@asmlift/core 0.8.1 → 0.10.0

package/src/raise/latch.ts

@@ -3,7 +3,7 @@
 // A loop whose back-edge carries a register copy — `add r3, r0, #0` then `b .L6` — lifts to a block
 // holding nothing but that branch, because SSA construction turns the copy into an EDGE ARGUMENT.
 // The loop is unchanged; its latch has just become a separate empty block between the exit test and
-// the header. Loop DISCOVERY still finds the loop — `structure/loops.ts` reads the same back-edge —
+// the header. Loop DISCOVERY still finds the loop — `ir/loops.ts` reads the same back-edge —
 // but the do-while emitter requires the latch to end in a `cond_br`, an empty one ends in `br`, and
 // the test is at the bottom so the `while` form is unavailable too. The back-edge survives to the
 // `onStack` refusal and the whole function declines with "unrecovered back-edge".
@@ -24,11 +24,13 @@
 // `if` (declining loud on the hazards). The guard therefore survives the fold either way; what the
 // gate preserves is the SHAPE — a forward trampoline is not a latch, and folding one re-casts an
 // unrelated branch as a loop guard — which is the `target-dominates` entry's own note below.
-import { Fn, dominators, foldWriteOrder } from '../ir/core';
+import { Block, Fn, dominators, foldWriteOrder, predecessors, reachForward, successorsOf } from '../ir/core';
+import { effectful } from '../ir/discipline';
+import { analyzeLoops } from '../ir/loops';
 import { type Gate, firstRejection } from '../l3/gates';
 
 /** What the gates below judge: one candidate block and the block its `br` goes to. */
-interface LatchCandidate {
+export interface LatchCandidate {
   block: Fn['blocks'][number];
   target: Fn['blocks'][number];
   dominatesBlock: boolean;
@@ -80,9 +82,9 @@ export const LATCH_GATES: readonly Gate<LatchCandidate>[] = [
  *  SUCCESSOR changes, so an edge that was not a back-edge becomes one. (Dominator sets themselves
  *  only ever shrink — removing a block removes it from every set it was in.)
  *
- *  A predecessor that already branches to the target ends up with two edges into one block. That is
- *  a block whose every edge continues the loop, so it has no exit and loop recovery declines — the
- *  same loud decline it gave before the fold.
+ *  A predecessor that already branches to the target ends up with two edges into one block, each
+ *  carrying its own arguments. Where that predecessor has no other edge the loop has no exit, and
+ *  loop recovery spells it `while (1)` with each edge's own update copy.
  */
 export function foldEmptyLatches(fn: Fn, gates: readonly Gate<LatchCandidate>[] = LATCH_GATES): number {
   let folded = 0;
@@ -124,3 +126,157 @@ export function foldEmptyLatches(fn: Fn, gates: readonly Gate<LatchCandidate>[]
     folded++;
   }
 }
+
+// ── EMPTY EXIT TRAMPOLINES ──────────────────────────────────────────────────────────────────────
+//
+// The same empty block on a loop's way OUT. `for (…) { if (t[i] == k) { r = i; break; } }` keeps
+// `r` in a register the break copies into (`add r2, r1, #0`), and the copy becomes an edge argument
+// of a block that holds nothing but its `br` to the code after the loop — beside a second exit edge
+// (the loop's own test failing) that reaches that code directly. The loop then has two exit targets
+// and none of them is a `return`, so every loop form refuses it, and the back-edge declines loud at
+// `onStack`. Which exit edge carries the block is the compiler's choice: agbcc puts it on the break
+// (`synthetic:break_value`) or on the latch's own exit with the break going direct (kleod
+// `sub_0801E664`).
+//
+// The second exit need not land on the target itself. ido, gcc2.7.2kmc and mwcc lay an `else` the
+// loop sits beside between the loop and its join — `if (f) { for (..) if (a(i) == k) { id = i + 100;
+// break; } } else id = f + 26; out(id);` (`synthetic:break_elsetail`) — so the loop's own exit is an
+// empty `b`/`j` over the `else`, and the break reaches the join only through the code its arm runs.
+// Folding the block there leaves the loop two exit targets all the same — the break arm's head is
+// one. What it buys is that the loop's own exit becomes the join the break arm runs on into, which
+// is the exit a `break` that runs code has to leave for (`codeBreakArm`'s region must reach it). So
+// the scope gate asks whether another exit edge's target REACHES the target, going forward and
+// outside the loop's body.
+//
+// Splicing it out re-points each edge into it at its target with its own arguments, and the loop
+// exits to one block: a `break` that carries its copies, which the structurer already spells. The
+// arguments move soundly for the reason the latch's do: the block has no params and one op, so
+// every value its `br` passes dominates it, and therefore the end of each of its predecessors.
+
+/** One candidate trampoline: the block, where its `br` goes, and the loops it may leave. */
+export interface ExitTrampoline {
+  block: Block;
+  target: Block;
+  /** the predecessors of `block` */
+  preds: readonly Block[];
+  /** does some loop hold every predecessor of `block` but not `block` itself, and leave by another
+   *  edge for `target` as well — landing on it, or on a block that reaches it forward without
+   *  re-entering the loop (`reachForward`)? */
+  sharedExit: boolean;
+  /** does every path from `target` reach a `ret` without an effect on the way? */
+  pureReturn: boolean;
+}
+
+export const EXIT_TRAMPOLINE_GATES: readonly Gate<ExitTrampoline>[] = [
+  {
+    id: 'trampoline-has-params',
+    why: 'a param is a join: the br args may read it, and they would not exist at a predecessor',
+    // the fold then hands a predecessor a value it does not dominate, which `verify` refuses loud
+    sound: false,
+    rejects: (c) => c.block.params.length > 0,
+  },
+  {
+    id: 'trampoline-does-work',
+    why: 'the sole terminator must be an unconditional `br`: folding a `cond_br` block discards its second successor',
+    sound: true,
+    guardedBy: 'latch.test.ts: an exit block whose sole op is a cond_br is never folded',
+    rejects: (c) => c.block.ops[0]?.opcode !== 'br',
+  },
+  {
+    id: 'trampoline-self-branch',
+    why: 'a block branching to itself is an infinite loop rather than a trampoline',
+    sound: false,
+    rejects: (c) => c.target === c.block,
+  },
+  {
+    // The SCOPE of the fold, not its soundness: an exit edge's empty block is harmless to the
+    // structurer wherever it is the loop's one way out, and folding it there would only re-spell
+    // functions that already lift.
+    id: 'trampoline-not-a-second-exit',
+    why: 'only a loop that also leaves for the same target by another edge, or for a block that runs on into it, gains from the fold an exit every edge out can leave for',
+    sound: false,
+    rejects: (c) => !c.sharedExit,
+  },
+  {
+    // A target that only returns already lifts: the structurer takes the edge through the
+    // trampoline as an early `return` and copies the pure tail into it. Kept that way, so the fold
+    // re-spells no function that lifted before it.
+    id: 'trampoline-returns-already',
+    why: 'an exit that only returns is an early `return` arm, which the structurer spells without the fold',
+    sound: false,
+    rejects: (c) => c.pureReturn,
+  },
+];
+
+/** Every path from `b` ends in a `ret` and runs no effect on the way. */
+export function returnsPurely(b: Block): boolean {
+  const seen = new Set<Block>();
+  for (const stack = [b]; stack.length > 0;) {
+    const x = stack.pop()!;
+    if (seen.has(x)) {
+      continue; // a join two paths share, or a cycle — either way judged on its first visit
+    }
+    seen.add(x);
+    if (x.ops.some(effectful)) {
+      return false;
+    }
+    const t = x.ops[x.ops.length - 1];
+    if (t?.opcode === 'ret') {
+      continue;
+    }
+    if (t?.opcode !== 'br' && t?.opcode !== 'cond_br') {
+      return false;
+    }
+    stack.push(...successorsOf(x));
+  }
+  return true;
+}
+
+/** Splice out every empty EXIT TRAMPOLINE the gates above admit; returns how many were removed.
+ *  Iterated, as the latch fold is: one splice can make another block's exit edges shared. */
+export function foldExitTrampolines(fn: Fn, gates: readonly Gate<ExitTrampoline>[] = EXIT_TRAMPOLINE_GATES): number {
+  let folded = 0;
+  for (;;) {
+    const preds = predecessors(fn);
+    const dom = dominators(fn);
+    const loops = [...analyzeLoops(fn, dom).byHeader.values()];
+    const found = fn.blocks.find((b) => {
+      const target = b.ops[0]?.successors[0]?.block;
+      if (target === undefined) {
+        return false;
+      }
+      const into = preds.get(b) ?? [];
+      const sharedExit =
+        into.length > 0 &&
+        loops.some(
+          (nl) =>
+            !nl.body.has(b) &&
+            into.every((p) => nl.body.has(p)) &&
+            nl.exitEdges.some((e) => e.to !== b && reachForward(e.to, dom, nl.body).has(target)),
+        );
+      return (
+        firstRejection(gates, { block: b, target, preds: into, sharedExit, pureReturn: returnsPurely(target) }) === null
+      );
+    });
+    if (!found) {
+      return folded;
+    }
+    const onward = found.ops[0].successors[0];
+    for (const b of fn.blocks) {
+      let repointed = false;
+      for (const op of b.ops) {
+        op.successors.forEach((s, i) => {
+          if (s.block === found) {
+            op.successors[i] = { block: onward.block, args: [...onward.args] };
+            repointed = true;
+          }
+        });
+      }
+      if (repointed) {
+        foldWriteOrder(fn.writeOrder, found, b);
+      }
+    }
+    fn.blocks = fn.blocks.filter((b) => b !== found);
+    folded++;
+  }
+}

package/src/raise/memberarrays.ts

@@ -71,6 +71,7 @@
 import { type Fn, type Op, type Value, defOpMap } from '../ir/core';
 import { type IrType, type StructField, T, scalarTypeForAccess } from '../ir/types';
 import { type Gate, firstRejection } from '../l3/gates';
+import { storeSigned } from './storesign';
 import { firstFreeStructIndex } from './structs';
 
 /** One variable-index access, resolved onto (base value, member offset). */
@@ -260,7 +261,9 @@ function stripExt(v: Value, defs: Map<Value, Op>): Value {
   }
 }
 
-/** `add(x, const)` read as (other operand, constant), or null. The add is commutative. */
+/** `add(x, const)` read as (other operand, constant), or null. The add is commutative. ONE link, not
+ *  a chain, and no `sub`: the shapes this pass reads are a single `add` of a scaled index or of a
+ *  member offset. A chain of constant displacements is ir/alias.ts `constDisplacementOf`. */
 function constAddend(op: Op, defs: Map<Value, Op>): { of: Value; k: number } | null {
   if (op.opcode !== 'add' || op.operands.length !== 2) {
     return null;
@@ -389,7 +392,7 @@ function accessesByBase(fn: Fn, defs: Map<Value, Op>): Map<Value, MemberAccess[]
         op,
         off: add === null ? 0 : add.k,
         elemSize,
-        signed: isLoad ? (op.attrs.signed as boolean) : elemSize === 4,
+        signed: isLoad ? (op.attrs.signed as boolean) : storeSigned(op, elemSize),
         isLoad,
         index: op.operands[1],
         addr: add === null ? null : op.operands[0],
@@ -583,8 +586,11 @@ export function recognizeMemberArrays(
       a.op.operands[0] = g.base;
       a.op.attrs.memberOff = a.off;
       if (!a.isLoad) {
-        // an astore carries no signedness of its own — the member's decides how the index node
-        // types, so the store spells through the same declaration the load does
+        // the member's declaration decides how the index node types, so the store spells through
+        // the same declaration the load does, over any stamp raise/storesign.ts left. No probed
+        // input reaches here with a stamp that disagrees: agbcc lifts a signed narrow constant as
+        // `neg`/`shl`, and the MIPS shapes (`p->t[i] = -1`, `-104` beside a u16 read) take a flat
+        // cast. One that does should keep its stamp, and the index node cast the cell to it.
         a.op.attrs.signed = g.members.find((m) => m.off === a.off)!.signed;
       }
     }

package/src/raise/narrow.ts

@@ -23,6 +23,16 @@
 // A signed and an unsigned right shift of the same value by the same amount differ only in the bits
 // the shift brings in, so `%134` is `sext(%133, 32 - 16)` — the same rewrite, and the reason this
 // pass matches the pair rather than either extension on its own.
+//
+// And a third, where the variable is carried SHIFTED and never extended at all: an `s8` walked down
+// a list, `i = buf[i].next`, is kept as `next << 24` and the test reads it back with `asr #24`.
+// The cast idiom folds that `asr` of the `lsl` into a `sext` of the load, which is the same bits
+// and no longer reads the carried value:
+//
+//     %41 = shl %40 {imm=24}    what `i` holds next iteration, shifted
+//     %42 = sext %40 {8}        the loop test
+//
+// `sext(v, 32 - k) === shr_s(shl(v, k), k)`, so `%42` is re-rooted as `shr_s %41 {k}`.
 import { Fn, Op, Value, defOpMap } from '../ir/core';
 import { CAST_WIDTHS, Opcode } from '../ir/opcodes';
 
@@ -41,8 +51,8 @@ const domainOf = (op: Op, low: Opcode, high: Opcode): { key: string; width: numb
   return null;
 };
 
-/** Re-root a sign extension on the co-existing zero extension of the same bits. Returns the number
- *  of rewrites. */
+/** Re-root a sign extension on the co-existing zero extension of the same bits, or on the carried
+ *  left shift that holds them. Returns the number of rewrites. */
 export function rerootNarrowReads(fn: Fn): number {
   // LOOP-CARRIED edge arguments only. The rewrite is sound for ANY co-existing pair — it only
   // re-associates two extensions of the same bits — so this gate is about what it BUYS, not about
@@ -87,6 +97,8 @@ export function rerootNarrowReads(fn: Fn): number {
     // else this could be a use before a def. That is the shape the idiom emits — one increment,
     // both extensions of it, in the block that computes it.
     const unsigned = new Map<Value, Map<string, Value>>();
+    // …and the carried left shifts, by operand and then by amount, under the same two rules
+    const shifted = new Map<Value, Map<number, Value>>();
     for (const op of b.ops) {
       const u = domainOf(op, 'zext', 'shr_u');
       if (u !== null && carried.has(op.results[0])) {
@@ -95,6 +107,21 @@ export function rerootNarrowReads(fn: Fn): number {
         unsigned.set(op.operands[0], byDomain);
         continue;
       }
+      if (op.opcode === 'shl' && typeof op.attrs.imm === 'number' && carried.has(op.results[0])) {
+        const byAmount = shifted.get(op.operands[0]) ?? new Map<number, Value>();
+        byAmount.set(op.attrs.imm, op.results[0]);
+        shifted.set(op.operands[0], byAmount);
+        continue;
+      }
+      const k = 32 - (op.attrs.width as number);
+      const sh = op.opcode === 'sext' && CAST_WIDTHS.has(32 - k) ? shifted.get(op.operands[0])?.get(k) : undefined;
+      if (sh !== undefined) {
+        op.opcode = 'shr_s';
+        op.operands = [sh];
+        op.attrs = { imm: k };
+        rewritten++;
+        continue;
+      }
       const sgn = domainOf(op, 'sext', 'shr_s');
       if (sgn === null) {
         continue;

package/src/raise/narrowlocal.ts

@@ -58,6 +58,12 @@
 //   u16 v; … *out = v;                  zext16                 4     0 MATCH
 //   s32 v; … *out = (u16)v;             zext16             0 MATCH       4
 //
+// A THIRD SPELLING of rows three and four is the `/escape-home` variation's
+// (structure/analysis.ts `escapingExtensions`): keep `s32 v` and give the truncation a NAME where
+// it happened, `t = (u16)v`. It is not an alternative to this pass — it judges an extension's
+// result where this one judges a block PARAMETER — and it is a ranked candidate where this is a
+// decision, so neither can take the other's input.
+//
 // Rows one and two are DECIDABLE by the carrier's own readers: a `zext_w` read by a `sext_w` is the
 // write-back truncation followed by the declaration's own sign extension, and no cast on a wide
 // local writes that pair. Rows three and four are the same IR in this pass's READER vocabulary —
@@ -131,7 +137,8 @@
 // admits), and `runPreRecovery` reads the shape ahead of the pass that manufactures it —
 // `mergeShapes`.
 import { type Block, type Fn, type Op, type Value, defOpMap, predecessors, replaceAllUsesWith } from '../ir/core';
-import { CAST_WIDTHS, REEVAL_UNSAFE_OPS } from '../ir/opcodes';
+import { reevalUnsafe } from '../ir/discipline';
+import { CAST_WIDTHS } from '../ir/opcodes';
 import { T } from '../ir/types';
 import { type Gate, firstRejection } from '../l3/gates';
 
@@ -350,8 +357,8 @@ function mergeArms(preds: Map<Block, Block[]>, fn: Fn, blk: Block): [Block, Bloc
  *    • a MEMORY READ is one op and is NOT one speculatable SET. `gcc/rtlanal.c:1770-1771` sends a
  *      MEM to `rtx_addr_can_trap_p` and `:144-147` says an address held in a plain pseudo CAN trap,
  *      so `jump.c` never hoists a load and the diamond survives under BOTH spellings, carrying no
- *      information. `REEVAL_UNSAFE_OPS` answers this (effects, reads, or traps — `may_trap_p`
- *      refuses the trapping divides too, at `rtlanal.c:1774-1784`); `HOIST_UNSAFE_OPS` does NOT,
+ *      information. `reevalUnsafe` answers this (effects, reads, or traps — `may_trap_p`
+ *      refuses the trapping divides too, at `rtlanal.c:1774-1784`); `speculationUnsafe` does NOT,
  *      because it omits reads for `raise/shortcircuit.ts`, whose arm C's own `&&` re-guards, and
  *      that exemption does not transfer to speculation above a compare.
  *    • a CONSTANT is not free. `v = a + 0x12345` is a literal-pool `ldr` plus the `add` — two
@@ -382,9 +389,7 @@ function mergeArms(preds: Map<Block, Block[]>, fn: Fn, blk: Block): [Block, Bloc
  *  clause in that table is `sound: false`), so the shared conservative predicate is the right one
  *  until a row asks for the cost model neither pass has. */
 export function armIsOneSet(b: Block): boolean {
-  return (
-    !b.ops.some((op) => REEVAL_UNSAFE_OPS.has(op.opcode)) && b.ops.filter((op) => op.results.length > 0).length === 1
-  );
+  return !b.ops.some(reevalUnsafe) && b.ops.filter((op) => op.results.length > 0).length === 1;
 }
 
 /** The join shape of every block, read ONCE off the IR it is handed.