Recover branching signed /2^k division and wider Thumb jump tables

[macabeus]

Works the four commits the m2c pin bump (#22) classified as worth porting, following #23 which did the nice-to-haves. Each entry got an isolated commit, a benchmark measurement, and two adversarial review passes — one hunting for bugs and edge cases, one judging fit against docs/level-tower.md and docs/asmlift-101.md.

asmlift 361 → 363 vs m2c 342 (743 rows). Declined 205 → 202.

m2c commit	outcome
a7c5c2d label+offset in jtbl loads	ported + two asmlift-specific gaps → 3 declines recovered
7e607d6 avoid negative struct/array indexing	discarded, reason pinned as tests
8ce8da5 non-word loads in the arg region	discarded, nothing to port and nothing to test
49b5d87 more division-by-2^k patterns	ported as intent → +2 matches

Jump tables: the port was the smallest of three gaps

The bump doc said asmlift has no jump-table support. It does — it recognised a spelling agbcc rarely emits. m2c's fix was one of three things standing between us and the six benchmark functions that dispatch through a table:

• Pool offset (m2c's fix). The dispatch pointer is loaded like every other pool word, LABEL[+N]; the recognizer accepted only a bare label whose pool held exactly one word. A literal pool is a pool — which slot the table pointer lands in is an artifact of emission order.
• Long-jump bounds guard (not in m2c's commit). cmp rX,#M ; bls DISP ; b DEF alongside cmp rX,#M ; bhi DEF. agbcc emits this whenever the default is out of a conditional branch's ±256-byte reach, which for a real switch it usually is: five of the six functions use it, one uses the direct form. So the recognizer covered the rarer spelling.
• Adjacent labels. agbcc drops a long-jump helper label straight onto an existing one; the empty block was filtered out and branches naming it dangled.

Plus a prerequisite fix(ssa): block args belong to the edge, not the block. A switch_br sending two case values to one body (case 1: case 2:, ordinary C) piled k copies of each arg onto the first edge and left the rest empty. Landed separately because it moves zero rows on its own — but it is not dead code: revert that file on top of the tip and two rows fail the verifier.

declined 205 → 202. Two rows become scored; sa3:sub_802DFC8 becomes noncompile, which is worth stating plainly — it now lifts and emits, and the emission trips the call-arity heuristic over-counting a callee with no prototype. That is loud here because the benchmark supplies project headers; in the playground with no prototypes, C89 implicit declarations would accept the extra argument and compile. The fix belongs in call-arity recovery. The other five functions recover their switch and decline further downstream on gaps unrelated to jump tables (unions, a sym+0x48 pool word, stack frames) — outcomes unchanged, decline reasons now specific and attributable.

Division by 2^k: ported as intent, and it's the win

x / 2^k truncates toward zero but an arithmetic shift rounds toward minus infinity, so a compiler biases a negative dividend by 2^k - 1. asmlift already folded the branchless spelling; this recovers the branch, which is what IDO emits and what GCC emits for larger k.

Deliberately not m2c's form. 49b5d87 adds a third and fourth instruction-window pattern, and its own message notes GCC reorders the final sra and defeats the window. This matches the value/CFG graph instead, which is immune to that — verified: the fold still fires when the sunk shift sits in a later block. A CFG diamond is unstateable in the patterns-as-data layer (its match DAG is over the def-graph inside one block), so it earns a pre-recovery pass, as raise/shortcircuit.ts does.

synthetic:div2:ido7.1 and synthetic:avg2:ido7.1 both flip nonmatch → MATCH — both rows where m2c matched and asmlift did not. synthetic:modpow2 (agbcc and gcc2.7.2kmc) changes text and stays matched, which is round-trip byte evidence on two further compilers. A real GBA function already folds a k=8 diamond (it declines for unrelated reasons), and a second waits behind the bltzl frontend gap.

The pass is ungated on magicdiv's self-verifying-round-trip argument, not on "the identity is arithmetic" — by this project's taxonomy that alone isn't a licence, since the pass does trade one spelling for another.

The two discards

7e607d6 — both halves are structural non-issues. m2c's index arrives as a byte offset it must divide by the element size, so a literal there is genuinely ambiguous; raise/arrays.ts matches only when 1 << k === width, which makes the shifted operand an index by construction. A constant index is then as well-defined as a variable one. And a negative offset stays exact pointer arithmetic (a0[-2]), with no struct synthesized across it. Probed four shapes before writing; the reasons are pinned as tests.

8ce8da5 — nothing to port and nothing to test: asmlift has no outgoing-arg-region inference to blind. Call arity comes from prototypes or argument-register liveness, and stack-passed args decline. A test would assert the absence of a subsystem.

What review changed

Two commits shipped silent miscompiles, both caught and fixed:

• The label-alias fix treated data labels as aliases, so beq .Lpool silently retargeted past the pool. Every agbcc literal pool is a label on data, so this was the common case.
• The pow2 pass counted only operands as uses, missing block arguments — a merge value escaping along an edge folded (y >> 2) + y into (x / 4) + (x / 4). A second reviewer hit the same bug independently from real MIPS asm, and also caught that the merge may be the entry block, where retiring a param silently deletes one of the function's own arguments while verify() passes.

Also backed out an over-correction: an n < 2 fail-closed guard broke a legal 1-case dispatch that demonstrably lifted correctly.

Two errata, both mine: the bump doc's "zero inhabitants" for the pow2 lever was correctly scoped to m2c's new windows — the lever had inhabitants all along, and my first erratum mis-stated why. And "declined → noncompile is loud" was too strong, as described above.

Notes

• Suite green: 949 tests, up from 939. Two new files — thumb-switch.test.ts (there was no Thumb jump-table fixture anywhere) and divpow2.test.ts. Both are refusal batteries: a mis-recovered table is not a wrong expression but a wrong block, and the division pass deletes a block and retires a phi, so in both cases the negative cases are the point.
• Benchmark artifacts regenerated from a clean tree, so the numbers are checkable in results.json.

🤖 Generated with Claude Code