@asmlift/core 0.9.0 → 0.10.0

package/src/raise/shortcircuit.ts

@@ -42,6 +42,7 @@
 // through untouched (a miss, never a miscompile).
 import { disjointConstSlots } from '../ir/alias';
 import {
+  type AttrVal,
   Block,
   Fn,
   Op,
@@ -59,11 +60,11 @@ import {
   successorsOf,
 } from '../ir/core';
 import { effectful, forgetHelperPlacement, orderSensitive, placedAt, speculationUnsafe } from '../ir/discipline';
-import { NEGATED_ICMP } from '../ir/opcodes';
+import { NEGATED_FCMP, NEGATED_ICMP } from '../ir/opcodes';
 import { T } from '../ir/types';
 import { type Gate, firstRejection } from '../l3/gates';
 
-const BOOL_OPS = new Set([...Object.keys(NEGATED_ICMP), 'logic_and', 'logic_or']);
+const BOOL_OPS = new Set([...Object.keys(NEGATED_ICMP), ...Object.keys(NEGATED_FCMP), 'logic_and', 'logic_or']);
 
 /** Run `step` until it stops rewriting, and answer whether it ever did.
  *
@@ -805,7 +806,9 @@ const NEGATE_BUDGET = 8;
 /** The ops computing `!v`, or `null` when `v` cannot be negated.
  *
  *  Two cases, and no third:
- *    - an `icmp_*` in `NEGATED_ICMP` → the swapped-opcode comparison over the SAME operands.
+ *    - an `icmp_*` in `NEGATED_ICMP`, or an `fcmp_*` in `NEGATED_FCMP` → the swapped-opcode
+ *      comparison over the SAME operands. A float compare negates to its unordered twin, never to
+ *      the flipped relation, which a NaN would tell apart.
  *    - a `logic_and`/`logic_or` → the DUAL connective over its two recursively negated operands.
  *      De Morgan: `!(a || b)` is `!a && !b`. This is the only reason the helper is recursive, and
  *      it is what lets a chain fold past its first level (`a || !(b || c)`).
@@ -823,8 +826,9 @@ const NEGATE_BUDGET = 8;
  *    - the cone exceeds `NEGATE_BUDGET` minted ops.
  *
  *  Ops are MINTED, never mutated: the originals stay where the caller hoisted them and die to the
- *  pass list's own `dce: true` (raise/pre-recovery.ts). Only `icmp_*`/`logic_and`/`logic_or` are
- *  ever rebuilt, all of them pure, so no effect can be duplicated or reordered by construction.
+ *  pass list's own `dce: true` (raise/pre-recovery.ts). Only `icmp_*`/`fcmp_*`/`logic_and`/
+ *  `logic_or` are ever rebuilt, all of them pure, so no effect can be duplicated or reordered by
+ *  construction.
  *
  *  Nothing is SHARED between paths, and that is the point rather than a limitation. Memoizing `go`
  *  in a `Map<Value, Value>` is three lines and would make the budget unnecessary — and it would
@@ -833,11 +837,11 @@ const NEGATE_BUDGET = 8;
  *  Nothing collapses the duplicates later either — `numberPureValues` runs as `addrnum`, far ahead
  *  of both folds. So the per-path rebuild is the mechanism and NEGATE_BUDGET is its price.
  *
- *  What it GUARANTEES about its result, which one caller leans on: every op it mints is an `icmp_*`
- *  or a `logic_and`/`logic_or`, so the returned value is always a C boolean. The value form hands an
- *  un-negated head straight on as the merge VALUE, which is why that caller checks booleanness for
- *  itself before deciding whether to call here at all (see its head gate); the branch form needs no
- *  such check, because its result only ever feeds a `cond_br`.
+ *  What it GUARANTEES about its result, which one caller leans on: every op it mints is an `icmp_*`,
+ *  an `fcmp_*` or a `logic_and`/`logic_or`, so the returned value is always a C boolean. The value
+ *  form hands an un-negated head straight on as the merge VALUE, which is why that caller checks
+ *  booleanness for itself before deciding whether to call here at all (see its head gate); the
+ *  branch form needs no such check, because its result only ever feeds a `cond_br`.
  *
  *  PRECONDITION, earned by the caller and not checked here: every value in the cone must dominate
  *  the point the caller splices `ops` into — the minted comparisons reuse the ORIGINAL leaf
@@ -860,8 +864,18 @@ function negateCondOps(defs: Map<Value, Op>, v: Value, budget: number): { ops: O
       return null;
     }
     const out = mkValue(T.unk(32));
-    if (NEGATED_ICMP[d.opcode]) {
-      ops.push(mkOp(NEGATED_ICMP[d.opcode], { operands: [...d.operands], results: [out] }));
+    const negated = NEGATED_ICMP[d.opcode] ?? NEGATED_FCMP[d.opcode];
+    // A float compare whose runtime helper names the relation the source spelled (raise/
+    // floathelpers.ts `attrs.relation`) has no negation that calls the same helper — gcc folds
+    // `!(a == b)` into `a != b` — so a fold that would negate it off that relation refuses, and one
+    // that negates it back onto the relation keeps the stamp for the structurer to spell.
+    const relation = d.attrs.relation;
+    if (negated && relation === d.opcode) {
+      return null;
+    }
+    if (negated) {
+      const attrs: Record<string, AttrVal> = typeof relation === 'string' ? { relation } : {};
+      ops.push(mkOp(negated, { operands: [...d.operands], results: [out], attrs }));
       return out;
     }
     if (d.opcode === 'logic_and' || d.opcode === 'logic_or') {

package/src/raise/softdiv.ts

@@ -49,7 +49,7 @@ export function recognizeSoftDiv(fn: Fn, target: TargetDescription): boolean {
       }
       // Fold only when BOTH arguments were recovered (the signature makes this the norm). A
       // mis-recovered arity leaves the call untouched rather than fabricating a wrong divide.
-      if (op.operands.length !== wordsOf(helper.params) || op.results.length !== 1) {
+      if (op.operands.length !== wordsOf(helper.params, target) || op.results.length !== 1) {
         continue;
       }
       b.ops.splice(i, 1, helperOp(helper.op, op.attrs.target as string, op.operands, op.results[0]));

package/src/raise/storesign.ts

@@ -0,0 +1,153 @@
+// asmlift — the signedness of a NARROW store, read off the constant it stores.
+//
+// A store does not say whether its lvalue is signed: `sh` writes the low half of a register either
+// way, so a 1- or 2-byte `store` gets the unsigned view by convention (`storeSigned` below). But a
+// compiler that converts the constant to the lvalue's type before it materializes it
+// (`compilerBehaviors.narrowStoreConstantTakesLvalueType`) leaves that type in the register's UPPER
+// bits, which the store throws away:
+//
+//     u16 *p; p[6] = -1;       li v0,0xffff   →  const 65535   →  unsigned
+//     s16 *p; p[6] = 0xFFFF;   li v0,-1       →  const -1      →  signed
+//
+// This pass records that as the store's `signed` attr, the slot an `astore` already carries for a
+// member's recorded signedness; raise/arrays.ts and raise/struct-arrays.ts carry it into the
+// `astore` they make. It changes no op and no value: what it moves is which view of the cell the C
+// spells, and both views store the same bytes.
+//
+// It refuses (leaves the attr unset, so the convention stands) for:
+//   - a target that does not declare the behavior;
+//   - a store that already carries `signed`, or a word-wide one;
+//   - a stored value that is not a `const` — a `neg`/`shl` the materialization left unfolded, a
+//     block param, anything computed;
+//   - a constant whose narrow sign bit is clear: both lvalue types materialize it the same way;
+//   - a constant whose upper bits are neither the zero- nor the sign-extension of its low bits:
+//     no conversion to a narrow type produces one;
+//   - a constant some OTHER use reads too, or whose 32-bit value another store writes at another
+//     width. The conversion is a fact about a LITERAL on the right of the store. A variable or a
+//     chained assignment whose value is a known constant is stored unconverted, in the register
+//     a wider use reads: `s32 v = -1; *q = v; p[1] = v;` with `u16 *p` is `li v0,-1; sw v0;
+//     sh v0` on gcc2.7.2 and gcc2.7.2kmc, and `li t6,-1; sw t6; li t7,-1; sh t7` on ido7.1, which
+//     rematerializes it. When that wide use is there, the register says the wider type's sign,
+//     not the lvalue's (the NONLITERAL bodies of
+//     packages/cli/test/matching/narrow-store-constant.test.ts).
+//
+// What it does NOT refuse is such a variable with no wide use: `s32 v = -1; p[6] = v;` (`u16 *p`),
+// or one only returned. Its register is the variable's, not the lvalue's, so the stamp can name a
+// type the source did not declare (`s16 *` there). It is not refused because nothing tells it
+// apart from a literal, and the spelling it gives recompiles to the register the target holds.
+import { Fn, Op, Value, defOpMap } from '../ir/core';
+import type { TargetDescription } from '../target';
+
+/** THE view a store's lvalue is seeded at, `width` bytes wide (`width` for a `store`, `elemSize`
+ *  for an `astore`): the `signed` a recovery recorded on it — this pass's stamp, or a member
+ *  array's own declaration (raise/memberarrays.ts) — else the convention, word ⇒ signed and
+ *  narrow ⇒ unsigned. raise/recover.ts, raise/structs.ts, raise/memberarrays.ts, rank-declare.ts
+ *  and the structurer seed from it; raise/struct-arrays.ts keeps the stamp beside its loads'
+ *  sign instead. What each does when a LOAD disagrees is its own: raise/structs.ts,
+ *  raise/struct-arrays.ts and rank-declare.ts prefer the load, and the structurer spells a member
+ *  that disagrees with the stamp as a cast cell (structure/structure.ts `stampedStoreLval`). */
+export function storeSigned(op: Op, width: number): boolean {
+  return (op.attrs.signed as boolean | undefined) ?? width === 4;
+}
+
+/** The lvalue signedness a constant stored at `width` bytes witnesses, read off the 32-bit register
+ *  it was materialized into: `true` sign-extended, `false` zero-extended, `null` when it says
+ *  neither (see the refusals at the top of this file). */
+export function storedConstantSign(value: number, width: number): boolean | null {
+  if (!Number.isInteger(value) || value < -(2 ** 31) || value >= 2 ** 32 || (width !== 1 && width !== 2)) {
+    return null;
+  }
+  const bits = width * 8;
+  const reg = value | 0;
+  const low = reg & ((1 << bits) - 1);
+  if ((low & (1 << (bits - 1))) === 0) {
+    return null;
+  }
+  if (reg === low) {
+    return false;
+  }
+  return reg === (low << (32 - bits)) >> (32 - bits) ? true : null;
+}
+
+/** Stamp `signed` on every narrow `store` whose stored constant witnesses its lvalue's signedness.
+ *  Returns how many it stamped. */
+export function seedNarrowStoreSigns(fn: Fn, target: TargetDescription): number {
+  if (target.compilerBehaviors.narrowStoreConstantTakesLvalueType !== true) {
+    return 0;
+  }
+  const defs = defOpMap(fn);
+  const stores: Op[] = fn.blocks.flatMap((b) => b.ops.filter((op) => op.opcode === 'store'));
+  // the values read other than as the value a store stores. Not a `ret`'s: before the return
+  // type is known it reads the return register whether the function returns it or not, and gcc
+  // stores a constant from that register in its delay slot (`li v0,-1; jr ra; sh v0,12(a0)`).
+  // Nor an edge's into a block param only a `ret` reads, directly or through more such params:
+  // that is the same register live out of a branch, `beqz a1,L; ...; li v0,0x8000; sh v0,4(a0);
+  // L: jr ra`.
+  const retOnly = retOnlyParams(fn);
+  const otherUses = new Set<Value>();
+  const bump = (v: Value) => otherUses.add(v);
+  for (const b of fn.blocks) {
+    for (const op of b.ops) {
+      op.operands.forEach((v, i) => ((op.opcode === 'store' && i === 1) || op.opcode === 'ret' ? undefined : bump(v)));
+      op.successors.forEach((s) => s.args.forEach((v, i) => (retOnly.has(s.block.params[i]) ? undefined : bump(v))));
+    }
+  }
+  // a stored constant's 32-bit register → the widths it is stored at, across every const op
+  const widthsOf = new Map<number, Set<number>>();
+  for (const op of stores) {
+    const d = defs.get(op.operands[1]);
+    if (d?.opcode === 'const') {
+      const reg = (d.attrs.value as number) | 0;
+      (widthsOf.get(reg) ?? widthsOf.set(reg, new Set()).get(reg)!).add(op.attrs.width as number);
+    }
+  }
+  let n = 0;
+  for (const op of stores) {
+    const d = defs.get(op.operands[1]);
+    if (
+      op.attrs.signed !== undefined ||
+      d?.opcode !== 'const' ||
+      otherUses.has(op.operands[1]) ||
+      widthsOf.get((d.attrs.value as number) | 0)!.size > 1
+    ) {
+      continue;
+    }
+    const signed = storedConstantSign(d.attrs.value as number, op.attrs.width as number);
+    if (signed !== null) {
+      op.attrs.signed = signed;
+      n++;
+    }
+  }
+  return n;
+}
+
+/** The block params (not the entry's: those are the function's parameters) that nothing reads but
+ *  a `ret` and the edges into other such params. */
+function retOnlyParams(fn: Fn): Set<Value> {
+  const read = new Set<Value>();
+  for (const b of fn.blocks) {
+    for (const op of b.ops) {
+      if (op.opcode !== 'ret') {
+        op.operands.forEach((v) => read.add(v));
+      }
+    }
+  }
+  const out = new Set(fn.blocks.slice(1).flatMap((b) => b.params.filter((p) => !read.has(p))));
+  // an edge into a param that is not ret-only reads its argument: drop arguments until none moves
+  for (let moved = true; moved;) {
+    moved = false;
+    for (const b of fn.blocks) {
+      for (const op of b.ops) {
+        for (const s of op.successors) {
+          s.args.forEach((v, i) => {
+            if (out.has(v) && !out.has(s.block.params[i])) {
+              out.delete(v);
+              moved = true;
+            }
+          });
+        }
+      }
+    }
+  }
+  return out;
+}

package/src/raise/struct-arrays.ts

@@ -93,8 +93,16 @@ function withPadding(dataFields: StructField[], stride: number): StructField[] {
  *  pokeemerald:GetGenderFromSpeciesAndPersonality, whose address is materialized twice). A base
  *  whose element pointers
  *  disagree on stride declines entirely: two strides over one base is a reinterpreted view or
- *  a 2D layout, genuinely ambiguous — decline over guess. */
-export function recognizeStructArrays(fn: Fn): number {
+ *  a 2D layout, genuinely ambiguous — decline over guess.
+ *
+ *  `aggregateBoundary` is the size the compiler rounds EVERY struct to (target.ts
+ *  `compilerBehaviors.aggregateBoundary`): agbcc 4, so `struct { u16 a; u8 _pad0[4]; }` is 8
+ *  bytes there, not the 6 its fields add up to. A group whose stride that rounding would change
+ *  declines, and its accesses keep the byte-offset spelling (`*(u16 *)(base + i * 6)`), which
+ *  says the stride itself. ABSENT means unmeasured (target.ts), and then every group declines the
+ *  same way: no boundary is safe to assume, since one too small is that very mis-stride on agbcc,
+ *  and the caller must say which layout it means — a target's value, or 1 for the natural one. */
+export function recognizeStructArrays(fn: Fn, aggregateBoundary: number | undefined): number {
   const defs = defOpMap(fn);
   let count = 0;
   // The NAME index is not the recognition count: `count` is this function's return value — how
@@ -148,7 +156,7 @@ export function recognizeStructArrays(fn: Fn): number {
     // load/store BASE with a field offset inside one element.
     const elemSet = new Set(elems.map((e) => e.add.results[0]));
     const indexOf = new Map(elems.map((e) => [e.add.results[0], e.index]));
-    const accesses: { op: Op; elem: Value; off: number; width: number; signed: boolean }[] = [];
+    const accesses: { op: Op; elem: Value; off: number; width: number; signed: boolean; stamp?: boolean }[] = [];
     for (const bb of fn.blocks) {
       for (const op of bb.ops) {
         const isMem = (op.opcode === 'load' || op.opcode === 'store') && elemSet.has(op.operands[0]);
@@ -170,6 +178,7 @@ export function recognizeStructArrays(fn: Fn): number {
             off,
             width,
             signed: op.opcode === 'load' ? (op.attrs.signed as boolean) : width === 4,
+            stamp: op.opcode === 'load' ? undefined : (op.attrs.signed as boolean | undefined),
           });
         }
       }
@@ -193,13 +202,14 @@ export function recognizeStructArrays(fn: Fn): number {
     // silently drops one side's zero/sign-extension (adversarially learned: `arr[i].f +
     // (u16)arr[i].f` lost its zext and a byte-exact match with it). A STORE's `signed` is the
     // width===4 CONVENTION, not a machine fact, so it never conflicts — the field takes its
-    // signedness from the loads when any exist.
-    const byOff = new Map<number, { width: number; loadSigned: boolean | null }>();
+    // signedness from the loads when any exist, else from the stores raise/storesign.ts stamped
+    // (the signed view when any says signed, as raise/structs.ts `buildStruct` prefers it).
+    const byOff = new Map<number, { width: number; loadSigned: boolean | null; stamped: boolean | null }>();
     for (const a of accesses) {
       const isLoad = a.op.opcode === 'load';
       const prev = byOff.get(a.off);
       if (!prev) {
-        byOff.set(a.off, { width: a.width, loadSigned: isLoad ? a.signed : null });
+        byOff.set(a.off, { width: a.width, loadSigned: isLoad ? a.signed : null, stamped: a.stamp ?? null });
       } else if (prev.width !== a.width) {
         clean = false;
       } else if (isLoad) {
@@ -208,6 +218,8 @@ export function recognizeStructArrays(fn: Fn): number {
         } else if (prev.loadSigned !== a.signed) {
           clean = false;
         }
+      } else if (a.stamp !== undefined) {
+        prev.stamped = prev.stamped === true || a.stamp;
       }
     }
     const offs = [...byOff.entries()].sort(([x], [y]) => x - y);
@@ -222,16 +234,19 @@ export function recognizeStructArrays(fn: Fn): number {
       }
       maxAlign = Math.max(maxAlign, width);
     }
-    if (stride % maxAlign !== 0) {
+    // The DECLARED struct is rounded to its widest member AND to the compiler's aggregate
+    // boundary; a stride neither divides is one `sizeof` cannot reproduce, and recompiled it reads
+    // the wrong bytes and stores past a frame buffer sized from the asm (sa3 sub_8038910).
+    if (aggregateBoundary === undefined || stride % Math.max(maxAlign, aggregateBoundary) !== 0) {
       clean = false;
     }
     if (!clean) {
       continue;
     }
-    const dataFields: StructField[] = offs.map(([off, { width, loadSigned }]) => ({
+    const dataFields: StructField[] = offs.map(([off, { width, loadSigned, stamped }]) => ({
       off,
-      // store-only field: the width===4 convention, exactly what the old access carried
-      type: scalarTypeForAccess(width, loadSigned ?? width === 4),
+      // a store-only field: its stamped stores' view, else the width===4 convention
+      type: scalarTypeForAccess(width, loadSigned ?? stamped ?? width === 4),
       name: `field_${off}`,
     }));
     const elemStruct = T.struct(`Elem${name++}`, withPadding(dataFields, stride), stride);
@@ -265,7 +280,11 @@ export function recognizeStructArrays(fn: Fn): number {
         } else if (op.opcode === 'store') {
           bb.ops[i] = mkOp('astore', {
             operands: [base, index, op.operands[1]],
-            attrs: carryDiscipline(op, { elemSize: stride, fieldOff: op.attrs.off as number }),
+            attrs: carryDiscipline(op, {
+              elemSize: stride,
+              fieldOff: op.attrs.off as number,
+              ...(op.attrs.signed !== undefined && { signed: op.attrs.signed }),
+            }),
           });
         }
       }