@asmlift/core 0.9.0 → 0.11.0

package/src/ir/verify.ts

@@ -3,30 +3,57 @@
 //   1. every block ends in exactly one terminator (and it is the last op)
 //   2. operands well-formed: opcode registered, correct arity/attrs
 //   3. SSA: each value defined once; every use is defined; def dominates use
-//   4. a float value is an operand or result of a float op or `ret` only — or a `double` operand of
-//      a call whose callee declares one there — and crosses an edge only into a block parameter of
-//      its own type; an `fconst` is a double, sixteen hex digits into an f64
+//   4. a float value is an operand or result of a float op, a conversion or a compare, or `ret` only
+//      — or a `double` operand of a call whose callee declares one there, or the result of a call
+//      whose callee is declared to return a `float` — and crosses an edge only
+//      into a block parameter of its own type; an `fconst` is a double, sixteen hex digits into an f64
 //   5. side data: a fn that carries a write-order record carries one for EVERY block, with every
 //      ordinal inside that block's own write count (ir/core.ts `WriteOrder`)
 import { Block, Fn, Op, Value, dominators } from './core';
 import { isDoubleBits } from './float-bits';
-import { FLOAT_OPS, WIDE_BITS, opSig } from './opcodes';
+import { FLOAT_COMPUTING, FLOAT_OPS, FLOAT_RESIZE, FLOAT_TO_INT, INT_TO_FLOAT, WIDE_BITS, opSig } from './opcodes';
 import { type IrType, T, intWidth, typeEquals, typeToString } from './types';
 
 export class VerifyError extends Error {}
 
 /** A call hands a float only to a parameter its callee is declared to take a `double` in — the
- *  operands the frontend lists in `doubles` — and returns none. */
-function doublesDeclared(op: Op): boolean {
-  const at = op.attrs.doubles;
+ *  operands the frontend lists in `doubles` — and returns one only where its callee is declared to
+ *  return a `float` (`floatReturn`), as that single. */
+function floatsDeclared(op: Op): boolean {
+  const at = Array.isArray(op.attrs.doubles) ? op.attrs.doubles : [];
   return (
     op.opcode === 'call' &&
-    Array.isArray(at) &&
-    op.results.every((r) => r.type.kind !== 'float') &&
+    op.results.every(
+      (r) => r.type.kind !== 'float' || (op.attrs.floatReturn === 'float' && typeEquals(r.type, T.f32())),
+    ) &&
     op.operands.every((o, i) => o.type.kind !== 'float' || (at.includes(i) && typeEquals(o.type, T.f64())))
   );
 }
 
+/** The ops where a float meets an integer or the other precision, each held to the one shape it
+ *  has: a conversion takes a float of either stated precision or none and gives an integer, or the
+ *  reverse; a resize takes its own source width to its own destination width; a compare takes two
+ *  floats of one type and gives a 32-bit integer. The integer side may be narrower than a word once
+ *  recovery has typed it (`(float)x` of a `short` parameter), which converts the value it promotes
+ *  to; the C spelling casts through `s32`/`s64`. */
+function verifyFloatCrossing(op: Op): void {
+  const ins = op.operands.map((o) => o.type);
+  const out = op.results[0].type;
+  const isInt = (t: IrType) => intWidth(t) !== null;
+  const resize = FLOAT_RESIZE[op.opcode];
+  const ok = FLOAT_TO_INT.has(op.opcode)
+    ? ins[0].kind === 'float' && isInt(out)
+    : INT_TO_FLOAT.has(op.opcode)
+      ? isInt(ins[0]) && out.kind === 'float'
+      : resize !== undefined
+        ? typeEquals(ins[0], resize.from === 64 ? T.f64() : T.f32()) &&
+          typeEquals(out, resize.to === 64 ? T.f64() : T.f32())
+        : ins[0].kind === 'float' && typeEquals(ins[0], ins[1]) && intWidth(out) === 32;
+  if (!ok) {
+    throw new VerifyError(`'${op.opcode}' does not take ${ins.map(typeToString).join(', ')} to ${typeToString(out)}`);
+  }
+}
+
 // Opcodes admitting EITHER a 2-operand register form OR a 1-operand + `imm` attr form.
 const TWO_OR_IMM = new Set(['sdiv', 'shl', 'shr_u', 'shr_s']);
 
@@ -41,7 +68,21 @@ const TWO_OR_IMM = new Set(['sdiv', 'shl', 'shr_u', 'shr_s']);
 // `unknown` PARTICIPATES, and that is the whole point: at L1 every value is `unknown`, so a rule
 // that skipped it would be vacuous exactly where this is meant to be red. The shifts count only
 // their SHIFTED operand — a 64-bit shift by a 32-bit count is what the machine does.
-const WIDTH_UNIFORM = new Set(['add', 'sub', 'mul', 'and', 'or', 'xor', 'neg', 'not', 'sdiv', 'udiv', 'smod', 'umod']);
+const WIDTH_UNIFORM = new Set([
+  'add',
+  'sub',
+  'mul',
+  'and',
+  'or',
+  'xor',
+  'neg',
+  'neg_s',
+  'not',
+  'sdiv',
+  'udiv',
+  'smod',
+  'umod',
+]);
 // The shifts count only their SHIFTED operand: a 64-bit value shifted by a 32-bit count is what
 // every one of these machines does. The comparisons count only their OPERANDS: the result of a C
 // comparison is an `int` whatever it compared, which is what `raise/recover.ts` already types it.
@@ -170,6 +211,7 @@ export function verify(fn: Fn): void {
           // second as `u8 name[count]`, so a typed element there would be a type nothing pinned —
           // the exact answer the audit refuses to invent. (One BYTE encodes like a real `u8`
           // scalar either way; the declaration is the same one, so nothing has to tell them apart.)
+          // A part's element, where its own accesses pin one, rides beside them as `elem` below.
           if (op.opcode === 'laddr') {
             const count = op.attrs.count;
             if (typeof count !== 'number' || !Number.isInteger(count) || count < 1) {
@@ -181,6 +223,47 @@ export function verify(fn: Fn): void {
                   `got width ${String(op.attrs.width)}, signed ${String(op.attrs.signed)}`,
               );
             }
+            // …and a PART of the one object (frame-objects.ts `provenParts`) is such storage too
+            if (op.attrs.part !== undefined && op.attrs.part !== true) {
+              throw new VerifyError(`'laddr' part must be true, got ${String(op.attrs.part)}`);
+            }
+            if (op.attrs.part === true && count < 2) {
+              throw new VerifyError(`'laddr' part must be storage of two or more bytes, got ${count}`);
+            }
+            // …whose ELEMENT its accesses may agree on (frame-objects.ts `stampPartElements`): a
+            // width that tiles the part, negative for a signed narrow one, never the default `u8`
+            const elem = op.attrs.elem;
+            if (
+              elem !== undefined &&
+              (op.attrs.part !== true ||
+                op.attrs.views !== undefined ||
+                ![2, 4, -1, -2].includes(elem as number) ||
+                count % Math.abs(elem as number) !== 0)
+            ) {
+              throw new VerifyError(
+                `'laddr' elem is a part's element width (2, 4; -1, -2 signed) tiling its ${count} bytes, ` +
+                  `got ${String(elem)}${op.attrs.part === true ? '' : ' on storage that is no part'}`,
+              );
+            }
+            // …and storage accessed at two widths over one byte names the VIEWS a union of it
+            // declares (frame-objects.ts `unionViews`): one per element width in bytes, negative
+            // for a signed narrow one, each tiling the storage — so at least two, distinct, of a
+            // width a view is named for, and a word never signed-marked (it has one view).
+            const views = op.attrs.views;
+            if (views !== undefined) {
+              const ok =
+                Array.isArray(views) &&
+                count > 1 &&
+                views.length >= 2 &&
+                new Set(views).size === views.length &&
+                views.every((v) => [1, 2, 4, -1, -2].includes(v) && count % Math.abs(v) === 0);
+              if (!ok) {
+                throw new VerifyError(
+                  `'laddr' views must be two or more distinct element widths (1, 2, 4; negative for a signed ` +
+                    `narrow view) tiling its ${String(count)} bytes, got ${JSON.stringify(views)}`,
+                );
+              }
+            }
           }
           // A 64-bit value is BUILT and TAKEN APART by exactly these three, so their shape is
           // checked here rather than left to whoever reads a half. `concat` is the only producer.
@@ -223,7 +306,9 @@ export function verify(fn: Fn): void {
             if (floats.length !== all.length || all.some((t) => !typeEquals(t, all[0]))) {
               throw new VerifyError(`'${op.opcode}' computes on floats only, got ${all.map(typeToString).join(', ')}`);
             }
-          } else if (floats.length > 0 && op.opcode !== 'ret' && !doublesDeclared(op)) {
+          } else if (FLOAT_COMPUTING.has(op.opcode)) {
+            verifyFloatCrossing(op);
+          } else if (floats.length > 0 && op.opcode !== 'ret' && !floatsDeclared(op)) {
             throw new VerifyError(`a float value reaches '${op.opcode}', which does not compute on floats`);
           }
           // A literal's width is its pattern's, so the pattern and the result must name one width.

package/src/l3/argbase.ts

@@ -208,6 +208,8 @@ export function materializeArgBases(sfn: SFn): SFn | null {
         break;
       case 'break':
       case 'continue':
+      case 'goto':
+      case 'caseEndGoto':
         out = s;
         break;
     }