x80 << 23`. Its
+  // value, or undefined where `v` is no constant.
+  const wordOf = (v: Value): number | undefined => {
+    const d = def.get(v);
+    if (d?.opcode === 'const') {
+      return Number(d.attrs.value);
+    }
+    const shift = d?.opcode === 'shl' ? d.attrs.imm : undefined;
+    const w =
+      d?.operands.length === 1 && (d.opcode === 'neg' || typeof shift === 'number') ? wordOf(d.operands[0]) : undefined;
+    return w === undefined ? undefined : d!.opcode === 'neg' ? -w | 0 : (w << (shift as number)) | 0;
+  };
+  // A LITERAL IS TWO CONSTANT WORDS, HIGH WORD FIRST on a target whose double crosses a call in
+  // general words (`TargetDescription.doubleArgWords`) — the order that makes the long long naming
+  // of the same pair another number. Its bits, or undefined where the pair is no literal, the target
+  // states no such double, its compiler is not known to read the literal back
+  // (`compilerBehaviors.roundTripsDoubleLiterals`), or the double is not finite — which no C literal
+  // spells.
+  const literalBits = (v: Value): string | undefined => {
+    const d = def.get(v);
+    const [first, second] = (d?.opcode === 'concat' ? d.operands : []).map(wordOf);
+    if (
+      target.doubleArgWords === undefined ||
+      target.compilerBehaviors.roundTripsDoubleLiterals !== true ||
+      first === undefined ||
+      second === undefined
+    ) {
+      return undefined;
+    }
+    const bits = doubleBits(first, second);
+    return Number.isFinite(doubleOf(bits)) ? bits : undefined;
+  };
+  const literal = (v: Value, calls: ReadonlySet<Op>) => literalBits(v) !== undefined && floatsOnly(v, calls);
+  const source = (v: Value, calls: ReadonlySet<Op>) => argument(v, calls) || fromCall(v, calls) || literal(v, calls);
+  for (;;) {
+    const calls = new Set(sites);
+    const kept = sites.filter(
+      (op) =>
+        op.operands.every((o) => source(o, calls)) &&
+        (users.get(op.results[0]) ?? []).every(
+          (u) => deadHalf(u) || floatUse(u, op.results[0], calls) || u?.opcode === 'ret',
+        ),
+    );
+    if (kept.length === sites.length) {
+      break;
+    }
+    sites = kept;
+  }
+  const calls = new Set(sites);
+  // A DECLARED DOUBLE HAS NO FALLBACK. A helper the fold refuses stays a call for
+  // `refuseUnmodelledHelpers` to gap, but an ordinary callee is no helper, and its two words handed
+  // on as integers are the wrong number — so a double parameter nothing here can hand a double
+  // refuses the function. It counts arguments as the source does: an `sret` call's operand 0, the
+  // hidden pointer, is not one.
+  for (const [op, at] of consumers) {
+    for (const i of at) {
+      if (!source(op.operands[i], calls)) {
+        const arg = i + (op.attrs.sret === true ? 0 : 1);
+        throw new RaiseUnsupportedError(
+          `cannot lift '${fn.name}': argument ${arg} of the call to '${String(op.attrs.target)}' ` +
+            'is a `double` its callee declares, and its two words are not a double this function was ' +
+            'handed, a runtime helper returned or a finite literal staged, moved whole',
+        );
+      }
+    }
+  }
+  if (!sites.length && !consumers.size) {
+    return false;
+  }
+  const floatOf = new Map<Value, Value>();
+  const float = (bits: number) => mkValue(bits > 32 ? T.f64() : T.f32());
+  // the `fconst` each literal's `concat` becomes, and the ops computing the constant words only it read
+  const literals = new Map<Op, Op>();
+  const spent = new Set<Op>();
+  const spend = (w: Value, by: Op) => {
+    const d = def.get(w)!;
+    if (users.get(w)!.every((u) => u === by)) {
+      spent.add(d);
+      d.operands.forEach((o) => spend(o, d));
+    }
+  };
+  // One parameter in its first slot's place, which is where the ABI put the value.
+  const retype = (o: Value, bits: number) => {
+    if (floatOf.has(o) || fromCall(o, calls)) {
+      return;
+    }
+    const d = def.get(o);
+    const pattern = literalBits(o);
+    if (pattern !== undefined) {
+      const whole = float(64);
+      literals.set(d!, mkOp('fconst', { results: [whole], attrs: { bits: pattern } }));
+      d!.operands.forEach((w) => spend(w, d!));
+      floatOf.set(o, whole);
+      return;
+    }
+    const slots = d === undefined ? [o] : d.operands;
+    const whole = float(bits);
+    entry.splice(entry.indexOf(slots[0]), slots.length, whole);
+    for (const u of d === undefined ? [] : users.get(slots[0])!) {
+      if (samePair(u, d!)) {
+        floatOf.set(u.results[0], whole);
+      }
+    }
+    floatOf.set(o, whole);
+  };
+  for (const op of sites) {
+    const helper = helperOf(op)!;
+    op.operands.forEach((o, i) => retype(o, helper.params[i]));
+    floatOf.set(op.results[0], float(helper.returns));
+  }
+  for (const [op, at] of consumers) {
+    at.forEach((i) => retype(op.operands[i], 64));
+  }
+  for (const block of fn.blocks) {
+    block.ops = block.ops.flatMap((op) => {
+      if (calls.has(op)) {
+        return [
+          helperOp(
+            helperOf(op)!.op!,
+            String(op.attrs.target),
+            op.operands.map((o) => floatOf.get(o)!),
+            floatOf.get(op.results[0])!,
+          ),
+        ];
+      }
+      if (literals.has(op)) {
+        return [literals.get(op)!];
+      }
+      const retired = op.results.length === 1 && floatOf.has(op.results[0]);
+      return retired || spent.has(op) || (deadHalf(op) && floatOf.has(op.operands[0])) ? [] : [op];
+    });
+  }
+  for (const [was, now] of floatOf) {
+    replaceAllUsesWith(fn, was, now);
+  }
+  return true;
+}

package/src/raise/globalshape.ts

@@ -505,11 +505,12 @@ export const SHAPE_GATES: readonly Gate<ShapeEvidence>[] = [
     id: 'index-materialized-first',
     why: 'a scaling of the index precedes the pool load IN ITS OWN BLOCK — the pointer path, which is the cast spelling',
     sound: true,
-    // Its SECOND reaching fixture is the compiler-shaped one: `…and the same function cast-spelled
-    // still refuses, on the access that CAN be compared` runs the real agbcc output for a function
-    // that subscripts the name once outside a loop and once inside it. It is not named in
-    // `guardedBy` because that field is matched against a single test title (gate-contract.ts).
-    guardedBy: 'global-array-shape.test.ts: one index-first access refuses a symbol the others license',
+    // Its SECOND reaching fixture is the compiler-shaped one: the real agbcc output for a function
+    // that subscripts the name once outside a loop and once inside it.
+    guardedBy: [
+      'global-array-shape.test.ts: one index-first access refuses a symbol the others license',
+      'global-array-shape.test.ts: …and the same function cast-spelled still refuses, on the access that CAN be compared',
+    ],
     rejects: anIndexFirstAccess,
   },
   {
@@ -955,6 +956,11 @@ export function inferGlobalArrays(
   }
   const pos = positions(fn);
   for (const [sym, accs] of accessesBySymbol(fn, target, gates.address)) {
+    // a function-scope static's shape is its definition's (structure/local-statics.ts), not an
+    // inference, and it is declared in the body rather than assumed
+    if (fn.localObjects?.has(sym)) {
+      continue;
+    }
     const si = Array.isArray(accs) ? shapeOf(accs, pos, gates.shape) : null;
     if (si !== null) {
       out.set(sym, si);

package/src/raise/gvn.ts

@@ -93,11 +93,8 @@ function keyOf(op: Op): string {
   return `${op.opcode}(${attrs})`;
 }
 
-/**
- * Collapse operand-free pure definitions that share a key down to one apiece, defined in the entry
- * block. Returns the number of definitions removed (0 when nothing changed).
- */
-export function numberPureValues(fn: Fn): number {
+/** The blocks numbering looks in: those the entry reaches through any op's successors. */
+function numberedBlocks(fn: Fn): Set<Block> {
   // REACHABLE blocks only. The entry dominates everything REACHABLE — it does not dominate an
   // unreachable block, and verify()'s dominator fixpoint models that faithfully (a block with no
   // predecessors converges to dom = {itself}). Numbering a group with a member in such a block
@@ -120,6 +117,15 @@ export function numberPureValues(fn: Fn): number {
   if (fn.blocks[0]) {
     walk(fn.blocks[0]);
   }
+  return reachable;
+}
+
+/**
+ * Collapse operand-free pure definitions that share a key down to one apiece, defined in the entry
+ * block. Returns the number of definitions removed (0 when nothing changed).
+ */
+export function numberPureValues(fn: Fn): number {
+  const reachable = numberedBlocks(fn);
   const groups = new Map<string, { op: Op; block: number }[]>();
   fn.blocks.forEach((b, bi) => {
     if (!reachable.has(b)) {
@@ -164,3 +170,18 @@ export function numberPureValues(fn: Fn): number {
   entry.ops.unshift(...hoisted);
   return removed;
 }
+
+/** The class {@link numberPureValues} puts a value in: the key of a numberable definition in a block
+ *  it numbers, or the value itself. Two values of one class are one value once it has run. */
+export function valueNumberOf(fn: Fn): (v: Value) => Value | string {
+  const reachable = numberedBlocks(fn);
+  const key = new Map<Value, string>();
+  for (const b of reachable) {
+    for (const op of b.ops) {
+      if (isNumberable(op.opcode) && op.results.length === 1) {
+        key.set(op.results[0], keyOf(op));
+      }
+    }
+  }
+  return (v) => key.get(v) ?? v;
+}

package/src/raise/narrow.ts

@@ -23,6 +23,16 @@
 // A signed and an unsigned right shift of the same value by the same amount differ only in the bits
 // the shift brings in, so `%134` is `sext(%133, 32 - 16)` — the same rewrite, and the reason this
 // pass matches the pair rather than either extension on its own.
+//
+// And a third, where the variable is carried SHIFTED and never extended at all: an `s8` walked down
+// a list, `i = buf[i].next`, is kept as `next << 24` and the test reads it back with `asr #24`.
+// The cast idiom folds that `asr` of the `lsl` into a `sext` of the load, which is the same bits
+// and no longer reads the carried value:
+//
+//     %41 = shl %40 {imm=24}    what `i` holds next iteration, shifted
+//     %42 = sext %40 {8}        the loop test
+//
+// `sext(v, 32 - k) === shr_s(shl(v, k), k)`, so `%42` is re-rooted as `shr_s %41 {k}`.
 import { Fn, Op, Value, defOpMap } from '../ir/core';
 import { CAST_WIDTHS, Opcode } from '../ir/opcodes';
 
@@ -41,8 +51,8 @@ const domainOf = (op: Op, low: Opcode, high: Opcode): { key: string; width: numb
   return null;
 };
 
-/** Re-root a sign extension on the co-existing zero extension of the same bits. Returns the number
- *  of rewrites. */
+/** Re-root a sign extension on the co-existing zero extension of the same bits, or on the carried
+ *  left shift that holds them. Returns the number of rewrites. */
 export function rerootNarrowReads(fn: Fn): number {
   // LOOP-CARRIED edge arguments only. The rewrite is sound for ANY co-existing pair — it only
   // re-associates two extensions of the same bits — so this gate is about what it BUYS, not about
@@ -87,6 +97,8 @@ export function rerootNarrowReads(fn: Fn): number {
     // else this could be a use before a def. That is the shape the idiom emits — one increment,
     // both extensions of it, in the block that computes it.
     const unsigned = new Map<Value, Map<string, Value>>();
+    // …and the carried left shifts, by operand and then by amount, under the same two rules
+    const shifted = new Map<Value, Map<number, Value>>();
     for (const op of b.ops) {
       const u = domainOf(op, 'zext', 'shr_u');
       if (u !== null && carried.has(op.results[0])) {
@@ -95,6 +107,21 @@ export function rerootNarrowReads(fn: Fn): number {
         unsigned.set(op.operands[0], byDomain);
         continue;
       }
+      if (op.opcode === 'shl' && typeof op.attrs.imm === 'number' && carried.has(op.results[0])) {
+        const byAmount = shifted.get(op.operands[0]) ?? new Map<number, Value>();
+        byAmount.set(op.attrs.imm, op.results[0]);
+        shifted.set(op.operands[0], byAmount);
+        continue;
+      }
+      const k = 32 - (op.attrs.width as number);
+      const sh = op.opcode === 'sext' && CAST_WIDTHS.has(32 - k) ? shifted.get(op.operands[0])?.get(k) : undefined;
+      if (sh !== undefined) {
+        op.opcode = 'shr_s';
+        op.operands = [sh];
+        op.attrs = { imm: k };
+        rewritten++;
+        continue;
+      }
       const sgn = domainOf(op, 'sext', 'shr_s');
       if (sgn === null) {
         continue;

package/src/raise/narrowlocal.ts

@@ -58,6 +58,12 @@
 //   u16 v; … *out = v;                  zext16                 4     0 MATCH
 //   s32 v; … *out = (u16)v;             zext16             0 MATCH       4
 //
+// A THIRD SPELLING of rows three and four is the `/escape-home` variation's
+// (structure/analysis.ts `escapingExtensions`): keep `s32 v` and give the truncation a NAME where
+// it happened, `t = (u16)v`. It is not an alternative to this pass — it judges an extension's
+// result where this one judges a block PARAMETER — and it is a ranked candidate where this is a
+// decision, so neither can take the other's input.
+//
 // Rows one and two are DECIDABLE by the carrier's own readers: a `zext_w` read by a `sext_w` is the
 // write-back truncation followed by the declaration's own sign extension, and no cast on a wide
 // local writes that pair. Rows three and four are the same IR in this pass's READER vocabulary —
@@ -131,7 +137,8 @@
 // admits), and `runPreRecovery` reads the shape ahead of the pass that manufactures it —
 // `mergeShapes`.
 import { type Block, type Fn, type Op, type Value, defOpMap, predecessors, replaceAllUsesWith } from '../ir/core';
-import { CAST_WIDTHS, REEVAL_UNSAFE_OPS } from '../ir/opcodes';
+import { reevalUnsafe } from '../ir/discipline';
+import { CAST_WIDTHS } from '../ir/opcodes';
 import { T } from '../ir/types';
 import { type Gate, firstRejection } from '../l3/gates';
 
@@ -350,8 +357,8 @@ function mergeArms(preds: Map<Block, Block[]>, fn: Fn, blk: Block): [Block, Bloc
  *    • a MEMORY READ is one op and is NOT one speculatable SET. `gcc/rtlanal.c:1770-1771` sends a
  *      MEM to `rtx_addr_can_trap_p` and `:144-147` says an address held in a plain pseudo CAN trap,
  *      so `jump.c` never hoists a load and the diamond survives under BOTH spellings, carrying no
- *      information. `REEVAL_UNSAFE_OPS` answers this (effects, reads, or traps — `may_trap_p`
- *      refuses the trapping divides too, at `rtlanal.c:1774-1784`); `HOIST_UNSAFE_OPS` does NOT,
+ *      information. `reevalUnsafe` answers this (effects, reads, or traps — `may_trap_p`
+ *      refuses the trapping divides too, at `rtlanal.c:1774-1784`); `speculationUnsafe` does NOT,
  *      because it omits reads for `raise/shortcircuit.ts`, whose arm C's own `&&` re-guards, and
  *      that exemption does not transfer to speculation above a compare.
  *    • a CONSTANT is not free. `v = a + 0x12345` is a literal-pool `ldr` plus the `add` — two
@@ -382,9 +389,7 @@ function mergeArms(preds: Map<Block, Block[]>, fn: Fn, blk: Block): [Block, Bloc
  *  clause in that table is `sound: false`), so the shared conservative predicate is the right one
  *  until a row asks for the cost model neither pass has. */
 export function armIsOneSet(b: Block): boolean {
-  return (
-    !b.ops.some((op) => REEVAL_UNSAFE_OPS.has(op.opcode)) && b.ops.filter((op) => op.results.length > 0).length === 1
-  );
+  return !b.ops.some(reevalUnsafe) && b.ops.filter((op) => op.results.length > 0).length === 1;
 }
 
 /** The join shape of every block, read ONCE off the IR it is handed.