@asmlift/core 0.9.0 → 0.11.0

package/src/raise/shortcircuit.ts

@@ -40,15 +40,16 @@
 // is NEGATABLE whenever the orientation inverts it — an icmp by opcode swap or a `logic_and`/`logic_or` by
 // De Morgan, both via `negateCondOps`, which the control-flow form below shares. Any deviation falls
 // through untouched (a miss, never a miscompile).
-import { disjointConstSlots } from '../ir/alias';
+import { constDisplacementOf, disjointConstSlots } from '../ir/alias';
 import {
+  type AttrVal,
   Block,
   Fn,
   Op,
   Successor,
   Value,
   defOpMap,
-  dominators,
+  dominance,
   foldWriteOrder,
   forwardingTarget,
   mkOp,
@@ -58,12 +59,19 @@ import {
   replaceAllUsesWith,
   successorsOf,
 } from '../ir/core';
-import { effectful, forgetHelperPlacement, orderSensitive, placedAt, speculationUnsafe } from '../ir/discipline';
-import { NEGATED_ICMP } from '../ir/opcodes';
+import {
+  effectful,
+  forgetHelperPlacement,
+  orderSensitive,
+  placedAt,
+  reevalUnsafe,
+  speculationUnsafe,
+} from '../ir/discipline';
+import { MEM_BASE_OPS, NEGATED_FCMP, NEGATED_ICMP } from '../ir/opcodes';
 import { T } from '../ir/types';
 import { type Gate, firstRejection } from '../l3/gates';
 
-const BOOL_OPS = new Set([...Object.keys(NEGATED_ICMP), 'logic_and', 'logic_or']);
+const BOOL_OPS = new Set([...Object.keys(NEGATED_ICMP), ...Object.keys(NEGATED_FCMP), 'logic_and', 'logic_or']);
 
 /** Run `step` until it stops rewriting, and answer whether it ever did.
  *
@@ -370,11 +378,14 @@ export function recognizeShortCircuit(fn: Fn): boolean {
 //     (`af:adds:ido7.1` and the `divv`/`gcd`/`modv` rows).
 //   - ^g holds a side effect — its ops move into ^h, which runs UNCONDITIONALLY. A store in `b`
 //     would then execute even when `a` already decided the branch. (`a || (*p = 1)`.)
-//   - a value defined in ^g is used more than once inside ^g. Then the structurer MATERIALIZES it
-//     into a local, which renders as a statement BEFORE the `if` — turning `b`'s conditional
-//     computation into an unconditional one. Single-use-and-local is precisely the shape
-//     analysis.ts inlines into the connective's right operand, where C's own short-circuit
-//     re-guards it. This is what keeps a load in `b` from being hoisted across the guard in `a`.
+//   - a value defined in ^g is used more than once inside ^g, and `SHARED_VALUE_GATES` refuses it.
+//     Such a value the structurer MATERIALIZES into a local, which renders as a statement BEFORE
+//     the `if` — turning `b`'s conditional computation into an unconditional one. Single-use-and-
+//     local is precisely the shape analysis.ts inlines into the connective's right operand, where
+//     C's own short-circuit re-guards it. The table is what keeps a load in `b` from being hoisted
+//     across the guard in `a`; what it admits is an ADDRESS (`&gS`, `&gS + k`), which reads nothing,
+//     so wherever it is spelled it runs nothing the source did not (l3/basecse.ts's
+//     `guarded-operand` keeps the default spelling inline under the operand).
 //   - a value defined in ^g is ALSO read past ^g, and a rule in `ARM_REREAD_GATES` refuses
 //     re-deriving it in the arm. A read past ^g is otherwise not a refusal: on verified IR it can
 //     only sit under the arm ^g's non-shared edge enters (^g dominates nothing else — the shared
@@ -544,6 +555,9 @@ export interface BranchShortCircuitOptions {
    *  in {@link ARM_REREAD_GATES} reads — `read-behind-effect`. Threaded by raise/pre-recovery.ts from
    *  the target it already holds, the way `narrowlocal`'s `hoistsSingleSetArm` is. Absent ⇒ false. */
   reloadsLocalReread?: boolean;
+  /** The USE-COUNT refusals — {@link SHARED_VALUE_GATES} when absent. A parameter for the same two
+   *  readers as `armReread`: a census (`bench gates --pass shared-value`) and a test's ablation. */
+  sharedValue?: readonly Gate<SharedValueSite>[];
 }
 
 export function recognizeBranchShortCircuit(fn: Fn, opts: BranchShortCircuitOptions = {}): boolean {
@@ -639,7 +653,7 @@ export function recognizeBranchShortCircuit(fn: Fn, opts: BranchShortCircuitOpti
         // `r0` values. The verdict is a conjunction of pure tests, so the order moves no fold. And
         // BEFORE tree ownership, so `onTreeOwned` keeps its meaning — the one thing in the way.
         const reread = armRereadCone(fn, g, otherEdge.block, preds, opts);
-        if (!reread || !definedValuesStayLocal(fn, g, reread)) {
+        if (!reread || !definedValuesStayLocal(fn, g, reread, defs, opts.sharedValue ?? SHARED_VALUE_GATES)) {
           continue;
         }
         // LAST refusal, so `onTreeOwned` reports a site where tree ownership is the ONE thing in the
@@ -805,7 +819,9 @@ const NEGATE_BUDGET = 8;
 /** The ops computing `!v`, or `null` when `v` cannot be negated.
  *
  *  Two cases, and no third:
- *    - an `icmp_*` in `NEGATED_ICMP` → the swapped-opcode comparison over the SAME operands.
+ *    - an `icmp_*` in `NEGATED_ICMP`, or an `fcmp_*` in `NEGATED_FCMP` → the swapped-opcode
+ *      comparison over the SAME operands. A float compare negates to its unordered twin, never to
+ *      the flipped relation, which a NaN would tell apart.
  *    - a `logic_and`/`logic_or` → the DUAL connective over its two recursively negated operands.
  *      De Morgan: `!(a || b)` is `!a && !b`. This is the only reason the helper is recursive, and
  *      it is what lets a chain fold past its first level (`a || !(b || c)`).
@@ -823,8 +839,9 @@ const NEGATE_BUDGET = 8;
  *    - the cone exceeds `NEGATE_BUDGET` minted ops.
  *
  *  Ops are MINTED, never mutated: the originals stay where the caller hoisted them and die to the
- *  pass list's own `dce: true` (raise/pre-recovery.ts). Only `icmp_*`/`logic_and`/`logic_or` are
- *  ever rebuilt, all of them pure, so no effect can be duplicated or reordered by construction.
+ *  pass list's own `dce: true` (raise/pre-recovery.ts). Only `icmp_*`/`fcmp_*`/`logic_and`/
+ *  `logic_or` are ever rebuilt, all of them pure, so no effect can be duplicated or reordered by
+ *  construction.
  *
  *  Nothing is SHARED between paths, and that is the point rather than a limitation. Memoizing `go`
  *  in a `Map<Value, Value>` is three lines and would make the budget unnecessary — and it would
@@ -833,11 +850,11 @@ const NEGATE_BUDGET = 8;
  *  Nothing collapses the duplicates later either — `numberPureValues` runs as `addrnum`, far ahead
  *  of both folds. So the per-path rebuild is the mechanism and NEGATE_BUDGET is its price.
  *
- *  What it GUARANTEES about its result, which one caller leans on: every op it mints is an `icmp_*`
- *  or a `logic_and`/`logic_or`, so the returned value is always a C boolean. The value form hands an
- *  un-negated head straight on as the merge VALUE, which is why that caller checks booleanness for
- *  itself before deciding whether to call here at all (see its head gate); the branch form needs no
- *  such check, because its result only ever feeds a `cond_br`.
+ *  What it GUARANTEES about its result, which one caller leans on: every op it mints is an `icmp_*`,
+ *  an `fcmp_*` or a `logic_and`/`logic_or`, so the returned value is always a C boolean. The value
+ *  form hands an un-negated head straight on as the merge VALUE, which is why that caller checks
+ *  booleanness for itself before deciding whether to call here at all (see its head gate); the
+ *  branch form needs no such check, because its result only ever feeds a `cond_br`.
  *
  *  PRECONDITION, earned by the caller and not checked here: every value in the cone must dominate
  *  the point the caller splices `ops` into — the minted comparisons reuse the ORIGINAL leaf
@@ -860,8 +877,18 @@ function negateCondOps(defs: Map<Value, Op>, v: Value, budget: number): { ops: O
       return null;
     }
     const out = mkValue(T.unk(32));
-    if (NEGATED_ICMP[d.opcode]) {
-      ops.push(mkOp(NEGATED_ICMP[d.opcode], { operands: [...d.operands], results: [out] }));
+    const negated = NEGATED_ICMP[d.opcode] ?? NEGATED_FCMP[d.opcode];
+    // A float compare whose runtime helper names the relation the source spelled (raise/
+    // floathelpers.ts `attrs.relation`) has no negation that calls the same helper — gcc folds
+    // `!(a == b)` into `a != b` — so a fold that would negate it off that relation refuses, and one
+    // that negates it back onto the relation keeps the stamp for the structurer to spell.
+    const relation = d.attrs.relation;
+    if (negated && relation === d.opcode) {
+      return null;
+    }
+    if (negated) {
+      const attrs: Record<string, AttrVal> = typeof relation === 'string' ? { relation } : {};
+      ops.push(mkOp(negated, { operands: [...d.operands], results: [out], attrs }));
       return out;
     }
     if (d.opcode === 'logic_and' || d.opcode === 'logic_or') {
@@ -1057,10 +1084,28 @@ function armRereadSite(
 /** Whether leaving ^g for `arm` leaves a natural loop ^g is in — some back-edge `t→h` (h dominates
  *  t) whose body, h plus everything reaching t without passing h, holds ^g and not the arm. */
 function leavesALoop(fn: Fn, g: Block, arm: Block, preds: ReadonlyMap<Block, readonly Block[]>): boolean {
-  const dom = dominators(fn);
+  return naturalLoopBodies(fn, preds).some((body) => body.has(g) && !body.has(arm));
+}
+
+/** The natural loop bodies of `fn`'s CFG as `preds` describes it, one per back-edge `t→h` (h
+ *  dominates t): h plus everything reaching t without passing h.
+ *
+ *  MEMOISED ON THE PREDECESSOR MAP. `recognizeBranchShortCircuit` builds one `preds` per scan of the
+ *  function and rescans after every fold, so one map stands for one CFG: every site that scan asks
+ *  `loop-exit` about shares one dominator computation instead of paying one each. That was the cost
+ *  of a large function's plain lift: Klonoa's sub_0800D188 (1,783 blocks) spent most of its first
+ *  five minutes rebuilding these dominator sets per site. A caller that mutates the CFG under a map
+ *  it keeps would read stale loops, as it already reads stale predecessors. */
+function naturalLoopBodies(fn: Fn, preds: ReadonlyMap<Block, readonly Block[]>): readonly Set<Block>[] {
+  const cached = LOOP_BODIES.get(preds);
+  if (cached !== undefined && cached.fn === fn) {
+    return cached.bodies;
+  }
+  const dominates = dominance(fn);
+  const bodies: Set<Block>[] = [];
   for (const t of fn.blocks) {
     for (const h of successorsOf(t)) {
-      if (!dom.get(t)?.has(h)) {
+      if (!dominates(h, t)) {
         continue;
       }
       const body = new Set<Block>([h]);
@@ -1071,13 +1116,13 @@ function leavesALoop(fn: Fn, g: Block, arm: Block, preds: ReadonlyMap<Block, rea
           work.push(...(preds.get(b) ?? []));
         }
       }
-      if (body.has(g) && !body.has(arm)) {
-        return true;
-      }
+      bodies.push(body);
     }
   }
-  return false;
+  LOOP_BODIES.set(preds, { fn, bodies });
+  return bodies;
 }
+const LOOP_BODIES = new WeakMap<ReadonlyMap<Block, readonly Block[]>, { fn: Fn; bodies: readonly Set<Block>[] }>();
 
 /** Whether analysis.ts would spell the arm's copy of a READ as a LOCAL rather than inline — a
  *  MIRROR of analysis.ts's placement and barrier rules (structure/analysis.ts: `emitPos`, the
@@ -1377,9 +1422,10 @@ function rereadInArm(fn: Fn, g: Block, arm: Block, { copy, drop }: ArmReread): v
   g.ops = g.ops.filter((op) => !drop.has(op));
 }
 
-/** True when every value `g` defines is read at most once, and any read is inside `g` or is one
- *  `armRereadCone` answered for — reads outside `g` move to the arm's copy, and reads BY a
- *  dropped original leave with it. The use-count half is the residue ARM_REREAD_GATES names.
+/** True when no value `g` defines escapes it un-re-derived, and every value `g` reads more than
+ *  once itself passes {@link SHARED_VALUE_GATES} (or `gates`) — reads outside `g` move to the arm's
+ *  copy, and reads BY a dropped original leave with it. The use-count half is the residue
+ *  ARM_REREAD_GATES names, and the table below is that half.
  *
  *  The VALUE form above needs no such check, and the asymmetry is real rather than drift: its feeder
  *  ends in `br M`, so the feeder has no successor of its own to dominate and every value it defines
@@ -1392,7 +1438,13 @@ function rereadInArm(fn: Fn, g: Block, arm: Block, { copy, drop }: ArmReread): v
  *  'the ENTRY block is never folded away' for the branch form. They are deliberately NOT routed
  *  through one shared `isEntry` helper — a helper enforces nothing, and it is the two tests that
  *  hold each fold to the refusal. When changing either fold, check the other. */
-function definedValuesStayLocal(fn: Fn, g: Block, { copy, drop }: ArmReread): boolean {
+function definedValuesStayLocal(
+  fn: Fn,
+  g: Block,
+  { copy, drop }: ArmReread,
+  defs: ReadonlyMap<Value, Op>,
+  gates: readonly Gate<SharedValueSite>[],
+): boolean {
   const defined = new Set<Value>(g.ops.flatMap((op) => op.results));
   if (defined.size === 0) {
     return true;
@@ -1419,11 +1471,142 @@ function definedValuesStayLocal(fn: Fn, g: Block, { copy, drop }: ArmReread): bo
     }
   }
   // ZERO uses is fine — a dead op renders nothing at all, so it cannot escape the short circuit.
-  // TWO or more is not: analysis.ts materializes a multi-consumer value into a local, which is a
-  // statement, and a statement lands before the `if`.
-  return [...defined].every((v) => (uses.get(v) ?? 0) <= 1);
+  // ONE inlines into the connective's operand. TWO or more is the table's question.
+  const defOf = new Map<Value, Op>(g.ops.flatMap((op) => op.results.map((r): [Value, Op] => [r, op])));
+  return [...defined].every(
+    (value) => (uses.get(value) ?? 0) <= 1 || firstRejection(gates, { g, value, defOf, defs }) === null,
+  );
+}
+
+/** One value ^g reads more than once itself — what analysis.ts would otherwise spell as a local. */
+export interface SharedValueSite {
+  /** ^g, the second condition block the fold would merge into ^h */
+  readonly g: Block;
+  /** the value, defined in ^g and read there 2+ times */
+  readonly value: Value;
+  /** the op in ^g defining each value ^g defines */
+  readonly defOf: ReadonlyMap<Value, Op>;
+  /** the defining op of every value in the function — an address's symbol and offsets are often
+   *  defined ABOVE ^g, where GVN numbered them with an earlier use */
+  readonly defs: ReadonlyMap<Value, Op>;
+}
+
+/** The part of `v`'s operand cone ^g computes — the ops a hoisted local would carry above the `if`. */
+function gConeOf(c: SharedValueSite): Op[] {
+  const out = new Set<Op>();
+  for (const work = [c.value]; work.length;) {
+    const d = c.defOf.get(work.pop()!);
+    if (d && !out.has(d)) {
+      out.add(d);
+      work.push(...d.operands);
+    }
+  }
+  return [...out];
+}
+
+/** Is `v` constant offsets over a symbol or frame address (`&gS + 0x35`), or over a literal address
+ *  or a value ^g did not compute (`p - 0x35` off a pointer parameter) that ^g reads only as a
+ *  memory ADDRESS? The chain is ir/alias.ts `constDisplacementOf`, the one reading of address
+ *  arithmetic, so Thumb's `sub r0, r0, #0x35` for a negative member offset ends where `add` does.
+ *  Asked over the WHOLE function's defs, not ^g's: agbcc's `add r0, r2, #0x35` off an `&gS` an
+ *  earlier block loaded is GVN's one `gaddr` (`sub_0800D188`'s site). A root ^g did not compute (a
+ *  parameter, an earlier block's result) is, by dominance, already computed when the first test
+ *  runs, so the cone spelled above the guard (as a local, or l3/basecse.ts's hoisted base) adds only
+ *  `± k` arithmetic, which reads nothing and cannot trap. That root is admitted only when `v` is
+ *  read as an address alone (`readAsAddress`): the pointer-parameter base is measured (agbcc's
+ *  `add r0, r4, #0x35; ldrb; add r0, r0, #0x22` off `struct T *p` folds to the target's bytes,
+ *  synthetic:scbase_pfar), while a counter's `i + 1` read twice by a latch's compare is not an
+ *  address, and folding it turns synthetic:retpost_notail on gcc2.7.2 and gcc2.7.2kmc into a
+ *  structure decline. */
+function constOffsetCone(c: SharedValueSite): boolean {
+  const disp = constDisplacementOf(c.defs, c.value);
+  const root = disp?.root ?? c.value;
+  const leaf = c.defs.get(root);
+  if (leaf?.opcode === 'gaddr' || leaf?.opcode === 'laddr') {
+    return true;
+  }
+  return (readsNothing(leaf) || (disp !== null && !c.defOf.has(root))) && readAsAddress(c.g, c.value);
+}
+
+/** Is `leaf` an operand-free op that reads nothing and cannot trap — a value spelled the same at
+ *  any program point? The property the root argument above rests on, asked of the op rather than
+ *  of a list of opcodes: agbcc's `ldr r0, =0x03005220` under `#define gL (*(struct S *)0x03005220)`
+ *  is a `const` the second test reads three members off, exactly as it reads them off `&gS`. Unlike
+ *  a symbol it is admitted only where read as an address (`readAsAddress`): a mask or a compare
+ *  constant read twice is not a base, and its spelling is unmeasured. */
+function readsNothing(leaf: Op | undefined): boolean {
+  return leaf !== undefined && leaf.operands.length === 0 && !reevalUnsafe(leaf);
+}
+
+/** Does every read ^g makes of `v` end in a memory access's ADDRESS: the base of a load or store,
+ *  or the pointer side of `v + x` / `v - x` whose result is in turn read only that way? An index
+ *  may be a variable (`p->arr[i]` is `add(p + 0x35, i)`), since it is the sum, not `v`, that it
+ *  joins. A SUCCESSOR ARGUMENT is a value read — a loop-carried `p + 1` is the next iteration's
+ *  pointer, a latch's `i + 1` its counter — and so is a compare, a mask, or a stored value. */
+function readAsAddress(g: Block, v: Value): boolean {
+  return g.ops.every((op) => {
+    if (!readsOf(op).includes(v)) {
+      return true;
+    }
+    if (op.successors.some((s) => s.args.includes(v))) {
+      return false;
+    }
+    const [first, ...rest] = op.operands;
+    if (MEM_BASE_OPS.has(op.opcode)) {
+      return first === v && !rest.includes(v);
+    }
+    const once = op.operands.length === 2 && op.operands.filter((x) => x === v).length === 1;
+    if (once && (op.opcode === 'add' || (op.opcode === 'sub' && first === v))) {
+      return op.results.every((r) => readAsAddress(g, r));
+    }
+    return false;
+  });
 }
 
+// ── THE USE-COUNT REFUSALS, AS DATA ──────────────────────────────────────────────────────────
+//
+// A value ^g reads twice itself is one analysis.ts materializes into a local, and a local is a
+// statement BEFORE the `if`: `b`'s computation runs whether or not `a` decided the branch. Taken as
+// an OPTIONAL parameter (`BranchShortCircuitOptions.sharedValue`) and censused from outside core by
+// `pnpm bench gates --pass shared-value`, through the same `PRE_RECOVERY_PASSES` seam as
+// `arm-reread`. Asked once per such value, below every other refusal of the fold but tree ownership.
+//
+// What the table ADMITS is a shared ADDRESS: agbcc loads `&gS` into one register and reads three
+// members off it (`(gS.a | gS.d | gS.c) != 0`), so the address is the one value with three readers.
+// Refused, the `||` splits into a nest and the structurer copies the shared arm AND everything after
+// it into both branches, once per such site (kleod's `sub_0800D188`, whose `&gUnk_03005220 + 0x35`
+// is the shape synthetic:scbase_far pins). The base may also be a literal address, a pointer
+// parameter (`p->a | p->d`) or another value computed before ^g, when ^g reads it only as an
+// address: a constant-offset cone over it reads nothing and cannot trap, so hoisting it changes no
+// behaviour.
+//
+// RESIDUE, not in the table: the ESCAPE half of `definedValuesStayLocal` (a value read past ^g that
+// the arm does not re-derive). `armRereadCone` copies the cone of every outside read, so on the
+// inputs it accepts that half has nothing left to see; it stays as the check that keeps it so.
+export const SHARED_VALUE_GATES: readonly Gate<SharedValueSite>[] = [
+  {
+    // `if (p == 0 || (*p | *p >> 4) != 0)`: the read, materialized, runs above the null test.
+    // `if (b == 0 || (q = a / b) + q != 0)`: so does the divide, on the path the test kept it off.
+    // A named local is an UNCONDITIONAL statement, so the predicate is `reevalUnsafe` (effects,
+    // reads AND traps), not `orderSensitive`, which has no trap half.
+    id: 'shared-read',
+    why: 'a read or trapping op the second test makes twice would be spelled as a local, run before the first test',
+    sound: true,
+    guardedBy: 'branch-shortcircuit.test.ts: REFUSED: a READ the second test consumes twice would run above the first',
+    rejects: (c) => gConeOf(c).some(reevalUnsafe),
+  },
+  {
+    // A pure, non-trapping value that is not an address `constOffsetCone` admits — `(x * x) != 0`
+    // over a computed `x`. Hoisting it is correct C; what the target spells there is unmeasured, so
+    // it keeps the nest. A pure SPELLING rule: disjoint from `shared-read` (a read or a trap in the cone
+    // is that rule's), so each ablates alone and ablating this one admits nothing unsafe.
+    id: 'shared-pure',
+    why: 'a computed value the second test reuses is kept in the nest until its spelling is measured',
+    sound: false,
+    rejects: (c) => !constOffsetCone(c) && !gConeOf(c).some(reevalUnsafe),
+  },
+];
+
 /** Two successor argument lists that a fold may collapse into one: same values, same order. */
 function sameArgs(a: Value[], b: Value[]): boolean {
   return a.length === b.length && a.every((v, i) => v === b[i]);

package/src/raise/softdiv.ts

@@ -49,7 +49,7 @@ export function recognizeSoftDiv(fn: Fn, target: TargetDescription): boolean {
       }
       // Fold only when BOTH arguments were recovered (the signature makes this the norm). A
       // mis-recovered arity leaves the call untouched rather than fabricating a wrong divide.
-      if (op.operands.length !== wordsOf(helper.params) || op.results.length !== 1) {
+      if (op.operands.length !== wordsOf(helper.params, target) || op.results.length !== 1) {
         continue;
       }
       b.ops.splice(i, 1, helperOp(helper.op, op.attrs.target as string, op.operands, op.results[0]));

package/src/raise/storesign.ts

@@ -0,0 +1,153 @@
+// asmlift — the signedness of a NARROW store, read off the constant it stores.
+//
+// A store does not say whether its lvalue is signed: `sh` writes the low half of a register either
+// way, so a 1- or 2-byte `store` gets the unsigned view by convention (`storeSigned` below). But a
+// compiler that converts the constant to the lvalue's type before it materializes it
+// (`compilerBehaviors.narrowStoreConstantTakesLvalueType`) leaves that type in the register's UPPER
+// bits, which the store throws away:
+//
+//     u16 *p; p[6] = -1;       li v0,0xffff   →  const 65535   →  unsigned
+//     s16 *p; p[6] = 0xFFFF;   li v0,-1       →  const -1      →  signed
+//
+// This pass records that as the store's `signed` attr, the slot an `astore` already carries for a
+// member's recorded signedness; raise/arrays.ts and raise/struct-arrays.ts carry it into the
+// `astore` they make. It changes no op and no value: what it moves is which view of the cell the C
+// spells, and both views store the same bytes.
+//
+// It refuses (leaves the attr unset, so the convention stands) for:
+//   - a target that does not declare the behavior;
+//   - a store that already carries `signed`, or a word-wide one;
+//   - a stored value that is not a `const` — a `neg`/`shl` the materialization left unfolded, a
+//     block param, anything computed;
+//   - a constant whose narrow sign bit is clear: both lvalue types materialize it the same way;
+//   - a constant whose upper bits are neither the zero- nor the sign-extension of its low bits:
+//     no conversion to a narrow type produces one;
+//   - a constant some OTHER use reads too, or whose 32-bit value another store writes at another
+//     width. The conversion is a fact about a LITERAL on the right of the store. A variable or a
+//     chained assignment whose value is a known constant is stored unconverted, in the register
+//     a wider use reads: `s32 v = -1; *q = v; p[1] = v;` with `u16 *p` is `li v0,-1; sw v0;
+//     sh v0` on gcc2.7.2 and gcc2.7.2kmc, and `li t6,-1; sw t6; li t7,-1; sh t7` on ido7.1, which
+//     rematerializes it. When that wide use is there, the register says the wider type's sign,
+//     not the lvalue's (the NONLITERAL bodies of
+//     packages/cli/test/matching/narrow-store-constant.test.ts).
+//
+// What it does NOT refuse is such a variable with no wide use: `s32 v = -1; p[6] = v;` (`u16 *p`),
+// or one only returned. Its register is the variable's, not the lvalue's, so the stamp can name a
+// type the source did not declare (`s16 *` there). It is not refused because nothing tells it
+// apart from a literal, and the spelling it gives recompiles to the register the target holds.
+import { Fn, Op, Value, defOpMap } from '../ir/core';
+import type { TargetDescription } from '../target';
+
+/** THE view a store's lvalue is seeded at, `width` bytes wide (`width` for a `store`, `elemSize`
+ *  for an `astore`): the `signed` a recovery recorded on it — this pass's stamp, or a member
+ *  array's own declaration (raise/memberarrays.ts) — else the convention, word ⇒ signed and
+ *  narrow ⇒ unsigned. raise/recover.ts, raise/structs.ts, raise/memberarrays.ts, rank-declare.ts
+ *  and the structurer seed from it; raise/struct-arrays.ts keeps the stamp beside its loads'
+ *  sign instead. What each does when a LOAD disagrees is its own: raise/structs.ts,
+ *  raise/struct-arrays.ts and rank-declare.ts prefer the load, and the structurer spells a member
+ *  that disagrees with the stamp as a cast cell (structure/structure.ts `stampedStoreLval`). */
+export function storeSigned(op: Op, width: number): boolean {
+  return (op.attrs.signed as boolean | undefined) ?? width === 4;
+}
+
+/** The lvalue signedness a constant stored at `width` bytes witnesses, read off the 32-bit register
+ *  it was materialized into: `true` sign-extended, `false` zero-extended, `null` when it says
+ *  neither (see the refusals at the top of this file). */
+export function storedConstantSign(value: number, width: number): boolean | null {
+  if (!Number.isInteger(value) || value < -(2 ** 31) || value >= 2 ** 32 || (width !== 1 && width !== 2)) {
+    return null;
+  }
+  const bits = width * 8;
+  const reg = value | 0;
+  const low = reg & ((1 << bits) - 1);
+  if ((low & (1 << (bits - 1))) === 0) {
+    return null;
+  }
+  if (reg === low) {
+    return false;
+  }
+  return reg === (low << (32 - bits)) >> (32 - bits) ? true : null;
+}
+
+/** Stamp `signed` on every narrow `store` whose stored constant witnesses its lvalue's signedness.
+ *  Returns how many it stamped. */
+export function seedNarrowStoreSigns(fn: Fn, target: TargetDescription): number {
+  if (target.compilerBehaviors.narrowStoreConstantTakesLvalueType !== true) {
+    return 0;
+  }
+  const defs = defOpMap(fn);
+  const stores: Op[] = fn.blocks.flatMap((b) => b.ops.filter((op) => op.opcode === 'store'));
+  // the values read other than as the value a store stores. Not a `ret`'s: before the return
+  // type is known it reads the return register whether the function returns it or not, and gcc
+  // stores a constant from that register in its delay slot (`li v0,-1; jr ra; sh v0,12(a0)`).
+  // Nor an edge's into a block param only a `ret` reads, directly or through more such params:
+  // that is the same register live out of a branch, `beqz a1,L; ...; li v0,0x8000; sh v0,4(a0);
+  // L: jr ra`.
+  const retOnly = retOnlyParams(fn);
+  const otherUses = new Set<Value>();
+  const bump = (v: Value) => otherUses.add(v);
+  for (const b of fn.blocks) {
+    for (const op of b.ops) {
+      op.operands.forEach((v, i) => ((op.opcode === 'store' && i === 1) || op.opcode === 'ret' ? undefined : bump(v)));
+      op.successors.forEach((s) => s.args.forEach((v, i) => (retOnly.has(s.block.params[i]) ? undefined : bump(v))));
+    }
+  }
+  // a stored constant's 32-bit register → the widths it is stored at, across every const op
+  const widthsOf = new Map<number, Set<number>>();
+  for (const op of stores) {
+    const d = defs.get(op.operands[1]);
+    if (d?.opcode === 'const') {
+      const reg = (d.attrs.value as number) | 0;
+      (widthsOf.get(reg) ?? widthsOf.set(reg, new Set()).get(reg)!).add(op.attrs.width as number);
+    }
+  }
+  let n = 0;
+  for (const op of stores) {
+    const d = defs.get(op.operands[1]);
+    if (
+      op.attrs.signed !== undefined ||
+      d?.opcode !== 'const' ||
+      otherUses.has(op.operands[1]) ||
+      widthsOf.get((d.attrs.value as number) | 0)!.size > 1
+    ) {
+      continue;
+    }
+    const signed = storedConstantSign(d.attrs.value as number, op.attrs.width as number);
+    if (signed !== null) {
+      op.attrs.signed = signed;
+      n++;
+    }
+  }
+  return n;
+}
+
+/** The block params (not the entry's: those are the function's parameters) that nothing reads but
+ *  a `ret` and the edges into other such params. */
+function retOnlyParams(fn: Fn): Set<Value> {
+  const read = new Set<Value>();
+  for (const b of fn.blocks) {
+    for (const op of b.ops) {
+      if (op.opcode !== 'ret') {
+        op.operands.forEach((v) => read.add(v));
+      }
+    }
+  }
+  const out = new Set(fn.blocks.slice(1).flatMap((b) => b.params.filter((p) => !read.has(p))));
+  // an edge into a param that is not ret-only reads its argument: drop arguments until none moves
+  for (let moved = true; moved;) {
+    moved = false;
+    for (const b of fn.blocks) {
+      for (const op of b.ops) {
+        for (const s of op.successors) {
+          s.args.forEach((v, i) => {
+            if (out.has(v) && !out.has(s.block.params[i])) {
+              out.delete(v);
+              moved = true;
+            }
+          });
+        }
+      }
+    }
+  }
+  return out;
+}

package/src/raise/struct-arrays.ts

@@ -93,8 +93,16 @@ function withPadding(dataFields: StructField[], stride: number): StructField[] {
  *  pokeemerald:GetGenderFromSpeciesAndPersonality, whose address is materialized twice). A base
  *  whose element pointers
  *  disagree on stride declines entirely: two strides over one base is a reinterpreted view or
- *  a 2D layout, genuinely ambiguous — decline over guess. */
-export function recognizeStructArrays(fn: Fn): number {
+ *  a 2D layout, genuinely ambiguous — decline over guess.
+ *
+ *  `aggregateBoundary` is the size the compiler rounds EVERY struct to (target.ts
+ *  `compilerBehaviors.aggregateBoundary`): agbcc 4, so `struct { u16 a; u8 _pad0[4]; }` is 8
+ *  bytes there, not the 6 its fields add up to. A group whose stride that rounding would change
+ *  declines, and its accesses keep the byte-offset spelling (`*(u16 *)(base + i * 6)`), which
+ *  says the stride itself. ABSENT means unmeasured (target.ts), and then every group declines the
+ *  same way: no boundary is safe to assume, since one too small is that very mis-stride on agbcc,
+ *  and the caller must say which layout it means — a target's value, or 1 for the natural one. */
+export function recognizeStructArrays(fn: Fn, aggregateBoundary: number | undefined): number {
   const defs = defOpMap(fn);
   let count = 0;
   // The NAME index is not the recognition count: `count` is this function's return value — how
@@ -148,7 +156,7 @@ export function recognizeStructArrays(fn: Fn): number {
     // load/store BASE with a field offset inside one element.
     const elemSet = new Set(elems.map((e) => e.add.results[0]));
     const indexOf = new Map(elems.map((e) => [e.add.results[0], e.index]));
-    const accesses: { op: Op; elem: Value; off: number; width: number; signed: boolean }[] = [];
+    const accesses: { op: Op; elem: Value; off: number; width: number; signed: boolean; stamp?: boolean }[] = [];
     for (const bb of fn.blocks) {
       for (const op of bb.ops) {
         const isMem = (op.opcode === 'load' || op.opcode === 'store') && elemSet.has(op.operands[0]);
@@ -170,6 +178,7 @@ export function recognizeStructArrays(fn: Fn): number {
             off,
             width,
             signed: op.opcode === 'load' ? (op.attrs.signed as boolean) : width === 4,
+            stamp: op.opcode === 'load' ? undefined : (op.attrs.signed as boolean | undefined),
           });
         }
       }
@@ -193,13 +202,14 @@ export function recognizeStructArrays(fn: Fn): number {
     // silently drops one side's zero/sign-extension (adversarially learned: `arr[i].f +
     // (u16)arr[i].f` lost its zext and a byte-exact match with it). A STORE's `signed` is the
     // width===4 CONVENTION, not a machine fact, so it never conflicts — the field takes its
-    // signedness from the loads when any exist.
-    const byOff = new Map<number, { width: number; loadSigned: boolean | null }>();
+    // signedness from the loads when any exist, else from the stores raise/storesign.ts stamped
+    // (the signed view when any says signed, as raise/structs.ts `buildStruct` prefers it).
+    const byOff = new Map<number, { width: number; loadSigned: boolean | null; stamped: boolean | null }>();
     for (const a of accesses) {
       const isLoad = a.op.opcode === 'load';
       const prev = byOff.get(a.off);
       if (!prev) {
-        byOff.set(a.off, { width: a.width, loadSigned: isLoad ? a.signed : null });
+        byOff.set(a.off, { width: a.width, loadSigned: isLoad ? a.signed : null, stamped: a.stamp ?? null });
       } else if (prev.width !== a.width) {
         clean = false;
       } else if (isLoad) {
@@ -208,6 +218,8 @@ export function recognizeStructArrays(fn: Fn): number {
         } else if (prev.loadSigned !== a.signed) {
           clean = false;
         }
+      } else if (a.stamp !== undefined) {
+        prev.stamped = prev.stamped === true || a.stamp;
       }
     }
     const offs = [...byOff.entries()].sort(([x], [y]) => x - y);
@@ -222,16 +234,19 @@ export function recognizeStructArrays(fn: Fn): number {
       }
       maxAlign = Math.max(maxAlign, width);
     }
-    if (stride % maxAlign !== 0) {
+    // The DECLARED struct is rounded to its widest member AND to the compiler's aggregate
+    // boundary; a stride neither divides is one `sizeof` cannot reproduce, and recompiled it reads
+    // the wrong bytes and stores past a frame buffer sized from the asm (sa3 sub_8038910).
+    if (aggregateBoundary === undefined || stride % Math.max(maxAlign, aggregateBoundary) !== 0) {
       clean = false;
     }
     if (!clean) {
       continue;
     }
-    const dataFields: StructField[] = offs.map(([off, { width, loadSigned }]) => ({
+    const dataFields: StructField[] = offs.map(([off, { width, loadSigned, stamped }]) => ({
       off,
-      // store-only field: the width===4 convention, exactly what the old access carried
-      type: scalarTypeForAccess(width, loadSigned ?? width === 4),
+      // a store-only field: its stamped stores' view, else the width===4 convention
+      type: scalarTypeForAccess(width, loadSigned ?? stamped ?? width === 4),
       name: `field_${off}`,
     }));
     const elemStruct = T.struct(`Elem${name++}`, withPadding(dataFields, stride), stride);
@@ -265,7 +280,11 @@ export function recognizeStructArrays(fn: Fn): number {
         } else if (op.opcode === 'store') {
           bb.ops[i] = mkOp('astore', {
             operands: [base, index, op.operands[1]],
-            attrs: carryDiscipline(op, { elemSize: stride, fieldOff: op.attrs.off as number }),
+            attrs: carryDiscipline(op, {
+              elemSize: stride,
+              fieldOff: op.attrs.off as number,
+              ...(op.attrs.signed !== undefined && { signed: op.attrs.signed }),
+            }),
           });
         }
       }