@asmlift/core 0.9.0 → 0.11.0

package/src/l3/ast.ts

@@ -9,7 +9,21 @@ export type Expr =
   // A `double` literal, carried as its IEEE bit pattern (ir/float-bits.ts) — a kind apart from the
   // integer `const`, so no integer fold, range test or signedness reading ever takes it for one.
   | { k: 'fconst'; bits: string }
-  | { k: 'bin'; op: BinOp; l: Expr; r: Expr }
+  // `unsignedCmp` is EVIDENCE, not spelling: an ordering compare (`<` `<=` `>` `>=`) lowered from an
+  // `icmp_u*`, which C spells with the same token as the signed one and decides from the operand
+  // types. The printer never reads it; `signedOverUnsignedCompare` (l3/typing.ts) does, over the
+  // FINISHED tree, so a pass that substitutes into a compare cannot re-spell it signed unseen.
+  // `exprEquals` ignores it, as it ignores `index.operandOff`: two nodes that print alike are
+  // alike to a CSE. A merge that keeps one of two equal nodes keeps it through `unionEvidence`, so
+  // the evidence of the one it drops is not lost with it.
+  //
+  // `helperRel` is evidence too: on a float `==`/`!=`, the relation the SOURCE spelled, where the
+  // compiler picked a runtime helper by it (runtime-helpers.ts `RuntimeHelper.relation` — agbcc's
+  // `__eqsf2` and `__nesf2`). It rides through `negateCond` unchanged, so a node whose `op` is not
+  // its `helperRel` is one a negation moved off the helper, and `keepsHelperRel` /
+  // `regainsHelperRel` below are what a pass choosing between `if (c) A else B` and
+  // `if (!c) B else A` asks. Ignored by `exprEquals` and by the printer, like `unsignedCmp`.
+  | { k: 'bin'; op: BinOp; l: Expr; r: Expr; unsignedCmp?: true; helperRel?: BinOp }
   | { k: 'un'; op: '-' | '~' | '!' | 'f-'; e: Expr }
   // A post-increment `name++` (`by` 1) or post-decrement `name--` (`by` -1): the value the local
   // held BEFORE the update, with the update as a side effect. The only expression form here that
@@ -31,10 +45,10 @@ export type Expr =
   // A C-style value cast `(T)e`. Tree-level producers: a width-narrowing cast `(u8)e` (the
   // recovered form of a byte/half extend idiom — zext/sext IR ops), the STRUCT-pointer cast
   // (structure.ts memAccess/arrayAccess struct paths — see the note on `field` below), and the
-  // integer legalization of a pointer operand under an operator C rejects (structure.ts intify,
-  // `3 & (s32)p`). Scalar deref casts are backend-owned — the C-family printer synthesizes
-  // them from the `index` node's width. Each backend spells the cast in its own syntax
-  // (C: `(u8)e`; Pascal: no spelling yet → fails loud).
+  // integer legalization of a pointer operand under an operator C rejects (the arithmetic table,
+  // structure/pointer-spelling.ts: `3 & (s32)p`). Scalar deref casts are backend-owned — the
+  // C-family printer synthesizes them from the `index` node's width. Each backend spells the cast
+  // in its own syntax (C: `(u8)e`; Pascal: no spelling yet → fails loud).
   //
   // `volatile` qualifies the POINTEE of a pointer cast (`(volatile u16 *)0x4000208`) — the one
   // place asmlift can say "this access is to a volatile object" when there is no declaration to
@@ -62,13 +76,29 @@ export type Expr =
   // `sret` is the type of a struct the callee returns BY VALUE through memory. `args[0]` is then the
   // hidden pointer the frontend read from the first argument register — the address of the struct
   // the call fills — and the rest are the declared arguments. The only C spelling is a statement,
-  // `dest = fn(rest)`, so such a call stands alone.
+  // `dest = fn(rest)`, so such a call stands alone. `returns` is the type of a struct the callee
+  // returns BY VALUE in registers, where the call is that value itself, `return mk(x);`
+  // (frontend/register-struct-call.ts); the declarations block prints its prototype by it.
+  //
+  // `byValue` names the arguments that are a struct passed BY VALUE — a local or a global spelled
+  // bare, `take(s)` — by their place in `args` and the declared parameter each is, with the struct
+  // the declaration passes
+  // (frontend/call-plan.ts `foldByValueArgs`); the declarations block defines each beside the
+  // callee's prototype.
   //
   // `fn` is the callee's NAME, or for an indirect call the EXPRESSION whose value is the address
   // called (ir/core.ts `calleeValue`) — a child of the node like its arguments, listed first in
   // `exprChildren`. That is no evaluation order: C leaves it unspecified, and agbcc loads the callee
   // after the arguments.
-  | { k: 'call'; fn: string | Expr; args: Expr[]; wide64?: true; sret?: IrType }
+  | {
+      k: 'call';
+      fn: string | Expr;
+      args: Expr[];
+      wide64?: true;
+      sret?: IrType;
+      returns?: IrType;
+      byValue?: readonly { readonly at: number; readonly param: number; readonly type: IrType }[];
+    }
   // The ADDRESS of a named global, `&gSym` (agbcc pool `.word gSym`, frontend `gaddr` op). A
   // DEREF of it collapses to the bare global: memAccess/arrayAccess spell `*(&gSym)` as `gSym`
   // and `(&gSym)[i]` as `gSym[i]` (a global name decays to a pointer). Only a genuinely
@@ -192,6 +222,15 @@ export type Expr =
       operandOff?: number;
       baseOrdered?: true;
       baseAdvanced?: number;
+      /** Spell element 0 as `base[0]`, never `*base`. The two are one lvalue to C and NOT to
+       *  agbcc's alias analysis: `u.half[0]` is an ARRAY_REF of a union member, alias set 0
+       *  (c-common.c `c_get_alias_set`), while `*u.half` dereferences the member's decay — an
+       *  INDIRECT_REF typed by its pointee, which a compiled `*u.half = 1; *u.word = x; return
+       *  *u.half;` returns stale (`mov r0, #0x1`) where the subscript reloads. Set on a view of a
+       *  frame union (structure.ts `frameUnionAccess`), the one access that rests on that set,
+       *  and on an element of a frame array, where it only keeps the element spelling at index 0
+       *  (structure.ts `bareArrayIndex`, l3/constinit.ts `asElement`). */
+      subscript?: true;
     }
   // A named struct-field access `base->name` (raise/structs.ts recovered `base` as a struct
   // pointer, so the byte offset resolves to a named field instead of a scaled array index).
@@ -226,9 +265,10 @@ export type Expr =
 // The divides earned it second, on pokeemerald:GetAnchorCoord — `(u32)(coord * a1) / (u32)a0`
 // standing beside two arithmetic shifts of the same values. Their only other channel is the operand
 // TYPES, reached by flipping a declaration, and there that flip is unreachable and unsound at
-// once: the divisor also feeds a signed compare, so the /uns-cmp reconciliation correctly refuses
-// it, and forcing it anyway makes agbcc delete the comparison as always-false. A per-operand pin is
-// the only spelling that says "this division alone is unsigned".
+// once: the divisor also feeds a signed compare, so the unsigned-compare reconciliation
+// (structure.ts unsignedCompareSpelling) correctly refuses it, and forcing it anyway makes agbcc
+// delete the comparison as always-false. A per-operand pin is the only spelling that says "this
+// division alone is unsigned".
 //
 // The COMPARISONS stay collapsed, and that asymmetry is the rule applying rather than an omission:
 // which side a compare was spelled from genuinely underdetermines — a signed spelling that
@@ -241,12 +281,20 @@ export type Expr =
 // and `+`/`-` are the pointer walks, reassociations and constant folds of a dozen L3 passes. A float
 // under any of those is a wrong program, so it gets operators none of them match — the same reason
 // the IR has `fadd` rather than a float-typed `add`. The unary minus splits the same way (`f-` on
-// `un`).
+// `un`). The float COMPARES split for the same reason and one more: NaN makes them a partial order,
+// so `negateCond` may flip `f==` and `f!=` into each other and no other — `!(a f> b)` is not
+// `a f<= b`, and it prints as the `!` it is.
 export type BinOp =
   | 'f+'
   | 'f-'
   | 'f*'
   | 'f/'
+  | 'f<'
+  | 'f<='
+  | 'f>'
+  | 'f>='
+  | 'f=='
+  | 'f!='
   | '+'
   | '-'
   | '*'
@@ -296,8 +344,44 @@ export type Stmt =
   // `break;` / `continue;` — a loop early-exit / next-iteration jump. Emitted ONLY when the target is
   // the innermost enclosing loop (bare C break/continue cannot express a multi-level exit; a deeper
   // target declines). SGI/IDO Pascal has neither, so its backend loud-fails them (like `field`/`cast`).
-  | { k: 'break' }
+  //
+  // `ofSwitch` makes the `break` the innermost enclosing SWITCH's instead: it leaves the arm it sits
+  // in for the code after the switch (`case 1: if (c) break; case 2: …`). Legal only inside a switch
+  // arm with no loop or switch between it and that arm — the producer's contract (structure.ts
+  // `switchBreakAt`). The C family prints both as `break;`, so its printer refuses each where C
+  // would bind it to the other kind — a plain one between `case` labels, this one in a loop body
+  // (backend/cfamily.ts `refuseMisboundBreak`). A pass that reads `break` as a loop exit must skip
+  // this one (l3/reindex.ts `hasLoopExit`).
+  //
+  // `label` names a switch-scoped `break` a case-end `goto` lands on (`L: break;`, see `goto`).
+  | { k: 'break'; ofSwitch?: true; label?: string }
   | { k: 'continue' }
+  // `goto <label>;` — L3 HOLDS TWO GOTOS, both narrow (docs/asmlift-101.md §2.7).
+  //
+  // A CASE-LABEL goto jumps to a case label of the switch it sits in, written where two or more arms
+  // enter one sibling arm's body and only one of them can reach it by falling through (`case 1: if
+  // (c) continue; goto L; case 2: … case 3: L: …`). `label` names the target arm's
+  // `SwitchCase.label`. It is the LAST statement of a case or default body, at that body's top
+  // level, and its label is a case of THAT switch — so no loop or nested switch stands between the
+  // jump and its target, and the jump runs exactly what a fall-through into that arm would run.
+  //
+  // A CASE-END goto is the next kind, `caseEndGoto`. Both are checked by `caseGotoViolation`
+  // (contracts.ts `assertCaseGotosNarrow`, which every structured and respelled tree passes). Any
+  // other goto is not representable. A goto ends its path like `break` and `continue`. SGI/IDO
+  // Pascal has no goto into a `case-of` arm, so its backend loud-fails it.
+  | { k: 'goto'; label: string }
+  // `goto <label>;` — THE CASE-END GOTO, the second goto L3 holds, a jump to the end of the arm it
+  // sits in: `label` names a labelled switch-scoped `break` (`L: break;`) that is an element of a
+  // statement list enclosing the goto, later in that list than the statement holding it, with no
+  // switch between the two and no loop around the label inside the arm — so the jump leaves every
+  // loop it sits in and then the switch, and runs nothing on the way. It is the source's `for (j…)
+  // { if (hit) { …; goto L; } } k(i); L: break;`, which agbcc threads past the loop around the
+  // switch (jump.c `follow_jumps`). Its own kind, not a flag on `goto`, so every pass that reads a
+  // `goto` as the jump into a case arm (`switchArmSuccessors`, `switchJumpsBack`) never meets one,
+  // and every exhaustive switch over `Stmt` decides it. It ends its path, and leaves the innermost
+  // switch around it. Written only by l3/caseendgoto.ts. SGI/IDO Pascal has no `break`, so its
+  // backend loud-fails it.
+  | { k: 'caseEndGoto'; label: string }
   // A multi-way `switch` over an integer scrutinee (recovered from a comparison tree — Regime A — or
   // a jump-table `switch_br` — Regime B). `cases` are emitted IN ARRAY ORDER; `default` (if present)
   // is emitted after `defaultAt` of them, or after all of them when that is absent.
@@ -342,6 +426,10 @@ export interface SwitchCase {
   values: number[];
   body: Stmt[];
   fallsThrough: boolean;
+  /** The C label printed after this arm's `case` labels, present only where a `goto` of this same
+   *  switch names it (see the `goto` statement). A pass that merges, drops or reorders arms keeps it
+   *  on the arm it labels. */
+  label?: string;
 }
 
 export interface SFn {
@@ -399,6 +487,13 @@ export interface SFn {
      *  one are deliberately left unstamped even where the offset is in hand — see the refusal at
      *  the structurer's build site for the measurement that decided it. */
     slots?: number[];
+    /** The declaration's initializer, element by element, null where the source left one out
+     *  (`SImage.init`) — present only on the copy the C-family emitter prints, where
+     *  l3/constinit.ts folded the block copy of the compiler's anonymous constant image into it
+     *  (`u8 sp0[16] = { … };`). Never on a tree a pass sees. */
+    init?: (number | InitAddress | null)[];
+    /** that initializer is spelled as a string literal — the image was written as one */
+    initString?: true;
   }[];
   /** project globals referenced with a known declaration shape (symbol map) — typed for the
    *  legalization env (exprCType) but NEVER declared by a backend: the project's own headers
@@ -408,6 +503,11 @@ export interface SFn {
    *  the top of its body ahead of the locals. Unlike `globals`, the backend declares these: no
    *  header does, because the source defined them here. */
   statics?: SStatic[];
+  /** The compiler's own constant images this function copies a local's initializer from
+   *  (structure/local-statics.ts), under labels the source never wrote. Not statics: no declaration
+   *  may spell one, so the C-family emitter folds each into the initializer of the local its copy
+   *  fills (l3/constinit.ts), and a backend that cannot refuses. */
+  images?: SImage[];
   retType: IrType;
   body: Stmt[];
   /** Struct types this function's fields reference, declared above it by the backend. Empty
@@ -426,31 +526,64 @@ export interface SFn {
    *  and `l3/slotorder.ts` is the identity — never "ascending by default". */
   slotOrder?: 'ascending' | 'descending';
   /** Each declared callee's parameter types (an entry the printer cannot spell is `undefined`):
-   *  what an argument converts to. Read by the C-family printer where `dialect` says C++, which
-   *  refuses three conversions C makes implicitly (backend/cfamily.ts `argConversion`), and by the
-   *  pointer-cell conversions in every dialect (l3/ptrcell.ts). */
+   *  what an argument converts to. Read by the C-family printer where `dialect` says C++ or
+   *  `strictConversions` is set, either of which refuses three conversions C makes implicitly
+   *  (backend/cfamily.ts `argConversion`), and by the pointer-cell conversions in every dialect
+   *  (l3/ptrcell.ts). */
   declaredArgs?: Readonly<Record<string, readonly (string | undefined)[]>>;
   /** Each declared callee's return type as the project spells it, never printed: whether a call a
    *  pointer cell is compared with returns a pointer (l3/ptrcell.ts). */
   declaredReturns?: Readonly<Record<string, string>>;
   /** The emitted C is compiled AS C++. An emission policy like `slotOrder`. */
   dialect?: 'c++';
+  /** The compiler parses a designated element in an initializer (`[8] = 2`) — a fact of its
+   *  dialect, carried from `compilerBehaviors.designatedInitializers`. An emission policy: the
+   *  C-family printer spells an initializer's left-out run by index where present, as zeros where
+   *  not. */
+  designators?: true;
+  /** The compiler refuses C's implicit pointer conversions in C as well, as C++ does — carried from
+   *  `compilerBehaviors.strictPointerConversions`. An emission policy: the C-family printer casts an
+   *  argument to its declared parameter (`declaredArgs`), and a pointer of another pointee written
+   *  into a pointer slot, wherever it would for C++. */
+  strictConversions?: true;
+}
+
+/** An initial element that is an ADDRESS CONSTANT (ir/core.ts `LocalObject.relocs`): `symbol`'s
+ *  address plus `addend` bytes, held in the element's integer type — a global's, which a
+ *  declaration outside the function names. */
+export interface InitAddress {
+  symbol: string;
+  addend: number;
 }
 
 /** One function-scope static's definition: `static [const] T name[count] = { init };`. `init` is
- *  the initial elements in order, absent for a static with no initializer (the target's bss).
- *  `align` is an alignment in bytes wider than the type's own, which the definition must state. */
+ *  the initial elements in order, absent for a static with no initializer (the target's bss); an
+ *  element the target relocates is the {@link InitAddress} it holds. `align` is an alignment in
+ *  bytes wider than the type's own, which the definition must state. */
 export interface SStatic {
   name: string;
   type: IrType;
   const?: true;
   align?: number;
-  init?: number[];
+  init?: (number | InitAddress)[];
   /** the initializer is spelled as a string literal — a byte array the compiler aligns as a
    *  string (structure/local-statics.ts) */
   string?: true;
 }
 
+/** One constant image of the compiler's own (ir/core.ts `LocalObject.anonymous`), named by its
+ *  label: an integer array typed by the directives that wrote it, and its initializer element by
+ *  element — null where the source left one out (padding in the image, which C supplies as zero),
+ *  the {@link InitAddress} an element the target relocates holds, and ending at the last one it
+ *  spelled, so it may be shorter than `type`. */
+export interface SImage {
+  name: string;
+  type: IrType;
+  init: (number | InitAddress | null)[];
+  /** the image was written as a string literal (`.ascii`) */
+  string?: true;
+}
+
 /** A struct declaration surfaced to the backend (name + field list). Mirrors the IR struct
  *  type but lives in the neutral AST so a backend can print `struct N { ... };`. */
 export interface StructType {
@@ -471,6 +604,19 @@ export interface LanguageBackend {
    *  cannot print it turns a whole function that used to decompile into a loud stub. The
    *  structurer reads it through `StructureOptions.spellSwitchFallthrough`. */
   readonly spellsSwitchFallthrough: boolean;
+  /** Can this language spell a `break` that leaves a `switch` arm before its end
+   *  (`{ k: 'break', ofSwitch: true }`)? C and C++ can; Pascal has no `break` at all, and its
+   *  backend loud-fails the node. Asked for the same reason as `spellsSwitchFallthrough`: a
+   *  closed arm with a mid-arm exit (`case 10: if (a) { if (b) break; g(1); } h(2); break;`) also
+   *  spells without one, by copying the code the arm meets at into each path, which Pascal prints.
+   *  The structurer reads it through `StructureOptions.spellSwitchBreak`. */
+  readonly spellsSwitchBreak: boolean;
+  /** Can this language spell a `return` before the end of the function? C and C++ can; Pascal
+   *  cannot, and its backend loud-fails one. Asked for the same reason again: the join past early
+   *  returns ends each arm that leaves early in a `return`, and the same branch also spells by
+   *  copying the code below it into each arm (the return-tail copies), which Pascal prints. The
+   *  structurer reads it through `StructureOptions.spellEarlyReturns`. */
+  readonly spellsEarlyReturn: boolean;
   emit(fn: SFn): string;
   // Spell ONE LINE of text as a comment in this language (C block comments, Pascal `(* … *)`).
   // Used by the annotate-mode stub path to carry the failure reason + the original asm
@@ -560,6 +706,10 @@ export function exprEquals(a: Expr, b: Expr): boolean {
         (typeof a.fn === 'string' || typeof bb.fn === 'string' ? a.fn === bb.fn : exprEquals(a.fn, bb.fn)) &&
         (a.wide64 ?? false) === (bb.wide64 ?? false) &&
         (a.sret === undefined ? bb.sret === undefined : bb.sret !== undefined && typeEquals(a.sret, bb.sret)) &&
+        (a.returns === undefined
+          ? bb.returns === undefined
+          : bb.returns !== undefined && typeEquals(a.returns, bb.returns)) &&
+        (a.byValue ?? []).map((x) => x.at).join() === (bb.byValue ?? []).map((x) => x.at).join() &&
         a.args.length === bb.args.length &&
         a.args.every((x, i) => exprEquals(x, bb.args[i]))
       );
@@ -636,6 +786,60 @@ export function stmtsEqual(a: readonly Stmt[], b: readonly Stmt[]): boolean {
   return a.length === b.length && a.every((s, i) => stmtEquals(s, b[i]));
 }
 
+/** The node a merge KEEPS when it found `a` and `b` equal ({@link exprEquals}) and drops one: `a`,
+ *  with every compare carrying `unsignedCmp` if it did in EITHER. Equality ignores the evidence
+ *  because two compares that print alike are one expression to C; but when one of them was lowered
+ *  from an `icmp_u` and the other from a signed compare, the kept node now stands for both paths,
+ *  and the finished-tree judgment (l3/typing.ts `signedOverUnsignedCompare`) can only see the
+ *  unsigned one's obligation if the node still says so. Keeping `a` bare would publish a signed
+ *  `x < y` on the path that compared unsigned (an slt arm and an sltu arm merged by l3/tailmerge.ts
+ *  under `/signed-cmp`). Precondition: `exprEquals(a, b)`, so the two trees walk in step. */
+export function unionEvidence(a: Expr, b: Expr): Expr {
+  // `mapExprChildren` calls `f` in `exprChildren` order (an object literal evaluates its
+  // properties in source order), so the i-th call pairs with b's i-th child. Not by identity: one
+  // child object may sit in two positions, each with its own counterpart in `b`.
+  const bs = exprChildren(b);
+  let i = 0;
+  const out = mapExprChildren(a, (c) => unionEvidence(c, bs[i++]));
+  return out.k === 'bin' && b.k === 'bin' && b.unsignedCmp === true && out.unsignedCmp !== true
+    ? { ...out, unsignedCmp: true }
+    : out;
+}
+
+/** {@link unionEvidence} over two statements {@link stmtEquals} found equal. */
+export function unionStmtEvidence(a: Stmt, b: Stmt): Stmt {
+  switch (a.k) {
+    case 'assign':
+      return b.k === 'assign' ? { ...a, value: unionEvidence(a.value, b.value) } : a;
+    case 'store':
+      return b.k === 'store'
+        ? { ...a, lval: unionEvidence(a.lval, b.lval), value: unionEvidence(a.value, b.value) }
+        : a;
+    case 'exprstmt':
+      return b.k === 'exprstmt' ? { ...a, value: unionEvidence(a.value, b.value) } : a;
+    case 'return':
+      return b.k === 'return' && a.value !== undefined && b.value !== undefined
+        ? { ...a, value: unionEvidence(a.value, b.value) }
+        : a;
+    case 'if':
+      return b.k === 'if'
+        ? {
+            ...a,
+            cond: unionEvidence(a.cond, b.cond),
+            then: unionStmtsEvidence(a.then, b.then),
+            else: unionStmtsEvidence(a.else, b.else),
+          }
+        : a;
+    default:
+      return a;
+  }
+}
+
+/** {@link unionStmtEvidence} over two lists {@link stmtsEqual} found equal. */
+export function unionStmtsEvidence(a: readonly Stmt[], b: readonly Stmt[]): Stmt[] {
+  return a.map((s, i) => unionStmtEvidence(s, b[i]));
+}
+
 /** THE spelling of an `opaque`'s gap reason, in one place: `structure.ts` writes it into the
  *  marker, `contracts.ts` matches on it to prove the gap was not dropped, and the benchmark
  *  classifies declines by it. Two spellings make that contract silently vacuous — enforced-looking
@@ -730,6 +934,8 @@ export function stmtExprs(s: Stmt): Expr[] {
       return [s.scrutinee];
     case 'break':
     case 'continue':
+    case 'goto':
+    case 'caseEndGoto':
       return [];
   }
 }
@@ -769,6 +975,8 @@ export function mapStmtExprs(s: Stmt, f: (e: Expr) => Expr): Stmt {
       };
     case 'break':
     case 'continue':
+    case 'goto':
+    case 'caseEndGoto':
       return s;
   }
 }
@@ -875,6 +1083,44 @@ function* subterms(e: Expr): Generator<Expr> {
   }
 }
 
+export type Assign = Extract<Stmt, { k: 'assign' }>;
+
+/** Every `assign` in the tree, at any nesting. ORDER-FREE: its callers ask what a name is ever
+ *  assigned, never which assignment comes first, so a switch default's position does not matter. */
+export function assignsIn(body: readonly Stmt[]): Assign[] {
+  const out: Assign[] = [];
+  const visit = (s: Stmt): void => {
+    if (s.k === 'assign') {
+      out.push(s);
+    }
+    stmtChildren(s).forEach(visit);
+  };
+  body.forEach(visit);
+  return out;
+}
+
+/** Grow `seed` over assignments to a fixpoint: an assignment adds its target when `propagates`
+ *  says its value carries what the set holds so far. A FLOW-INSENSITIVE taint, which is what each
+ *  caller wants — the question is what a name may EVER hold, so one assignment anywhere is
+ *  enough. Callers own the seed and the rule; this owns only the iteration. */
+export function taintOverAssigns(
+  assigns: readonly Assign[],
+  seed: Iterable<string>,
+  propagates: (a: Assign, tainted: ReadonlySet<string>) => boolean,
+): Set<string> {
+  const tainted = new Set(seed);
+  for (let grew = true; grew;) {
+    grew = false;
+    for (const a of assigns) {
+      if (!tainted.has(a.name) && propagates(a, tainted)) {
+        tainted.add(a.name);
+        grew = true;
+      }
+    }
+  }
+  return tainted;
+}
+
 /** The statements a statement DIRECTLY contains, in the order a backend prints them — a `switch`
  *  splices its default in at `defaultAt` for that reason. NOTE for document-order walks: a `for`'s
  *  init/inc are listed here while its cond is in stmtExprs — a walker visiting exprs-then-stmts
@@ -887,6 +1133,8 @@ export function stmtChildren(s: Stmt): Stmt[] {
     case 'return':
     case 'break':
     case 'continue':
+    case 'goto':
+    case 'caseEndGoto':
       return [];
     case 'if':
       return [...s.then, ...s.else];
@@ -937,10 +1185,254 @@ export function isLoop(s: Stmt): s is Loop {
     case 'return':
     case 'break':
     case 'continue':
+    case 'goto':
+    case 'caseEndGoto':
       return false;
   }
 }
 
+/** Why `body` breaks the two forms a `goto` may take in L3 (the `goto` statement's contract), or
+ *  null when every `goto` in it keeps one. A case-label goto is the LAST statement of a case or
+ *  default body, at that body's top level, naming a label one case of THAT switch carries. A
+ *  case-end goto (`caseEndGoto`) names a labelled switch-scoped `break` later in a statement list that
+ *  encloses it, inside the same switch arm, with no switch between them; ifs and loops may stand
+ *  between, but no loop may stand between the labelled `break` and its arm. Labels are unique
+ *  across the function, case labels and `break` labels together. Any other placement is refused:
+ *  a case-label goto under an `if`, in a loop body, in a nested switch's arm aimed at the outer
+ *  switch or before another statement; a case-end goto in a nested switch, in another arm, outside
+ *  the switch, or after its label; a labelled `break` that is not the switch's or sits in a loop.
+ *
+ *  Shared by contracts.ts `assertCaseGotosNarrow`, which every structured and respelled tree
+ *  passes, and the C-family printer, which asks it of every function it prints: a pass that moves
+ *  a statement across an arm boundary is caught at the one place the program is spelled. */
+export function caseGotoViolation(body: readonly Stmt[]): string | null {
+  const seen = new Set<string>();
+  const claim = (label: string): string | null => {
+    if (seen.has(label)) {
+      return `the label \`${label}\` is carried by two switch arms`;
+    }
+    seen.add(label);
+    return null;
+  };
+  /** `labels`: the case labels a case-label goto here may name (null outside an arm's top level's
+   *  reach); `ends`: the `break` labels a case-end goto here may name; `inArm`: inside a switch arm
+   *  with no loop entered since it began, where a labelled `break` may sit. */
+  type Scope = { labels: ReadonlySet<string> | null; armTop: boolean; ends: ReadonlySet<string>; inArm: boolean };
+  const walk = (list: readonly Stmt[], scope: Scope): string | null => {
+    // `after[i]`: the `break` labels later in this list than `i`, beside the enclosing ones — built
+    // only for a list holding one, so the walk allocates nothing per statement on a goto-free tree
+    const after = endsAfter(list, scope.ends);
+    for (const [i, s] of list.entries()) {
+      if (s.k === 'caseEndGoto') {
+        if (!scope.ends.has(s.label)) {
+          return `\`goto ${s.label};\` names no labelled \`break;\` that ends the switch arm it sits in`;
+        }
+        continue;
+      }
+      if (s.k === 'goto') {
+        if (scope.labels === null || !scope.armTop || i !== list.length - 1) {
+          return `\`goto ${s.label};\` is not the last statement of a switch arm's own body`;
+        }
+        if (!scope.labels.has(s.label)) {
+          return `\`goto ${s.label};\` names no case label of the switch it sits in`;
+        }
+        continue;
+      }
+      if (s.k === 'break' && s.label !== undefined) {
+        if (s.ofSwitch !== true || !scope.inArm) {
+          return `the label \`${s.label}\` is not on a \`break;\` that leaves a switch arm`;
+        }
+        const why = claim(s.label);
+        if (why !== null) {
+          return why;
+        }
+        continue;
+      }
+      if (s.k === 'switch') {
+        const own = new Set<string>();
+        for (const c of s.cases) {
+          if (c.label !== undefined) {
+            const why = claim(c.label);
+            if (why !== null) {
+              return why;
+            }
+            own.add(c.label);
+          }
+        }
+        for (const arm of [...s.cases.map((c) => c.body), s.default ?? []]) {
+          const why = walk(arm, { labels: own, armTop: true, ends: NO_ENDS, inArm: true });
+          if (why !== null) {
+            return why;
+          }
+        }
+        continue;
+      }
+      // The `break` labels later in this list are the ends a goto inside `s` may reach. Inside a
+      // loop the switch's case labels are out of reach (a case-label goto there would leave the
+      // loop) and no `break;` leaves the arm.
+      const ends = after?.[i] ?? scope.ends;
+      const loop = isLoop(s);
+      for (const inner of stmtLists(s)) {
+        const why = walk(inner, {
+          labels: loop ? null : scope.labels,
+          armTop: false,
+          ends,
+          inArm: scope.inArm && !loop,
+        });
+        if (why !== null) {
+          return why;
+        }
+      }
+      if (s.k === 'for') {
+        const why = walk([s.init, s.inc], { labels: null, armTop: false, ends: NO_ENDS, inArm: false });
+        if (why !== null) {
+          return why;
+        }
+      }
+    }
+    return null;
+  };
+  return walk(body, { labels: null, armTop: false, ends: NO_ENDS, inArm: false });
+}
+
+const NO_ENDS: ReadonlySet<string> = new Set();
+
+/** For each index of `list`, `outer` and the labels of the labelled `break`s that are elements of
+ *  `list` after it; undefined where `list` holds none, so every index reads `outer`. */
+function endsAfter(list: readonly Stmt[], outer: ReadonlySet<string>): ReadonlySet<string>[] | undefined {
+  if (!list.some((s) => s.k === 'break' && s.label !== undefined)) {
+    return undefined;
+  }
+  const out: ReadonlySet<string>[] = new Array(list.length);
+  let later: ReadonlySet<string> = outer;
+  for (let i = list.length - 1; i >= 0; i--) {
+    out[i] = later;
+    const s = list[i];
+    if (s.k === 'break' && s.label !== undefined) {
+      later = new Set([...later, s.label]);
+    }
+  }
+  return out;
+}
+
+/** Does a case-end `goto` in `list`, at any depth, name a labelled `break` that `list` does not
+ *  hold — so the jump leaves `list`, and every loop of it the goto sits in? A pass asking whether a
+ *  loop body leaves its loop asks this beside its `break`s (l3/reindex.ts `hasLoopExit`). */
+export function caseEndGotoLeaves(list: readonly Stmt[]): boolean {
+  const held = new Set<string>();
+  const named: string[] = [];
+  const visit = (s: Stmt): void => {
+    if (s.k === 'break' && s.label !== undefined) {
+      held.add(s.label);
+    } else if (s.k === 'caseEndGoto') {
+      named.push(s.label);
+    }
+    stmtChildren(s).forEach(visit);
+  };
+  list.forEach(visit);
+  return named.some((l) => !held.has(l));
+}
+
+/** Can control fall off the END of `list`? False only where every path through it is provably
+ *  left first — by `return`, `continue`, a loop's `break`, a `goto`, a switch-scoped `break` or a
+ *  case-end `goto` (which leave the arm they sit in), or an `if` or `switch` none of whose paths
+ *  reaches its own end. A loop is read as reaching its end (a decided exit is not looked for), so
+ *  the answer errs toward "reaches", which is the side a caller appending a jump after the list
+ *  can afford: the jump it then writes is one no path runs, dead code and never a path cut. */
+export function reachesEnd(list: readonly Stmt[]): boolean {
+  // `end`: some path falls off the list's last statement; `leaves`: some path takes a
+  // switch-scoped `break` out of it, which ends the innermost switch around it.
+  const flow = (ss: readonly Stmt[]): { end: boolean; leaves: boolean } => {
+    let leaves = false;
+    for (const s of ss) {
+      switch (s.k) {
+        case 'return':
+        case 'continue':
+        case 'goto':
+          return { end: false, leaves };
+        // a case-end goto leaves the innermost switch around it, as its labelled `break;` does
+        case 'caseEndGoto':
+          return { end: false, leaves: true };
+        case 'break':
+          return { end: false, leaves: leaves || s.ofSwitch === true };
+        case 'if': {
+          const t = flow(s.then);
+          const e = flow(s.else);
+          leaves ||= t.leaves || e.leaves;
+          if (!t.end && !e.end) {
+            return { end: false, leaves };
+          }
+          break;
+        }
+        case 'switch': {
+          // Its end is reached by a `break` out of an arm, by an arm that neither falls nor jumps
+          // on and reaches its own end, or — with no `default` — by a value no case names.
+          const next = switchArmSuccessors(s);
+          const ends =
+            s.default === undefined ||
+            [...s.cases.map((c) => c.body), s.default].some((body, i) => {
+              const f = flow(body);
+              return f.leaves || (f.end && next[i] === undefined);
+            });
+          if (!ends) {
+            return { end: false, leaves };
+          }
+          break;
+        }
+        case 'while':
+        case 'dowhile':
+        case 'for':
+        case 'assign':
+        case 'store':
+        case 'exprstmt':
+          break;
+      }
+    }
+    return { end: true, leaves };
+  };
+  return flow(list).end;
+}
+
+/** For each arm of a `switch` — its cases in order, then its `default` at index `cases.length` —
+ *  the arm control runs on into from that arm's end, or undefined where it leaves the switch: the
+ *  arm a trailing `goto` names (its last top-level statement, `caseGotoViolation`), else the next
+ *  arm where the case falls through (the last case into the `default`, or out where there is
+ *  none). The one reading of "arm `i` runs on into arm `j`" that contracts.ts's effect count and
+ *  l3/coalesce.ts's arm-disjointness both follow, transitively. */
+export function switchArmSuccessors(sw: Extract<Stmt, { k: 'switch' }>): (number | undefined)[] {
+  const labelled = new Map(sw.cases.flatMap((c, i) => (c.label === undefined ? [] : [[c.label, i] as const])));
+  const jumpOf = (body: readonly Stmt[]): number | undefined => {
+    const last = body[body.length - 1];
+    return last?.k === 'goto' ? labelled.get(last.label) : undefined;
+  };
+  const last = sw.cases.length;
+  return [
+    ...sw.cases.map(
+      (c, i) => jumpOf(c.body) ?? (c.fallsThrough && (i + 1 < last || sw.default !== undefined) ? i + 1 : undefined),
+    ),
+    sw.default === undefined ? undefined : jumpOf(sw.default),
+  ];
+}
+
+/** Does a case-label `goto` of this switch land on an arm LAID OUT AT OR ABOVE the arm it ends —
+ *  a BACK EDGE with no loop statement around it? Then the arm it lands on runs AFTER the jumping
+ *  arm, so preorder stops being execution order inside the switch's own range, exactly as it does
+ *  inside a loop body; a pass that reads preorder as liveness must count such a switch with the
+ *  loops (l3/coalesce.ts `spans`). Positions are the layout {@link stmtChildren} walks: the
+ *  `default` sits at `defaultAt`. A fall-through only ever runs on DOWNWARD, so only the jumps are
+ *  asked. */
+export function switchJumpsBack(sw: Extract<Stmt, { k: 'switch' }>): boolean {
+  const at = sw.defaultAt ?? sw.cases.length;
+  const laidOut = (arm: number): number => (arm === sw.cases.length ? at : arm < at ? arm : arm + 1);
+  const labelled = new Map(sw.cases.flatMap((c, i) => (c.label === undefined ? [] : [[c.label, i] as const])));
+  const bodies = [...sw.cases.map((c) => c.body), sw.default ?? []];
+  return bodies.some((body, i) => {
+    const last = body[body.length - 1];
+    const to = last?.k === 'goto' ? labelled.get(last.label) : undefined;
+    return to !== undefined && laidOut(to) <= laidOut(i);
+  });
+}
+
 /** The nested statement LISTS of a statement — the SCOPES it opens.
  *
  *  Deliberately not `stmtChildren`, which flattens a `for`'s `init`/`inc` in with its body: those
@@ -968,6 +1460,8 @@ export function stmtLists(s: Stmt): Stmt[][] {
     case 'return':
     case 'break':
     case 'continue':
+    case 'goto':
+    case 'caseEndGoto':
       return [];
   }
 }
@@ -997,6 +1491,8 @@ export function mapStmtLists(s: Stmt, f: (list: Stmt[]) => Stmt[]): Stmt {
     case 'return':
     case 'break':
     case 'continue':
+    case 'goto':
+    case 'caseEndGoto':
       return s;
   }
 }
@@ -1077,8 +1573,76 @@ export const NEGATE_REL: Partial<Record<BinOp, BinOp>> = {
   '<=': '>',
   '==': '!=',
   '!=': '==',
+  // C's float `==` is false on a NaN and `!=` true, so these two are each other's negation; the
+  // ordered four have none in the operator vocabulary (the BinOp note).
+  'f==': 'f!=',
+  'f!=': 'f==',
 };
 
+/** The compares under `e`'s connectives whose runtime helper names the relation the source spelled
+ *  (`helperRel`), each answering whether it spells that relation now. `negateCond` flips every one
+ *  of them at once, through De Morgan. */
+function helperRelLeaves(e: Expr, out: boolean[] = []): boolean[] {
+  if (e.k === 'bin' && (e.op === '&&' || e.op === '||')) {
+    helperRelLeaves(e.l, out);
+    helperRelLeaves(e.r, out);
+  } else if (e.k === 'bin' && e.helperRel !== undefined) {
+    out.push(e.op === e.helperRel);
+  }
+  return out;
+}
+
+/** Whether `e` spells, at every compare of it whose runtime helper names the relation the source
+ *  spelled, that relation — so that negating `e` recompiles to the other helper at each of them:
+ *  the relation's twin and its `!` alike, since gcc folds `!(a == b)` into `a != b`. An arm swap
+ *  that would negate it keeps `e` and its arm order instead. */
+export function keepsHelperRel(e: Expr): boolean {
+  const leaves = helperRelLeaves(e);
+  return leaves.length > 0 && leaves.every((own) => own);
+}
+
+/** Whether negating `e` puts every such compare back on its helper's relation: the swap a pass
+ *  would otherwise leave alone is the one that spells the helpers. A condition mixing the two has
+ *  neither answer, and no arm order spells it. */
+export function regainsHelperRel(e: Expr): boolean {
+  const leaves = helperRelLeaves(e);
+  return leaves.length > 0 && leaves.every((own) => !own);
+}
+
+/** A loop's stay condition `P && S` whose compares under `S` are all negated off their helper's
+ *  relation, and whose `P` negates none: `{ head: P, guard: !S }`, which the loop spells
+ *  `while (P) { if (!S) break; … }` — the same tests in the same order, calling the helpers the
+ *  source called. `while (P && S)` has no spelling of that `S` that calls the helper (gcc folds
+ *  `!(a == b)` into `a != b`); the break guard is how the source wrote it before the branch fold
+ *  joined the two tests. Null when the condition already spells every helper's relation, or when no
+ *  split of its `&&` chain separates the two kinds of compare. */
+export function splitHelperBreak(cond: Expr): { head: Expr; guard: Expr } | null {
+  if (keepsHelperRel(cond) || helperRelLeaves(cond).length === 0) {
+    return null;
+  }
+  const conj: Expr[] = [];
+  const flatten = (e: Expr): void => {
+    if (e.k === 'bin' && e.op === '&&') {
+      flatten(e.l);
+      flatten(e.r);
+    } else {
+      conj.push(e);
+    }
+  };
+  flatten(cond);
+  const and = (xs: Expr[]): Expr => xs.reduce((l, r) => ({ k: 'bin', op: '&&', l, r }));
+  // The longest prefix that negates no helper leaf; the rest must negate every one it holds.
+  let k = 0;
+  while (k < conj.length && helperRelLeaves(conj[k]).every((own) => own)) {
+    k++;
+  }
+  if (k === 0 || k === conj.length) {
+    return null;
+  }
+  const rest = and(conj.slice(k));
+  return regainsHelperRel(rest) ? { head: and(conj.slice(0, k)), guard: negateCond(rest) } : null;
+}
+
 export function negateCond(e: Expr): Expr {
   if (e.k === 'bin') {
     const flipped = NEGATE_REL[e.op];