@asmlift/core 0.9.0 → 0.11.0

package/src/raise/divpow2.ts

@@ -40,6 +40,11 @@
 // `2^k - 1` for the SAME k the shift uses, the guard must test the SAME value the arms divide, and
 // the biased arm must be the negative one — the consistency check m2c's `49b5d87` also adds),
 // because every one of those is a way for a superficially similar diamond to mean something else.
+//
+// ir/bits.ts `integerRange` (its `remainderPair`) reads the same SUNK diamond under a remainder,
+// `x - (phi >> k << k)`, as one bounded term. It cannot wait for this pass's `sdiv`: the frontends'
+// frame audit asks those ranges before runPreRecovery runs; and as a bound, not a rewrite, it holds
+// for any bias in [0, 2^k) on any edge, so it does not take this pass's gates.
 import { Block, Fn, Op, Value, defOpMap, mkOp, mkValue, predecessors, replaceAllUsesWith } from '../ir/core';
 import { effectful } from '../ir/discipline';
 import { T } from '../ir/types';
@@ -225,3 +230,190 @@ export function recognizeDivPow2(fn: Fn): boolean {
   }
   return changed;
 }
+
+// ── the signed REMAINDER by a power of two, in IDO's branching form ─────────────────────────
+//
+// `x % 2^k` truncates toward zero, so a negative x with low bits set takes `2^k` off its masked
+// value. IDO masks first and corrects on a two-test branch (modpow2, `a % 16`):
+//
+//	bgez	a0, .L       ; x >= 0: the mask is the remainder
+//	andi	v0, a0, 15   ; (delay slot: runs on both paths)
+//	beqz	v0, .L       ; low bits clear: so is it
+//	nop
+//	addiu	v0, v0, -16  ; else take 2^k off
+//     .L:
+//
+// Two heads and a correction arm reach one merge, so — like the quotient above — it is a shape in
+// the control flow, out of the idiom patterns' reach. Lifted as written it is spelled
+// `if (x < 0 && (x & 15) != 0) v = (x & 15) + -16; else v = x & 15;`, which IDO compiles to other
+// code; `x % 16` compiles back to this diamond. The identity is exact for every signed x — the
+// diamond IS C's `%` — and the round trip is self-verifying for the reason the quotient's is.
+//
+// IDENTITY-OR-DECLINE again: the mask must be exactly `2^k - 1` of the dividend the first test
+// compares against zero, the second test must compare THAT mask against zero, the correction must
+// be exactly `mask - 2^k` (`correctedMask`), and the corrected value must reach the merge only from the arm
+// both tests failed into. The two inner blocks are deleted, so neither may do anything else.
+// agbcc, gcc and kmc COMPILE `%` as a biased floor (`x - (t >> k << k)`), which ir/bits.ts
+// `remainderPair` bounds and this does not touch; mwcc's is branch-free.
+//
+// THE PASS IS NOT GATED BY TARGET: a HAND-WRITTEN diamond of this shape on any compiler is folded
+// to `%` too (agbcc compiles `r = i & 15; if (i < 0 && r != 0) r -= 16;` to the same two-test
+// diamond, which lifts `i % 16`). The identity holds whatever wrote it, so the C is the same value;
+// whether `%` recompiles to the target's bytes there is the bench's question, not this pass's.
+
+/** `and x, const(2^k - 1)` → { x, k }, else null. The and is commutative. */
+function maskOf(defs: Map<Value, Op>, v: Value): { x: Value; k: number } | null {
+  const d = defs.get(v);
+  if (!d || d.opcode !== 'and' || d.operands.length !== 2) {
+    return null;
+  }
+  for (const [a, b] of [
+    [0, 1],
+    [1, 0],
+  ] as const) {
+    const c = defs.get(d.operands[b]);
+    const m = c?.opcode === 'const' ? (c.attrs.value as number) : undefined;
+    if (m !== undefined && m > 0 && (m & (m + 1)) === 0) {
+      return { x: d.operands[a], k: Math.log2(m + 1) };
+    }
+  }
+  return null;
+}
+
+/** The correction arm's value, `mask - 2^k` for the mask's own k, in either spelling the IR carries
+ *  it: an `add` of the constant `-2^k` (IDO's `addiu v0, v0, -2^k`, where it fits an immediate:
+ *  k < 16), or a `sub` of the constant `2^k` (k >= 16, where IDO materialises `2^k` as the mask's
+ *  register plus one in the second test's delay slot, `addiu at, at, 1; subu v0, v0, at`, which
+ *  the constant fold has made `2^k` by now). The identity is the subtraction, not its encoding. */
+function correctedMask(defs: Map<Value, Op>, v: Value): { t: Value; mk: { x: Value; k: number } } | null {
+  const u = defs.get(v);
+  if ((u?.opcode !== 'add' && u?.opcode !== 'sub') || u.operands.length !== 2) {
+    return null;
+  }
+  // a sub's minuend is its first operand; an add's mask may stand on either side
+  const orders =
+    u.opcode === 'sub'
+      ? ([[0, 1]] as const)
+      : ([
+          [0, 1],
+          [1, 0],
+        ] as const);
+  for (const [a, b] of orders) {
+    const c = defs.get(u.operands[b]);
+    const mk = maskOf(defs, u.operands[a]);
+    const want = u.opcode === 'sub' ? 2 ** (mk?.k ?? 0) : -(2 ** (mk?.k ?? 0));
+    if (c?.opcode === 'const' && mk !== null && c.attrs.value === want) {
+      return { t: u.operands[a], mk };
+    }
+  }
+  return null;
+}
+
+/** `icmp <op> v, const 0` → the compare's opcode, else null. */
+function zeroTest(defs: Map<Value, Op>, c: Value, v: Value): string | null {
+  const d = defs.get(c);
+  if (!d || d.operands.length !== 2 || d.operands[0] !== v) {
+    return null;
+  }
+  const z = defs.get(d.operands[1]);
+  return z?.opcode === 'const' && z.attrs.value === 0 ? d.opcode : null;
+}
+
+/**
+ * Fold IDO's branching signed-remainder-by-2^k diamond into `smod x, 2^k`. Returns true if the IR
+ * changed. Leaves the mask, the compares and the correction behind for the driver's DCE.
+ */
+export function recognizeSremPow2(fn: Fn): boolean {
+  let changed = false;
+  let progress = true;
+  while (progress) {
+    progress = false;
+    const defs = defOpMap(fn);
+    const preds = predecessors(fn);
+    const term = (b: Block) => b.ops[b.ops.length - 1];
+    // a result of `blocks`' ops read anywhere outside them, which deleting them would orphan
+    const escapes = (blocks: Block[]): boolean => {
+      const inside = new Set(blocks.flatMap((b) => b.ops.flatMap((op) => op.results)));
+      return fn.blocks
+        .filter((b) => !blocks.includes(b))
+        .some((b) =>
+          b.ops.some(
+            (op) =>
+              op.operands.some((v) => inside.has(v)) || op.successors.some((s) => s.args.some((v) => inside.has(v))),
+          ),
+        );
+    };
+    outer: for (const m of fn.blocks) {
+      // the merge holds the remainder alone and is reached by exactly the diamond's three edges
+      // (the entry block has an invisible edge; see recognizeDivPow2)
+      const mp = preds.get(m) ?? [];
+      if (m.params.length !== 1 || mp.length !== 3 || new Set(mp).size !== 3 || m === fn.blocks[0]) {
+        continue;
+      }
+      for (const fix of mp) {
+        // the CORRECTION arm: `mask - 2^k` to the merge, from the second test alone, nothing else
+        const ft = term(fix);
+        if (ft.opcode !== 'br' || ft.successors[0]?.block !== m || fix === fn.blocks[0] || fix.ops.some(effectful)) {
+          continue;
+        }
+        const n = preds.get(fix) ?? [];
+        if (n.length !== 1 || !mp.includes(n[0]) || n[0] === fn.blocks[0]) {
+          continue;
+        }
+        const inner = n[0];
+        const it = term(inner);
+        const hp = preds.get(inner) ?? [];
+        if (it.opcode !== 'cond_br' || hp.length !== 1 || !mp.includes(hp[0]) || inner.ops.some(effectful)) {
+          continue;
+        }
+        const head = hp[0];
+        const ht = term(head);
+        if (ht.opcode !== 'cond_br' || head === m || head === fix) {
+          continue;
+        }
+        // the corrected value: the mask less `2^k`
+        const corrected = correctedMask(defs, ft.successors[0].args[0]);
+        if (corrected === null || corrected.mk.k < 1 || corrected.mk.k > 30) {
+          continue;
+        }
+        const { t, mk } = corrected;
+        // the first test: x >= 0 to the merge with the mask, else on to the second
+        const [hTaken, hFall] = ht.successors;
+        const hFirst = zeroTest(defs, ht.operands[0], mk.x);
+        const hm = hFirst === 'icmp_sge' ? hTaken : hFirst === 'icmp_slt' ? hFall : null;
+        const hn = hFirst === 'icmp_sge' ? hFall : hFirst === 'icmp_slt' ? hTaken : null;
+        if (hm?.block !== m || hn?.block !== inner || hm.args[0] !== t || hn.args.length !== 0) {
+          continue;
+        }
+        // the second test: the mask == 0 to the merge with the mask, else to the correction
+        const [iTaken, iFall] = it.successors;
+        const iSecond = zeroTest(defs, it.operands[0], t);
+        const im = iSecond === 'icmp_eq' ? iTaken : iSecond === 'icmp_ne' ? iFall : null;
+        const ifx = iSecond === 'icmp_eq' ? iFall : iSecond === 'icmp_ne' ? iTaken : null;
+        if (im?.block !== m || ifx?.block !== fix || im.args[0] !== t || ifx.args.length !== 0) {
+          continue;
+        }
+        if (escapes([inner, fix])) {
+          continue;
+        }
+        // Rewrite: the head computes the remainder and goes straight to the merge.
+        const by = mkValue(T.s());
+        const r = mkValue(T.s());
+        head.ops.splice(
+          head.ops.length - 1,
+          0,
+          mkOp('const', { results: [by], attrs: { value: 2 ** mk.k } }),
+          mkOp('smod', { operands: [mk.x, by], results: [r] }),
+        );
+        head.ops[head.ops.length - 1] = mkOp('br', { successors: [{ block: m, args: [] }] });
+        replaceAllUsesWith(fn, m.params[0], r);
+        m.params = [];
+        fn.blocks = fn.blocks.filter((b) => b !== inner && b !== fix);
+        changed = true;
+        progress = true;
+        break outer;
+      }
+    }
+  }
+  return changed;
+}

package/src/raise/floathelpers.ts

@@ -1,17 +1,20 @@
 // asmlift — the soft-float boundary (L1 recognition): where integer words become floats.
 //
-// Three things cross it. A runtime helper whose op is a float op (`isFloatHelper`) — the peer of
+// Four things cross it. A runtime helper whose op computes on floats (`isFloatHelper`) — the peer of
 // `raise/widehelpers.ts`, gated by the target's runtime table rather than a hardware capability.
-// A parameter an ordinary callee declares `double` (the frontend's `doubles` on the call). And a
+// A parameter an ordinary callee declares `double` (the frontend's `doubles` on the call). The
+// result of an ordinary callee declared to return a floating type (its `floatReturn`). And a
 // double literal, two constant words, where the target states their order
 // (`TargetDescription.doubleArgWords`) and its compiler reads a literal back
-// (`compilerBehaviors.roundTripsDoubleLiterals`). What sets all three apart from the integer
+// (`compilerBehaviors.roundTripsDoubleLiterals`). What sets all four apart from the integer
 // helpers is the value's KIND: the words are bits in integer registers, and the pass re-types them
 // as floats, which only data flow may justify — see the function below.
+import { constWord } from '../ir/bits';
 import { Fn, Op, Value, mkOp, mkValue, replaceAllUsesWith } from '../ir/core';
 import { doubleBits, doubleOf } from '../ir/float-bits';
-import { T } from '../ir/types';
-import { arrivesAsDeclared, helperOp, isFloatHelper, lookupHelper } from '../runtime-helpers';
+import { type Opcode, fcmpOfTruth } from '../ir/opcodes';
+import { T, intWidth } from '../ir/types';
+import { arrivesAsDeclared, floatSidesOf, helperOp, isFloatHelper, lookupHelper } from '../runtime-helpers';
 import type { TargetDescription } from '../target';
 import { RaiseUnsupportedError } from './errors';
 import { isArgumentPair } from './pairparams';
@@ -34,17 +37,36 @@ import { isArgumentPair } from './pairparams';
  *     target's word order into an `fconst` (`a + 1.5` stages `0x3ff80000` in r2, its high word);
  *   - an argument the function also reads on its own, as a word or as one half of a pair;
  *   - a result read as a word or a half (`*(int *)&c` is a double's HIGH word, in r0), passed to
- *     any other call, or carried across an edge.
+ *     any other call, or carried across an edge;
+ *   - a result NOTHING reads. Folded, it would be a dead float op, and `dce` would delete the
+ *     arithmetic. Optimising (-O1, -O2), agbcc deletes a helper call whose result is dead
+ *     (`s = a * b; g(); return 0;` calls no `__mulsf3`), so the result's one reader was a later call
+ *     that took it in r0, and a guessed arity does not count a register a call wrote (frontend/ssa.ts
+ *     `fallbackArgc`, `trimClobberedCallArgs`): `g1(a * b)` with `g1` undeclared reads as
+ *     `__mulsf3(); return g1();`, and folded would print `return g1();`. A double's pair refuses
+ *     that shape at the frontend, naming the half the next call reads; a single is one word, so it
+ *     reaches here. At -O0 the rule is not asked: agbcc stores the result to the frame, which reads
+ *     it, and nothing folds there, its arguments being read from frame homes. A frontend that reads
+ *     those homes must re-measure this. A result some other op ALSO reads is not refused:
+ *     `s = a * b; g(s); return s;` and `s = a * b; g(); return s;` are the same bytes on agbcc, and
+ *     a declaration of `g` closes the trim's `g()` reading (`trimClobberedCallArgs`).
  *  A call refused takes every call its result feeds or is fed by with it, so what folds is a closed
- *  set of floats and verify's float rule holds by construction. */
+ *  set of floats and verify's float rule holds by construction.
+ *
+ *  A CONVERSION HAS AN INTEGER ON ONE SIDE (`floatSidesOf`), and only its float side is held to the
+ *  rule above: `(float)i` converts whatever integer `i` is, a parameter, a load or a sum, and
+ *  `(int)x` hands an integer to anything. Its result must still be read, by the dead-result rule,
+ *  and a float the function also reads as a word is no float source for it either. */
 export function recognizeFloatHelpers(fn: Fn, target: TargetDescription): boolean {
   const table = target.runtimeHelpers ?? {};
   let sites: Op[] = [];
   const consumers = new Map<Op, readonly number[]>();
   const def = new Map<Value, Op>();
   const users = new Map<Value, Array<Op | null>>(); // null: an edge argument
+  const returners = new Map<Op, string>(); // ordinary calls declared to return a floating type
   const use = (v: Value, by: Op | null) => users.set(v, [...(users.get(v) ?? []), by]);
   const helperOf = (op: Op) => (op.opcode === 'call' ? lookupHelper(table, String(op.attrs.target)) : undefined);
+  const sidesOf = (op: Op) => floatSidesOf(helperOf(op)!);
   for (const block of fn.blocks) {
     for (const op of block.ops) {
       op.results.forEach((r) => def.set(r, op));
@@ -64,9 +86,12 @@ export function recognizeFloatHelpers(fn: Fn, target: TargetDescription): boolea
       } else if (!helper && op.opcode === 'call' && Array.isArray(op.attrs.doubles)) {
         consumers.set(op, op.attrs.doubles as number[]);
       }
+      if (!helper && op.opcode === 'call' && typeof op.attrs.floatReturn === 'string') {
+        returners.set(op, op.attrs.floatReturn);
+      }
     }
   }
-  if (!sites.length && !consumers.size) {
+  if (!sites.length && !consumers.size && !returners.size) {
     return false;
   }
   // A projection nothing reads is not a read of a half: `dce` runs ahead of this pass only after a
@@ -78,7 +103,8 @@ export function recognizeFloatHelpers(fn: Fn, target: TargetDescription): boolea
   // same call as a word is a word read.
   const floatUse = (u: Op | null, v: Value, calls: ReadonlySet<Op>): boolean =>
     u !== null &&
-    (calls.has(u) || (consumers.has(u) && u.operands.every((o, i) => o !== v || consumers.get(u)!.includes(i))));
+    ((calls.has(u) && sidesOf(u).operands) ||
+      (consumers.has(u) && u.operands.every((o, i) => o !== v || consumers.get(u)!.includes(i))));
   const floatsOnly = (v: Value, calls: ReadonlySet<Op>) => (users.get(v) ?? []).every((u) => floatUse(u, v, calls));
   const entry = fn.blocks[0].params;
   // A `concat` of the same two slots in the same order as `d`: the frontend builds one afresh at each
@@ -98,24 +124,20 @@ export function recognizeFloatHelpers(fn: Fn, target: TargetDescription): boolea
       users.get(d.operands[0])!.every((u) => samePair(u, d) && floatsOnly(u.results[0], calls))
     );
   };
+  // A SINGLE AN ORDINARY CALLEE IS DECLARED TO RETURN is one whole word in the return register, so
+  // it is a float source as a helper's result is. A double is not: the frontend reads one word of
+  // it (`declaredReturnWidth` sizes no floating type), and that word is not the value.
+  const declaredSingle = (d: Op) => returners.get(d) === 'float' && intWidth(d.results[0].type) === 32;
   const fromCall = (v: Value, calls: ReadonlySet<Op>) => {
     const d = def.get(v);
-    return d !== undefined && calls.has(d);
+    return d !== undefined && ((calls.has(d) && sidesOf(d).result) || declaredSingle(d));
   };
   // A CONSTANT WORD, as a compiler may build one in two instructions: agbcc moves a word that is a
   // shifted byte as `mov`+`lsl` (thumb.md:66, `thumb_shiftable_const` at thumb.c:61) and one in
   // -255..-1 as `mov`+`neg` (thumb.md:88), so the high word of 2.0 reaches r3 as `0x80 << 23`. Its
-  // value, or undefined where `v` is no constant.
-  const wordOf = (v: Value): number | undefined => {
-    const d = def.get(v);
-    if (d?.opcode === 'const') {
-      return Number(d.attrs.value);
-    }
-    const shift = d?.opcode === 'shl' ? d.attrs.imm : undefined;
-    const w =
-      d?.operands.length === 1 && (d.opcode === 'neg' || typeof shift === 'number') ? wordOf(d.operands[0]) : undefined;
-    return w === undefined ? undefined : d!.opcode === 'neg' ? -w | 0 : (w << (shift as number)) | 0;
-  };
+  // value, or undefined where `v` is no constant — the shared word evaluator's answer (ir/bits.ts).
+  const words = { defs: def };
+  const wordOf = (v: Value): number | undefined => constWord(words, v) ?? undefined;
   // A LITERAL IS TWO CONSTANT WORDS, HIGH WORD FIRST on a target whose double crosses a call in
   // general words (`TargetDescription.doubleArgWords`) — the order that makes the long long naming
   // of the same pair another number. Its bits, or undefined where the pair is no literal, the target
@@ -138,21 +160,78 @@ export function recognizeFloatHelpers(fn: Fn, target: TargetDescription): boolea
   };
   const literal = (v: Value, calls: ReadonlySet<Op>) => literalBits(v) !== undefined && floatsOnly(v, calls);
   const source = (v: Value, calls: ReadonlySet<Op>) => argument(v, calls) || fromCall(v, calls) || literal(v, calls);
+  // A COMPARE FOLDS THROUGH THE TESTS OF ITS RESULT, which is libgcc's three-way answer: each reader
+  // must be a test of that integer against 0, and the compare the test then computes is read off
+  // the helper's contract — the sign that orders the operands, and its value on a NaN (`unordered`)
+  // — against `FCMP_TRUTH`. A test whose answer is no compare of the operands (always true, or true
+  // on both orders but not on equality), or a reader that is no test, refuses the helper.
+  const tests = new Map<Op, CompareTest[]>();
+  sites = sites.filter((op) => {
+    const unordered = helperOf(op)!.unordered;
+    if (unordered === undefined) {
+      return true;
+    }
+    const found = compareTests(op.results[0], users, def, wordOf, unordered);
+    if (found !== null) {
+      tests.set(op, found);
+    }
+    return found !== null;
+  });
   for (;;) {
     const calls = new Set(sites);
-    const kept = sites.filter(
-      (op) =>
-        op.operands.every((o) => source(o, calls)) &&
-        (users.get(op.results[0]) ?? []).every(
-          (u) => deadHalf(u) || floatUse(u, op.results[0], calls) || u?.opcode === 'ret',
-        ),
-    );
+    const kept = sites.filter((op) => {
+      const sides = sidesOf(op);
+      const read = (users.get(op.results[0]) ?? []).filter((u) => !deadHalf(u));
+      return (
+        (!sides.operands || op.operands.every((o) => source(o, calls))) &&
+        read.length > 0 &&
+        (!sides.result || read.every((u) => floatUse(u, op.results[0], calls) || u?.opcode === 'ret'))
+      );
+    });
     if (kept.length === sites.length) {
       break;
     }
     sites = kept;
   }
   const calls = new Set(sites);
+  // A DECLARED FLOATING RETURN HAS NO FALLBACK EITHER. The candidate prints the call against its
+  // declaration, so its result stored, compared, narrowed, carried across an edge in an integer
+  // variable or handed to any other call is CONVERTED there — `u.f = f(); g = u.b[0];` lifted as
+  // `g = f();` compiles to `bl f; bl __fixsfsi` — where the bytes moved the bits. So a single may
+  // go only where a helper's result may (a helper the fold keeps, a `double` parameter, the
+  // return), and is retyped a float; a double read off its one word goes nowhere. A result nothing
+  // reads is a call statement, and stays one.
+  const returned = new Map<Op, Value>();
+  for (const [op, spelled] of returners) {
+    const r = op.results[0];
+    const read = (users.get(r) ?? []).filter((u) => !deadHalf(u));
+    if (read.length === 0) {
+      continue;
+    }
+    if (!declaredSingle(op) || !read.every((u) => floatUse(u, r, calls) || u?.opcode === 'ret')) {
+      throw new RaiseUnsupportedError(
+        `cannot lift '${fn.name}': '${String(op.attrs.target)}' is declared to return ${spelled}, which this ` +
+          'target hands back as bits in a general register, and its result is read here as something ' +
+          'other than that float — a conversion the bytes do not make',
+      );
+    }
+    returned.set(op, mkValue(T.f32()));
+  }
+  // A FLOAT RETURNED MAKES THE FUNCTION'S RETURN A FLOAT, so every other `ret` converts what it
+  // hands back: `return 5;` beside `return fget();` compiles to the bits of 5.0f where the asm
+  // hands back the word 5. Each value a `ret` reads must then be a float this pass makes — a kept
+  // helper's result or a declared single's.
+  const madeFloat = (v: Value) => {
+    const d = def.get(v);
+    return d !== undefined && (returned.has(d) || (calls.has(d) && sidesOf(d).result));
+  };
+  const rets = fn.blocks.flatMap((b) => b.ops.filter((op) => op.opcode === 'ret' && op.operands.length > 0));
+  if (rets.some((r) => r.operands.some(madeFloat)) && !rets.every((r) => r.operands.every(madeFloat))) {
+    throw new RaiseUnsupportedError(
+      `cannot lift '${fn.name}': it returns a float on one path, and another return of this function hands ` +
+        'back an integer word, which C would convert to that float',
+    );
+  }
   // A DECLARED DOUBLE HAS NO FALLBACK. A helper the fold refuses stays a call for
   // `refuseUnmodelledHelpers` to gap, but an ordinary callee is no helper, and its two words handed
   // on as integers are the wrong number — so a double parameter nothing here can hand a double
@@ -170,7 +249,7 @@ export function recognizeFloatHelpers(fn: Fn, target: TargetDescription): boolea
       }
     }
   }
-  if (!sites.length && !consumers.size) {
+  if (!sites.length && !consumers.size && !returned.size) {
     return false;
   }
   const floatOf = new Map<Value, Value>();
@@ -209,23 +288,60 @@ export function recognizeFloatHelpers(fn: Fn, target: TargetDescription): boolea
     }
     floatOf.set(o, whole);
   };
+  for (const [op, now] of returned) {
+    floatOf.set(op.results[0], now);
+  }
   for (const op of sites) {
     const helper = helperOf(op)!;
-    op.operands.forEach((o, i) => retype(o, helper.params[i]));
-    floatOf.set(op.results[0], float(helper.returns));
+    const sides = floatSidesOf(helper);
+    if (sides.operands) {
+      op.operands.forEach((o, i) => retype(o, helper.params[i]));
+    }
+    if (sides.result) {
+      floatOf.set(op.results[0], float(helper.returns));
+    }
   }
   for (const [op, at] of consumers) {
     at.forEach((i) => retype(op.operands[i], 64));
   }
+  const folded = new Map<Op, Op>();
+  for (const [op, found] of tests) {
+    if (calls.has(op)) {
+      for (const t of found) {
+        const operands = op.operands.map((o) => floatOf.get(o)!);
+        const fcmp = helperOp(t.opcode, String(op.attrs.target), operands, t.at.results[0]);
+        // The relation the source spelled, where the test leaves it open: `__eqsf2` and `__nesf2`
+        // each fold to `fcmp_oeq` or to `fcmp_une`, by the sense of the branch that tests them
+        // (runtime-helpers.ts `RuntimeHelper.relation`).
+        const relation = helperOf(op)!.relation;
+        if (relation !== undefined) {
+          fcmp.attrs.relation = relation;
+        }
+        folded.set(t.at, fcmp);
+        t.spent.forEach((x) => spent.add(x));
+      }
+    }
+  }
   for (const block of fn.blocks) {
     block.ops = block.ops.flatMap((op) => {
+      // the call stays, its result now the float it was declared
+      if (returned.has(op)) {
+        return [mkOp('call', { operands: op.operands, results: [returned.get(op)!], attrs: op.attrs })];
+      }
+      if (folded.has(op)) {
+        return [folded.get(op)!];
+      }
+      if (calls.has(op) && tests.has(op)) {
+        return [];
+      }
       if (calls.has(op)) {
+        const sides = sidesOf(op);
         return [
           helperOp(
             helperOf(op)!.op!,
             String(op.attrs.target),
-            op.operands.map((o) => floatOf.get(o)!),
-            floatOf.get(op.results[0])!,
+            op.operands.map((o) => (sides.operands ? floatOf.get(o)! : o)),
+            sides.result ? floatOf.get(op.results[0])! : op.results[0],
           ),
         ];
       }
@@ -241,3 +357,108 @@ export function recognizeFloatHelpers(fn: Fn, target: TargetDescription): boolea
   }
   return true;
 }
+
+/** One test of a compare helper's result: the op whose 0/1 value is the test, the float compare
+ *  it computes, and the ops between the result and it, which only it reads. */
+interface CompareTest {
+  at: Op;
+  opcode: Opcode;
+  spent: Op[];
+}
+
+/** The integer compares a test may apply to the helper's result, each against the constant 0. */
+const INT_TEST: Readonly<Record<string, (x: number, y: number) => boolean>> = {
+  icmp_eq: (x, y) => x === y,
+  icmp_ne: (x, y) => x !== y,
+  icmp_slt: (x, y) => x < y,
+  icmp_sle: (x, y) => x <= y,
+  icmp_sgt: (x, y) => x > y,
+  icmp_sge: (x, y) => x >= y,
+  icmp_ult: (x, y) => x >>> 0 < y >>> 0,
+  icmp_ule: (x, y) => x >>> 0 <= y >>> 0,
+  icmp_ugt: (x, y) => x >>> 0 > y >>> 0,
+  icmp_uge: (x, y) => x >>> 0 >= y >>> 0,
+};
+
+/** Every test of `r`, a compare helper's result, or null where some reader of it is none. The tests
+ *  are the spellings agbcc gives a result's relation to 0: an integer compare with the constant 0
+ *  on either side (`cmp r0, #0` before a branch or a 0/1 select), and the three sign-bit forms of a
+ *  value — `r >> 31` (`< 0`), `~r >> 31` (`>= 0`) and `(-r | r) >> 31` (`!= 0`), each a logical
+ *  shift by 31. Each answers by the SIGN of `r` alone, so the helper's three-way result is read at
+ *  -1, 0 and 1 and at its NaN value, and the four answers name the compare in `FCMP_TRUTH`. */
+function compareTests(
+  r: Value,
+  users: ReadonlyMap<Value, ReadonlyArray<Op | null>>,
+  def: ReadonlyMap<Value, Op>,
+  wordOf: (v: Value) => number | undefined,
+  unordered: 1 | -1,
+): CompareTest[] | null {
+  const readers = (v: Value) => users.get(v) ?? [];
+  const only = (v: Value): Op | null => (readers(v).length === 1 ? readers(v)[0] : null);
+  const signBit = (u: Op | null, of: Value): boolean =>
+    u?.opcode === 'shr_u' && u.operands.length === 1 && u.operands[0] === of && u.attrs.imm === 31;
+  const found: CompareTest[] = [];
+  const answer = (at: Op, spent: Op[], test: (x: number) => boolean): boolean => {
+    const truth = [test(-1), test(0), test(1), test(unordered)];
+    const opcode = fcmpOfTruth(truth);
+    if (opcode === undefined) {
+      return false;
+    }
+    found.push({ at, opcode, spent });
+    return true;
+  };
+  for (const u of readers(r)) {
+    if (u === null) {
+      return null;
+    }
+    const cmp = INT_TEST[u.opcode];
+    if (cmp !== undefined && u.operands.length === 2) {
+      const [x, y] = u.operands;
+      const ok =
+        x === r && y !== r && wordOf(y) === 0
+          ? answer(u, [], (v) => cmp(v, 0))
+          : y === r && x !== r && wordOf(x) === 0 && answer(u, [], (v) => cmp(0, v));
+      if (!ok) {
+        return null;
+      }
+      continue;
+    }
+    if (signBit(u, r)) {
+      if (!answer(u, [], (v) => v < 0)) {
+        return null;
+      }
+      continue;
+    }
+    if (u.opcode === 'not' && u.operands.length === 1) {
+      const shift = only(u.results[0]);
+      if (!signBit(shift, u.results[0]) || !answer(shift!, [u], (v) => v >= 0)) {
+        return null;
+      }
+      continue;
+    }
+    // `(-r | r) >> 31`: `r` has two readers, the `neg` and the `or`, and the test is taken at the
+    // `neg`; the `or` is that same test, read when it is reached.
+    if (u.opcode === 'neg' && u.operands.length === 1) {
+      const or = only(u.results[0]);
+      const shift = or ? only(or.results[0]) : null;
+      const pairs =
+        or?.opcode === 'or' &&
+        or.operands.length === 2 &&
+        or.operands.includes(r) &&
+        or.operands.includes(u.results[0]) &&
+        readers(r).includes(or);
+      if (!pairs || !signBit(shift, or!.results[0]) || !answer(shift!, [u, or!], (v) => v !== 0)) {
+        return null;
+      }
+      continue;
+    }
+    if (
+      u.opcode === 'or' &&
+      u.operands.some((o) => o !== r && def.get(o)?.opcode === 'neg' && def.get(o)!.operands[0] === r)
+    ) {
+      continue;
+    }
+    return null;
+  }
+  return found.length > 0 ? found : null;
+}

package/src/raise/gvn.ts

@@ -32,9 +32,9 @@
 //               materializes a multi-use `const` that is live across a call into a named local, and
 //               its own comment records that this exact widening ("the small-constant regression")
 //               already cost matches once.
-//   `undef`   — numbering it would be VACUOUS: two `undef`s in one function always carry different
-//               `key`s (ir/opcodes.ts says so at the opcode), so "same key, therefore same value"
-//               never has two members to collapse.
+//   `undef`   — numbering it would be HARMFUL: two `undef`s of one `key` are a storage's content
+//               and a `copied` move of it into another storage's join (ir/opcodes.ts says so at the
+//               opcode), and one number would erase the move the structurer spells.
 //
 // The gate is a MATCHING policy, not a property of the opcode — which is why it is not a flag on
 // the opcode table, where `const` would satisfy it.