@asmlift/core 0.8.1 → 0.10.0

package/src/structure/switch-recover.ts

@@ -4,10 +4,14 @@
 // factory takes its dependencies EXPLICITLY (`SwitchRecoverDeps`); `expr`/`structureRegion` are
 // late-bound callbacks into the emission phase, so case bodies reuse the ordinary structuring
 // machinery (loops/ifs inside cases, the onStack guard).
+import { constWord } from '../ir/bits';
 import { Block, Fn, Op, Value, forwardingTarget, isBodyless, successorsOf } from '../ir/core';
-import { ORDER_SENSITIVE_OPS } from '../ir/opcodes';
+import { orderSensitive } from '../ir/discipline';
 import { Expr, Stmt, SwitchCase } from '../l3/ast';
 
+/** Which side of a relational test a compiler's dispatch lands a pinned case body on. */
+export type SwitchBoundCase = 'taken' | 'either';
+
 export interface SwitchRecoverDeps {
   fn: Fn;
   defs: Map<Value, Op>;
@@ -19,8 +23,9 @@ export interface SwitchRecoverDeps {
   /** is this opcode an integer comparison? */
   isCmpOpcode: (opcode: string) => boolean;
   switchAllowsNeqCase: boolean;
-  /** read a relational test whose BRANCH admits exactly one scrutinee value as that case */
-  switchAllowsBoundCase: boolean;
+  /** read a relational test as a case where the values that can reach it leave exactly one on
+   *  this side of it — its branch, or either side — or never (null) */
+  switchBoundCase: SwitchBoundCase | null;
   /** emit the case arms in the ASSEMBLY's block-layout order rather than by ascending case value */
   switchArmsFollowLayout: boolean;
   /** DECLINE a recovered tree whose own layout INTERLEAVES a test with a case body. A source
@@ -44,6 +49,11 @@ export interface SwitchRecoverDeps {
    *  of "where is this defined" `defs` does not answer. Taken from `structure.ts`, which builds
    *  both halves for def-site anchoring, rather than indexing the parameters a second time. */
   blockOf: (v: Value) => Block | undefined;
+  /** The header and exit of the loop the switch is being structured in, or null outside any loop.
+   *  Read LIVE: the structurer's loop frame is the one current when the switch is met. An edge to
+   *  the exit from inside a case arm is a `break` of that loop, which C binds to the switch instead
+   *  (`analyzeArmExit`), save where the exit is the switch's own merge. */
+  enclosingLoop: () => { header: Block; exit: Block | null } | null;
   /** THE DISPATCH HOIST: the copies of every edge the tree walk collapsed, merged and re-emitted
    *  ONCE ahead of the `switch`. `structure.ts hoistedDispatchAssigns` owns the emission
    *  (suppression, identity elision, `undef`, the write-order sort, `sequentialize`), so this
@@ -56,6 +66,10 @@ export interface SwitchRecoverDeps {
   ) => Stmt[] | null;
   expr: (v: Value) => Expr;
   structureRegion: (b: Block, stop: Block | null) => Stmt[];
+  /** One arm's body, from `entry` to `stop`, inside the switch whose code resumes at `merge`. The
+   *  structurer owns what `break;` means there (structure.ts `structureArm`), so both regimes hand
+   *  it every arm and the exit verdict they read for it. */
+  structureArm: (entry: Block, stop: Block | null, merge: Block | null, exit: ArmExit | undefined) => Stmt[];
 }
 
 /** Where ONE switch arm's region leaves it — the fact that decides whether the arm can be spelled
@@ -66,18 +80,30 @@ export interface SwitchRecoverDeps {
  *   - `fallthrough`  every path out leaves into exactly ONE sibling arm's entry: C's fall-through.
  *                    Only spellable when that sibling is the arm emitted NEXT, which `chainArms`
  *                    below arranges and both regimes then re-read off the emission array (see the
- *                    l3/ast.ts non-neutrality note).
- *   - `unstructurable`  anything else: two different siblings, or a mix of "into a sibling" and
- *                    "out to the merge". C needs a `goto` for those. Regime A declines to
- *                    if-recovery on this verdict; Regime B, having no fallback, fails LOUD. */
-export type ArmExit = { kind: 'break' } | { kind: 'fallthrough'; to: Block } | { kind: 'unstructurable'; why: string };
+ *                    l3/ast.ts non-neutrality note). With `breaks`, some paths out reach the
+ *                    switch's merge instead: `case 1: if (c) break; case 2: …`, the arm's own
+ *                    `break;` on those paths.
+ *   - `unstructurable`  anything else: two different siblings, or a sibling beside a block the
+ *                    switch does not dominate. C needs a `goto` for those. Regime A declines to
+ *                    if-recovery on this verdict; Regime B, having no fallback, fails LOUD.
+ *
+ *  `region` is the arm's own blocks: every block the walk below reached, the entry included. It is
+ *  what the structurer needs to find the arm's own joins (`structure.ts` `armJoin`) and to spell a
+ *  path to the merge in the middle of the arm as `break;` (`switchBreakAt`), in a closed arm as in a
+ *  falling one: `case 1: if (a) { if (b) break; g(1); } h(2); break;`. A closed arm that leaves
+ *  sideways, into a block the switch does not dominate, has none: its paths through such a block
+ *  are not the arm's, and it structures to the CFG's joins. */
+export type ArmExit =
+  | { kind: 'break'; region?: ReadonlySet<Block> }
+  | { kind: 'fallthrough'; to: Block; breaks: boolean; region: ReadonlySet<Block> }
+  | { kind: 'unstructurable'; why: string };
 
 export interface SwitchRecovery {
   recognizeSwitch: (b: Block, stop: Block | null) => Stmt[] | null;
   /** shared with the Regime-B (`switch_br`) path in structure.ts. Both regimes recover the
    *  fall-through this returns; on an `unstructurable` verdict Regime A declines to if-recovery and
    *  Regime B, which has no fallback, fails loud. */
-  analyzeArmExit: (entry: Block, b: Block, merge: Block | null, siblings: Set<Block>) => ArmExit;
+  analyzeArmExit: (entry: Block, b: Block, merge: Block | null, siblings: Set<Block>, stopAtLoop?: boolean) => ArmExit;
   /** a block's position in the ASSEMBLY — the arm-order evidence, shared with Regime B so the two
    *  regimes read it from one definition (and one statement of what it rests on). */
   layoutIndex: (blk: Block) => number;
@@ -128,66 +154,126 @@ export interface TestInfo {
   xOnLeft: boolean;
 }
 
-// Evaluate a test predicate for a CONCRETE scrutinee value — used to SIMULATE the decision tree and
-// verify recovered case values (below). Returns true iff the `taken` (successors[0]) edge is followed.
-// Signed/unsigned per the icmp opcode (PRE3, done concretely rather than via interval lattices).
-function evalCmp(opcode: string, xOnLeft: boolean, xv: number, k: number): boolean {
-  const uns = opcode.startsWith('icmp_u');
-  const [xn, kn] = uns ? [xv >>> 0, k >>> 0] : [xv | 0, k | 0];
-  const [l, r] = xOnLeft ? [xn, kn] : [kn, xn]; // put the scrutinee where it textually appears
-  switch (opcode) {
-    case 'icmp_eq':
-      return l === r;
-    case 'icmp_ne':
-      return l !== r;
-    case 'icmp_slt':
-    case 'icmp_ult':
-      return l < r;
-    case 'icmp_sle':
-    case 'icmp_ule':
-      return l <= r;
-    case 'icmp_sgt':
-    case 'icmp_ugt':
-      return l > r;
-    case 'icmp_sge':
-    case 'icmp_uge':
-      return l >= r;
-    default:
-      return false;
+// WHICH SCRUTINEE VALUES CAN REACH A TEST, AND WHICH ONE A SIDE OF IT PINS. A comparison dispatch
+// pins its last value with a RELATIONAL test once the tests above it have narrowed the scrutinee to
+// one value on that side: mwcc's `switch (x) { case 0: … case 1: … default: … }` is `cmpwi r0,1;
+// beq- case1; bge- default; cmpwi r0,0; bge- case0; b default`, where `x >= 0` is `case 0` only
+// because `x != 1` and `x < 1` came first. agbcc's `emit_case_nodes` does the same on the branch it
+// takes once `node_is_bounded` holds, and its `x <u 1` for `case 0` of an unsigned switch is the
+// instance that needs nothing from the tests above: one value at an end of the 32-bit domain. Read
+// as navigation instead, the pinned arm's body becomes a second default candidate and the whole
+// tree declines. Which SIDE of a test may pin a case is the compiler's (`switchBoundCase`,
+// target.ts).
+//
+// EXACT, not a bound. A range is the set of 32-bit register values, as disjoint signed intervals in
+// ascending order, and every test the walk narrows it by — `==`, `!=`, and a relational test under
+// either signedness — is an exact set over that register. An unsigned interval straddling 2^31 is
+// two signed ones (`fromUnsigned`). So a side that comes out a singleton names the only value that
+// CAN take it, and a side that comes out empty is one no value takes. Whether the value DOES reach
+// the body is still PRE3's to say, simulating the original tree case by case.
+//
+// THE DOMAIN IS THE REGISTER's, not the scrutinee's recovered type, so a narrower type has nearer
+// ends this misses. That costs a case and never invents one.
+type Ranges = readonly (readonly [number, number])[];
+
+const INT_MIN = -0x80000000;
+const INT_MAX = 0x7fffffff;
+const ALL: Ranges = [[INT_MIN, INT_MAX]];
+
+/** The same opcode with its operands swapped: `k < x` is `x > k`. */
+const MIRRORED: Record<string, string> = {
+  icmp_slt: 'icmp_sgt',
+  icmp_sgt: 'icmp_slt',
+  icmp_sle: 'icmp_sge',
+  icmp_sge: 'icmp_sle',
+  icmp_ult: 'icmp_ugt',
+  icmp_ugt: 'icmp_ult',
+  icmp_ule: 'icmp_uge',
+  icmp_uge: 'icmp_ule',
+};
+
+/** `[lo, hi]` of the UNSIGNED order as signed intervals: one, or two where it straddles 2^31. */
+function fromUnsigned(lo: number, hi: number): Ranges {
+  if (lo > hi) {
+    return [];
   }
+  return hi <= INT_MAX || lo > INT_MAX
+    ? [[lo | 0, hi | 0]]
+    : [
+        [INT_MIN, hi | 0],
+        [lo, INT_MAX],
+      ];
 }
 
-// Which single scrutinee value does this relational test's BRANCH admit, if exactly one? A
-// relational side is a HALF-LINE in the compare's own ordering, so it can hold one value only at
-// a domain endpoint — which is why testing the two endpoints and their neighbours decides it,
-// with no interval lattice. `x < 1` over an unsigned scrutinee admits `{0}` and is agbcc's
-// spelling of `case 0` in a balanced search: `emit_case_nodes` tests the subtree BOUND, not the
-// value, whenever the remaining range has collapsed to one. Read as navigation instead, that
-// arm's body becomes a second default candidate and the whole tree declines.
-//
-// THE BRANCH, never the fall-through. Every jump in `emit_case_nodes` that lands on a case body
-// is its test's BRANCH — for a single-valued node, LT to `node->left->code_label` and GT to
-// `node->right->code_label`, each guarded by `node_is_bounded` on that side — while the
-// fall-through always continues into more dispatch, so a fall-side reading has no producer in
-// this dispatch — and none turns up in 3176 generated agbcc dispatches.
-//
-// TWO PREMISES ABOUT THE DOMAIN. It is the 32-bit REGISTER's, not the scrutinee's recovered
-// type, so a narrower type has a nearer endpoint this misses — which costs a case and never
-// invents one. And it is the WHOLE of that domain, so an ancestor that already excluded the
-// value makes the reading wrong; PRE3 is what catches that, simulating the original tree for
-// every recovered case value and declining unless it lands on the recorded body, exactly as it
-// does for the `eq` cases. Null when the branch admits none, several, or the whole domain.
-function singletonTaken(ti: TestInfo): number | null {
-  const [min, max] = ti.opcode.startsWith('icmp_u') ? [0, -1] : [-0x80000000, 0x7fffffff];
-  for (const [v, next] of [
-    [min, min + 1],
-    [max, max - 1],
-  ]) {
-    if (evalCmp(ti.opcode, ti.xOnLeft, v, ti.k) && !evalCmp(ti.opcode, ti.xOnLeft, next, ti.k)) {
-      return v;
+function complement(r: Ranges): Ranges {
+  const out: [number, number][] = [];
+  let next = INT_MIN;
+  for (const [lo, hi] of r) {
+    if (lo > next) {
+      out.push([next, lo - 1]);
     }
+    next = hi + 1;
+  }
+  if (next <= INT_MAX) {
+    out.push([next, INT_MAX]);
   }
-  return null;
+  return out;
+}
+
+function intersect(a: Ranges, b: Ranges): Ranges {
+  const out: [number, number][] = [];
+  for (const [alo, ahi] of a) {
+    for (const [blo, bhi] of b) {
+      const lo = Math.max(alo, blo);
+      const hi = Math.min(ahi, bhi);
+      if (lo <= hi) {
+        out.push([lo, hi]);
+      }
+    }
+  }
+  return out.sort((x, y) => x[0] - y[0]);
+}
+
+/** The register values that take the test's BRANCH. */
+function takenBy(ti: TestInfo): Ranges {
+  const op = ti.xOnLeft ? ti.opcode : (MIRRORED[ti.opcode] ?? ti.opcode);
+  if (op === 'icmp_eq' || op === 'icmp_ne') {
+    const k = ti.k | 0;
+    return op === 'icmp_eq' ? [[k, k]] : complement([[k, k]]);
+  }
+  const uns = op.startsWith('icmp_u');
+  const [min, max, k] = uns ? [0, 0xffffffff, ti.k >>> 0] : [INT_MIN, INT_MAX, ti.k | 0];
+  const rel = op.slice('icmp_s'.length);
+  const [lo, hi] =
+    rel === 'lt'
+      ? [min, k - 1]
+      : rel === 'le'
+        ? [min, k]
+        : rel === 'gt'
+          ? [k + 1, max]
+          : rel === 'ge'
+            ? [k, max]
+            : [min, max];
+  return uns ? fromUnsigned(lo, hi) : lo > hi ? [] : [[lo, hi]];
+}
+
+/** What of `path` follows the test's `taken` edge, or its fall-through. */
+function narrow(path: Ranges, ti: TestInfo, taken: boolean): Ranges {
+  const t = takenBy(ti);
+  return intersect(path, taken ? t : complement(t));
+}
+
+/** Whether register value `v` is in `r`. PRE3's concrete simulation reads each test through this
+ *  and {@link takenBy}, so the tree it walks and the ranges a bound case is read off are one
+ *  definition of the icmp family, not two. */
+function contains(r: Ranges, v: number): boolean {
+  const x = v | 0;
+  return r.some(([lo, hi]) => lo <= x && x <= hi);
+}
+
+/** The one value in `r`, if it holds exactly one. */
+function singleton(r: Ranges): number | null {
+  return r.length === 1 && r[0][0] === r[0][1] ? r[0][0] : null;
 }
 
 /** Re-thread `order` so every FALLING arm sits directly above the arm it falls into. Each
@@ -251,23 +337,26 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
     isNamed,
     isCmpOpcode,
     switchAllowsNeqCase,
-    switchAllowsBoundCase,
+    switchBoundCase,
     switchArmsFollowLayout,
     switchRequiresFrontLoadedTests,
     spellSwitchFallthrough,
     emitsOwnStatement,
     blockOf,
+    enclosingLoop,
     hoistDispatchCopies,
     expr,
     structureRegion,
+    structureArm,
   } = deps;
 
   // A block's index in `fn.blocks` as its position in the ASSEMBLY — the warrant for every reading
   // of layout below, and true PER FRONTEND rather than of the IR:
   //   - thumb.ts and mips.ts build the list by scanning the instruction stream in address order;
-  //   - ppc.ts does not. It APPENDS a synthetic return block (`synthReturn`) at the end of the list
-  //     for every conditional-return branch, wherever in the stream that branch sits, so its list
-  //     is not address order at all;
+  //   - ppc.ts does too, and then APPENDS a synthetic return block (`synthReturn`) at the end of
+  //     the list for every conditional-return branch, wherever in the stream that branch sits. So
+  //     its real blocks keep address order among themselves, and each synthetic one — a bare
+  //     return, never a test — sorts after all of them;
   //   - raising only ever REMOVES blocks from the list (raise/{divpow2,latch,retsink,shortcircuit}
   //     .ts all `filter`), never inserts or reorders, so the frontend's order is what survives.
   // TWO READERS, both target-gated, and they need DIFFERENT strengths of the compiler half:
@@ -278,9 +367,14 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
   //     `MIPS_GCC` declares `switchRequiresFrontLoadedTests` and NOT `switchArmsFollowLayout` for
   //     exactly that reason — it has a scheduler and fills delay slots (target.ts).
   // Both are therefore claims about a target's FRONTEND as much as about its compiler, and a target
-  // opts in on both halves — which is why PPC_MWCC, whose frontend fails the frontend half outright,
-  // declares neither. Anything added below that reads `layoutIndex` inherits the frontend half and
-  // owes a statement of which strength of the compiler half it needs.
+  // opts in on both halves. PPC_MWCC's frontend holds the weaker half only: a synthetic return body
+  // sorting last can make PRE5 keep a `switch` it should decline, never decline one it should keep,
+  // so mwcc declares `switchRequiresFrontLoadedTests` and could not declare the placing reading.
+  // That is the frontend's limit and not the compiler's: mwcc lays its case bodies in source order
+  // (the compiled pairs at target.ts `switchArmsFollowLayout`), so a synthetic block placed at its
+  // branch's address would give PPC both halves.
+  // Anything added below that reads `layoutIndex` inherits the frontend half and owes a statement
+  // of which strength of the compiler half it needs.
   const blockIndex = new Map(fn.blocks.map((blk, i) => [blk, i] as const));
   const layoutIndex = (blk: Block): number => blockIndex.get(blk) ?? -1;
 
@@ -357,82 +451,19 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
   // has declared that its layout answers it — which SPELLING the source wrote.
 
   // Fold a value that is a compile-time constant (a `const`, or a synthesized immediate like agbcc's
-  // `250 << 2` for a large sparse case) to a number — else null.
-  const evalConst = (v: Value): number | null => {
-    if (isNamed(v)) {
-      return null;
-    } // a named variable is not a constant
-    const d = defs.get(v);
-    if (!d) {
-      return null;
-    }
-    if (d.opcode === 'const') {
-      return (d.attrs.value as number) | 0;
-    }
-    // Resolve the two operands of a binary op to constants (2-operand → both; 1-operand → operand +
-    // `imm` attr, which MUST be present, else decline — a missing imm would wrongly fold `and x` to 0).
-    const operands2 = (): [number, number] | null => {
-      const a = evalConst(d.operands[0]);
-      if (a === null) {
-        return null;
-      }
-      let c: number | null;
-      if (d.operands.length === 2) {
-        c = evalConst(d.operands[1]);
-      } else if (typeof d.attrs.imm === 'number') {
-        c = d.attrs.imm | 0;
-      } else {
-        return null;
-      }
-      return c === null ? null : [a, c];
-    };
-    const bin = (f: (a: number, c: number) => number): number | null => {
-      const p = operands2();
-      return p === null ? null : f(p[0], p[1]) | 0;
-    };
-    const shift = (f: (a: number, c: number) => number): number | null => {
-      const p = operands2();
-      if (p === null || p[1] < 0 || p[1] >= 32) {
-        return null;
-      } // out-of-range shift amount → decline
-      return f(p[0], p[1]) | 0;
-    };
-    switch (d.opcode) {
-      case 'shl':
-        return shift((a, c) => a << c);
-      case 'shr_u':
-        return shift((a, c) => a >>> c);
-      case 'shr_s':
-        return shift((a, c) => a >> c);
-      case 'or':
-        return bin((a, c) => a | c);
-      case 'and':
-        return bin((a, c) => a & c);
-      case 'xor':
-        return bin((a, c) => a ^ c);
-      case 'add':
-        return bin((a, c) => a + c);
-      case 'sub':
-        return bin((a, c) => a - c);
-      case 'neg': {
-        const a = evalConst(d.operands[0]);
-        return a === null ? null : -a | 0;
-      }
-      case 'not': {
-        const a = evalConst(d.operands[0]);
-        return a === null ? null : ~a | 0;
-      }
-      default:
-        return null;
-    }
-  };
+  // `250 << 2` for a large sparse case) to a number — else null. The shared word evaluator
+  // (ir/bits.ts), which declines an opcode it has no rule for: a `neg_s` (Thumb `cmn` under a signed
+  // branch) is no word, so a guard against it is never read as a case bound. A named variable is
+  // not a constant, whatever set it.
+  const words = { defs, opaque: isNamed };
+  const evalConst = (v: Value): number | null => constWord(words, v);
 
   // TWO QUESTIONS about a block, asked separately because the answers diverge and the walk needs
   // both: WHAT does it test (`testInfo`), and may this recovery DISCARD it (`collapsible`)?
   //
   // PRE4 (purity) is the second. A collapsed test block's ops re-render at whichever use inlines
   // them, at a point the switch decides — so the question is motion, not deletion, and
-  // `ORDER_SENSITIVE_OPS` is the set that asks it. NOT the trapping divides: a use is dominated by
+  // `orderSensitive` is the question that asks it. NOT the trapping divides: a use is dominated by
   // its def, so the re-rendered op runs on a subset of the paths it already ran on — nothing is
   // speculated. `emitsOwnStatement` covers what motion cannot save: a statement belonging to the
   // block rather than to a use. The root is exempt from all of it — its ops are already emitted as
@@ -441,8 +472,7 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
   // A block that tests the scrutinee and is NOT collapsible is still dispatch, so the walk must
   // read it as dispatch and decline, never re-read it as a case body — that would spell an arm
   // whose guard the dispatch has already decided.
-  const collapsible = (blk: Block): boolean =>
-    !blk.ops.some((op) => ORDER_SENSITIVE_OPS.has(op.opcode)) && !emitsOwnStatement(blk);
+  const collapsible = (blk: Block): boolean => !blk.ops.some(orderSensitive) && !emitsOwnStatement(blk);
   const testInfo = (blk: Block): TestInfo | null => {
     const term = blk.ops[blk.ops.length - 1];
     if (term.opcode !== 'cond_br') {
@@ -472,6 +502,123 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
     return { x, k, cls, opcode: cmp.opcode, xOnLeft };
   };
 
+  // Does `blk` leave the enclosing loop for its exit, other than by the loop's own bottom test (a
+  // block that also edges back to the header, which spells as the loop's condition)?
+  const breaksLoop = (blk: Block): boolean => {
+    const loop = enclosingLoop();
+    const succ = successorsOf(blk);
+    return loop !== null && loop.exit !== null && succ.includes(loop.exit) && !succ.includes(loop.header);
+  };
+
+  // Does a block some arm structures edge to `target`? Walked as `structureArm` walks an arm: every
+  // block reached from the arm's entry without stepping through `merge` or back into `header`. That
+  // is wider than `analyzeArmExit`'s dominated region on purpose: when Regime A recognises a sub-tree
+  // of the comparison tree, an arm can run on into the code of a case the tree's root already took,
+  // which the dispatch does not dominate, and `structureArm` structures that code inside the arm.
+  // A block that also edges back to `header` is the loop's bottom test, which spells as the loop's
+  // condition, not as the arm's (`breaksLoop`) — save where `header` IS the merge (a top-tested
+  // loop): no bottom test is then reachable without passing the merge, and an arm's
+  // `if (c) goto out;` is a block that edges to the exit and straight back into the header.
+  const armsReach = (entries: Iterable<Block>, merge: Block | null, header: Block, target: Block): boolean => {
+    const seen = new Set<Block>(entries);
+    for (const q = [...seen]; q.length;) {
+      const succ = successorsOf(q.pop()!);
+      if (succ.includes(target) && (header === merge || !succ.includes(header))) {
+        return true;
+      }
+      for (const s of succ) {
+        if (s !== target && s !== merge && s !== header && !seen.has(s)) {
+          seen.add(s);
+          q.push(s);
+        }
+      }
+    }
+    return false;
+  };
+
+  // Can a path from `from` reach `to` without passing `through`? False when `to` is null (the end
+  // of the function) or is `through` itself.
+  const reachesAvoiding = (from: Block, to: Block | null, through: Block | null): boolean => {
+    if (to === null || to === through) {
+      return false;
+    }
+    const seen = new Set<Block>([from]);
+    for (const q = [from]; q.length;) {
+      for (const s of successorsOf(q.pop()!)) {
+        if (s === to) {
+          return true;
+        }
+        if (s !== through && !seen.has(s)) {
+          seen.add(s);
+          q.push(s);
+        }
+      }
+    }
+    return false;
+  };
+
+  // THE LOOP-EXIT MERGE, WHERE IT SPELLS. A switch whose merge is its enclosing loop's exit puts
+  // the exit region after the `switch`, INSIDE the loop body, and reaches the loop bottom only
+  // through the arms that do not break. That is the source's text on two conditions, both read off
+  // the CFG here, and on either failing the merge-past-stop gate below declines to if-recovery:
+  //   - the exit region RETURNS: no path from `merge` reaches a block that dominates it (other
+  //     than `merge` itself, a loop of the exit region's own) — the enclosing loop's header, or an
+  //     OUTER loop's, whose back edge the inner body cannot spell
+  //     (`for (j...) { for (;;) { switch ... } out: u += prev; }` runs on to the outer latch);
+  //   - every loop-bottom TEST the arms reach (a block that edges back to the header) leaves for
+  //     the merge itself, which the arm then spells as its `break;` (`latchexit`). One that leaves
+  //     for any other block outside the loop is past what an arm structured against `merge` can
+  //     say: the merge is then the loop's exit only because an early `return` made a shared
+  //     epilogue the dispatch's post-dominator, while the code the bottom test leaves for runs
+  //     before it (`for (w = 0; w < 4; w++) { if (c) return w; switch ... } r(t);` on
+  //     gcc2.7.2kmc).
+  // And the loop's HEADER must not leave for the merge itself. One that does makes the loop
+  // top-tested on it, with the merge as the loop's own exit, which the exit region rendered after
+  // the switch inside the body would leave nothing to reach
+  // (`for (k = 0; k < 3; k++) { if (gC == 7) goto out; switch ... }` becomes `while (gC != 7)`).
+  // A test lower in the body that leaves for the merge ahead of the dispatch spells as its own
+  // `goto` or `break`, and keeps the switch.
+  const exitMergeSpells = (from: Block, merge: Block | null): boolean => {
+    if (merge === null) {
+      return false;
+    }
+    const above = dom.get(merge)!;
+    const exitSeen = new Set<Block>([merge]);
+    for (const q = [merge]; q.length;) {
+      for (const s of successorsOf(q.pop()!)) {
+        if (s !== merge && above.has(s)) {
+          return false;
+        }
+        if (!exitSeen.has(s)) {
+          exitSeen.add(s);
+          q.push(s);
+        }
+      }
+    }
+    const header = enclosingLoop()?.header ?? null;
+    if (header !== null && successorsOf(header).includes(merge)) {
+      return false;
+    }
+    const seen = new Set<Block>([from]);
+    for (const q = [from]; q.length;) {
+      const succ = successorsOf(q.pop()!);
+      if (
+        header !== null &&
+        succ.includes(header) &&
+        succ.some((s) => s !== header && s !== merge && !reachesAvoiding(s, header, merge))
+      ) {
+        return false;
+      }
+      for (const s of succ) {
+        if (s !== header && s !== merge && !seen.has(s)) {
+          seen.add(s);
+          q.push(s);
+        }
+      }
+    }
+    return true;
+  };
+
   // Where does one arm's region LEAVE? Walk it from `entry`, never stepping THROUGH the merge or a
   // sibling arm's entry, and classify what it steps INTO. `siblings` is every OTHER arm entry the
   // caller can emit a `case`/`default` label for — the merge is deliberately not among them, so a
@@ -483,22 +630,44 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
   // sideways does not fall into the next case — and only the FALL-THROUGH verdict consults that
   // record, so an arm that reaches no sibling still closes with a plain `break`.
   //
+  // With `stopAtLoop` (Regime A), a FALLING arm that also reaches the merge must not break the loop
+  // the switch sits in. When the dispatch IS the loop header (agbcc and IDO rotate
+  // `while (k < 4) { k++; switch … }` so), it dominates the loop's exit and all the code after the
+  // loop, and the merge is the header itself, so dominance cannot tell the arm's region from the
+  // code past the loop. Such an arm that falls into a sibling, reaches the merge by the back edge,
+  // and leaves for the loop's exit on a third path (a `goto out`, or a sibling that IS the exit, as
+  // a `default: goto out;` makes it) would read as falling with `breaks`, Regime A would commit,
+  // and the loop-exit refusal in `structure.ts` would fail the whole function where if-recovery
+  // spells it. So it is `unstructurable`. What counts is the block the refusal fires on
+  // (`breaksLoop`): the loop's own bottom test, reached after a `continue`, exits too but is the
+  // loop's condition, and a block that also edges to the merge is the switch's own end. Regime B,
+  // which has no fallback, does not ask: it lifts a jump table whose arms share the rotated latch
+  // and its exit (`do { … switch … t++; } while (t < 15)`).
+  //
   // A CONSEQUENCE, not a hole: a sibling reachable only THROUGH such a block is never seen, so the
   // arm reads as closed and `structureRegion` walks into the sibling's blocks and emits them again
   // under this arm. That is duplication, not a wrong dispatch — the same duplication the structurer
   // already does for any tail two arms share, and how the case bodies agbcc tail-merged are put
   // back. Costly for matching, correct to run.
-  const analyzeArmExit = (entry: Block, b: Block, merge: Block | null, siblings: Set<Block>): ArmExit => {
+  const analyzeArmExit = (
+    entry: Block,
+    b: Block,
+    merge: Block | null,
+    siblings: Set<Block>,
+    stopAtLoop = false,
+  ): ArmExit => {
     if (entry === merge) {
       return { kind: 'break' }; // an empty arm (a table slot pointing straight at the switch's end)
     }
     const into = new Set<Block>(); // sibling entries this arm flows into
     let toMerge = false,
-      escapes = false;
+      escapes = false,
+      leavesLoop = false;
     const seen = new Set<Block>([entry]);
     const q = [entry];
     while (q.length) {
       const cur = q.pop()!;
+      leavesLoop ||= !successorsOf(cur).includes(merge as Block) && breaksLoop(cur);
       for (const s of successorsOf(cur)) {
         if (s === merge) {
           toMerge = true;
@@ -515,32 +684,32 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
       }
     }
     if (into.size === 0) {
-      return { kind: 'break' };
-    }
-    if (into.size === 1 && !toMerge && !escapes) {
-      return { kind: 'fallthrough', to: [...into][0] };
+      return escapes ? { kind: 'break' } : { kind: 'break', region: seen };
     }
-    // Name what is actually missing. These three are different facts, and only the first is a shape
-    // C has no spelling for — the other two are asmlift's own limits, so say so rather than blame C.
-    const names = () => [...into].map((x) => `#${layoutIndex(x)}`).join(', ');
-    if (into.size > 1) {
+    // A path to the merge beside the fall-through is the arm's own `break;` — switch-scoped, so it
+    // spells only where nothing breakable sits between that edge and the arm, which the structurer
+    // checks where it emits it (`structure.ts` `switchBreakAt`) and refuses loud otherwise.
+    if (into.size === 1 && toMerge && leavesLoop && stopAtLoop) {
       return {
         kind: 'unstructurable',
-        why: `a case body reaches several sibling cases (${names()}) — C fall-through reaches only one, so this needs a goto`,
+        why: `a case body falls into sibling case ${[...into].map((x) => `#${layoutIndex(x)}`).join(', ')}, reaches the end of the switch, and leaves the loop the switch sits in`,
       };
     }
-    if (escapes) {
+    if (into.size === 1 && !escapes) {
+      return { kind: 'fallthrough', to: [...into][0], breaks: toMerge, region: seen };
+    }
+    // Name what is actually missing. These are two different facts: the first is a shape C's
+    // fall-through cannot spell, the second leaves the switch's region sideways.
+    const names = () => [...into].map((x) => `#${layoutIndex(x)}`).join(', ');
+    if (into.size > 1) {
       return {
         kind: 'unstructurable',
-        why: `a case body reaches sibling case ${names()} on one path and, on another, a block the switch does not dominate`,
+        why: `a case body reaches several sibling cases (${names()}) — C fall-through reaches only one, so this needs a goto`,
       };
     }
     return {
       kind: 'unstructurable',
-      // `case 0: if (c) { …; break; } /* fall through */ case 1:` is the C for this, and the reason
-      // asmlift cannot write it is its own: `{k:'break'}` is emitted only for the innermost LOOP
-      // (l3/ast.ts), never switch-scoped. That is the capability this shape is waiting on.
-      why: `a case body reaches sibling case ${names()} on one path and the end of the switch on another — a switch-scoped \`break\` inside a case body is not emitted yet`,
+      why: `a case body reaches sibling case ${names()} on one path and, on another, a block the switch does not dominate`,
     };
   };
 
@@ -588,12 +757,15 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
         }
         guard.add(cur);
         const term = cur.ops[cur.ops.length - 1];
-        const taken = evalCmp(ti.opcode, ti.xOnLeft, xv, ti.k);
+        const taken = contains(takenBy(ti), xv);
         cur = forwardingTarget(term.successors[taken ? 0 : 1].block);
       }
     };
     const seen = new Set<Block>();
     const work: Block[] = [b];
+    // The values that can reach each test block, written as the walk pushes it. Only a bound case
+    // reads it; the tree is a tree (a second visit declines below), so each block has one entry.
+    const pathOf = new Map<Block, Ranges>([[b, ALL]]);
     while (work.length) {
       const blk = work.pop()!;
       if (seen.has(blk)) {
@@ -628,10 +800,13 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
         cases.set(k, child);
         return true;
       };
+      const path = pathOf.get(blk)!;
       /** Read `child` as a NAVIGATION edge: more dispatch to walk, or a non-test leaf, which is a
-       *  default candidate. Never declines — the leaf's own reading is settled below. */
-      const asNav = (child: Block): boolean => {
+       *  default candidate. Never declines — the leaf's own reading is settled below. `onTaken`
+       *  says which of `blk`'s edges it is, which decides what the range narrows to. */
+      const asNav = (child: Block, onTaken: boolean): boolean => {
         if (isTestOn(child)) {
+          pathOf.set(child, narrow(path, ti, onTaken));
           work.push(child);
           return true;
         }
@@ -642,7 +817,7 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
         if (!asCase(taken, ti.k)) {
           return null;
         } // x==k → taken is case k
-        if (!asNav(fall)) {
+        if (!asNav(fall, false)) {
           return null;
         }
       } else if (ti.cls === 'ne') {
@@ -652,12 +827,12 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
         if (!asCase(fall, ti.k)) {
           return null;
         } // x!=k → the EQUAL side (fall) is case k
-        if (!asNav(taken)) {
+        if (!asNav(taken, true)) {
           return null;
         }
       } else {
-        // relational → navigation, except where the BRANCH has collapsed to a single value and
-        // lands on a BODY, on a compiler that declared the spelling. Two more refusals:
+        // relational → navigation, except where a side the compiler declared (`switchBoundCase`)
+        // admits a single value and lands on a BODY. Two more refusals:
         //   - a bound test at the ROOT. `emit_case_nodes` emits a single-valued node's own
         //     `do_jump_if_equal` before either descent test, so a bound test always sits under
         //     another test of the same tree; one that OPENS the region did not come from this
@@ -665,11 +840,13 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
         //   - a singleton branch onto another TEST of the scrutinee, which is the search
         //     descending to pin the value. It is dispatch, so the walk reads it as dispatch —
         //     recovering it, or declining at PRE4 if it is not collapsible.
-        const k = switchAllowsBoundCase && blk !== b && !isTestOn(taken) ? singletonTaken(ti) : null;
-        if (!(k === null ? asNav(taken) : asCase(taken, k))) {
+        const sides = blk !== b ? switchBoundCase : null;
+        const kTaken = sides && !isTestOn(taken) ? singleton(narrow(path, ti, true)) : null;
+        const kFall = sides === 'either' && !isTestOn(fall) ? singleton(narrow(path, ti, false)) : null;
+        if (!(kTaken === null ? asNav(taken, true) : asCase(taken, kTaken))) {
           return null;
         }
-        if (!asNav(fall)) {
+        if (!(kFall === null ? asNav(fall, false) : asCase(fall, kFall))) {
           return null;
         }
       }
@@ -754,29 +931,73 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
     }
 
     // PRE2 (arm exits), per SITE. A `break` arm closes; a `fallthrough` arm runs on into the one
-    // sibling it reaches, which `chainArms` then places directly under it. `unstructurable` is a
-    // shape no single linear switch spells — a body reaching two siblings, or a sibling on one path
-    // and the switch's end on another — and Regime A declines to if-recovery, which spells every
-    // one of those edges. (Regime B reads the same verdicts and fails LOUD on either.)
+    // sibling it reaches, which `chainArms` then places directly under it — on every path, or on
+    // some while the others reach the switch's end, which the arm's own `break;` spells (`breaks`).
+    // `unstructurable` is a shape no single linear switch spells — a body reaching two siblings, or
+    // a sibling beside a block the switch does not dominate — and Regime A declines to if-recovery,
+    // which spells every one of those edges. (Regime B reads the same verdicts and fails LOUD on
+    // either.)
     const merge = ipdom.get(b) ?? stop;
     const targets = new Set<Block>([...caseBlocks, ...(defaultBlk ? [defaultBlk] : [])]);
     const siblings = new Set([...targets].filter((t) => t !== merge));
     const exitOf = new Map<Block, ArmExit>();
     for (const t of siblings) {
-      exitOf.set(t, analyzeArmExit(t, b, merge, siblings));
+      exitOf.set(t, analyzeArmExit(t, b, merge, siblings, true));
     }
     // A language with no fall-through in its `case` (Pascal) cannot print a falling arm at all, so
     // for it a falling arm is exactly as unspellable as an `unstructurable` one — and takes the
     // same exit: if-recovery, which that backend prints fine. Asked HERE rather than left to the
     // backend because the backend's refusal is terminal (the whole function becomes a stub) while
     // this one costs nothing but the `switch` spelling.
+    //
+    // A falling arm that also breaks is admitted wherever it falls, the `default:` arm included:
+    // for `case 1: if (c) break; default: f(); break;` the ladder if-recovery writes copies `f()`
+    // into the arm and misses the object the `switch` reaches.
     if (
       [...exitOf.values()].some(
-        (e) => e.kind === 'unstructurable' || (!spellSwitchFallthrough && e.kind === 'fallthrough'),
+        (e) => e.kind === 'unstructurable' || (e.kind === 'fallthrough' && !spellSwitchFallthrough),
       )
     ) {
       return null;
     }
+    // AN ARM'S `break;` NEEDS THE MERGE TO BE THE SWITCH'S END IN THIS REGION. The code after the
+    // `switch` is `structureRegion(merge, stop)`, which reads as that only where every path from
+    // the dispatch reaches `stop` through the merge. A sub-tree whose post-dominator lies PAST the
+    // region's `stop` breaks that: inside a loop body whose dispatch reaches both the latch (`stop`)
+    // and an early `return` block, ipdom is the return, so an arm's path to it would read as a
+    // switch `break` while a sibling arm runs through the latch and back to the header, which
+    // fails the whole function loud. Declined here, to if-recovery, which spells each edge as the
+    // `return` or the fall to the loop bottom it is. A merge that is the enclosing loop's EXIT is
+    // the exception the structurer spells (`exitMergeSpells`): the code after the switch is then
+    // the exit region, and an arm's path to it is the arm's `break;` (`structure.ts`, the loop-exit
+    // rules).
+    if (
+      [...exitOf.values()].some((e) => e.kind === 'fallthrough' && e.breaks) &&
+      !(merge === enclosingLoop()?.exit && exitMergeSpells(b, merge)) &&
+      reachesAvoiding(b, stop, merge)
+    ) {
+      return null;
+    }
+    // AN ARM'S EDGE TO THE LOOP'S EXIT, WHEN THAT EXIT IS NOT THE MERGE. A switch admitted on a
+    // falling arm's `break;` hands every arm to `structureArm`, where an edge to the enclosing loop's
+    // exit can be spelled only as the switch's own end or as a copied returning tail; any other is
+    // refused there, loud, for the whole function (`structure.ts`, "leaves its switch for a loop
+    // exit"). With an early `return` above the dispatch, the merge is the loop bottom, and a sibling
+    // arm's `goto out` to an exit that runs on to an OUTER loop's latch is such an edge. Declined
+    // here to if-recovery, which spells that `goto` as the inner loop's `break`. The exemption is
+    // the exit that is itself a `ret`; the structurer's other one, an early-return arm owning the
+    // edge, is not asked here, which costs only the `switch` spelling.
+    const loop = enclosingLoop();
+    if (
+      [...exitOf.values()].some((e) => e.kind === 'fallthrough' && e.breaks) &&
+      loop !== null &&
+      loop.exit !== null &&
+      loop.exit !== merge &&
+      loop.exit.ops[loop.exit.ops.length - 1]?.opcode !== 'ret' &&
+      armsReach(siblings, merge, loop.header, loop.exit)
+    ) {
+      return null;
+    }
 
     // PRE3 (concrete interval consistency): a `case k` is only sound if the ORIGINAL tree
     // actually routes x==k to its recorded body. A relational guard can make an `x==k` test DEAD (e.g.
@@ -1008,13 +1229,13 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
       // built, and no row asks for it (`sw_jtfall`/`sw_jtfalldesc` match today).
       outCases.push({
         values: armsByBlock.get(blk)!,
-        body: structureRegion(blk, to ?? merge),
+        body: structureArm(blk, to ?? merge, merge, exitOf.get(blk)),
         fallsThrough: to !== null,
       });
     }
     // An empty default arm is not a default (see the Regime-B note in structure.ts): the label
     // would carry no statement, which says nothing and is not valid C89.
-    const defBody = defaultBlk ? structureRegion(defaultBlk, merge) : [];
+    const defBody = defaultBlk ? structureArm(defaultBlk, merge, merge, exitOf.get(defaultBlk)) : [];
     // The `default:` arm is an ARM: where its block is laid out is read exactly as a case body's is
     // (`defaultLayoutPos`). The dispatch placed that block itself when the last test simply RAN OUT
     // into it and no other subtree jumps there — the two references the tree walk can count.
@@ -1060,3 +1281,7 @@ export function makeSwitchRecovery(deps: SwitchRecoverDeps): SwitchRecovery {
   };
   return { recognizeSwitch, analyzeArmExit, layoutIndex, defaultLayoutPos, chainArms };
 }
+
+/** Internal surface for this module's own tests, and for nothing else: PRE3 reads each test
+ *  through {@link takenBy}, so the ranges need a check that does not share their definition. */
+export const __testing = { takenBy, narrow, contains, ALL };