@asmlift/core 0.8.1 → 0.10.0

package/src/l3/typing.ts

@@ -17,8 +17,8 @@
 // Callers choose their conservative direction: the emission guard treats `undefined` as "not
 // provably a pointer" (adds a cast — valid C either way); the deref contract treats `undefined`
 // as "not provably wrong" (no error).
-import { IrType, T, scalarTypeForAccess } from '../ir/types';
-import { type Expr, type SFn, exprChildren } from './ast';
+import { IrType, T, isCastView, memberOf, scalarTypeForAccess } from '../ir/types';
+import { type BinOp, type Expr, type SFn, exprChildren, walkExprs } from './ast';
 
 /** The declared type of a printed variable — the env `exprCType` judges rendered C against.
  *  THE one copy of the SFn→env derivation — printers, contracts and L3 respell variations alike: each
@@ -31,6 +31,9 @@ export function declaredTypes(fn: SFn): VarTypes {
   for (const g of fn.globals ?? []) {
     m.set(g.name, g.type);
   }
+  for (const st of [...(fn.statics ?? []), ...(fn.images ?? [])]) {
+    m.set(st.name, st.type);
+  }
   for (const p of fn.params) {
     m.set(p.name, p.type);
   }
@@ -55,6 +58,12 @@ export function ptrElemBytes(to: IrType): number {
 export interface PrintEnv {
   readonly type: VarTypes;
   readonly volatilePointee: (name: string) => boolean;
+  /** a callee's declared parameter types, on a function whose compiler refuses C's implicit pointer
+   *  conversions: compiled as C++ (`SFn.dialect`), or by a C front end that refuses them too
+   *  (`SFn.strictConversions`) (`SFn.declaredArgs`) */
+  readonly declaredArgs: (callee: string) => readonly (string | undefined)[] | undefined;
+  /** a function-scope static this function defines `const` (`SFn.statics`) */
+  readonly constStatic: (name: string) => boolean;
 }
 
 export function printEnv(fn: SFn): PrintEnv {
@@ -63,7 +72,18 @@ export function printEnv(fn: SFn): PrintEnv {
   const vol = new Set(
     fn.locals.filter((l) => l.type.kind === 'ptr' && (l.pointeeVolatile || l.volatile)).map((l) => l.name),
   );
-  return { type: declaredTypes(fn), volatilePointee: (n) => vol.has(n) };
+  const constStatics = new Set((fn.statics ?? []).filter((s) => s.const).map((s) => s.name));
+  return {
+    type: declaredTypes(fn),
+    volatilePointee: (n) => vol.has(n),
+    declaredArgs: (callee) =>
+      (fn.dialect === 'c++' || fn.strictConversions === true) &&
+      fn.declaredArgs &&
+      Object.hasOwn(fn.declaredArgs, callee)
+        ? fn.declaredArgs[callee]
+        : undefined,
+    constStatic: (n) => constStatics.has(n),
+  };
 }
 
 /** Does anything under `e` assert a VOLATILE POINTEE? The two spellings that carry the qualifier
@@ -103,15 +123,97 @@ export function derefStrideOk(rt: IrType | undefined, width: number, signed: boo
   return false;
 }
 
-/** The USUAL ARITHMETIC CONVERSIONS over two rendered operands: at equal rank, unsigned wins.
- *  Either side unknown leaves the result unknown — EXCEPT when the known side is unsigned, which
- *  already decides it.
+/** The INTEGER RANK a rendered expression carries, as a width in bits: 64 only where it can be
+ *  PROVEN, 32 everywhere else. The complement of `renderedIntSignedness` — that one models the
+ *  signedness `exprCType` reports uniformly as `s32`, this one models the width it reports the same
+ *  way — and the two together are what the usual arithmetic conversions need.
+ *
+ *  THE COMPLEMENT PARTS COMPANY WITH `exprCType` AT ONE NODE, AND IT IS `call`. There `exprCType`
+ *  is UNINFORMED by design and answers `undefined`, while this reads the `wide64` stamp the
+ *  structurer put on the node and can answer 64. A reader who reaches for `exprCType` on a call
+ *  will be told the information does not exist; it does, and it is here.
+ *
+ *  ITS SOUNDNESS IS AN ENUMERATION OF THE PRODUCERS, so here is the enumeration. A 64-bit value
+ *  reaches a rendered expression in exactly four ways:
+ *    1. a `var`/`postincr` whose DECLARED type is 64 bits wide — read off `varType`;
+ *    2. a `cast` to a 64-bit type — read off the node;
+ *    3. a `call` the structurer STAMPED `wide64` — read off the node, and it is the one case where
+ *       the rank cannot be derived from anything visible here: a callee's return type comes from a
+ *       prototype outside the emitted function, which is why `exprCType` answers `undefined` for a
+ *       call and why the stamp exists (l3/ast.ts carries what it means);
+ *    4. an arithmetic node over one of those — the recursion below.
+ *  It does NOT arrive through MEMORY, because `contracts.ts` `SCALAR_WIDTHS` is {1,2,4} and there
+ *  is no 64-bit global; nor through a `const`, because a 64-bit literal only folds inside C `int`
+ *  range, where 32 is the right answer for the literal's own type.
  *
- *  That exception is the one place this returns a DEFINITE answer from an unknown operand, and it
- *  is sound only because every integer here is rank `int`: at UNEQUAL rank C converts to the wider
- *  type first, so `unsigned int & long long` is SIGNED. Core has no 64-bit integer type at all
- *  (the decomp typedef vocabulary stops at 32 — see contracts.ts SCALAR_WIDTHS), so the
- *  unequal-rank case cannot arise. Adding one would invalidate this.
+ *  AN UNSTAMPED CALL IS 32 AND THAT IS THE SAFE ANSWER, not a claim: it is what C makes of a callee
+ *  nobody declared, and every consumer of this rank takes a cast on a 32 it doubts and takes none on
+ *  a 64 — so the direction that would be wrong silently is the one this never guesses.
+ *
+ *  A SHIFT takes the rank of its left operand alone; every other ARITHMETIC node takes the wider of
+ *  the two. That is C, and it is also why this is not simply `exprCType(e).width`.
+ *
+ *  THE NODES THAT ARE NOT ARITHMETIC ONES are the same list `renderedIntSignedness` enumerates, and
+ *  they yield `int` however wide their operands: a comparison, a logical connective, and `!`. `-`
+ *  and `~` are not in it, because each carries the promoted type of its operand. */
+export function exprIntWidth(e: Expr, varType: VarTypes): 32 | 64 {
+  const wide = (t: IrType | undefined): boolean => t?.kind === 'int' && t.width === 64;
+  switch (e.k) {
+    case 'var':
+    case 'postincr':
+    case 'cast':
+    case 'index':
+    case 'field':
+      return wide(exprCType(e, varType)) ? 64 : 32;
+    case 'call':
+      return e.wide64 === true ? 64 : 32;
+    case 'un':
+      return e.op === '!' ? 32 : exprIntWidth(e.e, varType);
+    case 'bin':
+      if (INT_RESULT_BINOPS.has(e.op)) {
+        return 32;
+      }
+      if (e.op === '<<' || e.op === '>>' || e.op === '>>>') {
+        return exprIntWidth(e.l, varType);
+      }
+      return exprIntWidth(e.l, varType) === 64 || exprIntWidth(e.r, varType) === 64 ? 64 : 32;
+    default:
+      return 32;
+  }
+}
+
+/** The float operators (l3/ast.ts BinOp): their result is the float their operands are, never an
+ *  integer, so none of the integer conversion rules below applies to one. */
+export const FLOAT_BINOPS: ReadonlySet<BinOp> = new Set<BinOp>(['f+', 'f-', 'f*', 'f/']);
+
+/** The binary operators whose RESULT is a C `int` whatever their operands are — read by both
+ *  halves of the conversion model, which is the point of naming them once. A float compare is one:
+ *  its operands are floats and its result is C's `int`. */
+const INT_RESULT_BINOPS = new Set<BinOp>([
+  '<',
+  '<=',
+  '>',
+  '>=',
+  '==',
+  '!=',
+  '&&',
+  '||',
+  'f<',
+  'f<=',
+  'f>',
+  'f>=',
+  'f==',
+  'f!=',
+]);
+
+/** The USUAL ARITHMETIC CONVERSIONS over two rendered operands.
+ *
+ *  AT EQUAL RANK, unsigned wins, and either side unknown leaves the result unknown — EXCEPT when
+ *  the known side is unsigned, which already decides it. AT UNEQUAL RANK C converts to the wider
+ *  type first, so the WIDER side's signedness decides outright: `unsigned int / long long` is
+ *  SIGNED, and taking the equal-rank shortcut there would spell an unsigned divide over a signed
+ *  one. `exprIntWidth` is what tells the two cases apart, and it is TOTAL, so the rank is always
+ *  known and only the signedness can be undetermined.
  *
  *  Exported because two consumers ask it about an operator whose own rendering they are deciding,
  *  so they cannot ask `renderedIntSignedness` about the node: the C-family backend's operand pin,
@@ -119,6 +221,11 @@ export function derefStrideOk(rt: IrType | undefined, width: number, signed: boo
 export function arithConversionSignedness(l: Expr, r: Expr, varType: VarTypes): boolean | undefined {
   const ls = renderedIntSignedness(l, varType);
   const rs = renderedIntSignedness(r, varType);
+  const lw = exprIntWidth(l, varType);
+  const rw = exprIntWidth(r, varType);
+  if (lw !== rw) {
+    return lw > rw ? ls : rs;
+  }
   if (ls === false || rs === false) {
     return false;
   }
@@ -133,7 +240,7 @@ export function arithConversionSignedness(l: Expr, r: Expr, varType: VarTypes):
  *
  * THE one rendered-signedness judgment, and it lives beside the declarations it judges against
  * because every consumer shares it: the C-family backend's operand pin, structure.ts's
- * unsigned-compare gate (the /uns-cmp variation) and its signed-compare pin, and — through
+ * unsigned-compare gate (unsignedCompareSpelling) and its signed-compare pin, and — through
  * `arithConversionSignedness` above — initfirst's compare-meaning gate. Two of those models
  * disagreeing about one expression is the drift this placement prevents.
  *
@@ -149,8 +256,8 @@ export function arithConversionSignedness(l: Expr, r: Expr, varType: VarTypes):
  * instruction-for-instruction the same where `f` really returns `int`); a missing one is a
  * miscompile — with `u32 f(void);` in scope `f() / a` calls `__udivsi3` where the machine called
  * `__divsi3`, and `if (f() >= 0)` compiles to `bl f; mov r0, #0`, comparison and both arms gone.
- * The one consumer that reads `undefined` the other way is the /uns-cmp variation's own gate, which is
- * asking whether an operand is ALREADY unsigned.
+ * The one consumer that reads `undefined` the other way is the unsigned-compare spelling's own
+ * gate, which is asking whether an operand is ALREADY unsigned.
  *
  * Anything narrower than 32 bits promotes to `int` and is therefore SIGNED, whatever it was
  * declared. Pointers, calls and markers are `undefined`.
@@ -158,10 +265,16 @@ export function arithConversionSignedness(l: Expr, r: Expr, varType: VarTypes):
 export function renderedIntSignedness(e: Expr, varType: VarTypes): boolean | undefined {
   const rec = (x: Expr): boolean | undefined => renderedIntSignedness(x, varType);
   // an lvalue-ish leaf: its C type is a declaration / an explicit cast / a carried access width
+  // Anything narrower than `int` promotes and comes out SIGNED whatever it was declared. `int` and
+  // `long long` keep their own signedness, because no promotion applies to either. A width that is
+  // NEITHER is not a C type at all — an `index` node carries a struct STRIDE as its width — and
+  // stays undetermined, which is what every consumer already takes a cast on.
   const promoted = (t: IrType | undefined): boolean | undefined =>
-    t?.kind !== 'int' ? undefined : t.width < 32 ? true : t.width === 32 ? t.signed : undefined;
+    t?.kind !== 'int' ? undefined : t.width < 32 ? true : t.width === 32 || t.width === 64 ? t.signed : undefined;
   switch (e.k) {
     case 'var':
+    // `v++` renders the value the local held, so it promotes exactly as the bare name does.
+    case 'postincr':
     case 'cast':
     case 'index':
     case 'field':
@@ -174,10 +287,16 @@ export function renderedIntSignedness(e: Expr, varType: VarTypes): boolean | und
     // folded to a shift — where `a / (s32)-2147483648` calls `__divsi3`.
     case 'const':
       return e.value > -2147483648 && e.value <= 2147483647;
-    // `-x` / `~x` carry the PROMOTED type of the operand; `!x` is `int`.
+    case 'fconst':
+      return undefined;
+    // `-x` / `~x` carry the PROMOTED type of the operand; `!x` is `int`. A float has no integer
+    // signedness at all.
     case 'un':
-      return e.op === '!' ? true : rec(e.e);
+      return e.op === 'f-' ? undefined : e.op === '!' ? true : rec(e.e);
     case 'bin': {
+      if (FLOAT_BINOPS.has(e.op)) {
+        return undefined;
+      }
       // The SIGNEDNESS-CARRYING pairs — the ops the tower keeps apart because C spells each pair
       // with one token and picks between them from the operand types (l3/ast.ts BinOp). The
       // C-family backend PINS their operands, so what gets printed renders as the op says
@@ -194,8 +313,8 @@ export function renderedIntSignedness(e: Expr, varType: VarTypes): boolean | und
       if (e.op === '<<') {
         return rec(e.l);
       }
-      // Comparisons and the logical connectives yield `int`.
-      if (['<', '<=', '>', '>=', '==', '!=', '&&', '||'].includes(e.op)) {
+      // Comparisons and the logical connectives yield `int`, which is signed.
+      if (INT_RESULT_BINOPS.has(e.op)) {
         return true;
       }
       return arithConversionSignedness(e.l, e.r, varType);
@@ -208,16 +327,41 @@ export function renderedIntSignedness(e: Expr, varType: VarTypes): boolean | und
 }
 
 /** Is the rendered expression provably in [0, 2^31) — the range where a signed and an unsigned
- *  compare agree on every input (and where gcc itself emits the unsigned branch for the signed
- *  spelling)? Narrow unsigned values are the everyday case: a `(u8)x` cast or a `u8`/`u16`
- *  deref promotes to a non-negative `int`. Conservative false elsewhere. */
+ *  compare agree on every input? Narrow unsigned values are the everyday case: a `(u8)x` cast or a
+ *  `u8`/`u16` deref promotes to a non-negative `int`, and so is a mask, `x & 0xFFFF`, whose result
+ *  has no bit its non-negative side lacks; `|` and `^` set a bit only where a side has it, so they
+ *  are non-negative when both sides are. Conservative false elsewhere. A VALUE fact: it says the
+ *  two compares mean the same, not that they compile the same (`spelledNonNegative`). */
 export function provablyNonNegative(e: Expr, varType: VarTypes): boolean {
+  return nonNegative(e, varType, true);
+}
+
+/** The subset of `provablyNonNegative` over which the DEFAULT leaves an unsigned compare uncast
+ *  (structure.ts): everything but an `|`/`^`. Those are non-negative too, so their uncast
+ *  spelling owes no proof, but the pin stays in the default because it is codegen-visible where
+ *  the compiler does not track the bits: mwcc_242_81 compiles
+ *  `if ((unsigned)((a & 0xf0) | (b & 3)) < 0x31u)` beside a `!= 0` test to `cmplwi`, and the lift
+ *  scores 9/15 cast against 13/16 uncast over `s32` parameters (10/15 for the `u32` twin). Without
+ *  the pin in the default that spelling is in no candidate at all, since `/signed-cmp` is the
+ *  uncast one. A mask alone (gcc's own pick of the unsigned branch, kmc `selconst`) keeps the
+ *  uncast default. */
+export function spelledNonNegative(e: Expr, varType: VarTypes): boolean {
+  return nonNegative(e, varType, false);
+}
+
+function nonNegative(e: Expr, varType: VarTypes, orXor: boolean): boolean {
   switch (e.k) {
     case 'const':
       return e.value >= 0 && e.value < 0x80000000;
     case 'un':
       return e.op === '!';
     case 'bin':
+      if (e.op === '&') {
+        return nonNegative(e.l, varType, orXor) || nonNegative(e.r, varType, orXor);
+      }
+      if (orXor && (e.op === '|' || e.op === '^')) {
+        return nonNegative(e.l, varType, orXor) && nonNegative(e.r, varType, orXor);
+      }
       return ['<', '<=', '>', '>=', '==', '!=', '&&', '||'].includes(e.op);
     case 'cast':
       return e.to.kind === 'int' && e.to.width < 32 && !e.to.signed;
@@ -228,6 +372,47 @@ export function provablyNonNegative(e: Expr, varType: VarTypes): boolean {
   }
 }
 
+/** Would C evaluate `l OP r` SIGNED, for an ordering compare the machine did unsigned? Both sides
+ *  render as signed-promoting C (or as a type this env cannot see, which may be), neither is a
+ *  pointer (C compares an address unsigned), and they are not both `nonNeg`. With the default,
+ *  `provablyNonNegative`, a true answer means the C compares DIFFERENT values from the machine:
+ *  the proof obligation, which `signedOverUnsignedCompare` asks of the finished tree.
+ *  structure.ts also asks it with `spelledNonNegative` to place the `(u32)` pin. */
+export function rendersSignedOverUnsigned(
+  l: Expr,
+  r: Expr,
+  varType: VarTypes,
+  nonNeg: (e: Expr, varType: VarTypes) => boolean = provablyNonNegative,
+): boolean {
+  const ptrSide = (x: Expr): boolean => {
+    const t = exprCType(x, varType);
+    return t?.kind === 'ptr' || t?.kind === 'array';
+  };
+  return (
+    !ptrSide(l) &&
+    !ptrSide(r) &&
+    renderedIntSignedness(l, varType) !== false &&
+    renderedIntSignedness(r, varType) !== false &&
+    !(nonNeg(l, varType) && nonNeg(r, varType))
+  );
+}
+
+/** Does the finished tree spell some unsigned compare (`Expr.unsignedCmp`) so that C evaluates it
+ *  signed? Judged over the tree's own declarations, AFTER every pass that rewrites it: emission
+ *  pins each compare it lowers, but a respell that substitutes an arm's value into an emitted
+ *  compare (l3/unmerge.ts puts an `s16` global where a `u32` local stood) re-renders it without
+ *  asking. A name the declarations do not hold — a global the symbol declarations type outside
+ *  the tree — is not provably unsigned, so it counts: this errs toward withholding. */
+export function signedOverUnsignedCompare(sfn: SFn): boolean {
+  const env = declaredTypes(sfn);
+  for (const e of walkExprs(sfn.body)) {
+    if (e.k === 'bin' && e.unsignedCmp === true && rendersSignedOverUnsigned(e.l, e.r, env)) {
+      return true;
+    }
+  }
+  return false;
+}
+
 /** Does this write put a value that renders as a DEFINITELY-NON-POINTER C expression into a
  *  pointer-declared slot? — `v2 = a1 + v0` with `v2: u8 *`, a `return a0 + v0` from a
  *  pointer-returning function, a store through a pointer-element lvalue. The machine's register
@@ -257,17 +442,25 @@ export function exprCType(e: Expr, varType: (name: string) => IrType | undefined
   const rec = (x: Expr): IrType | undefined => exprCType(x, varType);
   switch (e.k) {
     case 'var':
+    case 'postincr':
       return varType(e.name);
     // An integer literal spells as a plain C `int` — NEVER a pointer, whatever the value's
     // recovered type was. This is the exact gap the emission guard exists to bridge.
     case 'const':
       return T.s(32);
+    case 'fconst':
+      return T.f64();
     case 'cast':
       return e.to;
-    // `-`/`~` yield the promoted integer; `!` yields int. None yields a pointer.
+    // `-`/`~` yield the promoted integer; `!` yields int. None yields a pointer. A float negation
+    // yields the float it negates.
     case 'un':
-      return T.s(32);
+      return e.op === 'f-' ? rec(e.e) : T.s(32);
     case 'bin': {
+      // Both operands are one float type (ir/verify.ts holds the IR op to that), so the left names it.
+      if (FLOAT_BINOPS.has(e.op)) {
+        return rec(e.l);
+      }
       if (e.op === '+' || e.op === '-') {
         const l = rec(e.l);
         const r = rec(e.r);
@@ -291,7 +484,14 @@ export function exprCType(e: Expr, varType: (name: string) => IrType | undefined
       return T.s(32);
     }
     // A callee's C return type comes from a prototype OUTSIDE the emitted function (the
-    // project ctx / C89 implicit int) — not statically knowable here.
+    // project ctx / C89 implicit int) — not derivable from the tree here.
+    //
+    // THE NODE MAY STILL CARRY ITS RANK, and that is a different question from its TYPE:
+    // `exprIntWidth` reads the `wide64` stamp and answers 64 for a call whose callee the frontend
+    // was told returns a pair. Nothing is read off it here, because the stamp is a width and this
+    // owes its callers a full `IrType` — signedness included, which no source states. Widening
+    // this to answer `s64` from the stamp would be a signedness claim nobody made, over the one
+    // node every rendered function has; the rank-only reader is the honest half.
     case 'call':
       return undefined;
     case 'index': {
@@ -306,8 +506,16 @@ export function exprCType(e: Expr, varType: (name: string) => IrType | undefined
       // would type it `s96`-style garbage and make the field contract reject valid trees. The
       // node width must AGREE with the element size (when the struct declares one): a mismatch
       // means the stride channel is corrupt, so it types scalar and the field contract flags it.
+      // A recovered struct declares no size, so the one other index on its pointer — a CAST VIEW of
+      // a `castViews` field, `((u8 *)p)[1]` (structure.ts `memAccess`) — is told apart by the
+      // same rule that minted it, and reads its scalar.
       const bt = rec(e.base);
-      if (bt?.kind === 'ptr' && bt.to.kind === 'struct' && (bt.to.size === undefined || bt.to.size === e.width)) {
+      if (
+        bt?.kind === 'ptr' &&
+        bt.to.kind === 'struct' &&
+        (bt.to.size === undefined || bt.to.size === e.width) &&
+        !(e.idx.k === 'const' && isCastView(bt.to, e.idx.value * e.width, e.width, e.signed, false))
+      ) {
         return bt.to;
       }
       if (bt?.kind === 'ptr' && derefStrideOk(bt, e.width, e.signed)) {
@@ -319,13 +527,10 @@ export function exprCType(e: Expr, varType: (name: string) => IrType | undefined
       return scalarTypeForAccess(e.width, e.signed);
     }
     case 'field': {
-      // `base->name` (base: ptr-to-struct) or `base.name` (base: struct value, an array element).
+      // `base->name` (base: ptr-to-struct) or `base.name` (base: struct value, an array element,
+      // or a union member's view).
       const bt = rec(e.base);
-      const st = bt?.kind === 'ptr' ? bt.to : bt;
-      if (st?.kind !== 'struct') {
-        return undefined;
-      }
-      return st.fields.find((f) => f.name === e.name)?.type;
+      return memberOf(bt?.kind === 'ptr' ? bt.to : bt, e.name)?.type;
     }
     case 'marker':
       return undefined;

package/src/l3/unreduce.ts

@@ -137,11 +137,12 @@
 // read off `acc = acc + K`, so it counts in the units of the ACCUMULATOR's declared type: on a
 // `u16 *` a step of 32 advances 64 BYTES. The closed form spells that stride onto the INIT, whose
 // `+` scales by whatever the INIT's own C type says. Where the two disagree the candidate
-// addresses the wrong byte, compiles clean, and carries no marker — structure.ts's `bytePtr`
-// states the same rule from the other end ("a `u16 *` walked by a computed offset addresses TWICE
-// the intended byte, and nothing downstream can see the error"). `stride-units` refuses unless
-// both scales are KNOWN and equal; a narrow integer accumulator is the same question in the other
-// direction, since `u16 acc` wraps at 65536 where `init + (i << 6)` does not.
+// addresses the wrong byte, compiles clean, and carries no marker — the POINTER STRIDE rule of
+// `ARITH_ROWS` in structure/pointer-spelling.ts states the same rule from the other end: a
+// runtime offset on a pointer whose pointee is not one byte walks `(u8 *)p`.
+// `stride-units` refuses unless both scales are KNOWN and equal; a narrow integer accumulator is
+// the same question in the other direction, since `u16 acc` wraps at 65536 where
+// `init + (i << 6)` does not.
 //
 // THAT GATE HAS NO BENCHMARK REACH AT ALL, and neither tier can see it. Censused at the
 // `firstRejection` call site over both — 750 synthetic trees and all 252 real-tier rows, the real
@@ -440,10 +441,10 @@ function arithScale(t: IrType | undefined): number | null {
  *  refusal.
  *
  *  MEASURED, so this is a stated zero and not an assumption: instrumented at the deletion site, it
- *  fires on none of the three agbcc rows that spill AND lift — `spillorder`, `dma_fill_uninit`,
- *  `uninit_spill` — so the clause costs no candidate today. (`spill10` spills too but declines in the
- *  Thumb frontend, so it never reaches this pass and its zero says nothing.) It is here for the day
- *  one does. */
+ *  fires on none of the agbcc rows that spill AND lift — `spillorder`, `dma_fill_uninit`,
+ *  `uninit_spill`, `spill10`, `spillarg` — so the clause costs no candidate today. (The last two
+ *  bring no local to these gates at all, so their zero says nothing.) It is here for the day one
+ *  does. */
 function declarationPins(l: SFn['locals'][number]): boolean {
   return (
     l.volatile !== undefined ||

package/src/l3/volatileptr.ts

@@ -27,7 +27,15 @@
 // mapped global through a volatile view the map never granted. No qualifying local ⇒ decline
 // (null), so the variation never emits a duplicate of the default.
 import { addrConst, cellAddress, inRange } from './address';
-import { type Expr, type SFn, type Stmt, mapExprChildren, rematerializableAddress, walkExprs } from './ast';
+import {
+  type Expr,
+  type SFn,
+  assignsIn,
+  mapExprChildren,
+  rematerializableAddress,
+  taintOverAssigns,
+  walkExprs,
+} from './ast';
 
 const exprHas = (e: Expr, pred: (x: Expr) => boolean): boolean => {
   if (pred(e)) {
@@ -41,36 +49,6 @@ const exprHas = (e: Expr, pred: (x: Expr) => boolean): boolean => {
   return hit;
 };
 
-function collectAssigns(stmts: Stmt[], out: { name: string; value: Expr }[]): void {
-  for (const s of stmts) {
-    switch (s.k) {
-      case 'assign':
-        out.push({ name: s.name, value: s.value });
-        break;
-      case 'if':
-        collectAssigns(s.then, out);
-        collectAssigns(s.else, out);
-        break;
-      case 'while':
-      case 'dowhile':
-        collectAssigns(s.body, out);
-        break;
-      case 'for':
-        collectAssigns([s.init, s.inc], out);
-        collectAssigns(s.body, out);
-        break;
-      case 'switch':
-        for (const c of s.cases) {
-          collectAssigns(c.body, out);
-        }
-        collectAssigns(s.default ?? [], out);
-        break;
-      default:
-        break;
-    }
-  }
-}
-
 /** How many of this tree's `volatile` claims land on a DEVICE REGISTER — the gate on rank.ts's
  *  volatility tie-break, so it is counted here beside the variation that mints the claims.
  *
@@ -100,8 +78,7 @@ export function deviceVolatileClaims(sfn: SFn, window?: readonly [number, number
       underSubscript.add(e.base);
     }
   }
-  const assigns: { name: string; value: Expr }[] = [];
-  collectAssigns(sfn.body, assigns);
+  const assigns = assignsIn(sfn.body);
   for (const l of sfn.locals) {
     if (l.type.kind === 'ptr' && (l.pointeeVolatile !== undefined || l.volatile !== undefined)) {
       n += assigns.filter((a) => a.name === l.name && inWindow(a.value)).length;
@@ -143,27 +120,13 @@ export const volatileEligibleValue = (e: Expr): boolean => rematerializableAddre
 
 /** the shared eligibility predicate (the GATE in the header) for one function's locals */
 function eligibility(sfn: SFn): (l: SFn['locals'][number]) => boolean {
-  const assigns: { name: string; value: Expr }[] = [];
-  collectAssigns(sfn.body, assigns);
-  const numericFed = new Set<string>();
-  const tainted = new Set<string>();
-  for (const a of assigns) {
-    if (rematerializableAddress(a.value)) {
-      numericFed.add(a.name);
-    }
-    if (feedsSymbolAddress(a.value)) {
-      tainted.add(a.name);
-    }
-  }
-  for (let grew = true; grew;) {
-    grew = false;
-    for (const a of assigns) {
-      if (!tainted.has(a.name) && exprHas(a.value, (x) => x.k === 'var' && tainted.has(x.name))) {
-        tainted.add(a.name);
-        grew = true;
-      }
-    }
-  }
+  const assigns = assignsIn(sfn.body);
+  const numericFed = new Set(assigns.filter((a) => rematerializableAddress(a.value)).map((a) => a.name));
+  const tainted = taintOverAssigns(
+    assigns,
+    assigns.filter((a) => feedsSymbolAddress(a.value)).map((a) => a.name),
+    (a, t) => exprHas(a.value, (x) => x.k === 'var' && t.has(x.name)),
+  );
   return (l) =>
     l.type.kind === 'ptr' &&
     l.volatile === undefined &&