Port m2c's three nice-to-have commits (+1 match, three silent miscompiles fixed)

[macabeus]

Works the three commits the m2c pin bump (#22) classified as nice-to-have. Each got an isolated commit, a benchmark measurement, and two adversarial review passes — one hunting for bugs and edge cases, one judging fit against docs/level-tower.md and docs/asmlift-101.md.

Headline: asmlift 360 → 361, m2c 342 unchanged (743 rows). Plus three silent miscompiles found and fixed, two of them pre-existing and unrelated to the ports.

m2c commit	outcome
40cbae3 fold x ^ 1 → !x	ported and extended → +1 match
7e8e106 declare only referenced symbols	nothing to port (verified) — regression tests
ef34aff don't crash on [sp+reg]	nothing to port (verified) — regression tests

The port that paid

The bump doc said no row hinges on x ^ 1, but that scan was ARM-only: seven MIPS rows carry xori …, 1, because MIPS has no set-on-greater-equal, so a materialised a >= b is spelled slt; xori. Zero agbcc rows have eor #1, so the ARM half of m2c's commit has no inhabitant here.

Ported as an idea, not code — thirty data patterns in the idiom layer, covering the branch-form siblings m2c handles elsewhere:

xor(cmp, 1)     → !cmp
icmp_eq(cmp, 0) → !cmp
icmp_ne(cmp, 0) →  cmp

These are the first ungated patterns in the bundle. The load-bearing argument isn't "semantic identity" (true, but that only preserves the IR) — it's that the shape is its own gate: the pattern can only fire where the compiler emitted the flip, and wherever it did, the negated comparison is what it was spelling. A compiler with set-on-greater-equal never produces the shape.

The zero-test half is what flipped a row. synthetic:clampu8:ido7.1 nonmatch → MATCH: if (a0 < 256 == 0) became if (a0 >= 256). Its slti/bnez pair sits in different blocks, so the frontend's own compare-branch peephole structurally cannot fuse it — that peephole is block-local and register-keyed, and the SSA-level idiom has neither limit. That's the layer choice validated by measurement rather than preference.

Round-trip evidence: synthetic:inrange:gcc2.7.2kmc stays byte-exact MATCH while its source goes from (a0 < a1 ^ 1) & (a2 < a0 ^ 1) to a0 >= a1 & a2 >= a0.

Also consolidates three hand-written copies of the comparison-negation table into one NEGATED_ICMP, with a test tying it to the opcode registry.

Three silent miscompiles

MIPS stale compare-fold (found while measuring the port, on a live row). The slt …; beqz fold kept its pending compare in a register-keyed map that nothing invalidated:

slt   v0,a0,a1
xori  v0,v0,0x1     ← v0 redefined: it now holds `a0 >= a1`
beqz  v0,.L

It folded against the dead slt and emitted the exactly inverted condition — inrange(5,1,0) returned 1 where the function returns 0, scored nonmatch 9/10, i.e. indistinguishable from an honest near-miss. Fixed by keying on the SSA value, which removes the class rather than the instance: invalidating on write would not have sufficed, since lui rD,%hi(SYM) reassigns a register without going through the write path. Pinned with a corpus fixture.

Thumb flags clobbered between a compare and its branch — cmp r0,r1; add r2,r0,#1; beq emitted if (a0 != a1) where the hardware tests r0 + 1 == 0 (on Thumb-1 nearly every low-register data-processing instruction sets flags, s-suffix or not). Now a loud decline. No corpus row exhibits it — but the corpus isn't the input domain, the playground takes hand-written asm where there is no oracle, and the remedy here is a decline, which guesses at nothing. Zero rows moved.

Thumb push/pop transparency and the uppercase-SP guard bypass — reproduced, not fixed here: pre-existing and outside these ports. push {r0}; pop {r1} silently loses the value, and ldr r0, [SP, r1] bypasses every sp guard because the guard is a blocklist over an unvalidated register namespace. Top of the follow-up list.

The two verifications

Both are "nothing to port", verified rather than assumed — and both first attempts were wrong, which review caught.

Declarations are reference-driven by construction: collectSymbolRefs derives from each candidate's final tree at the point of consumption. A sweep across 11 tree shapes and all 121 real symbol-map rows found zero spurious declarations. My first test for it was vacuous (its dead load is reaped before structuring, so a cached-at-structure-time field would also be empty — it couldn't discriminate the designs it named). Replaced with the two collector arms nothing covered; deleting either arm passed the whole suite before this. Recorded but not fixed: collectStructs is a second declaration producer with exactly m2c's shape, latent today.

sp-as-data is refused as a whole class, so the register-indexed form isn't a case to know about. The honest framing is that this is a capability gap, not parity — local stack frames are worth roughly a dozen matches, though only the sixth-largest decline class. PPC turned out to be the frontend that matters: it's asmlift's only one with a register-indexed addressing mode, making lwzx rD,r1,rB the exact structural analogue of m2c's case, and it declines only because addrX routes through read rather than by a check of its own. Now pinned.

Notes

• Suite green: 930 tests. This also restores clean benchmark provenance — the published results have carried dirty: true since the pin bump, so summary-consistency.test.ts has been red on main.
• One agent claim I checked and did not carry forward: inflated arity on two real rows attributed to the dropped pop doesn't replicate — those params come from high-register reads.

🤖 Generated with Claude Code