@asmlift/core 0.9.0 → 0.11.0

package/src/l3/narrowdecl.ts

@@ -1,22 +1,25 @@
-// L3 stacked variations `/narrow-decl` and `/narrow-read`: a named narrow value declared at its
-// width. `/narrow-decl` takes the narrowing at the local's one write, `/narrow-read` at every one of
-// its reads:
+// L3 stacked variations `/narrow-decl`, `/narrow-load` and `/narrow-read`: a named narrow value
+// declared at its width. `/narrow-decl` takes the narrowing cast at the local's one write,
+// `/narrow-load` a write that is a narrow memory read, which has no cast to drop, and `/narrow-read`
+// the narrowing at every one of its reads:
 //
 //   s32 v; v = (u8)(x - 1); … v …        becomes   u8 v; v = x - 1; … v …       (/narrow-decl)
+//   s32 v; v = p[3]; … v …               becomes   u8 v; v = p[3]; … v …        (/narrow-load)
 //   s32 v; v = f(); … (u8)v … (u8)v …    becomes   u8 v; v = f(); … v … v …     (/narrow-read)
 //
 // The two spellings compute the same C value at every read. The declaration truncates where the
-// cast did, and a `u8`, `s8`, `u16` or `s16` read is promoted to `int`, which is what an `s32` read
-// already is. They are not the same program to gcc 2.9's front end. `get_narrower`
-// (gcc/tree.c:4516) sees through the promotion of a narrow VARIABLE and not through an `int` that
-// a cast was assigned to, so for an unsigned narrow one `shorten_compare` (gcc/c-common.c:1158)
-// makes a compare against a constant unsigned and folds `>= 0`, `/` and `%` are shortened to their
-// unsigned helpers (gcc/c-typeck.c:2036-2041, :2079-2090), and `>>` becomes a logical shift
-// (gcc/c-typeck.c:2119). Without such an operator the object can still differ: `convert_to_integer`
-// pushes a narrow store's truncation into an AND's operands (gcc/convert.c:278-284), and a `u8`
-// local is a pseudo PROMOTE_MODE already zero-extended (gcc/thumb.h:344, gcc/stmt.c:3318-3323),
-// whose low byte is free to read (gcc/expr.c:830-836), where an `s32` one takes a fresh byte pseudo
-// and a register copy. Compiled with agbcc `-O2 -mthumb-interwork -fhex-asm -fprologue-bugfix`,
+// cast did, or stores a value already of its type, and a `u8`, `s8`, `u16` or `s16` read is
+// promoted to `int`, which is what an `s32` read already is. They are not the same program to gcc
+// 2.9's front end. `get_narrower` (gcc/tree.c:4516) sees through the promotion of a narrow VARIABLE
+// and not through an `int` that a cast was assigned to, so for an unsigned narrow one
+// `shorten_compare` (gcc/c-common.c:1158) makes a compare against a constant unsigned and folds
+// `>= 0`, `/` and `%` are shortened to their unsigned helpers (gcc/c-typeck.c:2036-2041, :2079-2090),
+// and `>>` becomes a logical shift (gcc/c-typeck.c:2119). Without such an operator the object can
+// still differ: `convert_to_integer` pushes a narrow store's truncation into an AND's operands
+// (gcc/convert.c:278-284), and a `u8` local is a pseudo PROMOTE_MODE already zero-extended
+// (gcc/thumb.h:344, gcc/stmt.c:3318-3323), whose low byte is free to read (gcc/expr.c:830-836),
+// where an `s32` one takes a fresh byte pseudo and a register copy. Compiled with agbcc
+// `-O2 -mthumb-interwork -fhex-asm -fprologue-bugfix`,
 //
 //   v = g.c - 1;  h.d = (v & 1) + rnd() % (5 - v) + 1;
 //
@@ -26,7 +29,9 @@
 // IDO, KMC gcc and gcc 2.7.2 each emit different code for that pair as well, and every mwcc
 // build does for a compare of the narrowed value. Which one the
 // source declared is not in the asm, so the differ referees, and the candidate it is derived onto
-// stays in the fan.
+// stays in the fan. A load written to a `u8` local is loaded where it is written, and one written to
+// an `s32` local where it is first read (two byte reads held across two calls, compiled in the
+// matching suite: `pokeemerald:LoadMonInfo`).
 //
 // At the reads, `(u8)(s32)e`, `(u8)(u32)e` and `(u8)e` keep the same low byte of any integer `e`,
 // so dropping each read's cast keeps its value, whichever write stored it. The pair compiles
@@ -34,13 +39,15 @@
 // as it is stored, right after the `bl`, where `(u8)v` extends at the read, after whatever ran in
 // between (`pokeemerald:RtcGetDayCount`, three results passed on as `u8`s).
 //
-// Two STACKED variations (rank-variations.ts), derived onto every other candidate's tree: the width
-// of a declaration is orthogonal to what every respell variation outside that table changes, and
-// the row that needs it needs it on top of `/offmember`. Two, not one, because a function holding a
-// local narrowed at its write and a local narrowed at its reads may need either one narrowed alone.
-// Each rewrites every local it admits. The two do not commute: a cast that is one local's write and
-// another's read is taken by whichever runs first. So each alone is its own candidate, and in the
-// all-together candidate `/narrow-decl` runs first and takes that cast as the write.
+// Three STACKED variations (rank-variations.ts), derived onto every other candidate's tree: the
+// width of a declaration is orthogonal to what every respell variation outside that table changes,
+// and the row that needs it needs it on top of `/offmember`. Three, not one, because a function
+// holding a local narrowed at its cast write, a local written by a narrow load and a local narrowed
+// at its reads may need any combination of the kinds narrowed. Each rewrites every local it admits.
+// They do not commute: a cast that is one local's write and another's read is taken by whichever
+// runs first, and so is a load-written local whose reads are all narrowed. So every subset of the
+// three is its own candidate, and in one holding a write-side member and `/narrow-read` the
+// write side runs first and takes the local.
 //
 // KNOWN GAP, and it is the price of deciding at L3 rather than where the value is named: which
 // spelling a call's result had shows only in where its extension lands, right after its `bl` or
@@ -58,13 +65,16 @@
 //   • a write of a constant that fits neither the signed nor the unsigned type of the narrow width,
 //     which gcc warns of when it converts one implicitly (gcc/c-common.c:849-861, :870-895) and a
 //     `-Werror` build refuses;
-//   • /narrow-decl: a `u32` local. Its reads stay bare, and a `u32` read is unsigned, so narrowing
-//     it would turn its compares, divisions and shifts into signed ones;
-//   • /narrow-decl: a local written more than once, or by `v++`, where a later write could store a
-//     value the narrow declaration would truncate and a bare read would not;
+//   • /narrow-decl, /narrow-load: a `u32` local. Its reads stay bare, and a `u32` read is unsigned,
+//     so narrowing it would turn its compares, divisions and shifts into signed ones;
+//   • /narrow-decl, /narrow-load: a local written more than once, or by `v++`, where a later write
+//     could store a value the narrow declaration would truncate and a bare read would not;
 //   • /narrow-decl: a local whose one write is a `for` loop's init, or that is not an integer
 //     narrowed to a narrower integer. A call's operand is not known to be an integer (its callee
 //     may return a pointer), so `(u8)f()` is refused too;
+//   • /narrow-load: a local whose one write is a `for` loop's init, or is no `p[i]` or member read
+//     of a narrower integer type. A narrow variable (`v = a1` of a `u8 a1`) is refused: no row has
+//     needed it;
 //   • /narrow-read: a read that is not a narrowing cast (a bare `v`, an index base, a `v++`), reads
 //     cast to two widths or two signednesses, a write in a `for` loop's init or step, and a write
 //     whose value is a pointer, a float or of no known type. A call is admitted: its value already
@@ -92,6 +102,16 @@ type Narrowing = Extract<Expr, { k: 'cast' }> & { to: Extract<IrType, { kind: 'i
 const isNarrowing = (e: Expr, env: ReturnType<typeof declaredTypes>): e is Narrowing =>
   e.k === 'cast' && !e.volatile && e.to.kind === 'int' && e.to.width < 32 && exprCType(e.e, env)?.kind === 'int';
 
+/** The narrower integer type a memory read (`p[i]`, `*p`, a member) already has, which a local it is
+ *  assigned to may be declared at with nothing to drop. */
+const narrowLoad = (e: Expr, env: ReturnType<typeof declaredTypes>): Narrowing['to'] | undefined => {
+  if (e.k !== 'index' && e.k !== 'field') {
+    return undefined;
+  }
+  const t = exprCType(e, env);
+  return t?.kind === 'int' && t.width < 32 ? (t as Narrowing['to']) : undefined;
+};
+
 /** `(T)v`, the read of `name` narrowed to the narrower integer T. */
 const isReadNarrowing = (e: Expr, name: string): e is Narrowing =>
   e.k === 'cast' && !e.volatile && e.to.kind === 'int' && e.to.width < 32 && e.e.k === 'var' && e.e.name === name;
@@ -159,8 +179,26 @@ const declared = (sfn: SFn, body: Stmt[], narrowed: Map<string, IrType>): SFn |
     ? null
     : { ...sfn, body, locals: sfn.locals.map((l) => ({ ...l, type: narrowed.get(l.name) ?? l.type })) };
 
-/** `/narrow-decl`: the tree with every admitted local narrowed at its write, or null when none is. */
-export function narrowDeclarations(sfn: SFn): SFn | null {
+/** What a write-side variation makes of a local's one write: the narrow type to declare the local
+ *  at and the value to store, or undefined when it does not take that write. */
+type WriteNarrowing = (
+  value: Expr,
+  env: ReturnType<typeof declaredTypes>,
+) => { to: Narrowing['to']; value: Expr } | undefined;
+
+/** A narrowing cast, dropped. */
+const castWrite: WriteNarrowing = (value, env) =>
+  isNarrowing(value, env) && storesQuietly(value.e, value.to) ? { to: value.to, value: value.e } : undefined;
+
+/** A narrow memory read, kept as written. */
+const loadWrite: WriteNarrowing = (value, env) => {
+  const to = narrowLoad(value, env);
+  return to === undefined ? undefined : { to, value };
+};
+
+/** The tree with every admitted local whose one write `take` takes narrowed at that write, or null
+ *  when none is. */
+function narrowAtWrite(sfn: SFn, take: WriteNarrowing): SFn | null {
   const mentions = localMentions(sfn);
   const env = declaredTypes(sfn);
   let body = sfn.body;
@@ -173,14 +211,10 @@ export function narrowDeclarations(sfn: SFn): SFn | null {
     let to: IrType | undefined;
     const rewrite = (list: Stmt[]): Stmt[] =>
       list.map((s) => {
-        if (
-          s.k === 'assign' &&
-          s.name === l.name &&
-          isNarrowing(s.value, env) &&
-          storesQuietly(s.value.e, s.value.to)
-        ) {
-          to = s.value.to;
-          return { ...s, value: s.value.e };
+        const taken = s.k === 'assign' && s.name === l.name ? take(s.value, env) : undefined;
+        if (taken !== undefined) {
+          to = taken.to;
+          return { ...s, value: taken.value };
         }
         return mapStmtLists(s, rewrite);
       });
@@ -193,6 +227,13 @@ export function narrowDeclarations(sfn: SFn): SFn | null {
   return declared(sfn, body, narrowed);
 }
 
+/** `/narrow-decl`: the tree with every admitted local narrowed at its cast write, or null when none is. */
+export const narrowDeclarations = (sfn: SFn): SFn | null => narrowAtWrite(sfn, castWrite);
+
+/** `/narrow-load`: the tree with every admitted local written by a narrow memory read declared at that
+ *  read's type, or null when none is. */
+export const narrowLoadDeclarations = (sfn: SFn): SFn | null => narrowAtWrite(sfn, loadWrite);
+
 /** `/narrow-read`: the tree with every admitted local narrowed at its reads, or null when none is. */
 export function narrowReadDeclarations(sfn: SFn): SFn | null {
   const mentions = localMentions(sfn);

package/src/l3/pollguard.ts

@@ -19,7 +19,7 @@
 // where the forms genuinely differ (the body runs at least once vs at least zero times), which
 // is why it never wraps. Declines (null) when no empty do-while exists.
 import type { Expr, SFn, Stmt } from './ast';
-import { exprChildren, exprEquals, mapExprChildren, mapStmtLists, stmtChildren, stmtExprs } from './ast';
+import { exprChildren, exprEquals, mapExprChildren, mapStmtLists, stmtChildren, stmtExprs, unionEvidence } from './ast';
 
 export function pollGuards(sfn: SFn): SFn | null {
   let changed = false;
@@ -140,7 +140,13 @@ export function pollReads(sfn: SFn): SFn | null {
         condFoldable(w.cond, volatileLocals) &&
         ownsEveryOccurrence(sfn.body, a.name)
       ) {
-        out.push({ k: 'while', cond: subst(w.cond, a.name, a.value), body: [] });
+        // The loop's re-read and the first read print alike; the folded read stands for both
+        // (ast.ts `unionEvidence`).
+        out.push({
+          k: 'while',
+          cond: subst(w.cond, a.name, unionEvidence(a.value, (w.body[0] as typeof a).value)),
+          body: [],
+        });
         dropped.add(a.name);
         i++;
         continue;

package/src/l3/ptrcell.ts

@@ -1,9 +1,11 @@
 // L3: a POINTER CELL — a global the body stores a pointer into, and the one place that spelling is
 // recognised.
 //
-// structure() spells a pointer value stored into a word global as `g = (void *)X` (structure.ts
-// `intoPtrCell`), the store every pointer declaration of `g` takes. Three readers act on it, and
-// all three ask `pointerCells` rather than re-reading the cast:
+// structure() spells a pointer value stored into a word global as `g = (void *)X`
+// (structure/pointer-spelling.ts `intoPtrCell`), the store every pointer declaration of `g` takes.
+// That store is built by `pointerCellValue` and read by `pointerCellStore`, both below; the one other
+// writer of it, `legalizePointerCells`, converts an integer stored into a cell through the same
+// function. Three readers act on it, and all three ask `pointerCells` rather than re-reading the cast:
 //
 //   • l3/symbol-refs.ts declares a name-only cell `void *` in the candidate's own world, the type
 //     that store needs, and so each global the cell meets bare that nothing reads as an integer
@@ -15,11 +17,24 @@
 // l3/symbol-refs.ts's header gives: a rewrite that drops the store must drop the fact with it.
 import { type IrType, T } from '../ir/types';
 import { declaredWidth } from '../proto';
-import { type Expr, type SFn, type Stmt, exprChildren, mapExprChildren, stmtChildren, walkExprs } from './ast';
+import {
+  type Expr,
+  type SFn,
+  type Stmt,
+  assignsIn,
+  exprChildren,
+  mapExprChildren,
+  taintOverAssigns,
+  walkExprs,
+} from './ast';
 import { declaredTypes, exprCType } from './typing';
 
-/** The bare name an `assign` stores a `(void *)` value into: a pointer cell, when no local binds
- *  it. */
+/** A value stored into a pointer cell: `(void *)X`, which every pointer declaration of the cell
+ *  takes. */
+export const pointerCellValue = (e: Expr): Expr => ({ k: 'cast', to: T.ptr(T.void()), e });
+
+/** The bare name an `assign` stores a `(void *)` value into (`pointerCellValue`): a pointer cell,
+ *  when no local binds it. */
 export function pointerCellStore(s: Stmt): string | undefined {
   return s.k === 'assign' && s.value.k === 'cast' && s.value.to.kind === 'ptr' && s.value.to.to.kind === 'void'
     ? s.name
@@ -28,18 +43,6 @@ export function pointerCellStore(s: Stmt): string | undefined {
 
 const COMPARE = new Set(['<', '<=', '>', '>=', '==', '!=']);
 
-const assigns = (body: Stmt[]): Extract<Stmt, { k: 'assign' }>[] => {
-  const out: Extract<Stmt, { k: 'assign' }>[] = [];
-  const visit = (s: Stmt): void => {
-    if (s.k === 'assign') {
-      out.push(s);
-    }
-    stmtChildren(s).forEach(visit);
-  };
-  body.forEach(visit);
-  return out;
-};
-
 /** Whether `e` reads a variable `pick` takes. */
 const readsVar = (e: Expr, pick: (name: string) => boolean): boolean =>
   (e.k === 'var' && pick(e.name)) || exprChildren(e).some((c) => readsVar(c, pick));
@@ -59,18 +62,12 @@ export function cellOffset(e: Expr, cells: ReadonlySet<string>): boolean {
 /** The globals `body` stores a pointer into: a `(void *)` store, or the bare value of another one,
  *  or that value moved by integers (`cellOffset`). */
 export function pointerCells(body: Stmt[], isGlobal: (name: string) => boolean): Set<string> {
-  const stores = assigns(body).filter((s) => isGlobal(s.name));
-  const out = new Set(stores.filter((s) => pointerCellStore(s) !== undefined).map((s) => s.name));
-  for (let grew = true; grew;) {
-    grew = false;
-    for (const s of stores) {
-      if (!out.has(s.name) && ((s.value.k === 'var' && out.has(s.value.name)) || cellOffset(s.value, out))) {
-        out.add(s.name);
-        grew = true;
-      }
-    }
-  }
-  return out;
+  const stores = assignsIn(body).filter((s) => isGlobal(s.name));
+  return taintOverAssigns(
+    stores,
+    stores.filter((s) => pointerCellStore(s) !== undefined).map((s) => s.name),
+    (s, cells) => (s.value.k === 'var' && cells.has(s.value.name)) || cellOffset(s.value, cells),
+  );
 }
 
 /** The bare globals a pointer cell meets bare: compared with one or with its `cellOffset`, or
@@ -83,7 +80,7 @@ function meetsBare(body: Stmt[], isGlobal: (name: string) => boolean, cells: Rea
     }
   };
   const isCell = (e: Expr): boolean => (e.k === 'var' && cells.has(e.name)) || cellOffset(e, cells);
-  for (const s of assigns(body)) {
+  for (const s of assignsIn(body)) {
     if (cells.has(s.name)) {
       meets(s.value);
     }
@@ -230,6 +227,8 @@ function mapIntegerSlots(sfn: SFn, cells: ReadonlySet<string>, rules: SlotRules)
         };
       case 'break':
       case 'continue':
+      case 'goto':
+      case 'caseEndGoto':
         return s;
     }
   };
@@ -303,8 +302,8 @@ export function pointerPartners(sfn: SFn): Set<string> {
  *  goes `(u32)(u8 *)g` beside the cell's `(u32)g`: under a float declaration that is no C, as the
  *  bare comparison was not. KNOWN GAP: under an array or a function declaration that is the
  *  global's address, compared with no diagnostic, and IDO takes the integer read that made it no
- *  partner (`v1 = g`) with none either; structure.ts `globalWord` says why no spelling reads the
- *  word there.
+ *  partner (`v1 = g`) with none either; structure/pointer-spelling.ts `globalWord` says why no
+ *  spelling reads the word there.
  *
  *  Run by the C-family backend's `emit` (backend/cfamily.ts), after every respell variation, so a
  *  respell reads the uses as the structurer spelled them and a store it removes takes the
@@ -350,7 +349,7 @@ export function legalizePointerCells(sfn: SFn): SFn {
     intArg: (e) =>
       e.k === 'bin' && cellSum(e) && exprCType(e, vt)?.kind === 'ptr' ? { k: 'cast', to: T.u(32), e } : asInt(e),
     comparedGlobal: (e) => ({ k: 'cast', to: T.u(32), e: { k: 'cast', to: T.ptr(T.u(8)), e } }),
-    intoCell: (e) => ({ k: 'cast', to: T.ptr(T.void()), e: asBytes(e) }),
+    intoCell: (e) => pointerCellValue(asBytes(e)),
     pointerOffset: asBytes,
     storedGlobal: () => {},
   });

package/src/l3/ptrfield.ts

@@ -29,10 +29,24 @@
 // `*(volatile s32 *)0x040000D4/D8/DC` device writes — `volatile` restricts what may be done with
 // THOSE accesses and does not merge their type into the pointer's alias set.
 //
-// SEMANTICS ARE PRESERVED BY CONSTRUCTION on a target whose pointers are 32 bits: the declaration
-// changes, and every read is wrapped in a cast back to the field's own recovered integer type, so
-// each use computes the same value it did. Nothing else moves. THE 32-BIT ASSUMPTION IS ASSERTED,
-// NOT CHECKED — there is no pointer-width field on TargetDescription to check it against, and the
+// SEMANTICS ARE PRESERVED BY CONSTRUCTION on a target whose pointers are 32 bits — WHILE NO STORE
+// OF ANOTHER ALIAS SET REACHES THE FIELD'S BYTES: the declaration changes, and every read is
+// wrapped in a cast back to the field's own recovered integer type, so each use computes the same
+// value it did. The cast keeps the VALUE, not the read's alias set: the load is still of a pointer
+// type, which is the very freedom this variation exists to give agbcc, and which it uses to read
+// stale past an integer store to the same bytes. Two such stores are knowable from the tree, and
+// each has a gate. Over a local array the body IS that store: the frame audit licenses a wider
+// runtime index into those bytes as one integer type (frontend/frame-objects.ts `indexedWidth`),
+// so `over-local-storage` refuses a field selected out of one. And once a local's address has LEFT
+// the function (a call argument, a stored or returned value) while the function writes local
+// storage, a pointer it obtains from anywhere but its params or a fixed address may be that same
+// address handed back (`k(buf); p = get(); x = p->a; buf[i] = v;`), so `frame-escaped` refuses a
+// field read through one. Past those, a store the asm shows is tied to the field's bytes only by
+// the caller's or a global's aliasing, which the tree cannot see — which spelling the original had
+// is then what the differ referees, and it is the only referee there.
+//
+// THE 32-BIT ASSUMPTION IS ASSERTED, NOT CHECKED — there is no pointer-width field on
+// TargetDescription to check it against, and the
 // assumption is already tower-wide (`l3/typing.ts`'s `ptrElemBytes` returns 4 for any pointee). On
 // a 64-bit target this variation would change a struct's LAYOUT rather than only its spelling, so the
 // width field is what that target's first row must add, and this note is where to start.
@@ -49,9 +63,11 @@
 //
 // GATE (PTR_FIELD_GATES, read once per field): the field's recovered type must be a 32-bit
 // integer; it must never be a store LVALUE (the write side would need a cast on the value, which
-// is a second question); and it must never stand as the BASE of another access (a field the tree
-// already dereferences is one the recovery typed from its own use, not from a width). Nothing
-// qualifying ⇒ decline (null).
+// is a second question); it must never stand as the BASE of another access (a field the tree
+// already dereferences is one the recovery typed from its own use, not from a width); and it must
+// never be selected out of a local array's bytes (`over-local-storage`, the caveat above); and
+// while a written local's address has escaped, it must be read through a param or a fixed address
+// (`frame-escaped`, the same caveat). Nothing qualifying ⇒ decline (null).
 //
 // SCOPE, because both of this table's blind spots look exactly like a gate refusing. First, THERE
 // IS NO PAD RULE, deliberately: `plan` builds a ctx only for fields the tree ACCESSES, so "a field
@@ -67,12 +83,16 @@ import {
   type SFn,
   type Stmt,
   type StructType,
+  assignsIn,
   mapExprChildren,
   mapStmtExprs,
+  mentionedName,
   stmtChildren,
+  taintOverAssigns,
   walkExprs,
 } from './ast';
 import { type Gate, firstRejection } from './gates';
+import { localAddresses, localStorageEscapesWritten, nameStorage } from './storage';
 import { declaredTypes, exprCType } from './typing';
 
 /** One recovered field as the gates read it — built only for fields the tree accesses. */
@@ -82,6 +102,12 @@ interface FieldCtx {
   written: boolean;
   /** the field's value stands as the base of an `index` or another `field` */
   dereferenced: boolean;
+  /** some access to the field selects it out of a local array's bytes */
+  overLocalStorage: boolean;
+  /** some access reads the field through a pointer that is neither a param nor a fixed address */
+  obtainedPointer: boolean;
+  /** a local's address leaves the function, and the function writes local storage */
+  frameEscaped: boolean;
 }
 
 export const PTR_FIELD_GATES: readonly Gate<FieldCtx>[] = [
@@ -106,6 +132,26 @@ export const PTR_FIELD_GATES: readonly Gate<FieldCtx>[] = [
     guardedBy: 'ptrfield.test.ts: a field standing as an access base declines',
     rejects: (c) => c.dereferenced,
   },
+  {
+    id: 'over-local-storage',
+    why:
+      "a local array's bytes are typed by the frame audit, which licenses a wider runtime index only " +
+      'while every access of one width is one integer type; a pointer field over them is an alias ' +
+      'set of its own, and agbcc at -O2 reads it stale past an integer store to the same bytes',
+    sound: true,
+    guardedBy: 'ptrfield.test.ts: a field selected out of a local array declines',
+    rejects: (c) => c.overLocalStorage,
+  },
+  {
+    id: 'frame-escaped',
+    why:
+      "once a written local's address has left the function, a pointer it obtains later may be that " +
+      'address handed back, and a pointer field read through it is then read stale past the integer ' +
+      'store to the same bytes',
+    sound: true,
+    guardedBy: 'ptrfield.test.ts: a field read through a re-obtained pointer after a frame address escaped declines',
+    rejects: (c) => c.frameEscaped && c.obtainedPointer,
+  },
 ];
 
 /** the struct a `field` node selects from, or null */
@@ -122,6 +168,10 @@ const keyOf = (structName: string, field: string): string => `${structName}.${fi
  *  reads cast back to. */
 function plan(sfn: SFn): Map<string, IrType> {
   const vt = declaredTypes(sfn);
+  const storage = localStorageNames(sfn);
+  const frameEscaped = localStorageEscapesWritten(sfn);
+  const fixed = fixedPointer(sfn);
+  const { accessAddress } = localAddresses(sfn);
   const seen = new Map<string, FieldCtx & { type: IrType }>();
   const note = (base: Expr, name: string, edit: (c: FieldCtx) => void): void => {
     const st = structOf(base, vt);
@@ -134,6 +184,9 @@ function plan(sfn: SFn): Map<string, IrType> {
       word: declared.kind === 'int' && declared.width === 32,
       written: false,
       dereferenced: false,
+      overLocalStorage: false,
+      obtainedPointer: false,
+      frameEscaped,
       type: declared,
     };
     edit(cur);
@@ -141,7 +194,14 @@ function plan(sfn: SFn): Map<string, IrType> {
   };
   for (const e of walkExprs(sfn.body)) {
     if (e.k === 'field') {
-      note(e.base, e.name, () => {});
+      note(e.base, e.name, (c) => {
+        if (reachesStorage(e.base, storage)) {
+          c.overLocalStorage = true;
+        }
+        if (!fixed(accessAddress(e))) {
+          c.obtainedPointer = true;
+        }
+      });
     }
     // a field standing as an access base is one the recovery typed from its own use
     const inner = e.k === 'index' ? e.base : e.k === 'field' ? e.base : null;
@@ -163,6 +223,61 @@ function plan(sfn: SFn): Map<string, IrType> {
   return out;
 }
 
+/** The locals whose value is a LOCAL OBJECT'S ADDRESS: every local array (the bytes the frame
+ *  audit typed — `u8 sp0[n]`), then every local assigned an expression that reaches one, or a
+ *  local's address, to a fixpoint (`p0 = (s32 *)sp0;` carries the bytes into `p0`). Over-wide by
+ *  design: a local holding `sp0[i]` (a value read OUT of the bytes) is swept in too, which only
+ *  ever refuses a variation. */
+function localStorageNames(sfn: SFn): { names: Set<string>; locals: Set<string> } {
+  const locals = new Set(sfn.locals.map((l) => l.name));
+  const names = taintOverAssigns(
+    assignsIn(sfn.body),
+    sfn.locals.filter((l) => l.type.kind === 'array').map((l) => l.name),
+    (a, names) => locals.has(a.name) && reachesStorage(a.value, { names, locals }),
+  );
+  return { names, locals };
+}
+
+/** Does the expression hold a pointer the function did not OBTAIN — one no escaped frame address
+ *  can come back through? A constant address, a global's address, or a param nothing assigns (the
+ *  caller's value, which predates this frame), under casts and offsets. Anything else — a local, a
+ *  call's result, a value loaded from memory — may be the frame. */
+function fixedPointer(sfn: SFn): (e: Expr) => boolean {
+  const storage = nameStorage(sfn);
+  const assigned = new Set(assignsIn(sfn.body).map((a) => a.name));
+  const fixed = (e: Expr): boolean => {
+    switch (e.k) {
+      case 'const':
+        return true;
+      case 'addr':
+        return storage.get(e.name) !== 'local' && storage.get(e.name) !== 'param';
+      case 'var':
+        return storage.get(e.name) === 'param' && !assigned.has(e.name);
+      case 'cast':
+        return fixed(e.e);
+      // An offset from a fixed pointer stays in the object it points into, but the tree does not
+      // say which operand is the pointer: in `p + off` with `p = get()` and `off` a param, the
+      // param is the fixed side and `p` may be the frame. So every operand must be fixed.
+      case 'bin':
+        return (e.op === '+' || e.op === '-') && fixed(e.l) && fixed(e.r);
+      default:
+        return false;
+    }
+  };
+  return fixed;
+}
+
+/** does the expression name local storage, or take a local's address? */
+function reachesStorage(
+  e: Expr,
+  storage: { readonly names: ReadonlySet<string>; readonly locals: ReadonlySet<string> },
+): boolean {
+  return [...walkExprs([{ k: 'exprstmt', value: e }])].some((x) => {
+    const n = mentionedName(x);
+    return n !== undefined && (storage.names.has(n) || (x.k === 'addr' && storage.locals.has(n)));
+  });
+}
+
 /** Every `store` in the tree. ORDER-FREE by construction, which is what lets it use the shared
  *  `stmtChildren` (a switch's default sits at `defaultAt`, not last): its one caller only sets
  *  `written` on entries the preceding `walkExprs` pass already created — `note` builds an entry

package/src/l3/regspell.ts

@@ -101,6 +101,8 @@ function renameInStmt(s: Stmt, from: string, to: string): Stmt {
       };
     case 'break':
     case 'continue':
+    case 'goto':
+    case 'caseEndGoto':
       return s;
   }
 }
@@ -189,16 +191,21 @@ function condOtherMentions(cond: Expr, E: Expr, v: string): boolean {
   };
   return other ? mentions(other) : false;
 }
-/** cond compares E against a pure operand → same comparison reading the named var. */
+/** cond compares E against a pure operand → same comparison reading the named var.
+ *  Both rebuilds below SPREAD the compare, so its `unsignedCmp` evidence (l3/ast.ts) rides along:
+ *  the copy is declared at E's type, which keeps the compare's C meaning but not its asm meaning,
+ *  and rank.ts's judgment of the finished tree (typing.ts `signedOverUnsignedCompare`) is what
+ *  says whether `w0 >= a1` still compares the way the machine did. The negation keeps it too: the
+ *  complement of an unsigned ordering is unsigned. */
 function rewriteCond(cond: Expr, E: Expr, name: string): Expr | null {
   if (cond.k !== 'bin' || !(cond.op in FLIP)) {
     return null;
   }
   if (exprEq(cond.l, E) && isPure(cond.r)) {
-    return { k: 'bin', op: cond.op, l: { k: 'var', name }, r: cond.r };
+    return { ...cond, l: { k: 'var', name } };
   }
   if (exprEq(cond.r, E) && isPure(cond.l)) {
-    return { k: 'bin', op: cond.op, l: cond.l, r: { k: 'var', name } };
+    return { ...cond, r: { k: 'var', name } };
   }
   return null;
 }
@@ -207,7 +214,7 @@ function flipCmp(cond: Expr): Expr | null {
     return null;
   }
   const op = FLIP[cond.op];
-  return op ? { k: 'bin', op: op as Extract<Expr, { k: 'bin' }>['op'], l: cond.l, r: cond.r } : null;
+  return op ? { ...cond, op: op as Extract<Expr, { k: 'bin' }>['op'] } : null;
 }
 /** in `upd`, the occurrence of subtree E replaced by var `name` (E was just assigned to it). */
 function renameSubexpr(e: Expr, E: Expr, name: string): Expr {