@asmlift/core 0.9.0 → 0.10.0

package/src/raise/floathelpers.ts

@@ -1,17 +1,20 @@
 // asmlift — the soft-float boundary (L1 recognition): where integer words become floats.
 //
-// Three things cross it. A runtime helper whose op is a float op (`isFloatHelper`) — the peer of
+// Four things cross it. A runtime helper whose op computes on floats (`isFloatHelper`) — the peer of
 // `raise/widehelpers.ts`, gated by the target's runtime table rather than a hardware capability.
-// A parameter an ordinary callee declares `double` (the frontend's `doubles` on the call). And a
+// A parameter an ordinary callee declares `double` (the frontend's `doubles` on the call). The
+// result of an ordinary callee declared to return a floating type (its `floatReturn`). And a
 // double literal, two constant words, where the target states their order
 // (`TargetDescription.doubleArgWords`) and its compiler reads a literal back
-// (`compilerBehaviors.roundTripsDoubleLiterals`). What sets all three apart from the integer
+// (`compilerBehaviors.roundTripsDoubleLiterals`). What sets all four apart from the integer
 // helpers is the value's KIND: the words are bits in integer registers, and the pass re-types them
 // as floats, which only data flow may justify — see the function below.
+import { constWord } from '../ir/bits';
 import { Fn, Op, Value, mkOp, mkValue, replaceAllUsesWith } from '../ir/core';
 import { doubleBits, doubleOf } from '../ir/float-bits';
-import { T } from '../ir/types';
-import { arrivesAsDeclared, helperOp, isFloatHelper, lookupHelper } from '../runtime-helpers';
+import { type Opcode, fcmpOfTruth } from '../ir/opcodes';
+import { T, intWidth } from '../ir/types';
+import { arrivesAsDeclared, floatSidesOf, helperOp, isFloatHelper, lookupHelper } from '../runtime-helpers';
 import type { TargetDescription } from '../target';
 import { RaiseUnsupportedError } from './errors';
 import { isArgumentPair } from './pairparams';
@@ -34,17 +37,36 @@ import { isArgumentPair } from './pairparams';
  *     target's word order into an `fconst` (`a + 1.5` stages `0x3ff80000` in r2, its high word);
  *   - an argument the function also reads on its own, as a word or as one half of a pair;
  *   - a result read as a word or a half (`*(int *)&c` is a double's HIGH word, in r0), passed to
- *     any other call, or carried across an edge.
+ *     any other call, or carried across an edge;
+ *   - a result NOTHING reads. Folded, it would be a dead float op, and `dce` would delete the
+ *     arithmetic. Optimising (-O1, -O2), agbcc deletes a helper call whose result is dead
+ *     (`s = a * b; g(); return 0;` calls no `__mulsf3`), so the result's one reader was a later call
+ *     that took it in r0, and a guessed arity does not count a register a call wrote (frontend/ssa.ts
+ *     `fallbackArgc`, `trimClobberedCallArgs`): `g1(a * b)` with `g1` undeclared reads as
+ *     `__mulsf3(); return g1();`, and folded would print `return g1();`. A double's pair refuses
+ *     that shape at the frontend, naming the half the next call reads; a single is one word, so it
+ *     reaches here. At -O0 the rule is not asked: agbcc stores the result to the frame, which reads
+ *     it, and nothing folds there, its arguments being read from frame homes. A frontend that reads
+ *     those homes must re-measure this. A result some other op ALSO reads is not refused:
+ *     `s = a * b; g(s); return s;` and `s = a * b; g(); return s;` are the same bytes on agbcc, and
+ *     a declaration of `g` closes the trim's `g()` reading (`trimClobberedCallArgs`).
  *  A call refused takes every call its result feeds or is fed by with it, so what folds is a closed
- *  set of floats and verify's float rule holds by construction. */
+ *  set of floats and verify's float rule holds by construction.
+ *
+ *  A CONVERSION HAS AN INTEGER ON ONE SIDE (`floatSidesOf`), and only its float side is held to the
+ *  rule above: `(float)i` converts whatever integer `i` is, a parameter, a load or a sum, and
+ *  `(int)x` hands an integer to anything. Its result must still be read, by the dead-result rule,
+ *  and a float the function also reads as a word is no float source for it either. */
 export function recognizeFloatHelpers(fn: Fn, target: TargetDescription): boolean {
   const table = target.runtimeHelpers ?? {};
   let sites: Op[] = [];
   const consumers = new Map<Op, readonly number[]>();
   const def = new Map<Value, Op>();
   const users = new Map<Value, Array<Op | null>>(); // null: an edge argument
+  const returners = new Map<Op, string>(); // ordinary calls declared to return a floating type
   const use = (v: Value, by: Op | null) => users.set(v, [...(users.get(v) ?? []), by]);
   const helperOf = (op: Op) => (op.opcode === 'call' ? lookupHelper(table, String(op.attrs.target)) : undefined);
+  const sidesOf = (op: Op) => floatSidesOf(helperOf(op)!);
   for (const block of fn.blocks) {
     for (const op of block.ops) {
       op.results.forEach((r) => def.set(r, op));
@@ -64,9 +86,12 @@ export function recognizeFloatHelpers(fn: Fn, target: TargetDescription): boolea
       } else if (!helper && op.opcode === 'call' && Array.isArray(op.attrs.doubles)) {
         consumers.set(op, op.attrs.doubles as number[]);
       }
+      if (!helper && op.opcode === 'call' && typeof op.attrs.floatReturn === 'string') {
+        returners.set(op, op.attrs.floatReturn);
+      }
     }
   }
-  if (!sites.length && !consumers.size) {
+  if (!sites.length && !consumers.size && !returners.size) {
     return false;
   }
   // A projection nothing reads is not a read of a half: `dce` runs ahead of this pass only after a
@@ -78,7 +103,8 @@ export function recognizeFloatHelpers(fn: Fn, target: TargetDescription): boolea
   // same call as a word is a word read.
   const floatUse = (u: Op | null, v: Value, calls: ReadonlySet<Op>): boolean =>
     u !== null &&
-    (calls.has(u) || (consumers.has(u) && u.operands.every((o, i) => o !== v || consumers.get(u)!.includes(i))));
+    ((calls.has(u) && sidesOf(u).operands) ||
+      (consumers.has(u) && u.operands.every((o, i) => o !== v || consumers.get(u)!.includes(i))));
   const floatsOnly = (v: Value, calls: ReadonlySet<Op>) => (users.get(v) ?? []).every((u) => floatUse(u, v, calls));
   const entry = fn.blocks[0].params;
   // A `concat` of the same two slots in the same order as `d`: the frontend builds one afresh at each
@@ -98,24 +124,20 @@ export function recognizeFloatHelpers(fn: Fn, target: TargetDescription): boolea
       users.get(d.operands[0])!.every((u) => samePair(u, d) && floatsOnly(u.results[0], calls))
     );
   };
+  // A SINGLE AN ORDINARY CALLEE IS DECLARED TO RETURN is one whole word in the return register, so
+  // it is a float source as a helper's result is. A double is not: the frontend reads one word of
+  // it (`declaredReturnWidth` sizes no floating type), and that word is not the value.
+  const declaredSingle = (d: Op) => returners.get(d) === 'float' && intWidth(d.results[0].type) === 32;
   const fromCall = (v: Value, calls: ReadonlySet<Op>) => {
     const d = def.get(v);
-    return d !== undefined && calls.has(d);
+    return d !== undefined && ((calls.has(d) && sidesOf(d).result) || declaredSingle(d));
   };
   // A CONSTANT WORD, as a compiler may build one in two instructions: agbcc moves a word that is a
   // shifted byte as `mov`+`lsl` (thumb.md:66, `thumb_shiftable_const` at thumb.c:61) and one in
   // -255..-1 as `mov`+`neg` (thumb.md:88), so the high word of 2.0 reaches r3 as `0x80 << 23`. Its
-  // value, or undefined where `v` is no constant.
-  const wordOf = (v: Value): number | undefined => {
-    const d = def.get(v);
-    if (d?.opcode === 'const') {
-      return Number(d.attrs.value);
-    }
-    const shift = d?.opcode === 'shl' ? d.attrs.imm : undefined;
-    const w =
-      d?.operands.length === 1 && (d.opcode === 'neg' || typeof shift === 'number') ? wordOf(d.operands[0]) : undefined;
-    return w === undefined ? undefined : d!.opcode === 'neg' ? -w | 0 : (w << (shift as number)) | 0;
-  };
+  // value, or undefined where `v` is no constant — the shared word evaluator's answer (ir/bits.ts).
+  const words = { defs: def };
+  const wordOf = (v: Value): number | undefined => constWord(words, v) ?? undefined;
   // A LITERAL IS TWO CONSTANT WORDS, HIGH WORD FIRST on a target whose double crosses a call in
   // general words (`TargetDescription.doubleArgWords`) — the order that makes the long long naming
   // of the same pair another number. Its bits, or undefined where the pair is no literal, the target
@@ -138,21 +160,78 @@ export function recognizeFloatHelpers(fn: Fn, target: TargetDescription): boolea
   };
   const literal = (v: Value, calls: ReadonlySet<Op>) => literalBits(v) !== undefined && floatsOnly(v, calls);
   const source = (v: Value, calls: ReadonlySet<Op>) => argument(v, calls) || fromCall(v, calls) || literal(v, calls);
+  // A COMPARE FOLDS THROUGH THE TESTS OF ITS RESULT, which is libgcc's three-way answer: each reader
+  // must be a test of that integer against 0, and the compare the test then computes is read off
+  // the helper's contract — the sign that orders the operands, and its value on a NaN (`unordered`)
+  // — against `FCMP_TRUTH`. A test whose answer is no compare of the operands (always true, or true
+  // on both orders but not on equality), or a reader that is no test, refuses the helper.
+  const tests = new Map<Op, CompareTest[]>();
+  sites = sites.filter((op) => {
+    const unordered = helperOf(op)!.unordered;
+    if (unordered === undefined) {
+      return true;
+    }
+    const found = compareTests(op.results[0], users, def, wordOf, unordered);
+    if (found !== null) {
+      tests.set(op, found);
+    }
+    return found !== null;
+  });
   for (;;) {
     const calls = new Set(sites);
-    const kept = sites.filter(
-      (op) =>
-        op.operands.every((o) => source(o, calls)) &&
-        (users.get(op.results[0]) ?? []).every(
-          (u) => deadHalf(u) || floatUse(u, op.results[0], calls) || u?.opcode === 'ret',
-        ),
-    );
+    const kept = sites.filter((op) => {
+      const sides = sidesOf(op);
+      const read = (users.get(op.results[0]) ?? []).filter((u) => !deadHalf(u));
+      return (
+        (!sides.operands || op.operands.every((o) => source(o, calls))) &&
+        read.length > 0 &&
+        (!sides.result || read.every((u) => floatUse(u, op.results[0], calls) || u?.opcode === 'ret'))
+      );
+    });
     if (kept.length === sites.length) {
       break;
     }
     sites = kept;
   }
   const calls = new Set(sites);
+  // A DECLARED FLOATING RETURN HAS NO FALLBACK EITHER. The candidate prints the call against its
+  // declaration, so its result stored, compared, narrowed, carried across an edge in an integer
+  // variable or handed to any other call is CONVERTED there — `u.f = f(); g = u.b[0];` lifted as
+  // `g = f();` compiles to `bl f; bl __fixsfsi` — where the bytes moved the bits. So a single may
+  // go only where a helper's result may (a helper the fold keeps, a `double` parameter, the
+  // return), and is retyped a float; a double read off its one word goes nowhere. A result nothing
+  // reads is a call statement, and stays one.
+  const returned = new Map<Op, Value>();
+  for (const [op, spelled] of returners) {
+    const r = op.results[0];
+    const read = (users.get(r) ?? []).filter((u) => !deadHalf(u));
+    if (read.length === 0) {
+      continue;
+    }
+    if (!declaredSingle(op) || !read.every((u) => floatUse(u, r, calls) || u?.opcode === 'ret')) {
+      throw new RaiseUnsupportedError(
+        `cannot lift '${fn.name}': '${String(op.attrs.target)}' is declared to return ${spelled}, which this ` +
+          'target hands back as bits in a general register, and its result is read here as something ' +
+          'other than that float — a conversion the bytes do not make',
+      );
+    }
+    returned.set(op, mkValue(T.f32()));
+  }
+  // A FLOAT RETURNED MAKES THE FUNCTION'S RETURN A FLOAT, so every other `ret` converts what it
+  // hands back: `return 5;` beside `return fget();` compiles to the bits of 5.0f where the asm
+  // hands back the word 5. Each value a `ret` reads must then be a float this pass makes — a kept
+  // helper's result or a declared single's.
+  const madeFloat = (v: Value) => {
+    const d = def.get(v);
+    return d !== undefined && (returned.has(d) || (calls.has(d) && sidesOf(d).result));
+  };
+  const rets = fn.blocks.flatMap((b) => b.ops.filter((op) => op.opcode === 'ret' && op.operands.length > 0));
+  if (rets.some((r) => r.operands.some(madeFloat)) && !rets.every((r) => r.operands.every(madeFloat))) {
+    throw new RaiseUnsupportedError(
+      `cannot lift '${fn.name}': it returns a float on one path, and another return of this function hands ` +
+        'back an integer word, which C would convert to that float',
+    );
+  }
   // A DECLARED DOUBLE HAS NO FALLBACK. A helper the fold refuses stays a call for
   // `refuseUnmodelledHelpers` to gap, but an ordinary callee is no helper, and its two words handed
   // on as integers are the wrong number — so a double parameter nothing here can hand a double
@@ -170,7 +249,7 @@ export function recognizeFloatHelpers(fn: Fn, target: TargetDescription): boolea
       }
     }
   }
-  if (!sites.length && !consumers.size) {
+  if (!sites.length && !consumers.size && !returned.size) {
     return false;
   }
   const floatOf = new Map<Value, Value>();
@@ -209,23 +288,60 @@ export function recognizeFloatHelpers(fn: Fn, target: TargetDescription): boolea
     }
     floatOf.set(o, whole);
   };
+  for (const [op, now] of returned) {
+    floatOf.set(op.results[0], now);
+  }
   for (const op of sites) {
     const helper = helperOf(op)!;
-    op.operands.forEach((o, i) => retype(o, helper.params[i]));
-    floatOf.set(op.results[0], float(helper.returns));
+    const sides = floatSidesOf(helper);
+    if (sides.operands) {
+      op.operands.forEach((o, i) => retype(o, helper.params[i]));
+    }
+    if (sides.result) {
+      floatOf.set(op.results[0], float(helper.returns));
+    }
   }
   for (const [op, at] of consumers) {
     at.forEach((i) => retype(op.operands[i], 64));
   }
+  const folded = new Map<Op, Op>();
+  for (const [op, found] of tests) {
+    if (calls.has(op)) {
+      for (const t of found) {
+        const operands = op.operands.map((o) => floatOf.get(o)!);
+        const fcmp = helperOp(t.opcode, String(op.attrs.target), operands, t.at.results[0]);
+        // The relation the source spelled, where the test leaves it open: `__eqsf2` and `__nesf2`
+        // each fold to `fcmp_oeq` or to `fcmp_une`, by the sense of the branch that tests them
+        // (runtime-helpers.ts `RuntimeHelper.relation`).
+        const relation = helperOf(op)!.relation;
+        if (relation !== undefined) {
+          fcmp.attrs.relation = relation;
+        }
+        folded.set(t.at, fcmp);
+        t.spent.forEach((x) => spent.add(x));
+      }
+    }
+  }
   for (const block of fn.blocks) {
     block.ops = block.ops.flatMap((op) => {
+      // the call stays, its result now the float it was declared
+      if (returned.has(op)) {
+        return [mkOp('call', { operands: op.operands, results: [returned.get(op)!], attrs: op.attrs })];
+      }
+      if (folded.has(op)) {
+        return [folded.get(op)!];
+      }
+      if (calls.has(op) && tests.has(op)) {
+        return [];
+      }
       if (calls.has(op)) {
+        const sides = sidesOf(op);
         return [
           helperOp(
             helperOf(op)!.op!,
             String(op.attrs.target),
-            op.operands.map((o) => floatOf.get(o)!),
-            floatOf.get(op.results[0])!,
+            op.operands.map((o) => (sides.operands ? floatOf.get(o)! : o)),
+            sides.result ? floatOf.get(op.results[0])! : op.results[0],
           ),
         ];
       }
@@ -241,3 +357,108 @@ export function recognizeFloatHelpers(fn: Fn, target: TargetDescription): boolea
   }
   return true;
 }
+
+/** One test of a compare helper's result: the op whose 0/1 value is the test, the float compare
+ *  it computes, and the ops between the result and it, which only it reads. */
+interface CompareTest {
+  at: Op;
+  opcode: Opcode;
+  spent: Op[];
+}
+
+/** The integer compares a test may apply to the helper's result, each against the constant 0. */
+const INT_TEST: Readonly<Record<string, (x: number, y: number) => boolean>> = {
+  icmp_eq: (x, y) => x === y,
+  icmp_ne: (x, y) => x !== y,
+  icmp_slt: (x, y) => x < y,
+  icmp_sle: (x, y) => x <= y,
+  icmp_sgt: (x, y) => x > y,
+  icmp_sge: (x, y) => x >= y,
+  icmp_ult: (x, y) => x >>> 0 < y >>> 0,
+  icmp_ule: (x, y) => x >>> 0 <= y >>> 0,
+  icmp_ugt: (x, y) => x >>> 0 > y >>> 0,
+  icmp_uge: (x, y) => x >>> 0 >= y >>> 0,
+};
+
+/** Every test of `r`, a compare helper's result, or null where some reader of it is none. The tests
+ *  are the spellings agbcc gives a result's relation to 0: an integer compare with the constant 0
+ *  on either side (`cmp r0, #0` before a branch or a 0/1 select), and the three sign-bit forms of a
+ *  value — `r >> 31` (`< 0`), `~r >> 31` (`>= 0`) and `(-r | r) >> 31` (`!= 0`), each a logical
+ *  shift by 31. Each answers by the SIGN of `r` alone, so the helper's three-way result is read at
+ *  -1, 0 and 1 and at its NaN value, and the four answers name the compare in `FCMP_TRUTH`. */
+function compareTests(
+  r: Value,
+  users: ReadonlyMap<Value, ReadonlyArray<Op | null>>,
+  def: ReadonlyMap<Value, Op>,
+  wordOf: (v: Value) => number | undefined,
+  unordered: 1 | -1,
+): CompareTest[] | null {
+  const readers = (v: Value) => users.get(v) ?? [];
+  const only = (v: Value): Op | null => (readers(v).length === 1 ? readers(v)[0] : null);
+  const signBit = (u: Op | null, of: Value): boolean =>
+    u?.opcode === 'shr_u' && u.operands.length === 1 && u.operands[0] === of && u.attrs.imm === 31;
+  const found: CompareTest[] = [];
+  const answer = (at: Op, spent: Op[], test: (x: number) => boolean): boolean => {
+    const truth = [test(-1), test(0), test(1), test(unordered)];
+    const opcode = fcmpOfTruth(truth);
+    if (opcode === undefined) {
+      return false;
+    }
+    found.push({ at, opcode, spent });
+    return true;
+  };
+  for (const u of readers(r)) {
+    if (u === null) {
+      return null;
+    }
+    const cmp = INT_TEST[u.opcode];
+    if (cmp !== undefined && u.operands.length === 2) {
+      const [x, y] = u.operands;
+      const ok =
+        x === r && y !== r && wordOf(y) === 0
+          ? answer(u, [], (v) => cmp(v, 0))
+          : y === r && x !== r && wordOf(x) === 0 && answer(u, [], (v) => cmp(0, v));
+      if (!ok) {
+        return null;
+      }
+      continue;
+    }
+    if (signBit(u, r)) {
+      if (!answer(u, [], (v) => v < 0)) {
+        return null;
+      }
+      continue;
+    }
+    if (u.opcode === 'not' && u.operands.length === 1) {
+      const shift = only(u.results[0]);
+      if (!signBit(shift, u.results[0]) || !answer(shift!, [u], (v) => v >= 0)) {
+        return null;
+      }
+      continue;
+    }
+    // `(-r | r) >> 31`: `r` has two readers, the `neg` and the `or`, and the test is taken at the
+    // `neg`; the `or` is that same test, read when it is reached.
+    if (u.opcode === 'neg' && u.operands.length === 1) {
+      const or = only(u.results[0]);
+      const shift = or ? only(or.results[0]) : null;
+      const pairs =
+        or?.opcode === 'or' &&
+        or.operands.length === 2 &&
+        or.operands.includes(r) &&
+        or.operands.includes(u.results[0]) &&
+        readers(r).includes(or);
+      if (!pairs || !signBit(shift, or!.results[0]) || !answer(shift!, [u, or!], (v) => v !== 0)) {
+        return null;
+      }
+      continue;
+    }
+    if (
+      u.opcode === 'or' &&
+      u.operands.some((o) => o !== r && def.get(o)?.opcode === 'neg' && def.get(o)!.operands[0] === r)
+    ) {
+      continue;
+    }
+    return null;
+  }
+  return found.length > 0 ? found : null;
+}

package/src/raise/gvn.ts

@@ -32,9 +32,9 @@
 //               materializes a multi-use `const` that is live across a call into a named local, and
 //               its own comment records that this exact widening ("the small-constant regression")
 //               already cost matches once.
-//   `undef`   — numbering it would be VACUOUS: two `undef`s in one function always carry different
-//               `key`s (ir/opcodes.ts says so at the opcode), so "same key, therefore same value"
-//               never has two members to collapse.
+//   `undef`   — numbering it would be HARMFUL: two `undef`s of one `key` are a storage's content
+//               and a `copied` move of it into another storage's join (ir/opcodes.ts says so at the
+//               opcode), and one number would erase the move the structurer spells.
 //
 // The gate is a MATCHING policy, not a property of the opcode — which is why it is not a flag on
 // the opcode table, where `const` would satisfy it.

package/src/raise/latch.ts

@@ -3,7 +3,7 @@
 // A loop whose back-edge carries a register copy — `add r3, r0, #0` then `b .L6` — lifts to a block
 // holding nothing but that branch, because SSA construction turns the copy into an EDGE ARGUMENT.
 // The loop is unchanged; its latch has just become a separate empty block between the exit test and
-// the header. Loop DISCOVERY still finds the loop — `structure/loops.ts` reads the same back-edge —
+// the header. Loop DISCOVERY still finds the loop — `ir/loops.ts` reads the same back-edge —
 // but the do-while emitter requires the latch to end in a `cond_br`, an empty one ends in `br`, and
 // the test is at the bottom so the `while` form is unavailable too. The back-edge survives to the
 // `onStack` refusal and the whole function declines with "unrecovered back-edge".
@@ -24,11 +24,13 @@
 // `if` (declining loud on the hazards). The guard therefore survives the fold either way; what the
 // gate preserves is the SHAPE — a forward trampoline is not a latch, and folding one re-casts an
 // unrelated branch as a loop guard — which is the `target-dominates` entry's own note below.
-import { Fn, dominators, foldWriteOrder } from '../ir/core';
+import { Block, Fn, dominators, foldWriteOrder, predecessors, reachForward, successorsOf } from '../ir/core';
+import { effectful } from '../ir/discipline';
+import { analyzeLoops } from '../ir/loops';
 import { type Gate, firstRejection } from '../l3/gates';
 
 /** What the gates below judge: one candidate block and the block its `br` goes to. */
-interface LatchCandidate {
+export interface LatchCandidate {
   block: Fn['blocks'][number];
   target: Fn['blocks'][number];
   dominatesBlock: boolean;
@@ -80,9 +82,9 @@ export const LATCH_GATES: readonly Gate<LatchCandidate>[] = [
  *  SUCCESSOR changes, so an edge that was not a back-edge becomes one. (Dominator sets themselves
  *  only ever shrink — removing a block removes it from every set it was in.)
  *
- *  A predecessor that already branches to the target ends up with two edges into one block. That is
- *  a block whose every edge continues the loop, so it has no exit and loop recovery declines — the
- *  same loud decline it gave before the fold.
+ *  A predecessor that already branches to the target ends up with two edges into one block, each
+ *  carrying its own arguments. Where that predecessor has no other edge the loop has no exit, and
+ *  loop recovery spells it `while (1)` with each edge's own update copy.
  */
 export function foldEmptyLatches(fn: Fn, gates: readonly Gate<LatchCandidate>[] = LATCH_GATES): number {
   let folded = 0;
@@ -124,3 +126,157 @@ export function foldEmptyLatches(fn: Fn, gates: readonly Gate<LatchCandidate>[]
     folded++;
   }
 }
+
+// ── EMPTY EXIT TRAMPOLINES ──────────────────────────────────────────────────────────────────────
+//
+// The same empty block on a loop's way OUT. `for (…) { if (t[i] == k) { r = i; break; } }` keeps
+// `r` in a register the break copies into (`add r2, r1, #0`), and the copy becomes an edge argument
+// of a block that holds nothing but its `br` to the code after the loop — beside a second exit edge
+// (the loop's own test failing) that reaches that code directly. The loop then has two exit targets
+// and none of them is a `return`, so every loop form refuses it, and the back-edge declines loud at
+// `onStack`. Which exit edge carries the block is the compiler's choice: agbcc puts it on the break
+// (`synthetic:break_value`) or on the latch's own exit with the break going direct (kleod
+// `sub_0801E664`).
+//
+// The second exit need not land on the target itself. ido, gcc2.7.2kmc and mwcc lay an `else` the
+// loop sits beside between the loop and its join — `if (f) { for (..) if (a(i) == k) { id = i + 100;
+// break; } } else id = f + 26; out(id);` (`synthetic:break_elsetail`) — so the loop's own exit is an
+// empty `b`/`j` over the `else`, and the break reaches the join only through the code its arm runs.
+// Folding the block there leaves the loop two exit targets all the same — the break arm's head is
+// one. What it buys is that the loop's own exit becomes the join the break arm runs on into, which
+// is the exit a `break` that runs code has to leave for (`codeBreakArm`'s region must reach it). So
+// the scope gate asks whether another exit edge's target REACHES the target, going forward and
+// outside the loop's body.
+//
+// Splicing it out re-points each edge into it at its target with its own arguments, and the loop
+// exits to one block: a `break` that carries its copies, which the structurer already spells. The
+// arguments move soundly for the reason the latch's do: the block has no params and one op, so
+// every value its `br` passes dominates it, and therefore the end of each of its predecessors.
+
+/** One candidate trampoline: the block, where its `br` goes, and the loops it may leave. */
+export interface ExitTrampoline {
+  block: Block;
+  target: Block;
+  /** the predecessors of `block` */
+  preds: readonly Block[];
+  /** does some loop hold every predecessor of `block` but not `block` itself, and leave by another
+   *  edge for `target` as well — landing on it, or on a block that reaches it forward without
+   *  re-entering the loop (`reachForward`)? */
+  sharedExit: boolean;
+  /** does every path from `target` reach a `ret` without an effect on the way? */
+  pureReturn: boolean;
+}
+
+export const EXIT_TRAMPOLINE_GATES: readonly Gate<ExitTrampoline>[] = [
+  {
+    id: 'trampoline-has-params',
+    why: 'a param is a join: the br args may read it, and they would not exist at a predecessor',
+    // the fold then hands a predecessor a value it does not dominate, which `verify` refuses loud
+    sound: false,
+    rejects: (c) => c.block.params.length > 0,
+  },
+  {
+    id: 'trampoline-does-work',
+    why: 'the sole terminator must be an unconditional `br`: folding a `cond_br` block discards its second successor',
+    sound: true,
+    guardedBy: 'latch.test.ts: an exit block whose sole op is a cond_br is never folded',
+    rejects: (c) => c.block.ops[0]?.opcode !== 'br',
+  },
+  {
+    id: 'trampoline-self-branch',
+    why: 'a block branching to itself is an infinite loop rather than a trampoline',
+    sound: false,
+    rejects: (c) => c.target === c.block,
+  },
+  {
+    // The SCOPE of the fold, not its soundness: an exit edge's empty block is harmless to the
+    // structurer wherever it is the loop's one way out, and folding it there would only re-spell
+    // functions that already lift.
+    id: 'trampoline-not-a-second-exit',
+    why: 'only a loop that also leaves for the same target by another edge, or for a block that runs on into it, gains from the fold an exit every edge out can leave for',
+    sound: false,
+    rejects: (c) => !c.sharedExit,
+  },
+  {
+    // A target that only returns already lifts: the structurer takes the edge through the
+    // trampoline as an early `return` and copies the pure tail into it. Kept that way, so the fold
+    // re-spells no function that lifted before it.
+    id: 'trampoline-returns-already',
+    why: 'an exit that only returns is an early `return` arm, which the structurer spells without the fold',
+    sound: false,
+    rejects: (c) => c.pureReturn,
+  },
+];
+
+/** Every path from `b` ends in a `ret` and runs no effect on the way. */
+export function returnsPurely(b: Block): boolean {
+  const seen = new Set<Block>();
+  for (const stack = [b]; stack.length > 0;) {
+    const x = stack.pop()!;
+    if (seen.has(x)) {
+      continue; // a join two paths share, or a cycle — either way judged on its first visit
+    }
+    seen.add(x);
+    if (x.ops.some(effectful)) {
+      return false;
+    }
+    const t = x.ops[x.ops.length - 1];
+    if (t?.opcode === 'ret') {
+      continue;
+    }
+    if (t?.opcode !== 'br' && t?.opcode !== 'cond_br') {
+      return false;
+    }
+    stack.push(...successorsOf(x));
+  }
+  return true;
+}
+
+/** Splice out every empty EXIT TRAMPOLINE the gates above admit; returns how many were removed.
+ *  Iterated, as the latch fold is: one splice can make another block's exit edges shared. */
+export function foldExitTrampolines(fn: Fn, gates: readonly Gate<ExitTrampoline>[] = EXIT_TRAMPOLINE_GATES): number {
+  let folded = 0;
+  for (;;) {
+    const preds = predecessors(fn);
+    const dom = dominators(fn);
+    const loops = [...analyzeLoops(fn, dom).byHeader.values()];
+    const found = fn.blocks.find((b) => {
+      const target = b.ops[0]?.successors[0]?.block;
+      if (target === undefined) {
+        return false;
+      }
+      const into = preds.get(b) ?? [];
+      const sharedExit =
+        into.length > 0 &&
+        loops.some(
+          (nl) =>
+            !nl.body.has(b) &&
+            into.every((p) => nl.body.has(p)) &&
+            nl.exitEdges.some((e) => e.to !== b && reachForward(e.to, dom, nl.body).has(target)),
+        );
+      return (
+        firstRejection(gates, { block: b, target, preds: into, sharedExit, pureReturn: returnsPurely(target) }) === null
+      );
+    });
+    if (!found) {
+      return folded;
+    }
+    const onward = found.ops[0].successors[0];
+    for (const b of fn.blocks) {
+      let repointed = false;
+      for (const op of b.ops) {
+        op.successors.forEach((s, i) => {
+          if (s.block === found) {
+            op.successors[i] = { block: onward.block, args: [...onward.args] };
+            repointed = true;
+          }
+        });
+      }
+      if (repointed) {
+        foldWriteOrder(fn.writeOrder, found, b);
+      }
+    }
+    fn.blocks = fn.blocks.filter((b) => b !== found);
+    folded++;
+  }
+}

package/src/raise/memberarrays.ts

@@ -71,6 +71,7 @@
 import { type Fn, type Op, type Value, defOpMap } from '../ir/core';
 import { type IrType, type StructField, T, scalarTypeForAccess } from '../ir/types';
 import { type Gate, firstRejection } from '../l3/gates';
+import { storeSigned } from './storesign';
 import { firstFreeStructIndex } from './structs';
 
 /** One variable-index access, resolved onto (base value, member offset). */
@@ -260,7 +261,9 @@ function stripExt(v: Value, defs: Map<Value, Op>): Value {
   }
 }
 
-/** `add(x, const)` read as (other operand, constant), or null. The add is commutative. */
+/** `add(x, const)` read as (other operand, constant), or null. The add is commutative. ONE link, not
+ *  a chain, and no `sub`: the shapes this pass reads are a single `add` of a scaled index or of a
+ *  member offset. A chain of constant displacements is ir/alias.ts `constDisplacementOf`. */
 function constAddend(op: Op, defs: Map<Value, Op>): { of: Value; k: number } | null {
   if (op.opcode !== 'add' || op.operands.length !== 2) {
     return null;
@@ -389,7 +392,7 @@ function accessesByBase(fn: Fn, defs: Map<Value, Op>): Map<Value, MemberAccess[]
         op,
         off: add === null ? 0 : add.k,
         elemSize,
-        signed: isLoad ? (op.attrs.signed as boolean) : elemSize === 4,
+        signed: isLoad ? (op.attrs.signed as boolean) : storeSigned(op, elemSize),
         isLoad,
         index: op.operands[1],
         addr: add === null ? null : op.operands[0],
@@ -583,8 +586,11 @@ export function recognizeMemberArrays(
       a.op.operands[0] = g.base;
       a.op.attrs.memberOff = a.off;
       if (!a.isLoad) {
-        // an astore carries no signedness of its own — the member's decides how the index node
-        // types, so the store spells through the same declaration the load does
+        // the member's declaration decides how the index node types, so the store spells through
+        // the same declaration the load does, over any stamp raise/storesign.ts left. No probed
+        // input reaches here with a stamp that disagrees: agbcc lifts a signed narrow constant as
+        // `neg`/`shl`, and the MIPS shapes (`p->t[i] = -1`, `-104` beside a u16 read) take a flat
+        // cast. One that does should keep its stamp, and the index node cast the cell to it.
         a.op.attrs.signed = g.members.find((m) => m.off === a.off)!.signed;
       }
     }