@asmlift/core 0.9.0 → 0.11.0

package/src/raise/aggmembers.ts

@@ -0,0 +1,290 @@
+// asmlift — A WHOLE-WORD READ OF A DECLARED STRUCT LOCAL, every use of which takes one member's
+// bits, READS THOSE MEMBERS.
+//
+// agbcc has no sp-relative halfword or byte load, so `struct S4 { u16 a; u8 b; u8 pad; } s =
+// mk(x); gOut = s.a;` reads the struct-return temp a word at a time and narrows in registers:
+//
+//     mov r0, sp / bl mk / ldr r1, [sp] / ldr r0, =gOut / strh r1, [r0]
+//
+// The frame-object audit types the temp as the struct the call returns (frame-objects.ts, the
+// `aggregate` stamp), so the word is bytes of a declared object, and each use of it names a byte
+// range: a narrowing store or extension (the low end), or one of those applied to a right shift
+// by whole bytes, or such a shift alone (the top end, whose zero fill is the member's own zero
+// extension). Where every use names exactly one declared integer member, the word is those
+// member reads — the same bytes, read at the same program point: each member load is placed where
+// the word load was, and the word load is left to dce.
+//
+// REFUSALS, each leaving the word read whole (spelled through a cast, which is the same bytes):
+//   * the base is not a frame object the audit typed as a struct, or the read is qualified;
+//   * a use is anything but the shapes above (an add, a compare of the whole word, a phi
+//     argument, a call argument), or a shift whose uses are not all of one width;
+//   * a range names no declared member exactly (a straddle, padding, a bitfield, a nested
+//     aggregate) — the member must start at that byte and be an integer of that width.
+import { type Block, type Fn, type Op, type Value, mkOp, mkValue } from '../ir/core';
+import { qualified } from '../ir/discipline';
+import { type IrType, T } from '../ir/types';
+
+type StructType = Extract<IrType, { kind: 'struct' }>;
+
+/** The struct a frame object's address points at, where the audit stamped one. */
+function frameStructOf(defs: ReadonlyMap<Value, Op>, base: Value): StructType | undefined {
+  const d = defs.get(base);
+  const t = d?.results[0].type;
+  return d?.opcode === 'laddr' && d.attrs.aggregate === true && t?.kind === 'ptr' && t.to.kind === 'struct'
+    ? t.to
+    : undefined;
+}
+
+/** The declared integer member at exactly `[byte, byte + width)`: its signedness, or undefined. */
+function memberAt(st: StructType, byte: number, width: number): boolean | undefined {
+  const f = st.fields.find((m) => m.off === byte);
+  return f !== undefined && f.type.kind === 'int' && f.type.width === width * 8 ? f.type.signed : undefined;
+}
+
+interface Use {
+  readonly op: Op;
+  readonly idx: number;
+}
+
+/** The bytes a use keeps of the value it reads, low end first: a narrowing store's or an
+ *  extension's width; undefined for any other use. */
+function narrowedTo(u: Use): number | undefined {
+  if (u.op.opcode === 'store' && u.idx === 1) {
+    return u.op.attrs.width as number;
+  }
+  return u.op.opcode === 'zext' || u.op.opcode === 'sext' ? (u.op.attrs.width as number) / 8 : undefined;
+}
+
+/** One member a word's uses take: its byte range in the word, and each op it is read for with the
+ *  rewiring of that op onto the member's load `m` (returning an op to place after the load). */
+interface MemberUse {
+  readonly byte: number;
+  readonly width: number;
+  readonly sites: readonly { readonly op: Op; readonly rewire: (m: Value, signed: boolean) => Op | undefined }[];
+}
+
+/** WHERE A MEMBER IS READ. The word was read once, where the compiler CSE'd the member reads of
+ *  the source into it; the source read each member where it is used. So a member read for an op
+ *  in another block is placed just before that op — where no write to the object lies on any path
+ *  from the word's load to it, which is the condition under which the two read the same bytes.
+ *  A write is any op but a load that takes the object's address (its struct-return call). */
+function readableAt(
+  load: Op,
+  site: Op,
+  { blockOf, preds, writes }: { blockOf: Map<Op, Block>; preds: Map<Block, Block[]>; writes: (op: Op) => boolean },
+): boolean {
+  const seen = new Set<Block>();
+  const work: [Block, number][] = [[blockOf.get(site)!, blockOf.get(site)!.ops.indexOf(site)]];
+  while (work.length > 0) {
+    const [b, end] = work.pop()!;
+    let reached = false;
+    for (let i = end - 1; i >= 0; i--) {
+      if (b.ops[i] === load) {
+        reached = true;
+        break;
+      }
+      if (writes(b.ops[i])) {
+        return false;
+      }
+    }
+    if (reached) {
+      continue;
+    }
+    const ps = preds.get(b) ?? [];
+    if (ps.length === 0) {
+      return false;
+    }
+    for (const p of ps) {
+      if (!seen.has(p)) {
+        seen.add(p);
+        work.push([p, p.ops.length]);
+      }
+    }
+  }
+  return true;
+}
+
+export function readDeclaredMembers(fn: Fn, littleEndian: boolean): number {
+  const defs = new Map<Value, Op>();
+  const uses = new Map<Value, Use[]>();
+  const branchArgs = new Set<Value>();
+  const blockOf = new Map<Op, Block>();
+  const preds = new Map<Block, Block[]>();
+  for (const b of fn.blocks) {
+    for (const op of b.ops) {
+      blockOf.set(op, b);
+      op.results.forEach((r) => defs.set(r, op));
+      op.operands.forEach((v, idx) => (uses.get(v) ?? uses.set(v, []).get(v)!).push({ op, idx }));
+      op.successors.forEach((s) => {
+        s.args.forEach((a) => branchArgs.add(a));
+        (preds.get(s.block) ?? preds.set(s.block, []).get(s.block)!).push(b);
+      });
+    }
+  }
+  // every read of `from`, an edge's argument included
+  const replaceAll = (from: Value, to: Value): void => {
+    for (const { op, idx } of uses.get(from) ?? []) {
+      op.operands[idx] = to;
+    }
+    if (branchArgs.has(from)) {
+      for (const b of fn.blocks) {
+        for (const op of b.ops) {
+          op.successors.forEach((sc) => (sc.args = sc.args.map((a) => (a === from ? to : a))));
+        }
+      }
+    }
+  };
+  // a narrowing use of `m`: a store takes the member's low bytes, an extension of the member's
+  // own kind is the member read, another extension extends the member
+  const narrowOnto = (u: Use, m: Value, signed: boolean): undefined => {
+    if (u.op.opcode === 'store') {
+      u.op.operands[1] = m;
+    } else if (signed === (u.op.opcode === 'sext')) {
+      replaceAll(u.op.results[0], m);
+    } else {
+      u.op.operands[0] = m;
+    }
+    return undefined;
+  };
+  const narrowSite = (u: Use) => ({ op: u.op, rewire: (m: Value, signed: boolean) => narrowOnto(u, m, signed) });
+  // a shift that leaves exactly a member's bits, extended its own way: the member, or the member
+  // extended that way where it is declared the other
+  const extractSite = (sh: Op, width: number) => ({
+    op: sh,
+    rewire: (m: Value, signed: boolean): Op | undefined => {
+      const want = sh.opcode === 'shr_s';
+      if (signed === want) {
+        replaceAll(sh.results[0], m);
+        return undefined;
+      }
+      const x = mkOp(want ? 'sext' : 'zext', {
+        operands: [m],
+        results: [mkValue(T.unk(32))],
+        attrs: { width: width * 8 },
+      });
+      replaceAll(sh.results[0], x.results[0]);
+      return x;
+    },
+  });
+  const isShr = (op: Op): boolean => (op.opcode === 'shr_u' || op.opcode === 'shr_s') && op.operands.length === 1;
+  const frameOff = (v: Value): number | undefined => {
+    const d = defs.get(v);
+    return d?.opcode === 'laddr' ? (d.attrs.off as number) : undefined;
+  };
+  let changed = 0;
+  for (const blk of fn.blocks) {
+    for (let i = 0; i < blk.ops.length; i++) {
+      const load = blk.ops[i];
+      if (load.opcode !== 'load' || qualified(load)) {
+        continue;
+      }
+      const st = frameStructOf(defs, load.operands[0]);
+      const word = load.attrs.width as number;
+      const at0 = load.attrs.off as number;
+      const v = load.results[0];
+      if (st === undefined || branchArgs.has(v)) {
+        continue;
+      }
+      // the byte a `width`-byte range `shift` bits up the word starts at
+      const byteOf = (shift: number, width: number): number => (littleEndian ? shift / 8 : word - shift / 8 - width);
+      const plan: MemberUse[] = [];
+      let ok = (uses.get(v) ?? []).length > 0;
+      for (const u of uses.get(v) ?? []) {
+        const width = narrowedTo(u);
+        if (width !== undefined && width < word) {
+          plan.push({ byte: byteOf(0, width), width, sites: [narrowSite(u)] });
+          continue;
+        }
+        // `(x << a) >> b`: bits [b - a, 32 - a) of the word, the middle members
+        if (u.op.opcode === 'shl' && u.op.operands.length === 1 && !branchArgs.has(u.op.results[0])) {
+          const a = u.op.attrs.imm as number;
+          const shrs = uses.get(u.op.results[0])?.map((x) => x.op) ?? [];
+          const b = shrs[0]?.attrs.imm as number | undefined;
+          const width = b === undefined ? 0 : (32 - b) / 8;
+          if (
+            b !== undefined &&
+            shrs.every((x) => isShr(x) && x.attrs.imm === b && !branchArgs.has(x.results[0])) &&
+            b >= a &&
+            (b - a) % 8 === 0 &&
+            (width === 1 || width === 2) &&
+            32 - a <= word * 8
+          ) {
+            plan.push({ byte: byteOf(b - a, width), width, sites: shrs.map((x) => extractSite(x, width)) });
+            continue;
+          }
+          ok = false;
+          break;
+        }
+        const shift = isShr(u.op) ? (u.op.attrs.imm as number) : 0;
+        if (shift <= 0 || shift % 8 !== 0 || shift >= word * 8 || branchArgs.has(u.op.results[0])) {
+          ok = false;
+          break;
+        }
+        const top = word - shift / 8;
+        const shUses = uses.get(u.op.results[0]) ?? [];
+        const widths = new Set(shUses.map(narrowedTo));
+        const narrowed = [...widths][0];
+        if (
+          u.op.opcode === 'shr_u' &&
+          shUses.length > 0 &&
+          widths.size === 1 &&
+          narrowed !== undefined &&
+          narrowed < top
+        ) {
+          plan.push({ byte: byteOf(shift, narrowed), width: narrowed, sites: shUses.map(narrowSite) });
+        } else if (word === 4 && (top === 1 || top === 2)) {
+          // the shift's fill is the top member's own extension — of a whole word, whose bits above the
+          // member are the shift's alone, not a narrower load's extension
+          plan.push({ byte: byteOf(shift, top), width: top, sites: [extractSite(u.op, top)] });
+        } else {
+          ok = false;
+          break;
+        }
+      }
+      const signs = plan.map((p) => memberAt(st, at0 + p.byte, p.width));
+      if (!ok || signs.some((s) => s === undefined)) {
+        continue;
+      }
+      const obj = frameOff(load.operands[0]);
+      const writes = (op: Op): boolean => op.opcode !== 'load' && op.operands.some((o) => frameOff(o) === obj);
+      const objectIsBranchArg = [...branchArgs].some((a) => frameOff(a) === obj);
+      const mkLoad = (p: MemberUse, signed: boolean): Op =>
+        mkOp('load', {
+          operands: [load.operands[0]],
+          results: [mkValue(T.unk(32))],
+          attrs: { off: at0 + p.byte, width: p.width, signed },
+        });
+      // a member read for an op of the word's own block shares one load where the word was read
+      const shared = new Map<string, Op>();
+      const after: Op[] = [];
+      const sunk: [Op, Op[]][] = [];
+      plan.forEach((p, k) => {
+        const signed = signs[k]!;
+        for (const site of p.sites) {
+          const elsewhere = blockOf.get(site.op) !== blk;
+          if (elsewhere && !objectIsBranchArg && readableAt(load, site.op, { blockOf, preds, writes })) {
+            const m = mkLoad(p, signed);
+            const extra = site.rewire(m.results[0], signed);
+            sunk.push([site.op, extra === undefined ? [m] : [m, extra]]);
+            continue;
+          }
+          const key = `${p.byte}:${p.width}`;
+          const m = shared.get(key) ?? shared.set(key, mkLoad(p, signed)).get(key)!;
+          const extra = site.rewire(m.results[0], signed);
+          if (extra !== undefined) {
+            after.push(extra);
+          }
+        }
+      });
+      for (const [site, ops] of sunk) {
+        const b = blockOf.get(site)!;
+        b.ops.splice(b.ops.indexOf(site), 0, ...ops);
+        ops.forEach((o) => blockOf.set(o, b));
+      }
+      blk.ops.splice(blk.ops.indexOf(load) + 1, 0, ...shared.values(), ...after);
+      i = blk.ops.indexOf(load);
+      changed++;
+    }
+  }
+  return changed;
+}

package/src/raise/arrays.ts

@@ -78,7 +78,11 @@ export function recognizeArrays(fn: Fn): number {
         }
         b.ops[i] = mkOp('astore', {
           operands: [m.base, m.index, op.operands[1]],
-          attrs: carryDiscipline(op, { elemSize: op.attrs.width as number }),
+          // the signedness raise/storesign.ts read off a stored constant, when it read one
+          attrs: carryDiscipline(op, {
+            elemSize: op.attrs.width as number,
+            ...(op.attrs.signed !== undefined && { signed: op.attrs.signed }),
+          }),
         });
         count++;
       }

package/src/raise/const.ts

@@ -72,6 +72,31 @@ export function foldConstPair(opcode: string, a: number, b: number): number | nu
   return f ? f(a, b) : null;
 }
 
+/** Integer opcodes whose const/const form a test can be read on, as int32: `foldConstPair`'s `add`
+ *  and `or`, the rest of the arithmetic and the comparisons. `null` for any other opcode. Shared by
+ *  the reroll's folded top test (`restoreTopTest`) and the `for` whose first test the compiler
+ *  folded away (structure.ts, `forPlanAt`): which opcodes a test folds through is one decision. */
+const EVAL: Readonly<Record<string, (a: number, b: number) => number>> = {
+  add: (a, b) => foldConstPair('add', a, b)!,
+  or: (a, b) => foldConstPair('or', a, b)!,
+  sub: (a, b) => (a - b) | 0,
+  and: (a, b) => a & b,
+  xor: (a, b) => a ^ b,
+  icmp_eq: (a, b) => +(a === b),
+  icmp_ne: (a, b) => +(a !== b),
+  icmp_slt: (a, b) => +(a < b),
+  icmp_sle: (a, b) => +(a <= b),
+  icmp_sgt: (a, b) => +(a > b),
+  icmp_sge: (a, b) => +(a >= b),
+  icmp_ult: (a, b) => +(a >>> 0 < b >>> 0),
+  icmp_ule: (a, b) => +(a >>> 0 <= b >>> 0),
+  icmp_ugt: (a, b) => +(a >>> 0 > b >>> 0),
+  icmp_uge: (a, b) => +(a >>> 0 >= b >>> 0),
+};
+export const evalIntPair = (opcode: string, a: number, b: number): number | null =>
+  opcode in EVAL ? EVAL[opcode](a, b) : null;
+export const isIntPairOpcode = (opcode: string): boolean => opcode in EVAL;
+
 /** Does this opcode's const/const form denote a constant? The membership half of `foldConstPair`,
  *  for callers that must classify an op before they have its operands' values. */
 export const isConstFoldOpcode = (opcode: string): boolean => opcode in FOLD;

package/src/raise/declared-volatile.ts

@@ -1,32 +1,53 @@
 // asmlift — the decider for ir/discipline.ts's `declared` placement: a memory access of an object
-// the project's symbol map declares volatile.
+// the project's symbol map, or its declaration context, declares volatile.
 //
-// The stamp is a function of the IR, the map the function is lifted and structured under, and the
-// compiler, and nothing else: an access whose base reaches a global the map qualifies, at the byte
-// the access names (`declaresVolatile`) — and, for a read, one the compiler could have made of a
-// `volatile` (target.ts `readCouldBeVolatile`, which the device pin asks too). It is put as the
+// The stamp is a function of the IR, the map the function is lifted and structured under, the
+// declaration context's globals and the compiler, and nothing else: an access whose base reaches a
+// global the map qualifies, at the byte the access names (`declaresVolatile`), or one the context
+// declares with a volatile byte and the map does not lay out (`ContextGlobals.volatiles`, per
+// object, not per byte), or one through the value of a pointer the context declares to point at a
+// volatile (`ContextGlobals.pointeeVolatiles`) — and, for a read, one the compiler could have made
+// of a `volatile` (target.ts `readCouldBeVolatile`, which the device pin asks too). It is put as the
 // lift is made (pipeline.ts `liftStamped`), before the first pass that asks whether a read may be
 // deleted, folded or moved, and re-derived by every pass that changes which object an access names
 // and by structuring. Structuring the same function under another map — the `/raw-globals` setting
 // has none — re-runs it, and an op the new map does not qualify loses the stamp, so a structuring
-// never answers for a map it was not given. The base is read as the structurer will read it: a join
-// whose every edge passes one address is that address (`addressThroughJoins`). A base that reaches
-// no name is a pointer parameter, a raw address or a genuine join: no declaration is in evidence,
-// and the access stays unplaced unless the lift pinned it (`device`).
+// never answers for a map it was not given. The context is not the map: every candidate compiles
+// against it whichever names it spells, so it is read in both settings.
+//
+// The base is read as the structurer will read it: a join whose every edge passes one address is
+// that address (`addressThroughJoins`), and one every edge of which reaches one object — two of its
+// addresses, or a pointer a loop steps through it — is an access of that object, as one every edge
+// of which moves a pointer global's value is an access of its pointee (`reachThroughJoins`, one
+// reader for both). A join whose edges reach different globals (`c ? gP : &gV`) is an access of any
+// of them, placed only where every one is declared. A base with an edge that reaches no name — a
+// pointer parameter, a raw address — has no declaration in evidence, and the access stays
+// unplaced unless the lift pinned it (`device`).
 //
 // A read structuring stamps that the earlier stamps left plain was plain to every raising pass, and a
 // short-circuit fold may have lifted it out of the arm it ran in. structure.ts declines on such a
 // read in a `&&`/`||`'s guarded operand rather than place it.
-import { globalBaseOf, globalCellOf } from '../ir/alias';
+import { globalCellOf } from '../ir/alias';
 import { type Fn, type Op, type Value, defOpMap } from '../ir/core';
 import { DECLARED_VOLATILE } from '../ir/discipline';
 import { MEM_BASE_OPS } from '../ir/opcodes';
+import type { ContextGlobals } from '../proto-context';
 import { type SymbolInfo, type SymbolMap, declaresVolatile, symbolsByName } from '../symbols';
 import { type TargetDescription, readCouldBeVolatile } from '../target';
 import { valueNumberOf } from './gvn';
 
-/** The compiler fact the stamp reads. */
-export type StampBehaviors = Pick<TargetDescription['compilerBehaviors'], 'volatileReadsExtendInRegister'>;
+/** The compiler fact the stamp reads, and the declaration context's globals when there is one.
+ *  The context is a REQUIRED key, `undefined` when there is none: the stamp clears every stamp it
+ *  does not re-derive, so a re-stamp handed the compiler behaviors alone would unplace every read
+ *  the context made volatile. Build one with pipeline.ts `stampBehaviorsFor`. */
+export type StampBehaviors = Pick<TargetDescription['compilerBehaviors'], 'volatileReadsExtendInRegister'> & {
+  readonly contextGlobals: ContextGlobals | undefined;
+};
+
+/** Does the map lay out this object's volatility itself? A layout answers per member, which is
+ *  finer than the context's per-object fact; an entry with none (a name and a size off the symbol
+ *  table) leaves the context's answer standing. */
+const laysOut = (info: SymbolInfo | undefined): boolean => Array.isArray(info?.layout) && info.layout.length > 0;
 
 /** May this memory access be stamped: a store, or a read the compiler could have made of a
  *  `volatile`? */
@@ -41,6 +62,29 @@ const stampable = (op: Op, behaviors: StampBehaviors): boolean =>
  *  is such a parameter, and the stamp is put before that pass, so it reads the base the structurer
  *  will. */
 function addressThroughJoins(fn: Fn): (v: Value) => Value {
+  const incoming = joinIncoming(fn);
+  const numberOf = valueNumberOf(fn);
+  const through = (v: Value, onWalk: Set<Value>): Value | null => {
+    const ins = incoming.get(v);
+    if (ins === undefined) {
+      return v;
+    }
+    if (onWalk.has(v)) {
+      return null;
+    }
+    onWalk.add(v);
+    const each = ins.filter((a) => a !== v).map((a) => through(a, onWalk));
+    onWalk.delete(v);
+    const first = each[0];
+    return first !== undefined && first !== null && each.every((a) => a !== null && numberOf(a) === numberOf(first))
+      ? first
+      : null;
+  };
+  return (v) => through(v, new Set()) ?? v;
+}
+
+/** Every block parameter's incoming values, one per in-edge (the entry block's excepted). */
+export function joinIncoming(fn: Fn): Map<Value, Value[]> {
   const incoming = new Map<Value, Value[]>();
   for (const b of fn.blocks) {
     for (const op of b.ops) {
@@ -56,48 +100,180 @@ function addressThroughJoins(fn: Fn): (v: Value) => Value {
       }
     }
   }
-  const numberOf = valueNumberOf(fn);
-  const through = (v: Value, onWalk: Set<Value>): Value | null => {
-    const ins = incoming.get(v);
+  return incoming;
+}
+
+/** What an address reaches: an access of a global OBJECT (`gW.b`, `gVA[i]`), or of what the pointer a
+ *  global holds points at (`*gP`, `gQ->b`) — the POINTEE of that global. */
+type Reach = { readonly kind: 'object' | 'pointee'; readonly sym: string };
+
+/** The globals an address reaches, one per edge that reaches a different one, each as an object or
+ *  as a pointer's pointee, read through address arithmetic and joins alike: a `gaddr` is its object;
+ *  a word read from a global's own first byte is that global's value, so an address moved from it
+ *  reaches the global's pointee (asked only of a global in `pointers`, the ones the context declares
+ *  to point at a volatile: any other word read is an index, not a base) — and so is a word read from
+ *  a join every edge of which is such a global's address; an `add` with one reaching operand and a
+ *  `sub` from one reach what they do; and a block parameter reaches what each in-edge's value
+ *  reaches, an edge that passes the parameter itself moved by an offset (a strength-reduced loop
+ *  pointer `v0 = v0 + 2`) aside. So `c ? &gW.a : &gW.b` and a pointer seeded with `&gVA` and stepped
+ *  through it are accesses of that one object, `c ? gP + 1 : gP + 2` and a pointer seeded with `gP`
+ *  and stepped are accesses of gP's pointee, and `c ? gP : gQ` or `c ? gP : &gV` is an access of
+ *  either, which the caller places only where every one is declared. ONE reader answers all of
+ *  them, so a shape the object path reads the pointee path reads too. Null where an edge reaches
+ *  none. `addressThroughJoins` — one value on every edge — is narrower. */
+function reachThroughJoins(
+  fn: Fn,
+  defs: Map<Value, Op>,
+  pointers: ReadonlySet<string> | undefined,
+): (v: Value) => readonly Reach[] | null {
+  const incoming = joinIncoming(fn);
+  const SELF = Symbol('self');
+  type Step = readonly Reach[] | typeof SELF | null;
+  const union = (steps: readonly (readonly Reach[])[]): Reach[] => {
+    const out: Reach[] = [];
+    for (const r of steps.flat()) {
+      if (!out.some((o) => o.kind === r.kind && o.sym === r.sym)) {
+        out.push(r);
+      }
+    }
+    return out;
+  };
+  /** The globals whose own address every edge of `v` passes, unmoved; null where one passes anything else. */
+  // A value's answer is the same from every walk that never cut a cycle below it, so those are
+  // remembered: without that, a chain of diamonds whose arms both step one pointer is walked once
+  // per path, 2^n times, on every stamp. An answer that cut a cycle depends on the walk and is not.
+  let cuts = 0;
+  const addressMemo = new Map<Value, string[] | null>();
+  const reachMemo = new Map<Value, Step>();
+  const addresses = (v: Value, onWalk: Set<Value>): string[] | null => {
+    const d = defs.get(v);
+    if (d?.opcode === 'gaddr') {
+      return [d.attrs.sym as string];
+    }
+    const ins = d === undefined ? incoming.get(v) : undefined;
     if (ins === undefined) {
-      return v;
+      return null;
     }
     if (onWalk.has(v)) {
+      cuts++;
       return null;
     }
+    if (addressMemo.has(v)) {
+      return addressMemo.get(v)!;
+    }
+    const before = cuts;
     onWalk.add(v);
-    const each = ins.filter((a) => a !== v).map((a) => through(a, onWalk));
+    const each = ins.filter((a) => a !== v).map((a) => addresses(a, onWalk));
     onWalk.delete(v);
-    const first = each[0];
-    return first !== undefined && first !== null && each.every((a) => a !== null && numberOf(a) === numberOf(first))
-      ? first
-      : null;
+    const out = each.length > 0 && each.every((a) => a !== null) ? [...new Set(each.flat())] : null;
+    if (cuts === before) {
+      addressMemo.set(v, out);
+    }
+    return out;
+  };
+  const reach = (v: Value, onWalk: Set<Value>): Step => {
+    if (reachMemo.has(v)) {
+      return reachMemo.get(v)!;
+    }
+    const before = cuts;
+    const out = reachOnce(v, onWalk);
+    if (cuts === before) {
+      reachMemo.set(v, out);
+    }
+    return out;
+  };
+  const reachOnce = (v: Value, onWalk: Set<Value>): Step => {
+    const d = defs.get(v);
+    if (d?.opcode === 'gaddr') {
+      return [{ kind: 'object', sym: d.attrs.sym as string }];
+    }
+    if (d?.opcode === 'load' && ((d.attrs.off as number | undefined) ?? 0) === 0) {
+      const syms = addresses(d.operands[0], new Set());
+      return syms !== null && syms.every((sym) => pointers?.has(sym) === true)
+        ? syms.map((sym) => ({ kind: 'pointee', sym }))
+        : null;
+    }
+    if (d?.opcode === 'add' && d.operands.length === 2) {
+      const a = reach(d.operands[0], onWalk);
+      const b = reach(d.operands[1], onWalk);
+      if (a !== null && b !== null) {
+        // An object's address plus a pointer's value is an index into the object (a byte array
+        // subscripted by a global the context also declares a pointer, or by a join of two such
+        // values); two of a kind name none, and neither does a side that mixes the kinds.
+        if (a === SELF || b === SELF) {
+          return null;
+        }
+        const all = (r: readonly Reach[], kind: Reach['kind']): boolean => r.every((x) => x.kind === kind);
+        if (all(a, 'object') && all(b, 'pointee')) {
+          return a;
+        }
+        return all(b, 'object') && all(a, 'pointee') ? b : null;
+      }
+      return a ?? b;
+    }
+    if (d?.opcode === 'sub' && d.operands.length === 2) {
+      return reach(d.operands[0], onWalk);
+    }
+    const ins = d === undefined ? incoming.get(v) : undefined;
+    if (ins === undefined) {
+      return null;
+    }
+    if (onWalk.has(v)) {
+      cuts++;
+      return SELF;
+    }
+    onWalk.add(v);
+    const each = ins.map((a) => reach(a, onWalk)).filter((r) => r !== SELF);
+    onWalk.delete(v);
+    return each.length > 0 && each.every((r) => r !== null) ? union(each as (readonly Reach[])[]) : null;
+  };
+  return (v) => {
+    const r = reach(v, new Set());
+    return r === null || r === SELF ? null : r;
   };
-  return (v) => through(v, new Set()) ?? v;
 }
 
-/** Stamp every memory access of `fn` to an object `symbols` declares volatile — a read only where a
- *  compiler behaving as `behaviors` says could have made it of one — and clear the stamp from every
- *  other op. Returns the ops it stamped that were not stamped before. */
+/** Stamp every memory access of `fn` to an object `symbols` or `behaviors.contextGlobals` declares
+ *  volatile — a read only where a compiler behaving as `behaviors` says could have made it of one —
+ *  and clear the stamp from every other op. Returns the ops it stamped that were not stamped before. */
 export function stampDeclaredVolatile(
   fn: Fn,
   symbols: ReadonlyMap<string, SymbolInfo> | undefined,
   behaviors: StampBehaviors,
 ): Op[] {
   const added: Op[] = [];
-  const defs = symbols ? defOpMap(fn) : undefined;
-  const addressOf = symbols ? addressThroughJoins(fn) : undefined;
+  const contextVolatiles = behaviors.contextGlobals?.volatiles;
+  const pointees = behaviors.contextGlobals?.pointeeVolatiles;
+  const reads =
+    symbols !== undefined ||
+    (contextVolatiles !== undefined && contextVolatiles.size > 0) ||
+    (pointees !== undefined && pointees.size > 0);
+  const defs = reads ? defOpMap(fn) : undefined;
+  const addressOf = reads ? addressThroughJoins(fn) : undefined;
+  const reachOf = reads ? reachThroughJoins(fn, defs!, pointees) : undefined;
   for (const b of fn.blocks) {
     for (const op of b.ops) {
       const addr = defs && stampable(op, behaviors) ? addressOf!(op.operands[0]) : undefined;
-      const base = addr !== undefined ? globalBaseOf(defs!, addr) : null;
+      const reached = addr !== undefined ? reachOf!(addr) : null;
       // A subscript reaches the object while naming no cell, so only a `load`/`store` asks by byte,
-      // and an access that names no byte is placed only where every byte it could reach is qualified.
+      // and an access that names no byte is placed only where every byte it could reach is
+      // qualified. An access that may reach any of several globals is placed only where each one
+      // declares it.
       const cell =
-        base !== null && (op.opcode === 'load' || op.opcode === 'store')
+        reached?.length === 1 && reached[0].kind === 'object' && (op.opcode === 'load' || op.opcode === 'store')
           ? globalCellOf(defs!, addr!, op.attrs.off as number)
           : null;
-      const declared = base !== null && declaresVolatile(symbols!.get(base), cell === null ? null : cell.byte);
+      const declares = (r: Reach): boolean => {
+        if (r.kind === 'pointee') {
+          return pointees?.has(r.sym) === true;
+        }
+        const info = symbols?.get(r.sym);
+        return (
+          declaresVolatile(info, cell === null ? null : cell.byte) ||
+          (contextVolatiles?.has(r.sym) === true && !laysOut(info))
+        );
+      };
+      const declared = reached !== null && reached.every(declares);
       // A fresh record either way: a rebuilder may hand two ops one `attrs` object.
       if (declared && op.attrs[DECLARED_VOLATILE] !== true) {
         op.attrs = { ...op.attrs, [DECLARED_VOLATILE]: true };