@asmlift/core 0.9.0 → 0.10.0

package/src/l3/ast.ts

@@ -9,7 +9,21 @@ export type Expr =
   // A `double` literal, carried as its IEEE bit pattern (ir/float-bits.ts) — a kind apart from the
   // integer `const`, so no integer fold, range test or signedness reading ever takes it for one.
   | { k: 'fconst'; bits: string }
-  | { k: 'bin'; op: BinOp; l: Expr; r: Expr }
+  // `unsignedCmp` is EVIDENCE, not spelling: an ordering compare (`<` `<=` `>` `>=`) lowered from an
+  // `icmp_u*`, which C spells with the same token as the signed one and decides from the operand
+  // types. The printer never reads it; `signedOverUnsignedCompare` (l3/typing.ts) does, over the
+  // FINISHED tree, so a pass that substitutes into a compare cannot re-spell it signed unseen.
+  // `exprEquals` ignores it, as it ignores `index.operandOff`: two nodes that print alike are
+  // alike to a CSE. A merge that keeps one of two equal nodes keeps it through `unionEvidence`, so
+  // the evidence of the one it drops is not lost with it.
+  //
+  // `helperRel` is evidence too: on a float `==`/`!=`, the relation the SOURCE spelled, where the
+  // compiler picked a runtime helper by it (runtime-helpers.ts `RuntimeHelper.relation` — agbcc's
+  // `__eqsf2` and `__nesf2`). It rides through `negateCond` unchanged, so a node whose `op` is not
+  // its `helperRel` is one a negation moved off the helper, and `keepsHelperRel` /
+  // `regainsHelperRel` below are what a pass choosing between `if (c) A else B` and
+  // `if (!c) B else A` asks. Ignored by `exprEquals` and by the printer, like `unsignedCmp`.
+  | { k: 'bin'; op: BinOp; l: Expr; r: Expr; unsignedCmp?: true; helperRel?: BinOp }
   | { k: 'un'; op: '-' | '~' | '!' | 'f-'; e: Expr }
   // A post-increment `name++` (`by` 1) or post-decrement `name--` (`by` -1): the value the local
   // held BEFORE the update, with the update as a side effect. The only expression form here that
@@ -31,10 +45,10 @@ export type Expr =
   // A C-style value cast `(T)e`. Tree-level producers: a width-narrowing cast `(u8)e` (the
   // recovered form of a byte/half extend idiom — zext/sext IR ops), the STRUCT-pointer cast
   // (structure.ts memAccess/arrayAccess struct paths — see the note on `field` below), and the
-  // integer legalization of a pointer operand under an operator C rejects (structure.ts intify,
-  // `3 & (s32)p`). Scalar deref casts are backend-owned — the C-family printer synthesizes
-  // them from the `index` node's width. Each backend spells the cast in its own syntax
-  // (C: `(u8)e`; Pascal: no spelling yet → fails loud).
+  // integer legalization of a pointer operand under an operator C rejects (the arithmetic table,
+  // structure/pointer-spelling.ts: `3 & (s32)p`). Scalar deref casts are backend-owned — the
+  // C-family printer synthesizes them from the `index` node's width. Each backend spells the cast
+  // in its own syntax (C: `(u8)e`; Pascal: no spelling yet → fails loud).
   //
   // `volatile` qualifies the POINTEE of a pointer cast (`(volatile u16 *)0x4000208`) — the one
   // place asmlift can say "this access is to a volatile object" when there is no declaration to
@@ -62,13 +76,29 @@ export type Expr =
   // `sret` is the type of a struct the callee returns BY VALUE through memory. `args[0]` is then the
   // hidden pointer the frontend read from the first argument register — the address of the struct
   // the call fills — and the rest are the declared arguments. The only C spelling is a statement,
-  // `dest = fn(rest)`, so such a call stands alone.
+  // `dest = fn(rest)`, so such a call stands alone. `returns` is the type of a struct the callee
+  // returns BY VALUE in registers, where the call is that value itself, `return mk(x);`
+  // (frontend/register-struct-call.ts); the declarations block prints its prototype by it.
+  //
+  // `byValue` names the arguments that are a struct passed BY VALUE — a local or a global spelled
+  // bare, `take(s)` — by their place in `args` and the declared parameter each is, with the struct
+  // the declaration passes
+  // (frontend/call-plan.ts `foldByValueArgs`); the declarations block defines each beside the
+  // callee's prototype.
   //
   // `fn` is the callee's NAME, or for an indirect call the EXPRESSION whose value is the address
   // called (ir/core.ts `calleeValue`) — a child of the node like its arguments, listed first in
   // `exprChildren`. That is no evaluation order: C leaves it unspecified, and agbcc loads the callee
   // after the arguments.
-  | { k: 'call'; fn: string | Expr; args: Expr[]; wide64?: true; sret?: IrType }
+  | {
+      k: 'call';
+      fn: string | Expr;
+      args: Expr[];
+      wide64?: true;
+      sret?: IrType;
+      returns?: IrType;
+      byValue?: readonly { readonly at: number; readonly param: number; readonly type: IrType }[];
+    }
   // The ADDRESS of a named global, `&gSym` (agbcc pool `.word gSym`, frontend `gaddr` op). A
   // DEREF of it collapses to the bare global: memAccess/arrayAccess spell `*(&gSym)` as `gSym`
   // and `(&gSym)[i]` as `gSym[i]` (a global name decays to a pointer). Only a genuinely
@@ -192,6 +222,15 @@ export type Expr =
       operandOff?: number;
       baseOrdered?: true;
       baseAdvanced?: number;
+      /** Spell element 0 as `base[0]`, never `*base`. The two are one lvalue to C and NOT to
+       *  agbcc's alias analysis: `u.half[0]` is an ARRAY_REF of a union member, alias set 0
+       *  (c-common.c `c_get_alias_set`), while `*u.half` dereferences the member's decay — an
+       *  INDIRECT_REF typed by its pointee, which a compiled `*u.half = 1; *u.word = x; return
+       *  *u.half;` returns stale (`mov r0, #0x1`) where the subscript reloads. Set on a view of a
+       *  frame union (structure.ts `frameUnionAccess`), the one access that rests on that set,
+       *  and on an element of a frame array, where it only keeps the element spelling at index 0
+       *  (structure.ts `frameArrayElement`, l3/constinit.ts `asElement`). */
+      subscript?: true;
     }
   // A named struct-field access `base->name` (raise/structs.ts recovered `base` as a struct
   // pointer, so the byte offset resolves to a named field instead of a scaled array index).
@@ -226,9 +265,10 @@ export type Expr =
 // The divides earned it second, on pokeemerald:GetAnchorCoord — `(u32)(coord * a1) / (u32)a0`
 // standing beside two arithmetic shifts of the same values. Their only other channel is the operand
 // TYPES, reached by flipping a declaration, and there that flip is unreachable and unsound at
-// once: the divisor also feeds a signed compare, so the /uns-cmp reconciliation correctly refuses
-// it, and forcing it anyway makes agbcc delete the comparison as always-false. A per-operand pin is
-// the only spelling that says "this division alone is unsigned".
+// once: the divisor also feeds a signed compare, so the unsigned-compare reconciliation
+// (structure.ts unsignedCompareSpelling) correctly refuses it, and forcing it anyway makes agbcc
+// delete the comparison as always-false. A per-operand pin is the only spelling that says "this
+// division alone is unsigned".
 //
 // The COMPARISONS stay collapsed, and that asymmetry is the rule applying rather than an omission:
 // which side a compare was spelled from genuinely underdetermines — a signed spelling that
@@ -241,12 +281,20 @@ export type Expr =
 // and `+`/`-` are the pointer walks, reassociations and constant folds of a dozen L3 passes. A float
 // under any of those is a wrong program, so it gets operators none of them match — the same reason
 // the IR has `fadd` rather than a float-typed `add`. The unary minus splits the same way (`f-` on
-// `un`).
+// `un`). The float COMPARES split for the same reason and one more: NaN makes them a partial order,
+// so `negateCond` may flip `f==` and `f!=` into each other and no other — `!(a f> b)` is not
+// `a f<= b`, and it prints as the `!` it is.
 export type BinOp =
   | 'f+'
   | 'f-'
   | 'f*'
   | 'f/'
+  | 'f<'
+  | 'f<='
+  | 'f>'
+  | 'f>='
+  | 'f=='
+  | 'f!='
   | '+'
   | '-'
   | '*'
@@ -296,7 +344,15 @@ export type Stmt =
   // `break;` / `continue;` — a loop early-exit / next-iteration jump. Emitted ONLY when the target is
   // the innermost enclosing loop (bare C break/continue cannot express a multi-level exit; a deeper
   // target declines). SGI/IDO Pascal has neither, so its backend loud-fails them (like `field`/`cast`).
-  | { k: 'break' }
+  //
+  // `ofSwitch` makes the `break` the innermost enclosing SWITCH's instead: it leaves the arm it sits
+  // in for the code after the switch (`case 1: if (c) break; case 2: …`). Legal only inside a switch
+  // arm with no loop or switch between it and that arm — the producer's contract (structure.ts
+  // `switchBreakAt`). The C family prints both as `break;`, so its printer refuses each where C
+  // would bind it to the other kind — a plain one between `case` labels, this one in a loop body
+  // (backend/cfamily.ts `refuseMisboundBreak`). A pass that reads `break` as a loop exit must skip
+  // this one (l3/reindex.ts `hasLoopExit`).
+  | { k: 'break'; ofSwitch?: true }
   | { k: 'continue' }
   // A multi-way `switch` over an integer scrutinee (recovered from a comparison tree — Regime A — or
   // a jump-table `switch_br` — Regime B). `cases` are emitted IN ARRAY ORDER; `default` (if present)
@@ -399,6 +455,13 @@ export interface SFn {
      *  one are deliberately left unstamped even where the offset is in hand — see the refusal at
      *  the structurer's build site for the measurement that decided it. */
     slots?: number[];
+    /** The declaration's initializer, element by element, null where the source left one out
+     *  (`SImage.init`) — present only on the copy the C-family emitter prints, where
+     *  l3/constinit.ts folded the block copy of the compiler's anonymous constant image into it
+     *  (`u8 sp0[16] = { … };`). Never on a tree a pass sees. */
+    init?: (number | InitAddress | null)[];
+    /** that initializer is spelled as a string literal — the image was written as one */
+    initString?: true;
   }[];
   /** project globals referenced with a known declaration shape (symbol map) — typed for the
    *  legalization env (exprCType) but NEVER declared by a backend: the project's own headers
@@ -408,6 +471,11 @@ export interface SFn {
    *  the top of its body ahead of the locals. Unlike `globals`, the backend declares these: no
    *  header does, because the source defined them here. */
   statics?: SStatic[];
+  /** The compiler's own constant images this function copies a local's initializer from
+   *  (structure/local-statics.ts), under labels the source never wrote. Not statics: no declaration
+   *  may spell one, so the C-family emitter folds each into the initializer of the local its copy
+   *  fills (l3/constinit.ts), and a backend that cannot refuses. */
+  images?: SImage[];
   retType: IrType;
   body: Stmt[];
   /** Struct types this function's fields reference, declared above it by the backend. Empty
@@ -426,31 +494,64 @@ export interface SFn {
    *  and `l3/slotorder.ts` is the identity — never "ascending by default". */
   slotOrder?: 'ascending' | 'descending';
   /** Each declared callee's parameter types (an entry the printer cannot spell is `undefined`):
-   *  what an argument converts to. Read by the C-family printer where `dialect` says C++, which
-   *  refuses three conversions C makes implicitly (backend/cfamily.ts `argConversion`), and by the
-   *  pointer-cell conversions in every dialect (l3/ptrcell.ts). */
+   *  what an argument converts to. Read by the C-family printer where `dialect` says C++ or
+   *  `strictConversions` is set, either of which refuses three conversions C makes implicitly
+   *  (backend/cfamily.ts `argConversion`), and by the pointer-cell conversions in every dialect
+   *  (l3/ptrcell.ts). */
   declaredArgs?: Readonly<Record<string, readonly (string | undefined)[]>>;
   /** Each declared callee's return type as the project spells it, never printed: whether a call a
    *  pointer cell is compared with returns a pointer (l3/ptrcell.ts). */
   declaredReturns?: Readonly<Record<string, string>>;
   /** The emitted C is compiled AS C++. An emission policy like `slotOrder`. */
   dialect?: 'c++';
+  /** The compiler parses a designated element in an initializer (`[8] = 2`) — a fact of its
+   *  dialect, carried from `compilerBehaviors.designatedInitializers`. An emission policy: the
+   *  C-family printer spells an initializer's left-out run by index where present, as zeros where
+   *  not. */
+  designators?: true;
+  /** The compiler refuses C's implicit pointer conversions in C as well, as C++ does — carried from
+   *  `compilerBehaviors.strictPointerConversions`. An emission policy: the C-family printer casts an
+   *  argument to its declared parameter (`declaredArgs`), and a pointer of another pointee written
+   *  into a pointer slot, wherever it would for C++. */
+  strictConversions?: true;
+}
+
+/** An initial element that is an ADDRESS CONSTANT (ir/core.ts `LocalObject.relocs`): `symbol`'s
+ *  address plus `addend` bytes, held in the element's integer type — a global's, which a
+ *  declaration outside the function names. */
+export interface InitAddress {
+  symbol: string;
+  addend: number;
 }
 
 /** One function-scope static's definition: `static [const] T name[count] = { init };`. `init` is
- *  the initial elements in order, absent for a static with no initializer (the target's bss).
- *  `align` is an alignment in bytes wider than the type's own, which the definition must state. */
+ *  the initial elements in order, absent for a static with no initializer (the target's bss); an
+ *  element the target relocates is the {@link InitAddress} it holds. `align` is an alignment in
+ *  bytes wider than the type's own, which the definition must state. */
 export interface SStatic {
   name: string;
   type: IrType;
   const?: true;
   align?: number;
-  init?: number[];
+  init?: (number | InitAddress)[];
   /** the initializer is spelled as a string literal — a byte array the compiler aligns as a
    *  string (structure/local-statics.ts) */
   string?: true;
 }
 
+/** One constant image of the compiler's own (ir/core.ts `LocalObject.anonymous`), named by its
+ *  label: an integer array typed by the directives that wrote it, and its initializer element by
+ *  element — null where the source left one out (padding in the image, which C supplies as zero),
+ *  the {@link InitAddress} an element the target relocates holds, and ending at the last one it
+ *  spelled, so it may be shorter than `type`. */
+export interface SImage {
+  name: string;
+  type: IrType;
+  init: (number | InitAddress | null)[];
+  /** the image was written as a string literal (`.ascii`) */
+  string?: true;
+}
+
 /** A struct declaration surfaced to the backend (name + field list). Mirrors the IR struct
  *  type but lives in the neutral AST so a backend can print `struct N { ... };`. */
 export interface StructType {
@@ -471,6 +572,13 @@ export interface LanguageBackend {
    *  cannot print it turns a whole function that used to decompile into a loud stub. The
    *  structurer reads it through `StructureOptions.spellSwitchFallthrough`. */
   readonly spellsSwitchFallthrough: boolean;
+  /** Can this language spell a `break` that leaves a `switch` arm before its end
+   *  (`{ k: 'break', ofSwitch: true }`)? C and C++ can; Pascal has no `break` at all, and its
+   *  backend loud-fails the node. Asked for the same reason as `spellsSwitchFallthrough`: a
+   *  closed arm with a mid-arm exit (`case 10: if (a) { if (b) break; g(1); } h(2); break;`) also
+   *  spells without one, by copying the code the arm meets at into each path, which Pascal prints.
+   *  The structurer reads it through `StructureOptions.spellSwitchBreak`. */
+  readonly spellsSwitchBreak: boolean;
   emit(fn: SFn): string;
   // Spell ONE LINE of text as a comment in this language (C block comments, Pascal `(* … *)`).
   // Used by the annotate-mode stub path to carry the failure reason + the original asm
@@ -560,6 +668,10 @@ export function exprEquals(a: Expr, b: Expr): boolean {
         (typeof a.fn === 'string' || typeof bb.fn === 'string' ? a.fn === bb.fn : exprEquals(a.fn, bb.fn)) &&
         (a.wide64 ?? false) === (bb.wide64 ?? false) &&
         (a.sret === undefined ? bb.sret === undefined : bb.sret !== undefined && typeEquals(a.sret, bb.sret)) &&
+        (a.returns === undefined
+          ? bb.returns === undefined
+          : bb.returns !== undefined && typeEquals(a.returns, bb.returns)) &&
+        (a.byValue ?? []).map((x) => x.at).join() === (bb.byValue ?? []).map((x) => x.at).join() &&
         a.args.length === bb.args.length &&
         a.args.every((x, i) => exprEquals(x, bb.args[i]))
       );
@@ -636,6 +748,60 @@ export function stmtsEqual(a: readonly Stmt[], b: readonly Stmt[]): boolean {
   return a.length === b.length && a.every((s, i) => stmtEquals(s, b[i]));
 }
 
+/** The node a merge KEEPS when it found `a` and `b` equal ({@link exprEquals}) and drops one: `a`,
+ *  with every compare carrying `unsignedCmp` if it did in EITHER. Equality ignores the evidence
+ *  because two compares that print alike are one expression to C; but when one of them was lowered
+ *  from an `icmp_u` and the other from a signed compare, the kept node now stands for both paths,
+ *  and the finished-tree judgment (l3/typing.ts `signedOverUnsignedCompare`) can only see the
+ *  unsigned one's obligation if the node still says so. Keeping `a` bare would publish a signed
+ *  `x < y` on the path that compared unsigned (an slt arm and an sltu arm merged by l3/tailmerge.ts
+ *  under `/signed-cmp`). Precondition: `exprEquals(a, b)`, so the two trees walk in step. */
+export function unionEvidence(a: Expr, b: Expr): Expr {
+  // `mapExprChildren` calls `f` in `exprChildren` order (an object literal evaluates its
+  // properties in source order), so the i-th call pairs with b's i-th child. Not by identity: one
+  // child object may sit in two positions, each with its own counterpart in `b`.
+  const bs = exprChildren(b);
+  let i = 0;
+  const out = mapExprChildren(a, (c) => unionEvidence(c, bs[i++]));
+  return out.k === 'bin' && b.k === 'bin' && b.unsignedCmp === true && out.unsignedCmp !== true
+    ? { ...out, unsignedCmp: true }
+    : out;
+}
+
+/** {@link unionEvidence} over two statements {@link stmtEquals} found equal. */
+export function unionStmtEvidence(a: Stmt, b: Stmt): Stmt {
+  switch (a.k) {
+    case 'assign':
+      return b.k === 'assign' ? { ...a, value: unionEvidence(a.value, b.value) } : a;
+    case 'store':
+      return b.k === 'store'
+        ? { ...a, lval: unionEvidence(a.lval, b.lval), value: unionEvidence(a.value, b.value) }
+        : a;
+    case 'exprstmt':
+      return b.k === 'exprstmt' ? { ...a, value: unionEvidence(a.value, b.value) } : a;
+    case 'return':
+      return b.k === 'return' && a.value !== undefined && b.value !== undefined
+        ? { ...a, value: unionEvidence(a.value, b.value) }
+        : a;
+    case 'if':
+      return b.k === 'if'
+        ? {
+            ...a,
+            cond: unionEvidence(a.cond, b.cond),
+            then: unionStmtsEvidence(a.then, b.then),
+            else: unionStmtsEvidence(a.else, b.else),
+          }
+        : a;
+    default:
+      return a;
+  }
+}
+
+/** {@link unionStmtEvidence} over two lists {@link stmtsEqual} found equal. */
+export function unionStmtsEvidence(a: readonly Stmt[], b: readonly Stmt[]): Stmt[] {
+  return a.map((s, i) => unionStmtEvidence(s, b[i]));
+}
+
 /** THE spelling of an `opaque`'s gap reason, in one place: `structure.ts` writes it into the
  *  marker, `contracts.ts` matches on it to prove the gap was not dropped, and the benchmark
  *  classifies declines by it. Two spellings make that contract silently vacuous — enforced-looking
@@ -875,6 +1041,44 @@ function* subterms(e: Expr): Generator<Expr> {
   }
 }
 
+export type Assign = Extract<Stmt, { k: 'assign' }>;
+
+/** Every `assign` in the tree, at any nesting. ORDER-FREE: its callers ask what a name is ever
+ *  assigned, never which assignment comes first, so a switch default's position does not matter. */
+export function assignsIn(body: readonly Stmt[]): Assign[] {
+  const out: Assign[] = [];
+  const visit = (s: Stmt): void => {
+    if (s.k === 'assign') {
+      out.push(s);
+    }
+    stmtChildren(s).forEach(visit);
+  };
+  body.forEach(visit);
+  return out;
+}
+
+/** Grow `seed` over assignments to a fixpoint: an assignment adds its target when `propagates`
+ *  says its value carries what the set holds so far. A FLOW-INSENSITIVE taint, which is what each
+ *  caller wants — the question is what a name may EVER hold, so one assignment anywhere is
+ *  enough. Callers own the seed and the rule; this owns only the iteration. */
+export function taintOverAssigns(
+  assigns: readonly Assign[],
+  seed: Iterable<string>,
+  propagates: (a: Assign, tainted: ReadonlySet<string>) => boolean,
+): Set<string> {
+  const tainted = new Set(seed);
+  for (let grew = true; grew;) {
+    grew = false;
+    for (const a of assigns) {
+      if (!tainted.has(a.name) && propagates(a, tainted)) {
+        tainted.add(a.name);
+        grew = true;
+      }
+    }
+  }
+  return tainted;
+}
+
 /** The statements a statement DIRECTLY contains, in the order a backend prints them — a `switch`
  *  splices its default in at `defaultAt` for that reason. NOTE for document-order walks: a `for`'s
  *  init/inc are listed here while its cond is in stmtExprs — a walker visiting exprs-then-stmts
@@ -1077,8 +1281,76 @@ export const NEGATE_REL: Partial<Record<BinOp, BinOp>> = {
   '<=': '>',
   '==': '!=',
   '!=': '==',
+  // C's float `==` is false on a NaN and `!=` true, so these two are each other's negation; the
+  // ordered four have none in the operator vocabulary (the BinOp note).
+  'f==': 'f!=',
+  'f!=': 'f==',
 };
 
+/** The compares under `e`'s connectives whose runtime helper names the relation the source spelled
+ *  (`helperRel`), each answering whether it spells that relation now. `negateCond` flips every one
+ *  of them at once, through De Morgan. */
+function helperRelLeaves(e: Expr, out: boolean[] = []): boolean[] {
+  if (e.k === 'bin' && (e.op === '&&' || e.op === '||')) {
+    helperRelLeaves(e.l, out);
+    helperRelLeaves(e.r, out);
+  } else if (e.k === 'bin' && e.helperRel !== undefined) {
+    out.push(e.op === e.helperRel);
+  }
+  return out;
+}
+
+/** Whether `e` spells, at every compare of it whose runtime helper names the relation the source
+ *  spelled, that relation — so that negating `e` recompiles to the other helper at each of them:
+ *  the relation's twin and its `!` alike, since gcc folds `!(a == b)` into `a != b`. An arm swap
+ *  that would negate it keeps `e` and its arm order instead. */
+export function keepsHelperRel(e: Expr): boolean {
+  const leaves = helperRelLeaves(e);
+  return leaves.length > 0 && leaves.every((own) => own);
+}
+
+/** Whether negating `e` puts every such compare back on its helper's relation: the swap a pass
+ *  would otherwise leave alone is the one that spells the helpers. A condition mixing the two has
+ *  neither answer, and no arm order spells it. */
+export function regainsHelperRel(e: Expr): boolean {
+  const leaves = helperRelLeaves(e);
+  return leaves.length > 0 && leaves.every((own) => !own);
+}
+
+/** A loop's stay condition `P && S` whose compares under `S` are all negated off their helper's
+ *  relation, and whose `P` negates none: `{ head: P, guard: !S }`, which the loop spells
+ *  `while (P) { if (!S) break; … }` — the same tests in the same order, calling the helpers the
+ *  source called. `while (P && S)` has no spelling of that `S` that calls the helper (gcc folds
+ *  `!(a == b)` into `a != b`); the break guard is how the source wrote it before the branch fold
+ *  joined the two tests. Null when the condition already spells every helper's relation, or when no
+ *  split of its `&&` chain separates the two kinds of compare. */
+export function splitHelperBreak(cond: Expr): { head: Expr; guard: Expr } | null {
+  if (keepsHelperRel(cond) || helperRelLeaves(cond).length === 0) {
+    return null;
+  }
+  const conj: Expr[] = [];
+  const flatten = (e: Expr): void => {
+    if (e.k === 'bin' && e.op === '&&') {
+      flatten(e.l);
+      flatten(e.r);
+    } else {
+      conj.push(e);
+    }
+  };
+  flatten(cond);
+  const and = (xs: Expr[]): Expr => xs.reduce((l, r) => ({ k: 'bin', op: '&&', l, r }));
+  // The longest prefix that negates no helper leaf; the rest must negate every one it holds.
+  let k = 0;
+  while (k < conj.length && helperRelLeaves(conj[k]).every((own) => own)) {
+    k++;
+  }
+  if (k === 0 || k === conj.length) {
+    return null;
+  }
+  const rest = and(conj.slice(k));
+  return regainsHelperRel(rest) ? { head: and(conj.slice(0, k)), guard: negateCond(rest) } : null;
+}
+
 export function negateCond(e: Expr): Expr {
   if (e.k === 'bin') {
     const flipped = NEGATE_REL[e.op];

package/src/l3/basecse.ts

@@ -248,15 +248,35 @@ function collect(stmts: Stmt[], c: Collected, loop: boolean): void {
   }
 }
 
-/** Rewrite every `index`-of-hoistable-base whose key is hoisted so its base becomes the hoist local. */
-function rewrite(e: Expr, localFor: Map<string, string>): Expr {
+/** Rewrite every `index`-of-hoistable-base whose key is hoisted so its base becomes the hoist local.
+ *
+ *  A `volatile` cast over a hoisted LEAF keeps its cast and takes the local under it:
+ *  `((volatile s32 *)0x40000D4)[2]` beside a hoisted `p0 = (s32 *)0x40000D4` becomes
+ *  `((volatile s32 *)p0)[2]`. The cast is never hoisted itself (`isHoistableBase`), since the local
+ *  would drop its qualifier; under it the local is the same address, so the access keeps its
+ *  qualifier and its cell, and reads the register the compiler already holds the base in. Inline, a
+ *  qualified access at a nonzero offset makes agbcc materialize a second literal with the offset
+ *  folded in (`.word 0x40000dc` + `ldr r0, [r0]`) where the source read `[r4, #0x8]` off the base
+ *  it had loaded — the `dmaRegs[2];` that ends a DMA macro. `leafLocal` maps a hoisted leaf to its
+ *  local, whichever key hoisted it. */
+function rewrite(e: Expr, localFor: Map<string, string>, leafLocal: ReadonlyMap<string, string>): Expr {
   if (e.k === 'index' && isHoistableBase(e.base)) {
     const nm = localFor.get(keyOf(e.base, e.width, e.signed));
     if (nm) {
-      return { ...e, base: { k: 'var', name: nm }, idx: rewrite(e.idx, localFor) };
+      return { ...e, base: { k: 'var', name: nm }, idx: rewrite(e.idx, localFor, leafLocal) };
+    }
+  }
+  if (e.k === 'index' && e.base.k === 'cast' && e.base.volatile === true && isHoistableLeaf(e.base.e)) {
+    const nm = leafLocal.get(leafId(e.base.e));
+    if (nm) {
+      return {
+        ...e,
+        base: { ...e.base, e: { k: 'var', name: nm } },
+        idx: rewrite(e.idx, localFor, leafLocal),
+      };
     }
   }
-  return mapExprChildren(e, (c) => rewrite(c, localFor));
+  return mapExprChildren(e, (c) => rewrite(c, localFor, leafLocal));
 }
 
 /** One base under consideration, keyed as `(base, width, signedness)`. */
@@ -784,7 +804,15 @@ export function hoistBaseLocals(
     });
   }
 
-  const rewritten = sfn.body.map((s) => mapStmtExprs(s, (e) => rewrite(e, localFor)));
+  const leafLocal = new Map<string, string>();
+  for (const k of hoisted) {
+    const b = meta.get(k)!.base;
+    const leaf = leafId(b.k === 'cast' ? b.e : b);
+    if (!leafLocal.has(leaf)) {
+      leafLocal.set(leaf, localFor.get(k)!);
+    }
+  }
+  const rewritten = sfn.body.map((s) => mapStmtExprs(s, (e) => rewrite(e, localFor, leafLocal)));
   // The new inits join the tree's LEADING run of base inits rather than being prepended above it:
   // when rank's /livebase re-runs this pass the head already carries the default run's, and
   // blindly prepending would spell the new base's pool load above locals the compiler loads first.