@asmlift/core 0.8.1 → 0.10.0

package/src/l3/parkfirst.ts

@@ -28,15 +28,17 @@
 // gcc2.7.2 schedules it last — so a second inhabitant consolidates both into one entry-prefix
 // ordering variation rather than growing a sibling.
 import type { Expr, SFn, Stmt } from './ast';
-import { exprChildren, exprHasEffect } from './ast';
+import { exprChildren, exprHasEffect, mentionedName } from './ast';
 
 type Assign = Extract<Stmt, { k: 'assign' }>;
 
-// `addr` counts as touching its name: `foo(&v)` may read or write v through the pointer, so a
-// park must treat it exactly like a direct read-and-write of v.
+// Every mention counts as touching its name: `foo(&v)` may read or write v through the pointer,
+// and `v++` writes it outright, so a park must treat either exactly like a direct read-and-write
+// of v.
 const readVars = (e: Expr, acc: Set<string> = new Set()): Set<string> => {
-  if (e.k === 'var' || e.k === 'addr') {
-    acc.add(e.name);
+  const n = mentionedName(e);
+  if (n !== undefined) {
+    acc.add(n);
   }
   for (const c of exprChildren(e)) {
     readVars(c, acc);
@@ -49,6 +51,7 @@ const pureOverParams = (e: Expr, params: ReadonlySet<string>): boolean => {
     case 'var':
       return params.has(e.name);
     case 'const':
+    case 'fconst':
       return true;
     case 'un':
     case 'cast':

package/src/l3/pollguard.ts

@@ -19,7 +19,7 @@
 // where the forms genuinely differ (the body runs at least once vs at least zero times), which
 // is why it never wraps. Declines (null) when no empty do-while exists.
 import type { Expr, SFn, Stmt } from './ast';
-import { exprChildren, exprEquals, mapExprChildren, mapStmtLists, stmtChildren, stmtExprs } from './ast';
+import { exprChildren, exprEquals, mapExprChildren, mapStmtLists, stmtChildren, stmtExprs, unionEvidence } from './ast';
 
 export function pollGuards(sfn: SFn): SFn | null {
   let changed = false;
@@ -58,8 +58,9 @@ const countVar = (e: Expr, n: string): number =>
 const countAddr = (e: Expr, n: string): number =>
   (e.k === 'addr' && e.name === n ? 1 : 0) + exprChildren(e).reduce((a, c) => a + countAddr(c, n), 0);
 
-/** call- and marker-free: no effect the fold could move or duplicate. */
-const pure = (e: Expr): boolean => e.k !== 'call' && e.k !== 'marker' && exprChildren(e).every(pure);
+/** call-, marker- and post-increment-free: no effect the fold could move or duplicate. */
+const pure = (e: Expr): boolean =>
+  e.k !== 'call' && e.k !== 'marker' && e.k !== 'postincr' && exprChildren(e).every(pure);
 
 /** The var a deref's base stands on, through casts only — null for anything else (a raw address, an
  *  arithmetic base), which is exactly the set `condDerefsPlain` refuses. */
@@ -139,7 +140,13 @@ export function pollReads(sfn: SFn): SFn | null {
         condFoldable(w.cond, volatileLocals) &&
         ownsEveryOccurrence(sfn.body, a.name)
       ) {
-        out.push({ k: 'while', cond: subst(w.cond, a.name, a.value), body: [] });
+        // The loop's re-read and the first read print alike; the folded read stands for both
+        // (ast.ts `unionEvidence`).
+        out.push({
+          k: 'while',
+          cond: subst(w.cond, a.name, unionEvidence(a.value, (w.body[0] as typeof a).value)),
+          body: [],
+        });
         dropped.add(a.name);
         i++;
         continue;

package/src/l3/ptrcell.ts

@@ -0,0 +1,354 @@
+// L3: a POINTER CELL — a global the body stores a pointer into, and the one place that spelling is
+// recognised.
+//
+// structure() spells a pointer value stored into a word global as `g = (void *)X`
+// (structure/pointer-spelling.ts `intoPtrCell`), the store every pointer declaration of `g` takes.
+// That store is built by `pointerCellValue` and read by `pointerCellStore`, both below; the one other
+// writer of it, `legalizePointerCells`, converts an integer stored into a cell through the same
+// function. Three readers act on it, and all three ask `pointerCells` rather than re-reading the cast:
+//
+//   • l3/symbol-refs.ts declares a name-only cell `void *` in the candidate's own world, the type
+//     that store needs, and so each global the cell meets bare that nothing reads as an integer
+//     (`pointerPartners`);
+//   • `legalizePointerCells` below converts the cell's other uses to match that declaration;
+//   • l3/intcell.ts spells the cell as the integer a project may have declared instead.
+//
+// The fact is derived from the final tree at each reader rather than carried on SFn, for the reason
+// l3/symbol-refs.ts's header gives: a rewrite that drops the store must drop the fact with it.
+import { type IrType, T } from '../ir/types';
+import { declaredWidth } from '../proto';
+import {
+  type Expr,
+  type SFn,
+  type Stmt,
+  assignsIn,
+  exprChildren,
+  mapExprChildren,
+  taintOverAssigns,
+  walkExprs,
+} from './ast';
+import { declaredTypes, exprCType } from './typing';
+
+/** A value stored into a pointer cell: `(void *)X`, which every pointer declaration of the cell
+ *  takes. */
+export const pointerCellValue = (e: Expr): Expr => ({ k: 'cast', to: T.ptr(T.void()), e });
+
+/** The bare name an `assign` stores a `(void *)` value into (`pointerCellValue`): a pointer cell,
+ *  when no local binds it. */
+export function pointerCellStore(s: Stmt): string | undefined {
+  return s.k === 'assign' && s.value.k === 'cast' && s.value.to.kind === 'ptr' && s.value.to.to.kind === 'void'
+    ? s.name
+    : undefined;
+}
+
+const COMPARE = new Set(['<', '<=', '>', '>=', '==', '!=']);
+
+/** Whether `e` reads a variable `pick` takes. */
+const readsVar = (e: Expr, pick: (name: string) => boolean): boolean =>
+  (e.k === 'var' && pick(e.name)) || exprChildren(e).some((c) => readsVar(c, pick));
+
+/** A cell's value moved by integers (`g + 4`, `g + a0 - 8`): pointer arithmetic, a pointer as the
+ *  cell is. Whatever is added is an integer, as no pointer is; what is subtracted is a constant,
+ *  since a pointer's difference is no pointer. */
+export function cellOffset(e: Expr, cells: ReadonlySet<string>): boolean {
+  if (e.k !== 'bin' || (e.op !== '+' && e.op !== '-')) {
+    return false;
+  }
+  const base = (x: Expr): boolean => (x.k === 'var' && cells.has(x.name)) || cellOffset(x, cells);
+  const offset = (x: Expr): boolean => !readsVar(x, (n) => e.op === '-' || cells.has(n));
+  return (base(e.l) && offset(e.r)) || (e.op === '+' && base(e.r) && offset(e.l));
+}
+
+/** The globals `body` stores a pointer into: a `(void *)` store, or the bare value of another one,
+ *  or that value moved by integers (`cellOffset`). */
+export function pointerCells(body: Stmt[], isGlobal: (name: string) => boolean): Set<string> {
+  const stores = assignsIn(body).filter((s) => isGlobal(s.name));
+  return taintOverAssigns(
+    stores,
+    stores.filter((s) => pointerCellStore(s) !== undefined).map((s) => s.name),
+    (s, cells) => (s.value.k === 'var' && cells.has(s.value.name)) || cellOffset(s.value, cells),
+  );
+}
+
+/** The bare globals a pointer cell meets bare: compared with one or with its `cellOffset`, or
+ *  stored into one. */
+function meetsBare(body: Stmt[], isGlobal: (name: string) => boolean, cells: ReadonlySet<string>): Set<string> {
+  const out = new Set<string>();
+  const meets = (e: Expr): void => {
+    if (e.k === 'var' && isGlobal(e.name) && !cells.has(e.name)) {
+      out.add(e.name);
+    }
+  };
+  const isCell = (e: Expr): boolean => (e.k === 'var' && cells.has(e.name)) || cellOffset(e, cells);
+  for (const s of assignsIn(body)) {
+    if (cells.has(s.name)) {
+      meets(s.value);
+    }
+  }
+  for (const e of walkExprs(body)) {
+    if (e.k === 'bin' && COMPARE.has(e.op)) {
+      if (isCell(e.l)) {
+        meets(e.r);
+      }
+      if (isCell(e.r)) {
+        meets(e.l);
+      }
+    }
+  }
+  return out;
+}
+
+/** Whether a name `sfn` reads is a global: no param or local binds it. */
+const globalOf = (sfn: SFn): ((name: string) => boolean) => {
+  const bound = new Set([...sfn.params.map((p) => p.name), ...sfn.locals.map((l) => l.name)]);
+  return (name) => !bound.has(name);
+};
+
+/** The globals `sfn` stores a pointer into (`pointerCells`). */
+export function pointerCellsOf(sfn: SFn): Set<string> {
+  return pointerCells(sfn.body, globalOf(sfn));
+}
+
+/** Whether a declared parameter spelling is an integer of at most a word: the conversion a pointer
+ *  argument needs to reach it. A spelling this cannot read is no opinion. */
+const integerParam = (t: string | undefined): boolean => {
+  if (t === undefined) {
+    return false;
+  }
+  const w = declaredWidth(t);
+  return w !== undefined && w <= 32 && !t.includes('*') && !t.includes('(');
+};
+
+/** What `mapIntegerSlots` does at each place a pointer cell meets an integer. */
+interface SlotRules {
+  /** An operand a cell meets bare, which no conversion takes. */
+  pointerTyped: (e: Expr) => boolean;
+  /** An operand the context reads as an integer. */
+  int: (e: Expr) => Expr;
+  /** An argument an integer parameter takes. */
+  intArg: (e: Expr) => Expr;
+  /** A bare global compared with a cell that is no partner. */
+  comparedGlobal: (e: Expr) => Expr;
+  /** A value stored into a cell. */
+  intoCell: (e: Expr) => Expr;
+  /** A `cellOffset` a pointer meets. */
+  pointerOffset: (e: Expr) => Expr;
+  /** A global stored into that is no cell, which is an integer slot. */
+  storedGlobal: (name: string) => void;
+}
+
+/** `sfn` with `rules` applied at every place its context states an integer type: an operand of a
+ *  non-additive operator, of `-`/`~`, an index, a switch, a comparison with no pointer, a call
+ *  argument whose callee's declared parameter (`SFn.declaredArgs`) is an integer, and a store, an
+ *  assignment or a return into an integer slot. A global stored into that is no cell is an integer
+ *  slot: the candidate's own world declares it one. */
+function mapIntegerSlots(sfn: SFn, cells: ReadonlySet<string>, rules: SlotRules): SFn {
+  const isGlobal = globalOf(sfn);
+  const vt = declaredTypes(sfn);
+  const isCell = (e: Expr): boolean => (e.k === 'var' && cells.has(e.name)) || cellOffset(e, cells);
+  const bareGlobal = (e: Expr): boolean => e.k === 'var' && isGlobal(e.name) && !cells.has(e.name);
+  const compare = (x: Expr, other: Expr): Expr =>
+    isCell(other) && bareGlobal(x) && !rules.pointerTyped(x)
+      ? rules.comparedGlobal(x)
+      : rules.pointerTyped(other) || cellOffset(other, cells)
+        ? cellOffset(x, cells)
+          ? rules.pointerOffset(x)
+          : x
+        : rules.int(x);
+  const expr = (e0: Expr): Expr => {
+    const e = mapExprChildren(e0, expr);
+    switch (e.k) {
+      case 'bin':
+        if (e.op === '&&' || e.op === '||' || e.op === '+' || e.op === '-') {
+          return e;
+        }
+        if (COMPARE.has(e.op)) {
+          return { ...e, l: compare(e.l, e.r), r: compare(e.r, e.l) };
+        }
+        return { ...e, l: rules.int(e.l), r: rules.int(e.r) };
+      case 'un':
+        return e.op === '-' || e.op === '~' ? { ...e, e: rules.int(e.e) } : e;
+      case 'call': {
+        const params =
+          typeof e.fn === 'string' && sfn.declaredArgs && Object.hasOwn(sfn.declaredArgs, e.fn)
+            ? sfn.declaredArgs[e.fn]
+            : undefined;
+        if (params === undefined) {
+          return e;
+        }
+        return { ...e, args: e.args.map((a, i) => (integerParam(params[i]) ? rules.intArg(a) : a)) };
+      }
+      case 'index':
+        return { ...e, idx: rules.int(e.idx), ...(e.lead ? { lead: e.lead.map(rules.int) } : {}) };
+      default:
+        return e;
+    }
+  };
+
+  const stmt = (s: Stmt): Stmt => {
+    switch (s.k) {
+      case 'assign': {
+        const value = expr(s.value);
+        if (cells.has(s.name)) {
+          return { ...s, value: rules.pointerTyped(value) ? value : rules.intoCell(value) };
+        }
+        const t = vt(s.name);
+        if (t === undefined && isGlobal(s.name)) {
+          rules.storedGlobal(s.name);
+          return { ...s, value: rules.int(value) };
+        }
+        return { ...s, value: t?.kind === 'int' ? rules.int(value) : value };
+      }
+      case 'store': {
+        const value = expr(s.value);
+        return {
+          ...s,
+          lval: expr(s.lval),
+          value: exprCType(s.lval, vt)?.kind === 'int' ? rules.int(value) : value,
+        };
+      }
+      case 'exprstmt':
+        return { ...s, value: expr(s.value) };
+      case 'return':
+        return s.value ? { ...s, value: sfn.retType.kind === 'int' ? rules.int(expr(s.value)) : expr(s.value) } : s;
+      case 'if':
+        return { ...s, cond: expr(s.cond), then: s.then.map(stmt), else: s.else.map(stmt) };
+      case 'while':
+      case 'dowhile':
+        return { ...s, cond: expr(s.cond), body: s.body.map(stmt) };
+      case 'for':
+        return { ...s, init: stmt(s.init), cond: expr(s.cond), inc: stmt(s.inc), body: s.body.map(stmt) };
+      case 'switch':
+        return {
+          ...s,
+          scrutinee: rules.int(expr(s.scrutinee)),
+          cases: s.cases.map((c) => ({ ...c, body: c.body.map(stmt) })),
+          default: s.default?.map(stmt),
+        };
+      case 'break':
+      case 'continue':
+        return s;
+    }
+  };
+  return { ...sfn, body: sfn.body.map(stmt) };
+}
+
+/** A sum no operand of which renders a pointer: read as an integer, each bare name in it is. */
+const integerSum = (e: Expr, vt: (name: string) => IrType | undefined): e is Extract<Expr, { k: 'bin' }> =>
+  e.k === 'bin' &&
+  (e.op === '+' || e.op === '-') &&
+  exprCType(e.l, vt)?.kind !== 'ptr' &&
+  exprCType(e.r, vt)?.kind !== 'ptr';
+
+/** The globals a pointer cell meets bare (compared with it or its offset, or stored into it) that hold a pointer
+ *  too: the candidate's own world declares each `void *` beside the cells, and they are left as
+ *  spelled, since converting one would convert whatever the project declares it, where bare a
+ *  float, an array or a function meets the cell as a constraint violation.
+ *
+ *  A global the body also reads as an integer is not one: `void *` takes none of those reads, so its
+ *  own world declares it the integer it is read as, and the cell converts to meet it. */
+export function pointerPartners(sfn: SFn): Set<string> {
+  const isGlobal = globalOf(sfn);
+  const cells = pointerCells(sfn.body, isGlobal);
+  const meets = meetsBare(sfn.body, isGlobal, cells);
+  if (meets.size === 0) {
+    return meets;
+  }
+  const vt = declaredTypes(sfn);
+  const read = new Set<string>();
+  const int = (e: Expr): Expr => {
+    if (e.k === 'var' && meets.has(e.name)) {
+      read.add(e.name);
+    } else if (integerSum(e, vt)) {
+      int(e.l);
+      int(e.r);
+    }
+    return e;
+  };
+  mapIntegerSlots(sfn, cells, {
+    pointerTyped: (e) => e.k === 'var' && (cells.has(e.name) || meets.has(e.name)),
+    int,
+    intArg: int,
+    comparedGlobal: int,
+    intoCell: (e) => e,
+    pointerOffset: (e) => e,
+    storedGlobal: (name) => {
+      if (meets.has(name)) {
+        read.add(name);
+      }
+    },
+  });
+  return new Set([...meets].filter((n) => !read.has(n)));
+}
+
+/** `sfn` with every integer use of a pointer cell converted to the integer it reads as, and every
+ *  integer stored into one converted to a pointer.
+ *
+ *  A cell the body stores a pointer into is a pointer under every declaration that store compiles
+ *  against, so the cell's integer readers (`return g;`, `if (g >= a0)`, `v0 = g;`, `g + 4` returned
+ *  as an integer, an integer parameter's argument) and its integer writers (`g = a0;`) need the
+ *  conversion C leaves implicit and CodeWarrior and IDO reject: `(u32)g`, `g = (void *)a0`. The
+ *  conversion of a word is no instruction, so the bytes are the implicit one's. A cell's offset
+ *  (`cellOffset`) stored into a cell or compared with a pointer is the pointer it is, spelled in
+ *  bytes: `gOut = (void *)((u8 *)g + 4)`, `(u8 *)g + 4 == gP`.
+ *
+ *  SCOPE: a use whose context states an integer type (`mapIntegerSlots`); elsewhere the use is left
+ *  as the structurer spelled it. A truth test, a sum that renders a pointer (the structurer's own
+ *  byte sum, which the backend converts at an integer slot: `legalizePointerWrites`), and a
+ *  comparison with a pointer (a call by its declared return, `SFn.declaredReturns`), with 0 or with
+ *  a partner (`pointerPartners`) are left alone. A global compared with the cell that is no partner
+ *  goes `(u32)(u8 *)g` beside the cell's `(u32)g`: under a float declaration that is no C, as the
+ *  bare comparison was not. KNOWN GAP: under an array or a function declaration that is the
+ *  global's address, compared with no diagnostic, and IDO takes the integer read that made it no
+ *  partner (`v1 = g`) with none either; structure/pointer-spelling.ts `globalWord` says why no
+ *  spelling reads the word there.
+ *
+ *  Run by the C-family backend's `emit` (backend/cfamily.ts), after every respell variation, so a
+ *  respell reads the uses as the structurer spelled them and a store it removes takes the
+ *  conversions with it. */
+export function legalizePointerCells(sfn: SFn): SFn {
+  const cells = pointerCellsOf(sfn);
+  if (cells.size === 0) {
+    return sfn;
+  }
+  const partners = pointerPartners(sfn);
+  const vt = declaredTypes(sfn);
+  const isCell = (e: Expr): boolean => e.k === 'var' && cells.has(e.name);
+  const returnsPointer = (fn: string | Expr): boolean =>
+    typeof fn === 'string' &&
+    sfn.declaredReturns !== undefined &&
+    Object.hasOwn(sfn.declaredReturns, fn) &&
+    sfn.declaredReturns[fn].includes('*');
+  const asInt = (e: Expr): Expr =>
+    isCell(e) ? { k: 'cast', to: T.u(32), e } : integerSum(e, vt) ? { ...e, l: asInt(e.l), r: asInt(e.r) } : e;
+  // A cell's offset as the pointer it is: byte arithmetic on the cell, `(u8 *)g + 4`, which no
+  // pointee scales and which a `void *` takes.
+  const asBytes = (e: Expr): Expr =>
+    isCell(e)
+      ? { k: 'cast', to: T.ptr(T.u(8)), e }
+      : e.k === 'bin' && cellOffset(e, cells)
+        ? { ...e, l: asBytes(e.l), r: e.op === '+' ? asBytes(e.r) : e.r }
+        : e;
+  // The structurer's byte sum on a cell's value (`(u8 *)g + 8`) is a pointer too, which an integer
+  // parameter takes converted as a bare cell does; the backend converts it at every other integer
+  // slot (`legalizePointerWrites`).
+  const cellSum = (e: Expr): boolean =>
+    (e.k === 'cast' && e.to.kind === 'ptr' && isCell(e.e)) ||
+    (e.k === 'bin' && (e.op === '+' || e.op === '-') && (cellSum(e.l) || cellSum(e.r)));
+  return mapIntegerSlots(sfn, cells, {
+    pointerTyped: (e) =>
+      isCell(e) ||
+      (e.k === 'var' && partners.has(e.name)) ||
+      e.k === 'addr' ||
+      (e.k === 'call' && returnsPointer(e.fn)) ||
+      (e.k === 'const' && e.value === 0) ||
+      exprCType(e, vt)?.kind === 'ptr',
+    int: asInt,
+    intArg: (e) =>
+      e.k === 'bin' && cellSum(e) && exprCType(e, vt)?.kind === 'ptr' ? { k: 'cast', to: T.u(32), e } : asInt(e),
+    comparedGlobal: (e) => ({ k: 'cast', to: T.u(32), e: { k: 'cast', to: T.ptr(T.u(8)), e } }),
+    intoCell: (e) => pointerCellValue(asBytes(e)),
+    pointerOffset: asBytes,
+    storedGlobal: () => {},
+  });
+}

package/src/l3/ptrfield.ts

@@ -29,10 +29,24 @@
 // `*(volatile s32 *)0x040000D4/D8/DC` device writes — `volatile` restricts what may be done with
 // THOSE accesses and does not merge their type into the pointer's alias set.
 //
-// SEMANTICS ARE PRESERVED BY CONSTRUCTION on a target whose pointers are 32 bits: the declaration
-// changes, and every read is wrapped in a cast back to the field's own recovered integer type, so
-// each use computes the same value it did. Nothing else moves. THE 32-BIT ASSUMPTION IS ASSERTED,
-// NOT CHECKED — there is no pointer-width field on TargetDescription to check it against, and the
+// SEMANTICS ARE PRESERVED BY CONSTRUCTION on a target whose pointers are 32 bits — WHILE NO STORE
+// OF ANOTHER ALIAS SET REACHES THE FIELD'S BYTES: the declaration changes, and every read is
+// wrapped in a cast back to the field's own recovered integer type, so each use computes the same
+// value it did. The cast keeps the VALUE, not the read's alias set: the load is still of a pointer
+// type, which is the very freedom this variation exists to give agbcc, and which it uses to read
+// stale past an integer store to the same bytes. Two such stores are knowable from the tree, and
+// each has a gate. Over a local array the body IS that store: the frame audit licenses a wider
+// runtime index into those bytes as one integer type (frontend/frame-objects.ts `indexedWidth`),
+// so `over-local-storage` refuses a field selected out of one. And once a local's address has LEFT
+// the function (a call argument, a stored or returned value) while the function writes local
+// storage, a pointer it obtains from anywhere but its params or a fixed address may be that same
+// address handed back (`k(buf); p = get(); x = p->a; buf[i] = v;`), so `frame-escaped` refuses a
+// field read through one. Past those, a store the asm shows is tied to the field's bytes only by
+// the caller's or a global's aliasing, which the tree cannot see — which spelling the original had
+// is then what the differ referees, and it is the only referee there.
+//
+// THE 32-BIT ASSUMPTION IS ASSERTED, NOT CHECKED — there is no pointer-width field on
+// TargetDescription to check it against, and the
 // assumption is already tower-wide (`l3/typing.ts`'s `ptrElemBytes` returns 4 for any pointee). On
 // a 64-bit target this variation would change a struct's LAYOUT rather than only its spelling, so the
 // width field is what that target's first row must add, and this note is where to start.
@@ -49,9 +63,11 @@
 //
 // GATE (PTR_FIELD_GATES, read once per field): the field's recovered type must be a 32-bit
 // integer; it must never be a store LVALUE (the write side would need a cast on the value, which
-// is a second question); and it must never stand as the BASE of another access (a field the tree
-// already dereferences is one the recovery typed from its own use, not from a width). Nothing
-// qualifying ⇒ decline (null).
+// is a second question); it must never stand as the BASE of another access (a field the tree
+// already dereferences is one the recovery typed from its own use, not from a width); and it must
+// never be selected out of a local array's bytes (`over-local-storage`, the caveat above); and
+// while a written local's address has escaped, it must be read through a param or a fixed address
+// (`frame-escaped`, the same caveat). Nothing qualifying ⇒ decline (null).
 //
 // SCOPE, because both of this table's blind spots look exactly like a gate refusing. First, THERE
 // IS NO PAD RULE, deliberately: `plan` builds a ctx only for fields the tree ACCESSES, so "a field
@@ -67,12 +83,16 @@ import {
   type SFn,
   type Stmt,
   type StructType,
+  assignsIn,
   mapExprChildren,
   mapStmtExprs,
+  mentionedName,
   stmtChildren,
+  taintOverAssigns,
   walkExprs,
 } from './ast';
 import { type Gate, firstRejection } from './gates';
+import { localAddresses, localStorageEscapesWritten, nameStorage } from './storage';
 import { declaredTypes, exprCType } from './typing';
 
 /** One recovered field as the gates read it — built only for fields the tree accesses. */
@@ -82,6 +102,12 @@ interface FieldCtx {
   written: boolean;
   /** the field's value stands as the base of an `index` or another `field` */
   dereferenced: boolean;
+  /** some access to the field selects it out of a local array's bytes */
+  overLocalStorage: boolean;
+  /** some access reads the field through a pointer that is neither a param nor a fixed address */
+  obtainedPointer: boolean;
+  /** a local's address leaves the function, and the function writes local storage */
+  frameEscaped: boolean;
 }
 
 export const PTR_FIELD_GATES: readonly Gate<FieldCtx>[] = [
@@ -106,6 +132,26 @@ export const PTR_FIELD_GATES: readonly Gate<FieldCtx>[] = [
     guardedBy: 'ptrfield.test.ts: a field standing as an access base declines',
     rejects: (c) => c.dereferenced,
   },
+  {
+    id: 'over-local-storage',
+    why:
+      "a local array's bytes are typed by the frame audit, which licenses a wider runtime index only " +
+      'while every access of one width is one integer type; a pointer field over them is an alias ' +
+      'set of its own, and agbcc at -O2 reads it stale past an integer store to the same bytes',
+    sound: true,
+    guardedBy: 'ptrfield.test.ts: a field selected out of a local array declines',
+    rejects: (c) => c.overLocalStorage,
+  },
+  {
+    id: 'frame-escaped',
+    why:
+      "once a written local's address has left the function, a pointer it obtains later may be that " +
+      'address handed back, and a pointer field read through it is then read stale past the integer ' +
+      'store to the same bytes',
+    sound: true,
+    guardedBy: 'ptrfield.test.ts: a field read through a re-obtained pointer after a frame address escaped declines',
+    rejects: (c) => c.frameEscaped && c.obtainedPointer,
+  },
 ];
 
 /** the struct a `field` node selects from, or null */
@@ -122,6 +168,10 @@ const keyOf = (structName: string, field: string): string => `${structName}.${fi
  *  reads cast back to. */
 function plan(sfn: SFn): Map<string, IrType> {
   const vt = declaredTypes(sfn);
+  const storage = localStorageNames(sfn);
+  const frameEscaped = localStorageEscapesWritten(sfn);
+  const fixed = fixedPointer(sfn);
+  const { accessAddress } = localAddresses(sfn);
   const seen = new Map<string, FieldCtx & { type: IrType }>();
   const note = (base: Expr, name: string, edit: (c: FieldCtx) => void): void => {
     const st = structOf(base, vt);
@@ -134,6 +184,9 @@ function plan(sfn: SFn): Map<string, IrType> {
       word: declared.kind === 'int' && declared.width === 32,
       written: false,
       dereferenced: false,
+      overLocalStorage: false,
+      obtainedPointer: false,
+      frameEscaped,
       type: declared,
     };
     edit(cur);
@@ -141,7 +194,14 @@ function plan(sfn: SFn): Map<string, IrType> {
   };
   for (const e of walkExprs(sfn.body)) {
     if (e.k === 'field') {
-      note(e.base, e.name, () => {});
+      note(e.base, e.name, (c) => {
+        if (reachesStorage(e.base, storage)) {
+          c.overLocalStorage = true;
+        }
+        if (!fixed(accessAddress(e))) {
+          c.obtainedPointer = true;
+        }
+      });
     }
     // a field standing as an access base is one the recovery typed from its own use
     const inner = e.k === 'index' ? e.base : e.k === 'field' ? e.base : null;
@@ -163,6 +223,61 @@ function plan(sfn: SFn): Map<string, IrType> {
   return out;
 }
 
+/** The locals whose value is a LOCAL OBJECT'S ADDRESS: every local array (the bytes the frame
+ *  audit typed — `u8 sp0[n]`), then every local assigned an expression that reaches one, or a
+ *  local's address, to a fixpoint (`p0 = (s32 *)sp0;` carries the bytes into `p0`). Over-wide by
+ *  design: a local holding `sp0[i]` (a value read OUT of the bytes) is swept in too, which only
+ *  ever refuses a variation. */
+function localStorageNames(sfn: SFn): { names: Set<string>; locals: Set<string> } {
+  const locals = new Set(sfn.locals.map((l) => l.name));
+  const names = taintOverAssigns(
+    assignsIn(sfn.body),
+    sfn.locals.filter((l) => l.type.kind === 'array').map((l) => l.name),
+    (a, names) => locals.has(a.name) && reachesStorage(a.value, { names, locals }),
+  );
+  return { names, locals };
+}
+
+/** Does the expression hold a pointer the function did not OBTAIN — one no escaped frame address
+ *  can come back through? A constant address, a global's address, or a param nothing assigns (the
+ *  caller's value, which predates this frame), under casts and offsets. Anything else — a local, a
+ *  call's result, a value loaded from memory — may be the frame. */
+function fixedPointer(sfn: SFn): (e: Expr) => boolean {
+  const storage = nameStorage(sfn);
+  const assigned = new Set(assignsIn(sfn.body).map((a) => a.name));
+  const fixed = (e: Expr): boolean => {
+    switch (e.k) {
+      case 'const':
+        return true;
+      case 'addr':
+        return storage.get(e.name) !== 'local' && storage.get(e.name) !== 'param';
+      case 'var':
+        return storage.get(e.name) === 'param' && !assigned.has(e.name);
+      case 'cast':
+        return fixed(e.e);
+      // An offset from a fixed pointer stays in the object it points into, but the tree does not
+      // say which operand is the pointer: in `p + off` with `p = get()` and `off` a param, the
+      // param is the fixed side and `p` may be the frame. So every operand must be fixed.
+      case 'bin':
+        return (e.op === '+' || e.op === '-') && fixed(e.l) && fixed(e.r);
+      default:
+        return false;
+    }
+  };
+  return fixed;
+}
+
+/** does the expression name local storage, or take a local's address? */
+function reachesStorage(
+  e: Expr,
+  storage: { readonly names: ReadonlySet<string>; readonly locals: ReadonlySet<string> },
+): boolean {
+  return [...walkExprs([{ k: 'exprstmt', value: e }])].some((x) => {
+    const n = mentionedName(x);
+    return n !== undefined && (storage.names.has(n) || (x.k === 'addr' && storage.locals.has(n)));
+  });
+}
+
 /** Every `store` in the tree. ORDER-FREE by construction, which is what lets it use the shared
  *  `stmtChildren` (a switch's default sits at `defaultAt`, not last): its one caller only sets
  *  `written` on entries the preceding `walkExprs` pass already created — `note` builds an entry