@asmlift/core 0.9.0 → 0.11.0

package/src/raise/latch.ts

@@ -3,7 +3,7 @@
 // A loop whose back-edge carries a register copy — `add r3, r0, #0` then `b .L6` — lifts to a block
 // holding nothing but that branch, because SSA construction turns the copy into an EDGE ARGUMENT.
 // The loop is unchanged; its latch has just become a separate empty block between the exit test and
-// the header. Loop DISCOVERY still finds the loop — `structure/loops.ts` reads the same back-edge —
+// the header. Loop DISCOVERY still finds the loop — `ir/loops.ts` reads the same back-edge —
 // but the do-while emitter requires the latch to end in a `cond_br`, an empty one ends in `br`, and
 // the test is at the bottom so the `while` form is unavailable too. The back-edge survives to the
 // `onStack` refusal and the whole function declines with "unrecovered back-edge".
@@ -24,11 +24,13 @@
 // `if` (declining loud on the hazards). The guard therefore survives the fold either way; what the
 // gate preserves is the SHAPE — a forward trampoline is not a latch, and folding one re-casts an
 // unrelated branch as a loop guard — which is the `target-dominates` entry's own note below.
-import { Fn, dominators, foldWriteOrder } from '../ir/core';
+import { Block, Fn, dominators, foldWriteOrder, predecessors, reachForward, successorsOf } from '../ir/core';
+import { effectful } from '../ir/discipline';
+import { analyzeLoops } from '../ir/loops';
 import { type Gate, firstRejection } from '../l3/gates';
 
 /** What the gates below judge: one candidate block and the block its `br` goes to. */
-interface LatchCandidate {
+export interface LatchCandidate {
   block: Fn['blocks'][number];
   target: Fn['blocks'][number];
   dominatesBlock: boolean;
@@ -80,9 +82,9 @@ export const LATCH_GATES: readonly Gate<LatchCandidate>[] = [
  *  SUCCESSOR changes, so an edge that was not a back-edge becomes one. (Dominator sets themselves
  *  only ever shrink — removing a block removes it from every set it was in.)
  *
- *  A predecessor that already branches to the target ends up with two edges into one block. That is
- *  a block whose every edge continues the loop, so it has no exit and loop recovery declines — the
- *  same loud decline it gave before the fold.
+ *  A predecessor that already branches to the target ends up with two edges into one block, each
+ *  carrying its own arguments. Where that predecessor has no other edge the loop has no exit, and
+ *  loop recovery spells it `while (1)` with each edge's own update copy.
  */
 export function foldEmptyLatches(fn: Fn, gates: readonly Gate<LatchCandidate>[] = LATCH_GATES): number {
   let folded = 0;
@@ -124,3 +126,157 @@ export function foldEmptyLatches(fn: Fn, gates: readonly Gate<LatchCandidate>[]
     folded++;
   }
 }
+
+// ── EMPTY EXIT TRAMPOLINES ──────────────────────────────────────────────────────────────────────
+//
+// The same empty block on a loop's way OUT. `for (…) { if (t[i] == k) { r = i; break; } }` keeps
+// `r` in a register the break copies into (`add r2, r1, #0`), and the copy becomes an edge argument
+// of a block that holds nothing but its `br` to the code after the loop — beside a second exit edge
+// (the loop's own test failing) that reaches that code directly. The loop then has two exit targets
+// and none of them is a `return`, so every loop form refuses it, and the back-edge declines loud at
+// `onStack`. Which exit edge carries the block is the compiler's choice: agbcc puts it on the break
+// (`synthetic:break_value`) or on the latch's own exit with the break going direct (kleod
+// `sub_0801E664`).
+//
+// The second exit need not land on the target itself. ido, gcc2.7.2kmc and mwcc lay an `else` the
+// loop sits beside between the loop and its join — `if (f) { for (..) if (a(i) == k) { id = i + 100;
+// break; } } else id = f + 26; out(id);` (`synthetic:break_elsetail`) — so the loop's own exit is an
+// empty `b`/`j` over the `else`, and the break reaches the join only through the code its arm runs.
+// Folding the block there leaves the loop two exit targets all the same — the break arm's head is
+// one. What it buys is that the loop's own exit becomes the join the break arm runs on into, which
+// is the exit a `break` that runs code has to leave for (`codeBreakArm`'s region must reach it). So
+// the scope gate asks whether another exit edge's target REACHES the target, going forward and
+// outside the loop's body.
+//
+// Splicing it out re-points each edge into it at its target with its own arguments, and the loop
+// exits to one block: a `break` that carries its copies, which the structurer already spells. The
+// arguments move soundly for the reason the latch's do: the block has no params and one op, so
+// every value its `br` passes dominates it, and therefore the end of each of its predecessors.
+
+/** One candidate trampoline: the block, where its `br` goes, and the loops it may leave. */
+export interface ExitTrampoline {
+  block: Block;
+  target: Block;
+  /** the predecessors of `block` */
+  preds: readonly Block[];
+  /** does some loop hold every predecessor of `block` but not `block` itself, and leave by another
+   *  edge for `target` as well — landing on it, or on a block that reaches it forward without
+   *  re-entering the loop (`reachForward`)? */
+  sharedExit: boolean;
+  /** does every path from `target` reach a `ret` without an effect on the way? */
+  pureReturn: boolean;
+}
+
+export const EXIT_TRAMPOLINE_GATES: readonly Gate<ExitTrampoline>[] = [
+  {
+    id: 'trampoline-has-params',
+    why: 'a param is a join: the br args may read it, and they would not exist at a predecessor',
+    // the fold then hands a predecessor a value it does not dominate, which `verify` refuses loud
+    sound: false,
+    rejects: (c) => c.block.params.length > 0,
+  },
+  {
+    id: 'trampoline-does-work',
+    why: 'the sole terminator must be an unconditional `br`: folding a `cond_br` block discards its second successor',
+    sound: true,
+    guardedBy: 'latch.test.ts: an exit block whose sole op is a cond_br is never folded',
+    rejects: (c) => c.block.ops[0]?.opcode !== 'br',
+  },
+  {
+    id: 'trampoline-self-branch',
+    why: 'a block branching to itself is an infinite loop rather than a trampoline',
+    sound: false,
+    rejects: (c) => c.target === c.block,
+  },
+  {
+    // The SCOPE of the fold, not its soundness: an exit edge's empty block is harmless to the
+    // structurer wherever it is the loop's one way out, and folding it there would only re-spell
+    // functions that already lift.
+    id: 'trampoline-not-a-second-exit',
+    why: 'only a loop that also leaves for the same target by another edge, or for a block that runs on into it, gains from the fold an exit every edge out can leave for',
+    sound: false,
+    rejects: (c) => !c.sharedExit,
+  },
+  {
+    // A target that only returns already lifts: the structurer takes the edge through the
+    // trampoline as an early `return` and copies the pure tail into it. Kept that way, so the fold
+    // re-spells no function that lifted before it.
+    id: 'trampoline-returns-already',
+    why: 'an exit that only returns is an early `return` arm, which the structurer spells without the fold',
+    sound: false,
+    rejects: (c) => c.pureReturn,
+  },
+];
+
+/** Every path from `b` ends in a `ret` and runs no effect on the way. */
+export function returnsPurely(b: Block): boolean {
+  const seen = new Set<Block>();
+  for (const stack = [b]; stack.length > 0;) {
+    const x = stack.pop()!;
+    if (seen.has(x)) {
+      continue; // a join two paths share, or a cycle — either way judged on its first visit
+    }
+    seen.add(x);
+    if (x.ops.some(effectful)) {
+      return false;
+    }
+    const t = x.ops[x.ops.length - 1];
+    if (t?.opcode === 'ret') {
+      continue;
+    }
+    if (t?.opcode !== 'br' && t?.opcode !== 'cond_br') {
+      return false;
+    }
+    stack.push(...successorsOf(x));
+  }
+  return true;
+}
+
+/** Splice out every empty EXIT TRAMPOLINE the gates above admit; returns how many were removed.
+ *  Iterated, as the latch fold is: one splice can make another block's exit edges shared. */
+export function foldExitTrampolines(fn: Fn, gates: readonly Gate<ExitTrampoline>[] = EXIT_TRAMPOLINE_GATES): number {
+  let folded = 0;
+  for (;;) {
+    const preds = predecessors(fn);
+    const dom = dominators(fn);
+    const loops = [...analyzeLoops(fn, dom).byHeader.values()];
+    const found = fn.blocks.find((b) => {
+      const target = b.ops[0]?.successors[0]?.block;
+      if (target === undefined) {
+        return false;
+      }
+      const into = preds.get(b) ?? [];
+      const sharedExit =
+        into.length > 0 &&
+        loops.some(
+          (nl) =>
+            !nl.body.has(b) &&
+            into.every((p) => nl.body.has(p)) &&
+            nl.exitEdges.some((e) => e.to !== b && reachForward(e.to, dom, nl.body).has(target)),
+        );
+      return (
+        firstRejection(gates, { block: b, target, preds: into, sharedExit, pureReturn: returnsPurely(target) }) === null
+      );
+    });
+    if (!found) {
+      return folded;
+    }
+    const onward = found.ops[0].successors[0];
+    for (const b of fn.blocks) {
+      let repointed = false;
+      for (const op of b.ops) {
+        op.successors.forEach((s, i) => {
+          if (s.block === found) {
+            op.successors[i] = { block: onward.block, args: [...onward.args] };
+            repointed = true;
+          }
+        });
+      }
+      if (repointed) {
+        foldWriteOrder(fn.writeOrder, found, b);
+      }
+    }
+    fn.blocks = fn.blocks.filter((b) => b !== found);
+    folded++;
+  }
+}

package/src/raise/memberarrays.ts

@@ -71,6 +71,7 @@
 import { type Fn, type Op, type Value, defOpMap } from '../ir/core';
 import { type IrType, type StructField, T, scalarTypeForAccess } from '../ir/types';
 import { type Gate, firstRejection } from '../l3/gates';
+import { storeSigned } from './storesign';
 import { firstFreeStructIndex } from './structs';
 
 /** One variable-index access, resolved onto (base value, member offset). */
@@ -260,7 +261,9 @@ function stripExt(v: Value, defs: Map<Value, Op>): Value {
   }
 }
 
-/** `add(x, const)` read as (other operand, constant), or null. The add is commutative. */
+/** `add(x, const)` read as (other operand, constant), or null. The add is commutative. ONE link, not
+ *  a chain, and no `sub`: the shapes this pass reads are a single `add` of a scaled index or of a
+ *  member offset. A chain of constant displacements is ir/alias.ts `constDisplacementOf`. */
 function constAddend(op: Op, defs: Map<Value, Op>): { of: Value; k: number } | null {
   if (op.opcode !== 'add' || op.operands.length !== 2) {
     return null;
@@ -389,7 +392,7 @@ function accessesByBase(fn: Fn, defs: Map<Value, Op>): Map<Value, MemberAccess[]
         op,
         off: add === null ? 0 : add.k,
         elemSize,
-        signed: isLoad ? (op.attrs.signed as boolean) : elemSize === 4,
+        signed: isLoad ? (op.attrs.signed as boolean) : storeSigned(op, elemSize),
         isLoad,
         index: op.operands[1],
         addr: add === null ? null : op.operands[0],
@@ -583,8 +586,11 @@ export function recognizeMemberArrays(
       a.op.operands[0] = g.base;
       a.op.attrs.memberOff = a.off;
       if (!a.isLoad) {
-        // an astore carries no signedness of its own — the member's decides how the index node
-        // types, so the store spells through the same declaration the load does
+        // the member's declaration decides how the index node types, so the store spells through
+        // the same declaration the load does, over any stamp raise/storesign.ts left. No probed
+        // input reaches here with a stamp that disagrees: agbcc lifts a signed narrow constant as
+        // `neg`/`shl`, and the MIPS shapes (`p->t[i] = -1`, `-104` beside a u16 read) take a flat
+        // cast. One that does should keep its stamp, and the index node cast the cell to it.
         a.op.attrs.signed = g.members.find((m) => m.off === a.off)!.signed;
       }
     }