kit

cg_adapter.c (49982B)

---

 #include <string.h>
 
 #include "parse/parse_priv.h"
 
 KitCgTypeId pcg_tid(Parser* p, const Type* ty) {
   return type_cg_id_in_pool(p->c, p->pool, ty);
 }
 
 /* Set both a slot's C type and its lowered CG id together so the two never
  * drift. Every site that writes slot->type must go through this (or copy a
  * whole slot, which carries cg_id along). The id is lowered lazily on first
  * read (pcg_slot_cg_id), not here, so an incomplete record stamped at push time
  * still lowers to its real layout once completed -- identical to a direct
  * type_cg_id_in_pool call. */
 static void pcg_slot_set_type(PcgSlot* s, const Type* ty) {
   s->type = ty;
   s->cg_id = KIT_CG_TYPE_NONE; /* lazily lowered on first read */
 }
 
 /* The slot's lowered CG id, lowering+caching on first read. A NULL type yields
  * KIT_CG_TYPE_NONE every time (the sentinel also means "unfilled", but
  * type_cg_id_in_pool(NULL) is constant so re-lowering is free). For a real type
  * the first read crosses the bridge once; later reads are a load. */
 static KitCgTypeId pcg_slot_cg_id(Parser* p, PcgSlot* s) {
   if (s->cg_id == KIT_CG_TYPE_NONE && s->type)
     s->cg_id = type_cg_id_in_pool(p->c, p->pool, s->type);
   return s->cg_id;
 }
 
 /* The cached CG id of the TOS slot's type, lowering lazily on first read.
  * Empty-stack-safe (returns NONE), matching pcg_tid(p, pcg_top_type(p)). */
 static KitCgTypeId pcg_top_cg_id(Parser* p) {
   return p->cg_type_sp
              ? pcg_slot_cg_id(p, &p->cg_slot_stack[p->cg_type_sp - 1u])
              : KIT_CG_TYPE_NONE;
 }
 
 /* The cached CG id of the depth-2 slot's type (matching pcg_top2_type). */
 static KitCgTypeId pcg_top2_cg_id(Parser* p) {
   return p->cg_type_sp >= 2
              ? pcg_slot_cg_id(p, &p->cg_slot_stack[p->cg_type_sp - 2u])
              : KIT_CG_TYPE_NONE;
 }
 
 #define PCG_VALUE_LVALUE 1u
 #define PCG_VALUE_MODIFIABLE 2u
 #define PCG_VALUE_BITFIELD 4u
 #define PCG_VALUE_NULL_PTR_CONST 8u
 #define PCG_VALUE_REGISTER 16u
 
 static u8 pcg_lvalue_flags_for_type(const Type* ty) {
   u8 flags = PCG_VALUE_LVALUE;
   if (ty && !(ty->qual & Q_CONST) && ty->kind != TY_ARRAY &&
       ty->kind != TY_FUNC && ty->kind != TY_VOID) {
     flags |= PCG_VALUE_MODIFIABLE;
   }
   return flags;
 }
 
 /* Build a MemAccess from an already-lowered CG id plus the C type (for its
  * qualifiers). Lets a caller that already has the slot's cached cg_id skip the
  * type_cg_id_in_pool re-crossing pcg_mem(ty) does twice (lower + align). */
 static KitCgMemAccess pcg_mem_id(Parser* p, KitCgTypeId id, const Type* ty) {
   KitCgMemAccess m;
   memset(&m, 0, sizeof m);
   m.type = id;
   m.align = (u32)kit_cg_type_align(p->c, id);
   if (ty && (ty->qual & Q_VOLATILE)) m.flags |= KIT_CG_MEM_VOLATILE;
   if (type_is_int(ty) && pcg_type_is_signed(ty))
     m.flags |= KIT_CG_MEM_SOURCE_SIGNED;
   return m;
 }
 
 KitCgMemAccess pcg_mem(Parser* p, const Type* ty) {
   return pcg_mem_id(p, pcg_tid(p, ty), ty);
 }
 
 static void pcg_aux_clear(PcgLvAux* a) {
   a->offset = 0;
   a->scale = 0;
   a->bit_offset = 0;
   a->bit_width = 0;
   a->storage_size = 0;
   a->bit_signed = 0;
   a->base_kind = PCG_LV_BASE_LOCAL;
   a->is_subobject = 0;
   a->pad[0] = a->pad[1] = a->pad[2] = a->pad[3] = a->pad[4] = 0;
 }
 
 static void pcg_stack_grow(Parser* p, u32 want) {
   PcgSlot* ns;
   u32 nc;
   if (p->cg_type_cap >= want) return;
   nc = p->cg_type_cap ? p->cg_type_cap * 2u : 64u;
   while (nc < want) nc *= 2u;
   ns = arena_zarray(p->pool->arena, PcgSlot, nc);
   if (!ns) perr(p, "out of memory in CG shadow stack");
   if (p->cg_slot_stack && p->cg_type_sp)
     memcpy(ns, p->cg_slot_stack, sizeof(*ns) * p->cg_type_sp);
   p->cg_slot_stack = ns;
   p->cg_type_cap = nc;
 }
 
 void pcg_push_type(Parser* p, const Type* ty) {
   PcgSlot* s;
   pcg_stack_grow(p, p->cg_type_sp + 1u);
   s = &p->cg_slot_stack[p->cg_type_sp];
   pcg_slot_set_type(s, ty);
   s->flags = 0;
   pcg_aux_clear(&s->aux);
   ++p->cg_type_sp;
 }
 
 void pcg_drop_type(Parser* p) {
   if (p->cg_type_sp) --p->cg_type_sp;
 }
 
 void pcg_dup_type(Parser* p) {
   PcgSlot top;
   if (p->cg_type_sp) {
     top = p->cg_slot_stack[p->cg_type_sp - 1u];
   } else {
     pcg_slot_set_type(&top, NULL);
     top.flags = 0;
     pcg_aux_clear(&top.aux);
   }
   /* Copy the slot out before push: pcg_stack_grow may reallocate. The whole
    * slot (cg_id included) is copied back at the end, so dup preserves the id.
    */
   pcg_push_type(p, top.type);
   if (p->cg_type_sp) p->cg_slot_stack[p->cg_type_sp - 1u] = top;
 }
 
 void pcg_swap_type(Parser* p) {
   if (p->cg_type_sp >= 2) {
     PcgSlot tmp = p->cg_slot_stack[p->cg_type_sp - 1u];
     p->cg_slot_stack[p->cg_type_sp - 1u] = p->cg_slot_stack[p->cg_type_sp - 2u];
     p->cg_slot_stack[p->cg_type_sp - 2u] = tmp;
   }
 }
 
 void pcg_rot3_type(Parser* p) {
   if (p->cg_type_sp >= 3) {
     PcgSlot a = p->cg_slot_stack[p->cg_type_sp - 3u];
     p->cg_slot_stack[p->cg_type_sp - 3u] = p->cg_slot_stack[p->cg_type_sp - 2u];
     p->cg_slot_stack[p->cg_type_sp - 2u] = p->cg_slot_stack[p->cg_type_sp - 1u];
     p->cg_slot_stack[p->cg_type_sp - 1u] = a;
   }
 }
 
 /* Structural CG ops that must keep the parser's typed shadow stack in lockstep
  * with the CG stack: each emits the CG op (when codegen is enabled) and mirrors
  * the same structural effect onto the type stack. */
 void pcg_dup(Parser* p) {
   if (pcg_emit_enabled(p)) kit_cg_dup(p->cg);
   pcg_dup_type(p);
 }
 
 void pcg_swap(Parser* p) {
   if (pcg_emit_enabled(p)) kit_cg_swap(p->cg);
   pcg_swap_type(p);
 }
 
 void pcg_drop(Parser* p) {
   if (pcg_emit_enabled(p)) kit_cg_drop(p->cg);
   pcg_drop_type(p);
 }
 
 /* Reclaim dead compiler-temp slots at a statement boundary. The authoritative
  * "no value is live" witness is the CG value stack depth, which
  * kit_cg_reclaim_temps checks (g->sp == 0): a stray non-empty call is a safe
  * no-op rather than a miscompile. (The parser's typed shadow stack cg_type_sp
  * is NOT a reliable witness — it is not drained in lockstep with the value
  * stack.) */
 void pcg_reclaim_temps(Parser* p) {
   if (!pcg_emit_enabled(p)) return;
   kit_cg_reclaim_temps(p->cg);
 }
 
 PcgLvAux* pcg_top_lv_aux(Parser* p) {
   return p->cg_type_sp ? &p->cg_slot_stack[p->cg_type_sp - 1u].aux : NULL;
 }
 
 PcgLvAux* pcg_lv_aux_at(Parser* p, u32 depth) {
   return (p->cg_type_sp > depth)
              ? &p->cg_slot_stack[p->cg_type_sp - 1u - depth].aux
              : NULL;
 }
 
 const Type* pcg_top_type(Parser* p) {
   return p->cg_type_sp ? p->cg_slot_stack[p->cg_type_sp - 1u].type : NULL;
 }
 
 const Type* pcg_top2_type(Parser* p) {
   return p->cg_type_sp >= 2 ? p->cg_slot_stack[p->cg_type_sp - 2u].type : NULL;
 }
 
 void pcg_retag_top(Parser* p, const Type* ty) {
   if (p->cg_type_sp) {
     pcg_slot_set_type(&p->cg_slot_stack[p->cg_type_sp - 1u], ty);
     p->cg_slot_stack[p->cg_type_sp - 1u].flags = 0;
     pcg_aux_clear(&p->cg_slot_stack[p->cg_type_sp - 1u].aux);
   }
 }
 
 /* Replace the type of the slot `depth` below the top (depth 0 == top) while
  * preserving its value flags and lvalue aux. Unlike pcg_retag_top this keeps
  * the slot's lvalue-ness/bitfield/aux intact — used where only the C type
  * changes (e.g. struct unqualification, narrowing a compound-assign LHS). */
 void pcg_retag_keep_flags(Parser* p, u32 depth, const Type* ty) {
   if (p->cg_type_sp > depth)
     pcg_slot_set_type(&p->cg_slot_stack[p->cg_type_sp - 1u - depth], ty);
 }
 
 int pcg_top_is_bitfield(Parser* p) {
   return p->cg_type_sp &&
          (p->cg_slot_stack[p->cg_type_sp - 1u].flags & PCG_VALUE_BITFIELD) != 0;
 }
 
 void pcg_set_top_bitfield(Parser* p) {
   if (p->cg_type_sp)
     p->cg_slot_stack[p->cg_type_sp - 1u].flags |= PCG_VALUE_BITFIELD;
 }
 
 int pcg_top_is_register(Parser* p) {
   return p->cg_type_sp &&
          (p->cg_slot_stack[p->cg_type_sp - 1u].flags & PCG_VALUE_REGISTER) != 0;
 }
 
 void pcg_set_top_register(Parser* p) {
   if (p->cg_type_sp)
     p->cg_slot_stack[p->cg_type_sp - 1u].flags |= PCG_VALUE_REGISTER;
 }
 
 int pcg_top_is_lvalue(Parser* p) {
   return p->cg_type_sp &&
          (p->cg_slot_stack[p->cg_type_sp - 1u].flags & PCG_VALUE_LVALUE) != 0;
 }
 
 int pcg_top_is_modifiable_lvalue(Parser* p) {
   return p->cg_type_sp && (p->cg_slot_stack[p->cg_type_sp - 1u].flags &
                            (PCG_VALUE_LVALUE | PCG_VALUE_MODIFIABLE)) ==
                               (PCG_VALUE_LVALUE | PCG_VALUE_MODIFIABLE);
 }
 
 int pcg_top_is_null_ptr_const(Parser* p) {
   return p->cg_type_sp && (p->cg_slot_stack[p->cg_type_sp - 1u].flags &
                            PCG_VALUE_NULL_PTR_CONST) != 0;
 }
 
 void pcg_set_top_lvalue(Parser* p) {
   const Type* ty = pcg_top_type(p);
   if (p->cg_type_sp)
     p->cg_slot_stack[p->cg_type_sp - 1u].flags = pcg_lvalue_flags_for_type(ty);
 }
 
 int pcg_emit_enabled(Parser* p) { return p && p->suppress_codegen == 0; }
 
 void pcg_codegen_suppress_push(Parser* p) {
   if (p) ++p->suppress_codegen;
 }
 
 void pcg_codegen_suppress_pop(Parser* p) {
   if (!p) return;
   if (!p->suppress_codegen)
     perr(p, "internal parser codegen suppression underflow");
   --p->suppress_codegen;
 }
 
 int pcg_type_is_fp(const Type* ty) {
   return ty && type_kind_is_fp((TypeKind)ty->kind);
 }
 
 int pcg_type_is_signed(const Type* ty) { return type_is_signed_integer(ty); }
 
 KitCgIntBinOp pcg_int_binop(BinOp op) {
   switch (op) {
     case BO_IADD:
       return KIT_CG_INT_ADD;
     case BO_ISUB:
       return KIT_CG_INT_SUB;
     case BO_IMUL:
       return KIT_CG_INT_MUL;
     case BO_SDIV:
       return KIT_CG_INT_SDIV;
     case BO_UDIV:
       return KIT_CG_INT_UDIV;
     case BO_SREM:
       return KIT_CG_INT_SREM;
     case BO_UREM:
       return KIT_CG_INT_UREM;
     case BO_AND:
       return KIT_CG_INT_AND;
     case BO_OR:
       return KIT_CG_INT_OR;
     case BO_XOR:
       return KIT_CG_INT_XOR;
     case BO_SHL:
       return KIT_CG_INT_SHL;
     case BO_SHR_S:
       return KIT_CG_INT_ASHR;
     case BO_SHR_U:
       return KIT_CG_INT_LSHR;
     default:
       return KIT_CG_INT_ADD;
   }
 }
 
 KitCgFpBinOp pcg_fp_binop(BinOp op) {
   switch (op) {
     case BO_FADD:
       return KIT_CG_FP_ADD;
     case BO_FSUB:
       return KIT_CG_FP_SUB;
     case BO_FMUL:
       return KIT_CG_FP_MUL;
     case BO_FDIV:
       return KIT_CG_FP_DIV;
     default:
       return KIT_CG_FP_ADD;
   }
 }
 
 KitCgIntCmpOp pcg_int_cmp(CmpOp op) {
   switch (op) {
     case CMP_EQ:
       return KIT_CG_INT_EQ;
     case CMP_NE:
       return KIT_CG_INT_NE;
     case CMP_LT_S:
       return KIT_CG_INT_LT_S;
     case CMP_LE_S:
       return KIT_CG_INT_LE_S;
     case CMP_GT_S:
       return KIT_CG_INT_GT_S;
     case CMP_GE_S:
       return KIT_CG_INT_GE_S;
     case CMP_LT_U:
       return KIT_CG_INT_LT_U;
     case CMP_LE_U:
       return KIT_CG_INT_LE_U;
     case CMP_GT_U:
       return KIT_CG_INT_GT_U;
     case CMP_GE_U:
       return KIT_CG_INT_GE_U;
     default:
       return KIT_CG_INT_EQ;
   }
 }
 
 KitCgFpCmpOp pcg_fp_cmp(CmpOp op) {
   switch (op) {
     case CMP_EQ:
       return KIT_CG_FP_OEQ;
     case CMP_NE:
       /* C `!=` on floats is *unordered* not-equal: `NaN != x` is true (and
        * `__builtin_isnan(x)` lowers to `x != x`). Map to UNE, not ONE. */
       return KIT_CG_FP_UNE;
     case CMP_LT_F:
     case CMP_OLT_F:
       return KIT_CG_FP_OLT;
     case CMP_LE_F:
     case CMP_OLE_F:
       return KIT_CG_FP_OLE;
     case CMP_GT_F:
     case CMP_OGT_F:
       return KIT_CG_FP_OGT;
     case CMP_GE_F:
     case CMP_OGE_F:
       return KIT_CG_FP_OGE;
     case CMP_OEQ_F:
       return KIT_CG_FP_OEQ;
     case CMP_ONE_F:
       return KIT_CG_FP_ONE;
     case CMP_UEQ_F:
       return KIT_CG_FP_UEQ;
     case CMP_UNE_F:
       return KIT_CG_FP_UNE;
     case CMP_ULT_F:
       return KIT_CG_FP_ULT;
     case CMP_ULE_F:
       return KIT_CG_FP_ULE;
     case CMP_UGT_F:
       return KIT_CG_FP_UGT;
     case CMP_UGE_F:
       return KIT_CG_FP_UGE;
     default:
       return KIT_CG_FP_OEQ;
   }
 }
 
 KitCgAtomicOp pcg_atomic_op(AtomicOp op) {
   switch (op) {
     case AO_XCHG:
       return KIT_CG_ATOMIC_XCHG;
     case AO_ADD:
       return KIT_CG_ATOMIC_ADD;
     case AO_SUB:
       return KIT_CG_ATOMIC_SUB;
     case AO_AND:
       return KIT_CG_ATOMIC_AND;
     case AO_OR:
       return KIT_CG_ATOMIC_OR;
     case AO_XOR:
       return KIT_CG_ATOMIC_XOR;
     case AO_NAND:
       return KIT_CG_ATOMIC_NAND;
   }
   return KIT_CG_ATOMIC_XCHG;
 }
 
 KitCgMemOrder pcg_mem_order(MemOrder ord) { return (KitCgMemOrder)ord; }
 
 static int pcg_slot_is_volatile(const FrameSlotDesc* fsd) {
   return fsd && ((fsd->flags & FSF_VOLATILE) ||
                  (fsd->type && (fsd->type->qual & Q_VOLATILE)));
 }
 
 FrameSlot pcg_local(Parser* p, const FrameSlotDesc* fsd) {
   KitCgLocalAttrs attrs;
   memset(&attrs, 0, sizeof attrs);
   if (!pcg_emit_enabled(p)) return FRAME_SLOT_NONE;
   attrs.name = fsd->name;
   attrs.align = fsd->align;
   if (pcg_slot_is_volatile(fsd)) attrs.flags |= KIT_CG_LOCAL_MEMORY_REQUIRED;
   /* FSF_ADDR_TAKEN is no longer propagated to CG: there is no
    * KIT_CG_LOCAL_ADDRESS_TAKEN attribute. The C-side flag stays for any
    * parser-internal uses; opt's opt_promote_scalar_locals (Stream I) decides
    * register-promotion from observed access patterns, not from the flag. */
   return kit_cg_local(p->cg, pcg_tid(p, fsd->type), attrs);
 }
 
 FrameSlot pcg_param_slot(Parser* p, u32 index, const FrameSlotDesc* fsd) {
   KitCgLocalAttrs attrs;
   if (!pcg_emit_enabled(p)) return FRAME_SLOT_NONE;
   memset(&attrs, 0, sizeof attrs);
   attrs.name = fsd->name;
   attrs.align = fsd->align;
   if (pcg_slot_is_volatile(fsd)) attrs.flags |= KIT_CG_LOCAL_MEMORY_REQUIRED;
   return kit_cg_param(p->cg, index, pcg_tid(p, fsd->type), attrs);
 }
 
 void pcg_param(Parser* p, const CGParamDesc* pd) {
   (void)p;
   (void)pd;
 }
 
 void pcg_func_begin(Parser* p, const CGFuncDesc* fd) {
   if (pcg_emit_enabled(p)) {
     KitCgFuncAttrs attrs;
     memset(&attrs, 0, sizeof attrs);
     attrs.inline_policy = fd->inline_policy;
     if (fd->flags & CGFD_NORETURN) attrs.flags |= KIT_CG_FUNC_NORETURN;
     kit_cg_func_begin_attrs(p->cg, fd->sym, attrs);
   }
 }
 
 void pcg_func_end(Parser* p) {
   if (pcg_emit_enabled(p)) kit_cg_func_end(p->cg);
 }
 
 void pcg_set_loc(Parser* p, SrcLoc loc) {
   if (pcg_emit_enabled(p)) kit_cg_set_loc(p->cg, loc);
 }
 
 void pcg_push_int(Parser* p, i64 v, const Type* ty) {
   if (pcg_emit_enabled(p)) {
     kit_cg_push_int(p->cg, (uint64_t)v, pcg_tid(p, ty));
   }
   pcg_push_type(p, ty);
   if (v == 0 && p->cg_type_sp) {
     p->cg_slot_stack[p->cg_type_sp - 1u].flags |= PCG_VALUE_NULL_PTR_CONST;
   }
 }
 
 void pcg_push_float(Parser* p, double v, const Type* ty) {
   if (pcg_emit_enabled(p)) kit_cg_push_float(p->cg, v, pcg_tid(p, ty));
   pcg_push_type(p, ty);
 }
 
 /* Tag the TOS place as a bit-field place when `lv` carries bit-field geometry.
  * The frontend builds the storage-unit place itself (materialize + deref), so
  * it attaches the descriptor here; a plain load/store then extracts/inserts the
  * field. Must be called on the place each time a fresh one is built (each deref
  * yields a plain place). No-op for non-bit-field lvalues. */
 static void pcg_apply_bitfield(Parser* p, const PcgLvAux* lv) {
   if (lv && lv->bit_width) {
     kit_cg_field_bits(p->cg, lv->bit_offset, lv->bit_width, lv->storage_size,
                       lv->bit_signed);
   }
 }
 
 /* A trivially-addressable lvalue: a bare local slot with no pending field
  * offset, array scale, or bit-field. Its PLACE is already on the CG stack
  * (push_local), so a load/store can consume it directly without first
  * materializing an address. */
 static int pcg_lv_is_trivial_local(const PcgLvAux* lv) {
   return lv && lv->base_kind == PCG_LV_BASE_LOCAL && lv->offset == 0 &&
          lv->scale == 0 && lv->bit_width == 0;
 }
 
 /* Materialize the TOS lvalue (folding its pending field offset / array scale
  * into the address) as a single pointer rvalue. Defined below; the memops use
  * it to build an explicit place before load/store. */
 static void pcg_materialize_lv_to_ptr(Parser* p, const Type* result_ptr_ty);
 static void pcg_lv_to_memop_place(Parser* p, const Type* field_ty);
 
 void pcg_push_local_typed(Parser* p, FrameSlot s, const Type* ty) {
   if (pcg_emit_enabled(p)) kit_cg_push_local(p->cg, s);
   pcg_push_type(p, ty);
   if (p->cg_type_sp) {
     p->cg_slot_stack[p->cg_type_sp - 1u].flags = pcg_lvalue_flags_for_type(ty);
     p->cg_slot_stack[p->cg_type_sp - 1u].aux.base_kind = PCG_LV_BASE_LOCAL;
   }
 }
 
 void pcg_push_global(Parser* p, ObjSymId sym, const Type* ty) {
   /* push_symbol_addr produces a pointer rvalue; the parser tags the slot as
    * a C-language lvalue with PCG_LV_BASE_POINTER_RV so subsequent
    * load/store/addr know the base is already a pointer. The cg layer accepts
    * pointer-rvalue bases for memops uniformly (Stream A). */
   if (pcg_emit_enabled(p)) kit_cg_push_symbol_addr(p->cg, sym, 0);
   pcg_push_type(p, ty);
   if (p->cg_type_sp) {
     p->cg_slot_stack[p->cg_type_sp - 1u].flags = pcg_lvalue_flags_for_type(ty);
     p->cg_slot_stack[p->cg_type_sp - 1u].aux.base_kind = PCG_LV_BASE_POINTER_RV;
   }
 }
 
 void pcg_load(Parser* p) {
   const Type* ty = pcg_top_type(p);
   int was_lvalue = pcg_top_is_lvalue(p);
   if (pcg_emit_enabled(p)) {
     PcgLvAux* lv = pcg_top_lv_aux(p);
     KitCgTypeId cg_id = pcg_top_cg_id(p); /* cached TOS-slot id, lowered once */
     KitCgMemAccess access = pcg_mem_id(p, cg_id, ty);
     /* Snapshot bit-field geometry before materialize clears the aux. */
     PcgLvAux bf = lv ? *lv : (PcgLvAux){0};
     /* Build the PLACE the strict load requires. A trivial local already has its
      * PLACE on the CG stack (push_local) and loads directly; anything else is
      * reduced to a single pointer (materialize, or a pointer-rvalue base) and
      * then deref'd to a place. A bit-field place is then tagged with its bit
      * geometry so the load extracts the field. */
     if (!was_lvalue || !pcg_lv_is_trivial_local(lv)) {
       if (was_lvalue)
         pcg_lv_to_memop_place(p, ty);
       else
         kit_cg_deref(p->cg, 0);
     }
     pcg_apply_bitfield(p, &bf);
     kit_cg_load(p->cg, access);
   }
   if (was_lvalue && p->cg_type_sp) {
     /* The emit block above can rewrite the TOS slot's type (materialize /
      * deref push/drop), so restore it to the loaded value's type `ty` here --
      * stamping cg_id alongside it. */
     pcg_slot_set_type(&p->cg_slot_stack[p->cg_type_sp - 1u], ty);
     p->cg_slot_stack[p->cg_type_sp - 1u].flags = 0;
     pcg_aux_clear(&p->cg_slot_stack[p->cg_type_sp - 1u].aux);
   }
 }
 
 /* Materialize the pending EA on the TOS lvalue as a pointer rvalue.
  * Postcondition: TOS is a pointer rvalue of type result_ptr_ty (which the
  * caller has computed as type_ptr(pool, current_lv_type)) and the CG stack
  * holds that single pointer where the lvalue's [base] or [base, index] used
  * to be. Aux is cleared.
  *
  * The materialization sequence depends on the aux:
  *   base_kind == LOCAL:
  *     - scale == 0, offset == 0:        addr
  *     - scale == 0, offset != 0:        addr ; ptr_to_int ; +offset ;
  * int_to_ptr
  *     - scale != 0:                     addr ; ptr_to_int ; idx*scale + ofs ;
  * int_to_ptr base_kind == POINTER_RV:
  *     - scale == 0, offset == 0:        no-op
  *     - scale == 0, offset != 0:        ptr_to_int ; +offset ; int_to_ptr
  *     - scale != 0:                     ptr_to_int ; idx*scale + ofs ;
  * int_to_ptr */
 static void pcg_materialize_lv_to_ptr(Parser* p, const Type* result_ptr_ty) {
   PcgLvAux* lv = pcg_top_lv_aux(p);
   int emit = pcg_emit_enabled(p);
   PcgLvBaseKind base_kind =
       lv ? (PcgLvBaseKind)lv->base_kind : PCG_LV_BASE_LOCAL;
   i64 ofs = lv ? lv->offset : 0;
   u32 scale = lv ? lv->scale : 0u;
   const Type* idx_ty = c_abi_ptrdiff_type(p->abi, p->pool);
   KitCgTypeId idx_tid = pcg_tid(p, idx_ty);
   KitCgTypeId ptr_tid = pcg_tid(p, result_ptr_ty);
   if (scale == 0 && ofs == 0) {
     if (base_kind == PCG_LV_BASE_LOCAL) {
       if (emit) kit_cg_addr(p->cg);
     }
     /* Already a pointer with no pending modifiers. */
   } else if (scale == 0) {
     if (emit) {
       if (base_kind == PCG_LV_BASE_LOCAL) kit_cg_addr(p->cg);
       kit_cg_ptr_to_int(p->cg, idx_tid);
       kit_cg_push_int(p->cg, (uint64_t)ofs, idx_tid);
       kit_cg_int_binop(p->cg, KIT_CG_INT_ADD, KIT_CG_INTOP_NONE);
       kit_cg_int_to_ptr(p->cg, ptr_tid);
     }
   } else {
     /* CG stack on entry: [base_ptr_now, index]. Compute
      * base_ptr_now + index*scale + ofs. */
     if (emit) {
       if (base_kind == PCG_LV_BASE_LOCAL) {
         kit_cg_swap(p->cg); /* [index, base_lv] */
         kit_cg_addr(p->cg); /* [index, base_ptr] */
         kit_cg_swap(p->cg); /* [base_ptr, index] */
       }
       kit_cg_swap(p->cg); /* [index, base_ptr] */
       kit_cg_ptr_to_int(p->cg, idx_tid);
       kit_cg_swap(p->cg); /* [base_int, index] */
       kit_cg_push_int(p->cg, (uint64_t)scale, idx_tid);
       kit_cg_int_binop(p->cg, KIT_CG_INT_MUL, KIT_CG_INTOP_NONE);
       kit_cg_int_binop(p->cg, KIT_CG_INT_ADD, KIT_CG_INTOP_NONE);
       if (ofs != 0) {
         kit_cg_push_int(p->cg, (uint64_t)ofs, idx_tid);
         kit_cg_int_binop(p->cg, KIT_CG_INT_ADD, KIT_CG_INTOP_NONE);
       }
       kit_cg_int_to_ptr(p->cg, ptr_tid);
     }
   }
   pcg_retag_top(p, result_ptr_ty);
   {
     PcgLvAux* out = pcg_top_lv_aux(p);
     if (out) out->base_kind = PCG_LV_BASE_POINTER_RV;
   }
 }
 
 /* Build the PLACE a load/store reads, from the TOS lvalue, keeping a constant
  * field/element offset as the deref displacement (so the backend folds it into
  * the load/store: `ldr w, [base, #ofs]`) rather than baking it into an explicit
  * `base + ofs` pointer the way pcg_materialize_lv_to_ptr + kit_cg_deref(0)
  * does. Mirrors that pair's postcondition (CG TOS is the place; parser slot is
  * the field pointer type with aux cleared). The pointer is reinterpreted to the
  * field type with a bitcast — free on the native backend (a no-op same-width
  * cast), an explicit cast on the C-source backend. Indexed (scale != 0) and
  * out-of-displacement-range offsets fall back to the explicit-pointer fold.
  * Caller guarantees emit is enabled. */
 static void pcg_lv_to_memop_place(Parser* p, const Type* field_ty) {
   PcgLvAux* lv = pcg_top_lv_aux(p);
   PcgLvBaseKind base_kind =
       lv ? (PcgLvBaseKind)lv->base_kind : PCG_LV_BASE_LOCAL;
   i64 ofs = lv ? lv->offset : 0;
   u32 scale = lv ? lv->scale : 0u;
   const Type* fptr = type_ptr(p->pool, field_ty);
   if (ofs < INT32_MIN || ofs > INT32_MAX) {
     /* Out-of-int32 displacement can't ride a deref/EA offset; materialize an
      * explicit base+ofs pointer. */
     pcg_materialize_lv_to_ptr(p, fptr);
     kit_cg_deref(p->cg, 0);
     return;
   }
   if (scale != 0u) {
     /* Scaled subscript: build one fused [base + index*scale + ofs] place via
      * kit_cg_elem_scaled rather than materializing a standalone
      * base+index*scale+ofs pointer (an explicit mul/add + a copy into the deref
      * base). CG stack on entry is [base, index]; decay the base to a field_ty*
      * pointer value, then fuse. The index stride is the containing array's
      * element size (scale) while the access type is field_ty, so `a[i].f`
      * strides by sizeof(elem) but reads `f`. */
     kit_cg_swap(p->cg); /* [index, base] */
     if (base_kind == PCG_LV_BASE_LOCAL)
       kit_cg_addr(p->cg);                    /* [index, base_ptr] */
     kit_cg_bitcast(p->cg, pcg_tid(p, fptr)); /* [index, (T*)base] */
     kit_cg_swap(p->cg);                      /* [base, index] */
     kit_cg_elem_scaled(p->cg, scale, ofs);   /* [place] */
   } else {
     if (base_kind == PCG_LV_BASE_LOCAL) kit_cg_addr(p->cg);
     kit_cg_bitcast(p->cg, pcg_tid(p, fptr));
     kit_cg_deref(p->cg, ofs);
   }
   pcg_retag_top(p, fptr);
   {
     PcgLvAux* out = pcg_top_lv_aux(p);
     if (out) out->base_kind = PCG_LV_BASE_POINTER_RV;
   }
 }
 
 void pcg_addr(Parser* p) {
   const Type* ty = pcg_top_type(p);
   pcg_materialize_lv_to_ptr(p, type_ptr(p->pool, ty));
 }
 
 /* Pushes the address of a label as a `void*` rvalue (GNU `&&label`). */
 void pcg_push_label_addr(Parser* p, CGLabel label) {
   const Type* vp = type_ptr(p->pool, type_void(p->pool));
   if (pcg_emit_enabled(p)) kit_cg_push_label_addr(p->cg, label, pcg_tid(p, vp));
   pcg_push_type(p, vp);
 }
 
 /* Pops the target pointer and emits a computed `goto *expr;`. */
 void pcg_computed_goto(Parser* p, const CGLabel* targets, u32 ntargets) {
   if (pcg_emit_enabled(p)) kit_cg_computed_goto(p->cg, targets, ntargets);
   pcg_drop_type(p);
 }
 
 /* ---- Control flow ----
  *
  * Label placement / jump / branch ops gate on emit; the conditional branches
  * also pop the tested value off the type stack to mirror the CG-side consume.
  * Suppressed parses, such as C99 `extern inline` bodies, do not open a CG
  * function, so they use a nonzero dummy label only for semantic bookkeeping
  * around break/continue/case validation. */
 CGLabel pcg_label_new(Parser* p) {
   if (!pcg_emit_enabled(p)) return (CGLabel)1;
   return kit_cg_label_new(p->cg);
 }
 
 void pcg_label_place(Parser* p, CGLabel l) {
   if (pcg_emit_enabled(p)) kit_cg_label_place(p->cg, l);
 }
 
 void pcg_jump(Parser* p, CGLabel l) {
   if (pcg_emit_enabled(p)) kit_cg_jump(p->cg, l);
 }
 
 void pcg_branch_true(Parser* p, CGLabel l) {
   if (pcg_emit_enabled(p)) kit_cg_branch_true(p->cg, l);
   pcg_drop_type(p);
 }
 
 void pcg_branch_false(Parser* p, CGLabel l) {
   if (pcg_emit_enabled(p)) kit_cg_branch_false(p->cg, l);
   pcg_drop_type(p);
 }
 
 /* Store [lv, rv] -> [rv]. The expression-value of an assignment is the
  * assigned rvalue, so the store sequence must leave a copy of rv on TOS. */
 /* keep_result == 0: consume [place, value] and leave nothing — the assignment's
  * value is discarded (the dominant `expr;` / initializer case). Skipping the
  * dup lets a still-delayed RHS flow straight into the destination local
  * (kit_cg_store's scalar-local fast path), killing the temp->local routing mov.
  * keep_result == 1: leave the assignment's value on the stack for an enclosing
  * expression (`a = b = c`, `if ((x = f()))`). */
 static void pcg_store_impl(Parser* p, int keep_result) {
   const Type* lv_ty = pcg_top2_type(p);
   const Type* rv_ty = pcg_top_type(p);
   const Type* mem_ty = lv_ty;
   /* Cached CG ids of the two slots (lowered once, not re-crossed by pcg_mem).
    */
   KitCgTypeId rv_cg = pcg_top_cg_id(p);
   KitCgTypeId mem_cg = pcg_top2_cg_id(p); /* tracks mem_ty (= lv_ty) */
   int emit = pcg_emit_enabled(p);
   /* The aux to consume lives on the lvalue slot at parser depth 1. */
   PcgLvAux* lv = pcg_lv_aux_at(p, 1);
   /* Snapshot bit-field geometry before materialize clears the aux. */
   PcgLvAux bf = lv ? *lv : (PcgLvAux){0};
   KitCgMemAccess access;
   if (rv_ty && type_is_ptr(rv_ty) && (!lv_ty || !type_is_ptr(lv_ty))) {
     mem_ty = rv_ty;
     mem_cg = rv_cg;
   }
   access = pcg_mem_id(p, mem_ty ? mem_cg : rv_cg, mem_ty ? mem_ty : rv_ty);
   if (emit) {
     int wide =
         rv_ty && (rv_ty->kind == TY_INT128 || rv_ty->kind == TY_UINT128 ||
                   rv_ty->kind == TY_LDOUBLE);
     if (pcg_lv_is_trivial_local(lv) && !wide) {
       /* The destination place is already on the CG stack: [place, value]. When
        * the result is kept, dup rv first so a copy survives the store; when it
        * is discarded, store straight from [place, value] so the RHS (possibly a
        * still-delayed arith/cmp) lands directly in the local. */
       if (keep_result) {
         kit_cg_dup(p->cg);
         kit_cg_rot3(p->cg);
         kit_cg_swap(p->cg);
       }
       kit_cg_store(p->cg, access);
     } else {
       /* Stash rv into a temp so the destination place can be built from the
        * base — folding any field offset / array scale into an explicit pointer
        * — then reload rv to store it and to leave it as the expression value.
        */
       FrameSlotDesc fsd;
       FrameSlot tmp;
       KitCgMemAccess rv_access = pcg_mem_id(p, rv_cg, rv_ty);
       int trivial = pcg_lv_is_trivial_local(lv);
       memset(&fsd, 0, sizeof fsd);
       fsd.type = rv_ty;
       fsd.size = c_abi_sizeof(p->abi, p->pool, rv_ty);
       fsd.align = c_abi_alignof(p->abi, p->pool, rv_ty);
       fsd.kind = FS_LOCAL;
       tmp = pcg_local(p, &fsd);
       kit_cg_push_local(p->cg, tmp);  /* [base.., value, &tmp] */
       kit_cg_swap(p->cg);             /* [base.., &tmp, value] */
       kit_cg_store(p->cg, rv_access); /* [base..] (stash rv) */
       if (!trivial) {
         /* Materialize operates on the parser-TOS lvalue; drop the rv type slot
          * so the lvalue is on top and matches the CG [base..]. The pointer is
          * deref'd to the PLACE the strict store requires, then tagged with the
          * bit-field geometry so the store inserts the field. */
         pcg_drop_type(p);
         pcg_lv_to_memop_place(p, lv_ty); /* [dst_place] */
         pcg_apply_bitfield(p, &bf);
         pcg_push_type(p, rv_ty);
       }
       kit_cg_push_local(p->cg, tmp);
       kit_cg_load(p->cg, rv_access); /* [dst, value] */
       kit_cg_store(p->cg, access);   /* [] */
       if (keep_result) {
         kit_cg_push_local(p->cg, tmp);
         kit_cg_load(p->cg, rv_access); /* [value] */
       }
     }
   }
   pcg_drop_type(p);
   pcg_drop_type(p);
   if (keep_result) pcg_push_type(p, rv_ty);
 }
 
 void pcg_store(Parser* p) { pcg_store_impl(p, 1); }
 
 /* Store whose assignment value is discarded (the `expr;` / initializer case).
  * Replaces the `pcg_store(p); pcg_drop(p)` idiom; avoids materializing the RHS
  * into a temp just to drop it. */
 void pcg_store_void(Parser* p) { pcg_store_impl(p, 0); }
 
 void pcg_deref(Parser* p, const Type* pointee) {
   const Type* ptr_ty = pcg_top_type(p);
   if (pointee && pointee->kind == TY_FUNC) {
     /* Function lvalues collapse to function pointers in C; no CG-level
      * dereference is needed (functions aren't first-class data). */
     pcg_retag_top(p, pointee);
     return;
   }
   if (ptr_ty && ptr_ty->kind == TY_PTR && ptr_ty->ptr.pointee != pointee) {
     const Type* want_ptr_ty = type_ptr(p->pool, pointee);
     if (pcg_emit_enabled(p)) kit_cg_bitcast(p->cg, pcg_tid(p, want_ptr_ty));
     pcg_retag_top(p, want_ptr_ty);
   }
   /* No kit_cg_indirect: the cg load/store accept pointer-rvalue bases
    * directly. Mark the slot as a C-language lvalue with POINTER_RV base; the
    * pointer stays on the CG stack untouched. */
   pcg_retag_top(p, pointee);
   if (p->cg_type_sp) {
     p->cg_slot_stack[p->cg_type_sp - 1u].flags =
         pcg_lvalue_flags_for_type(pointee);
     p->cg_slot_stack[p->cg_type_sp - 1u].aux.base_kind = PCG_LV_BASE_POINTER_RV;
   }
 }
 
 /* ---- Lvalue chain helpers ---- */
 
 void pcg_lv_member(Parser* p, i64 byte_offset, const Type* field_ty,
                    u16 bf_offset, u16 bf_width, u32 bf_storage_size) {
   PcgLvAux* lv = pcg_top_lv_aux(p);
   int was_lvalue = pcg_top_is_lvalue(p);
   const Type* base_ty = pcg_top_type(p);
   /* A member of an rvalue aggregate (e.g. `mk().field` for a struct-returning
    * call) lives in a CG-side temporary that is memory-backed, so the member is
    * readable as an lvalue — but per C it is not a *modifiable* lvalue. */
   int base_is_rvalue_agg =
       !was_lvalue && base_ty &&
       (base_ty->kind == TY_STRUCT || base_ty->kind == TY_UNION);
   i64 saved_offset = lv ? lv->offset + byte_offset : byte_offset;
   u32 saved_scale = lv ? lv->scale : 0u;
   u8 saved_base_kind = lv ? lv->base_kind : PCG_LV_BASE_LOCAL;
   /* Bumping the offset preserves the base kind and any earlier offset/scale
    * accumulated on the chain (`a[i].f.g` keeps `scale = sizeof(elem)` and
    * adds the field offsets). */
   pcg_retag_top(p, field_ty);
   if (was_lvalue) {
     pcg_set_top_lvalue(p);
   } else if (base_is_rvalue_agg && p->cg_type_sp) {
     p->cg_slot_stack[p->cg_type_sp - 1u].flags = PCG_VALUE_LVALUE;
   }
   /* pcg_retag_top cleared aux; re-apply the bumped offset and base kind. */
   {
     PcgLvAux* lv_after = pcg_top_lv_aux(p);
     if (lv_after) {
       lv_after->offset = saved_offset;
       lv_after->scale = saved_scale;
       lv_after->base_kind = saved_base_kind;
       lv_after->bit_offset = bf_offset;
       lv_after->bit_width = bf_width;
       lv_after->storage_size = bf_storage_size;
       lv_after->bit_signed = pcg_type_is_signed(field_ty) ? 1u : 0u;
       /* A member access narrows to a sub-object of a larger CG-tracked
        * object; record it so aggregate reads materialize a pointer to the
        * exact sub-object (the offset alone can be 0 for a first member). */
       lv_after->is_subobject = 1u;
     }
     if (bf_width && p->cg_type_sp)
       p->cg_slot_stack[p->cg_type_sp - 1u].flags |= PCG_VALUE_BITFIELD;
   }
 }
 
 void pcg_lv_subscript(Parser* p, u32 elem_size, const Type* elem_ty) {
   /* Stack on entry (parser side): [base_lv, index_rv].
    * Stack on entry (CG side):     [base, index].
    * After this call (parser):     [elem_lv] with aux.scale = elem_size.
    * After this call (CG):         [base, index] — unchanged; the eventual
    * load/store consumes both via the EA. */
   PcgLvAux* base_lv = pcg_lv_aux_at(p, 1);
   i64 saved_offset = base_lv ? base_lv->offset : 0;
   u8 base_is_lvalue =
       (p->cg_type_sp >= 2u &&
        (p->cg_slot_stack[p->cg_type_sp - 2u].flags & PCG_VALUE_LVALUE) != 0);
   u8 saved_base_kind = !base_is_lvalue
                            ? PCG_LV_BASE_POINTER_RV
                            : (base_lv ? base_lv->base_kind : PCG_LV_BASE_LOCAL);
   if (base_lv && base_lv->scale != 0) {
     perr(p, "internal: nested subscript without materialization");
   }
   pcg_drop_type(p);          /* drop index parser slot */
   pcg_retag_top(p, elem_ty); /* retag base parser slot as element */
   pcg_set_top_lvalue(p);
   {
     PcgLvAux* lv = pcg_top_lv_aux(p);
     if (lv) {
       lv->offset = saved_offset;
       lv->scale = elem_size;
       lv->base_kind = saved_base_kind;
     }
   }
 }
 
 void pcg_decay_array(Parser* p, const Type* arr_ty) {
   const Type* ptr_ty = type_ptr(p->pool, arr_ty->arr.elem);
   pcg_materialize_lv_to_ptr(p, ptr_ty);
 }
 
 void pcg_binop(Parser* p, BinOp op) {
   const Type* result = pcg_top2_type(p);
   if (op == BO_FADD || op == BO_FSUB || op == BO_FMUL || op == BO_FDIV) {
     if (pcg_emit_enabled(p)) {
       kit_cg_fp_binop(p->cg, pcg_fp_binop(op), KIT_CG_FP_NONE);
     }
   } else {
     if (pcg_emit_enabled(p)) {
       kit_cg_int_binop(p->cg, pcg_int_binop(op), KIT_CG_INTOP_NONE);
     }
   }
   pcg_drop_type(p);
   pcg_retag_top(p, result);
 }
 
 void pcg_unop(Parser* p, UnOp op) {
   if (op == UO_NEG && pcg_type_is_fp(pcg_top_type(p))) {
     if (pcg_emit_enabled(p))
       kit_cg_fp_unop(p->cg, KIT_CG_FP_NEG, KIT_CG_FP_NONE);
   } else {
     KitCgIntUnOp iop = op == UO_NOT    ? KIT_CG_INT_NOT
                        : op == UO_BNOT ? KIT_CG_INT_BNOT
                                        : KIT_CG_INT_NEG;
     if (pcg_emit_enabled(p)) kit_cg_int_unop(p->cg, iop, KIT_CG_INTOP_NONE);
   }
 }
 
 void pcg_cmp(Parser* p, CmpOp op) {
   /* The FP block starts at CMP_LT_F (relational operator markers) and runs
    * through the ordered/unordered predicate members; everything below is
    * integer. CMP_EQ/CMP_NE additionally route to FP when the operand type is
    * floating (C `==`/`!=` on floats is ordered-equal / unordered-not-equal). */
   if (op >= CMP_LT_F ||
       ((op == CMP_EQ || op == CMP_NE) && pcg_type_is_fp(pcg_top_type(p)))) {
     if (pcg_emit_enabled(p)) kit_cg_fp_cmp(p->cg, pcg_fp_cmp(op));
   } else {
     if (pcg_emit_enabled(p)) kit_cg_int_cmp(p->cg, pcg_int_cmp(op));
   }
   pcg_drop_type(p);
   pcg_retag_top(p, type_prim(p->pool, TY_INT));
 }
 
 void pcg_convert(Parser* p, const Type* dst) {
   const Type* src = pcg_top_type(p);
   /* src is the TOS slot: read its cached id; dst is lowered once and reused for
    * both its size and the convert id. */
   KitCgTypeId src_id = pcg_top_cg_id(p);
   KitCgTypeId id = pcg_tid(p, dst);
   u32 ss = (u32)kit_cg_type_size(p->c, src_id);
   u32 ds = (u32)kit_cg_type_size(p->c, id);
   int si = type_is_int(src) || type_is_ptr(src);
   int di = type_is_int(dst) || type_is_ptr(dst);
   int sf = pcg_type_is_fp(src);
   int df = pcg_type_is_fp(dst);
   int emit = pcg_emit_enabled(p);
   if (src == dst) return;
   /* C has no struct/union conversion: a pcg_convert reaching here with an
    * aggregate on the stack is only reconciling a qualifier difference between
    * two compatible types — e.g. the arms of a `?:` where one is a `const`
    * struct lvalue (`*top`, top a `const T*`) and the other is not. The
    * representation is identical, so retag the place to dst and emit nothing.
    * Falling through would hand the aggregate to the scalar bitcast path, which
    * pushes it as a value — illegal for an aggregate (api_push rejects it). The
    * flag-preserving retag keeps it a place so the caller can copy it. */
   if (src->kind == TY_STRUCT || src->kind == TY_UNION) {
     pcg_retag_keep_flags(p, 0, dst);
     return;
   }
   /* Conversion to _Bool is "value != 0", not a truncation: a value whose set
    * bits all lie above the bool storage width (e.g. 256, or the sign bit of a
    * 128-bit operand) must still become 1. Emit an explicit compare-against-zero
    * for any non-bool scalar source. */
   if (dst->kind == TY_BOOL && src->kind != TY_BOOL) {
     if (emit) {
       KitCgTypeId sid = src_id; /* cached TOS-slot id */
       if (sf) {
         kit_cg_push_float(p->cg, 0.0, sid);
         kit_cg_fp_cmp(p->cg, KIT_CG_FP_UNE);
       } else {
         kit_cg_push_int(p->cg, 0, sid);
         kit_cg_int_cmp(p->cg, KIT_CG_INT_NE);
       }
       /* The compare yields a 0/1 int; narrow it to the bool storage width. */
       kit_cg_trunc(p->cg, id);
     }
     pcg_retag_top(p, dst);
     return;
   }
   if (type_is_ptr(src) && type_is_ptr(dst)) {
     if (emit) kit_cg_bitcast(p->cg, id);
     pcg_retag_top(p, dst);
     return;
   }
   if (si && di) {
     if (ds < ss) {
       if (emit) kit_cg_trunc(p->cg, id);
     } else if (ds > ss && type_is_int(src) && pcg_type_is_signed(src)) {
       if (emit) kit_cg_sext(p->cg, id);
     } else if (ds > ss) {
       if (emit) kit_cg_zext(p->cg, id);
     } else if (type_is_ptr(src) != type_is_ptr(dst)) {
       if (emit) kit_cg_bitcast(p->cg, id);
     }
   } else if (type_is_int(src) && df) {
     if (pcg_type_is_signed(src)) {
       if (emit) kit_cg_sint_to_float(p->cg, id, KIT_CG_ROUND_DEFAULT);
     } else {
       if (emit) kit_cg_uint_to_float(p->cg, id, KIT_CG_ROUND_DEFAULT);
     }
   } else if (sf && type_is_int(dst)) {
     if (pcg_type_is_signed(dst)) {
       if (emit) kit_cg_float_to_sint(p->cg, id, KIT_CG_ROUND_DEFAULT);
     } else {
       if (emit) kit_cg_float_to_uint(p->cg, id, KIT_CG_ROUND_DEFAULT);
     }
   } else if (sf && df) {
     if (ds > ss) {
       if (emit) kit_cg_fpext(p->cg, id);
     } else if (ds < ss) {
       if (emit) kit_cg_fptrunc(p->cg, id);
     }
   } else {
     if (emit) kit_cg_bitcast(p->cg, id);
   }
   pcg_retag_top(p, dst);
 }
 
 /* Emit "value <op> step" for an inc/dec, picking the float or integer binop
  * based on the operand type. Floating operands step by 1.0 via an FP add/sub;
  * pointers step by the pointee size and everything else by 1. */
 static void pcg_emit_inc_step(Parser* p, const Type* ty, BinOp op,
                               KitCgIntBinOp cg_op, const Type* step_ty,
                               u32 step) {
   if (pcg_type_is_fp(ty)) {
     BinOp fop = (op == BO_ISUB) ? BO_FSUB : BO_FADD;
     kit_cg_push_float(p->cg, 1.0, pcg_tid(p, ty));
     kit_cg_fp_binop(p->cg, pcg_fp_binop(fop), KIT_CG_FP_NONE);
   } else {
     i64 amount = (ty && ty->kind == TY_PTR) ? (i64)step : 1;
     kit_cg_push_int(p->cg, amount, pcg_tid(p, step_ty));
     kit_cg_int_binop(p->cg, cg_op, 0);
   }
 }
 
 void pcg_inc_dec(Parser* p, BinOp op, int post) {
   const Type* ty = pcg_top_type(p);
   /* Cache the TOS-slot id NOW: pcg_materialize_lv_to_ptr below retypes the slot
    * to a pointer, so a later pcg_top_cg_id would no longer be `ty`'s id. */
   KitCgTypeId ty_cg = pcg_top_cg_id(p);
   if (!pcg_emit_enabled(p)) {
     /* Drop the lvalue parser slot and push the rvalue result type. */
     pcg_drop_type(p);
     pcg_push_type(p, ty);
     return;
   }
   {
     KitCgIntBinOp cg_op = pcg_int_binop(op);
     PcgLvAux* lv = pcg_top_lv_aux(p);
     /* Snapshot bit-field geometry before materialize clears the aux. */
     PcgLvAux bf = lv ? *lv : (PcgLvAux){0};
     KitCgMemAccess access = pcg_mem_id(p, ty_cg, ty);
     const Type* step_ty = ty;
     u32 step = 1;
     if (ty && ty->kind == TY_PTR) {
       const Type* pointee = ty->ptr.pointee;
       if (pointee && pointee->kind == TY_VOID)
         perr(p, "pointer arithmetic on void pointer");
       step = c_abi_sizeof(p->abi, p->pool, pointee);
       step_ty = c_abi_ptrdiff_type(p->abi, p->pool);
     }
     /* Materialize the lvalue to a single destination pointer so its address can
      * be duplicated for the read-modify-write. */
     pcg_materialize_lv_to_ptr(p, type_ptr(p->pool, ty));
     {
       FrameSlotDesc fsd;
       FrameSlot tmp;
       const Type* result_ty = ty;
       KitCgMemAccess r_access = pcg_mem_id(p, ty_cg, result_ty);
       memset(&fsd, 0, sizeof fsd);
       fsd.type = result_ty;
       fsd.size = c_abi_sizeof(p->abi, p->pool, result_ty);
       fsd.align = c_abi_alignof(p->abi, p->pool, result_ty);
       fsd.kind = FS_LOCAL;
       tmp = pcg_local(p, &fsd);
       kit_cg_dup(p->cg);      /* [ptr, ptr] */
       kit_cg_deref(p->cg, 0); /* [ptr, place] */
       pcg_apply_bitfield(p, &bf);
       kit_cg_load(p->cg, access); /* [ptr, old] */
       if (post) {
         /* Stash old, compute new, store, then re-load old as result. */
         kit_cg_dup(p->cg); /* [ptr, old, old] */
         kit_cg_push_local(p->cg, tmp);
         kit_cg_swap(p->cg);
         kit_cg_store(p->cg, r_access);                      /* [ptr, old] */
         pcg_emit_inc_step(p, ty, op, cg_op, step_ty, step); /* [ptr, new] */
         kit_cg_swap(p->cg);                                 /* [new, ptr] */
         kit_cg_deref(p->cg, 0);                             /* [new, place] */
         pcg_apply_bitfield(p, &bf);
         kit_cg_swap(p->cg);          /* [place, new] */
         kit_cg_store(p->cg, access); /* [] */
         kit_cg_push_local(p->cg, tmp);
         kit_cg_load(p->cg, r_access); /* [old] */
       } else {
         /* Compute new, stash new, store, then re-load new as result. */
         pcg_emit_inc_step(p, ty, op, cg_op, step_ty, step); /* [ptr, new] */
         kit_cg_dup(p->cg); /* [ptr, new, new] */
         kit_cg_push_local(p->cg, tmp);
         kit_cg_swap(p->cg);
         kit_cg_store(p->cg, r_access); /* [ptr, new] */
         kit_cg_swap(p->cg);            /* [new, ptr] */
         kit_cg_deref(p->cg, 0);        /* [new, place] */
         pcg_apply_bitfield(p, &bf);
         kit_cg_swap(p->cg);          /* [place, new] */
         kit_cg_store(p->cg, access); /* [] */
         kit_cg_push_local(p->cg, tmp);
         kit_cg_load(p->cg, r_access); /* [new] */
       }
       (void)step;
     }
   }
   /* Parser stack: drop the lvalue slot, push the result rvalue type. */
   pcg_drop_type(p);
   pcg_push_type(p, ty);
 }
 
 void pcg_call(Parser* p, u32 nargs, const Type* fn_type) {
   if (pcg_emit_enabled(p)) {
     kit_cg_call_default(p->cg, nargs, pcg_tid(p, fn_type));
   }
   for (u32 i = 0; i < nargs + 1u; ++i) pcg_drop_type(p);
   if (fn_type && fn_type->kind == TY_FUNC && fn_type->fn.ret->kind != TY_VOID) {
     pcg_push_type(p, fn_type->fn.ret);
   }
 }
 
 void pcg_call_symbol(Parser* p, KitCgSym sym, u32 nargs, const Type* fn_type) {
   if (pcg_emit_enabled(p)) {
     KitCgCallAttrs attrs;
     memset(&attrs, 0, sizeof attrs);
     kit_cg_call_symbol(p->cg, sym, nargs, attrs);
   }
   for (u32 i = 0; i < nargs; ++i) pcg_drop_type(p);
   if (fn_type && fn_type->kind == TY_FUNC && fn_type->fn.ret->kind != TY_VOID) {
     pcg_push_type(p, fn_type->fn.ret);
   }
 }
 
 void pcg_ret(Parser* p, int has_value) {
   if (has_value) {
     if (pcg_emit_enabled(p)) kit_cg_ret(p->cg);
     pcg_drop_type(p);
   } else if (pcg_emit_enabled(p)) {
     /* No value supplied. For a void function this is the normal 0-result
      * return. For a non-void function it is a UB fall-off-the-end or an
      * already-diagnosed bare `return;` — terminate with unreachable rather
      * than asking kit_cg_ret to pop a result that was never pushed. */
     if (p->cur_func_ret && p->cur_func_ret->kind != TY_VOID)
       kit_cg_unreachable(p->cg);
     else
       kit_cg_ret(p->cg);
   }
 }
 
 void pcg_alloca(Parser* p) {
   if (pcg_emit_enabled(p)) {
     kit_cg_alloca(p->cg, 16, pcg_tid(p, type_ptr(p->pool, type_void(p->pool))));
   }
   pcg_drop_type(p);
   pcg_push_type(p, type_ptr(p->pool, type_void(p->pool)));
 }
 
 void pcg_va_arg(Parser* p, const Type* ty) {
   if (pcg_emit_enabled(p)) kit_cg_vararg_next(p->cg, pcg_tid(p, ty));
   pcg_drop_type(p);
   pcg_push_type(p, ty);
 }
 
 void pcg_va_start(Parser* p) {
   if (pcg_emit_enabled(p)) kit_cg_vararg_start(p->cg);
 }
 
 void pcg_va_end(Parser* p) {
   if (pcg_emit_enabled(p)) kit_cg_vararg_end(p->cg);
 }
 
 void pcg_va_copy(Parser* p) {
   if (pcg_emit_enabled(p)) kit_cg_vararg_copy(p->cg);
 }
 
 void pcg_atomic_load(Parser* p, MemOrder ord) {
   const Type* pty = pcg_top_type(p);
   const Type* ty = (pty && pty->kind == TY_PTR) ? pty->ptr.pointee : pty;
   if (pcg_emit_enabled(p)) {
     kit_cg_atomic_load(p->cg, pcg_mem(p, ty), pcg_mem_order(ord));
   }
   pcg_retag_top(p, ty);
 }
 
 void pcg_atomic_store(Parser* p, MemOrder ord) {
   const Type* pty = pcg_top2_type(p);
   const Type* ty = (pty && pty->kind == TY_PTR) ? pty->ptr.pointee : pty;
   if (pcg_emit_enabled(p)) {
     kit_cg_atomic_store(p->cg, pcg_mem(p, ty), pcg_mem_order(ord));
   }
   pcg_drop_type(p);
   pcg_drop_type(p);
 }
 
 void pcg_atomic_rmw(Parser* p, AtomicOp op, MemOrder ord) {
   const Type* pty = pcg_top2_type(p);
   const Type* ty = (pty && pty->kind == TY_PTR) ? pty->ptr.pointee : pty;
   if (pcg_emit_enabled(p)) {
     kit_cg_atomic_rmw(p->cg, pcg_mem(p, ty), pcg_atomic_op(op),
                       pcg_mem_order(ord));
   }
   pcg_drop_type(p);
   pcg_retag_top(p, ty);
 }
 
 void pcg_atomic_cas(Parser* p, MemOrder succ, MemOrder fail) {
   const Type* ty = pcg_top2_type(p);
   if (pcg_emit_enabled(p)) {
     kit_cg_atomic_cmpxchg(p->cg, pcg_mem(p, ty), pcg_mem_order(succ),
                           pcg_mem_order(fail), 0);
   }
   pcg_drop_type(p); /* desired */
   pcg_drop_type(p); /* expected */
   pcg_drop_type(p); /* pointer */
   pcg_push_type(p, ty);
   pcg_push_type(p, type_prim(p->pool, TY_BOOL));
 }
 
 void pcg_fence(Parser* p, MemOrder ord) {
   if (pcg_emit_enabled(p)) kit_cg_atomic_fence(p->cg, pcg_mem_order(ord));
 }
 
 void pcg_intrinsic_unary_to_int(Parser* p, IntrinKind k) {
   KitCgIntrinsic ck = k == INTRIN_CLZ   ? KIT_CG_INTRIN_CLZ
                       : k == INTRIN_CTZ ? KIT_CG_INTRIN_CTZ
                                         : KIT_CG_INTRIN_POPCOUNT;
   const Type* ity = type_prim(p->pool, TY_INT);
   if (pcg_emit_enabled(p)) {
     kit_cg_intrinsic(p->cg, ck, 1, pcg_tid(p, ity));
   }
   pcg_retag_top(p, ity);
 }
 
 void pcg_intrinsic_void(Parser* p, IntrinKind k) {
   if (k == INTRIN_UNREACHABLE) {
     if (pcg_emit_enabled(p)) kit_cg_unreachable(p->cg);
   } else {
     if (pcg_emit_enabled(p)) {
       kit_cg_intrinsic(p->cg, KIT_CG_INTRIN_TRAP, 0,
                        kit_cg_type_builtin(p->c, KIT_CG_BUILTIN_VOID));
     }
   }
 }
 
 void pcg_syscall(Parser* p, u32 nargs, const Type* long_ty) {
   if (pcg_emit_enabled(p))
     kit_cg_intrinsic(p->cg, KIT_CG_INTRIN_SYSCALL, nargs, pcg_tid(p, long_ty));
   for (u32 i = 0; i < nargs; ++i) pcg_drop_type(p);
   pcg_push_type(p, long_ty);
 }
 
 /* __builtin_readcyclecounter(): read the target cycle/timestamp counter. No
  * operands; pushes an unsigned long long result. */
 void pcg_readcyclecounter(Parser* p) {
   const Type* ull = type_prim(p->pool, TY_ULLONG);
   if (pcg_emit_enabled(p))
     kit_cg_intrinsic(p->cg, KIT_CG_INTRIN_READCYCLECOUNTER, 0, pcg_tid(p, ull));
   pcg_push_type(p, ull);
 }
 
 /* __builtin_return_address(level) / __builtin_frame_address(level): emit the
  * frame-pointer-chain intrinsic. The constant level rides as a single immediate
  * operand (kept as OPK_IMM by kit_cg_intrinsic); the result is void*. */
 void pcg_frame_or_return_address(Parser* p, int is_return, u32 level) {
   const Type* void_ptr = type_ptr(p->pool, type_void(p->pool));
   KitCgIntrinsic intrin =
       is_return ? KIT_CG_INTRIN_RETURN_ADDRESS : KIT_CG_INTRIN_FRAME_ADDRESS;
   pcg_push_int(p, (i64)level, type_prim(p->pool, TY_INT));
   if (pcg_emit_enabled(p))
     kit_cg_intrinsic(p->cg, intrin, 1, pcg_tid(p, void_ptr));
   /* kit_cg_intrinsic popped the level operand and pushed the void* result;
    * retag the slot pcg_push_int added (also clears the level's value flags,
    * e.g. the null-pointer-constant tag set for level 0). */
   pcg_retag_top(p, void_ptr);
 }
 
 void pcg_inline_asm(Parser* p, const char* tmpl, const AsmConstraint* outs,
                     u32 nout, const AsmConstraint* ins, u32 nin,
                     const Sym* clobbers, u32 nclob) {
   KitCgInlineAsm a;
   KitCgAsmOperand* o = NULL;
   KitCgAsmOperand* in = NULL;
   KitSym* cl = NULL;
   memset(&a, 0, sizeof a);
   a.tmpl = kit_sym_intern(p->c, kit_slice_cstr(tmpl ? tmpl : ""));
   if (nout) {
     o = arena_zarray(p->pool->arena, KitCgAsmOperand, nout);
     for (u32 i = 0; i < nout; ++i) {
       o[i].constraint =
           kit_sym_intern(p->c, kit_slice_cstr(outs[i].str ? outs[i].str : ""));
       o[i].name = outs[i].name;
       o[i].type = pcg_tid(p, outs[i].type);
       o[i].reg = outs[i].reg;
       o[i].dir = KIT_CG_ASM_OUT;
     }
   }
   if (nin) {
     in = arena_zarray(p->pool->arena, KitCgAsmOperand, nin);
     for (u32 i = 0; i < nin; ++i) {
       in[i].constraint =
           kit_sym_intern(p->c, kit_slice_cstr(ins[i].str ? ins[i].str : ""));
       in[i].name = ins[i].name;
       in[i].type = pcg_tid(p, ins[i].type);
       in[i].reg = ins[i].reg;
       in[i].dir = (ins[i].dir == ASM_INOUT) ? KIT_CG_ASM_INOUT : KIT_CG_ASM_IN;
     }
   }
   if (nclob) {
     cl = arena_array(p->pool->arena, KitSym, nclob);
     for (u32 i = 0; i < nclob; ++i) cl[i] = clobbers[i];
   }
   a.outputs = o;
   a.noutputs = nout;
   a.inputs = in;
   a.ninputs = nin;
   a.clobbers = cl;
   a.nclobbers = nclob;
   if (pcg_emit_enabled(p)) kit_cg_inline_asm(p->cg, a);
   /* Mirror kit_cg_inline_asm's stack effect on the parser's typed shadow stack.
    */
   for (u32 i = 0; i < nin; ++i) pcg_drop_type(p);
   for (u32 i = 0; i < nout; ++i) pcg_push_type(p, outs[i].type);
 }