kit

pass_combine.c (104969B)

---

 #include <kit/cg.h>
 #include <stdint.h>
 #include <string.h>
 
 #include "cg/ir_eval.h"
 #include "core/arena.h"
 #include "opt/opt_internal.h"
 
 /* O1 combine, MIR-shaped (see mir-gen.c:8808-9146). One forward pass per BB
  * maintains last-def / last-mem-def tracking; per-BB fixpoint loop iterates
  * until no fold fires. Rewrites in this file:
  *
  *   1. Substitute producer source into consumer operand
  *      (IR_COPY / IR_LOAD_IMM / IR_CONVERT producer; into register slot,
  *       indirect base, or indirect index).
  *   2. Address-mode synthesis (IR_BINOP IADD/ISHL producer; into OPK_INDIRECT
  *       base/index/scale/ofs).
  *   3. Sink producer into single-use IR_COPY destination.
  *   4. combine_exts: fold ext-of-ext chains with size+signedness rules.
  *
  * Spill compaction (store-then-reload, etc.) and self-copy removal continue
  * to run in opt_combine_compact_block, unchanged. */
 
 /* ---- shared helpers (operand inspection / counting) ---- */
 
 static int same_reg_operand(const Operand* a, const Operand* b) {
   return a->kind == OPK_REG && b->kind == OPK_REG && a->cls == b->cls &&
          a->v.reg == b->v.reg;
 }
 
 static int producer_def_aliases_source(const Operand* def, const Operand* src) {
   return def && src && same_reg_operand(def, src);
 }
 
 static int frame_slot_is_spill(Func* f, FrameSlot fs) {
   if (fs == FRAME_SLOT_NONE || fs > f->nframe_slots) return 0;
   return f->frame_slots[fs - 1u].kind == FS_SPILL;
 }
 
 typedef enum SpillAccessKind {
   SPILL_ACCESS_NONE = 0,
   SPILL_ACCESS_LOAD,
   SPILL_ACCESS_STORE,
 } SpillAccessKind;
 
 typedef struct SpillAccess {
   SpillAccessKind kind;
   FrameSlot slot;
   u32 size;
   u16 addr_space;
   const Operand* value;
 } SpillAccess;
 
 /* W6 address-offset profitability gate: is `ofs` an offset the target can keep
  * inline in a load/store (so folding it into an indirect whose base producer
  * survives does not force an emit-time address build)? Conservatively keyed on
  * the target's NATIVE_IMM_ADDR_OFFSET legality. With no target oracle, treat
  * only a zero offset as safe. */
 static int combine_offset_fold_ok(NativeTarget* target, KitCgTypeId type,
                                   i64 ofs) {
   if (ofs == 0) return 1;
   if (!target || !target->imm_legal) return 0;
   return target->imm_legal(target, NATIVE_IMM_ADDR_OFFSET, 0, type, ofs);
 }
 
 /* Normalize location-MIR stack copies to the one spill-access vocabulary
  * consumed by compaction and stack DSE. Spill traffic exists only after
  * allocation and deliberately uses IR_COPY + OPK_STACK: recognizing semantic
  * IR_LOAD/IR_STORE + OPK_LOCAL here would collapse a spill value back into an
  * addressable source-language local and violate the HIR/MIR boundary. */
 static int direct_spill_access(Func* f, const Inst* in, SpillAccess* out) {
   SpillAccess access;
   const Operand* stack = NULL;
   memset(&access, 0, sizeof access);
   if (!f || !in || (IROp)in->op != IR_COPY || in->nopnds < 2u ||
       !in->opnds)
     return 0;
 
   if (in->opnds[0].kind == OPK_STACK &&
       in->opnds[1].kind != OPK_STACK) {
     access.kind = SPILL_ACCESS_STORE;
     stack = &in->opnds[0];
     access.value = &in->opnds[1];
   } else if (in->opnds[1].kind == OPK_STACK &&
              in->opnds[0].kind != OPK_STACK) {
     access.kind = SPILL_ACCESS_LOAD;
     stack = &in->opnds[1];
     access.value = &in->opnds[0];
   } else {
     return 0;
   }
 
   if (!frame_slot_is_spill(f, stack->v.frame_slot)) return 0;
   {
     u64 size = cg_type_size(f->c, stack->type);
     if (!size || size > UINT32_MAX) return 0;
     access.slot = stack->v.frame_slot;
     access.size = (u32)size;
   }
   access.addr_space = 0u;
 
   if (!access.size || access.slot == FRAME_SLOT_NONE || !access.value)
     return 0;
   if (out) *out = access;
   return 1;
 }
 
 static int same_spill_shape(const SpillAccess* a, const SpillAccess* b) {
   return a && b && a->slot == b->slot && a->size == b->size &&
          a->addr_space == b->addr_space;
 }
 
 static int same_phys_reg(const Operand* a, const Operand* b) {
   return a && b && a->kind == OPK_REG && b->kind == OPK_REG &&
          a->cls == b->cls && a->v.reg == b->v.reg;
 }
 
 static int operand_uses_phys_reg(const Operand* op, const Operand* r) {
   if (!op || !r || r->kind != OPK_REG) return 0;
   if (op->kind == OPK_REG)
     return op->cls == r->cls && op->v.reg == r->v.reg ? 1 : 0;
   if (op->kind == OPK_INDIRECT) {
     if (r->cls != RC_INT) return 0;
     return (op->v.ind.base_kind == OPT_INDIRECT_REG &&
             op->v.ind.base == r->v.reg) ||
            (op->v.ind.index_kind == OPT_INDIRECT_REG &&
             op->v.ind.index != (Reg)REG_NONE &&
             op->v.ind.index == r->v.reg);
   }
   return 0;
 }
 
 typedef struct CombinePhysRegEffect {
   u8 uses;
   u8 defines;
   u8 clobbers;
 } CombinePhysRegEffect;
 
 static CombinePhysRegEffect inst_phys_reg_effect(Func* f, const Inst* in,
                                                  const Operand* reg) {
   OptRegEffects effects;
   CombinePhysRegEffect result = {0};
   if (!reg || reg->kind != OPK_REG || reg->cls >= OPT_REG_CLASSES ||
       reg->v.reg >= OPT_MAX_HARD_REGS)
     return result;
   opt_inst_reg_effects(f, in, &effects);
   result.uses = effects.use_count[reg->cls][reg->v.reg];
   result.defines =
       (u8)((effects.defs.cls[reg->cls] & (1u << reg->v.reg)) != 0u);
   result.clobbers =
       (u8)((effects.clobbers.cls[reg->cls] & (1u << reg->v.reg)) != 0u);
   return result;
 }
 
 static int hard_set_has_reg(const OptHardRegSet* set, const Operand* reg) {
   if (!set || !reg || reg->kind != OPK_REG ||
       reg->cls >= OPT_REG_CLASSES || reg->v.reg >= OPT_MAX_HARD_REGS)
     return 0;
   return (set->cls[reg->cls] & (1u << reg->v.reg)) != 0;
 }
 
 static int inst_kills_phys_reg(Func* f, const Inst* in, const Operand* reg) {
   OptHardRegSet kills;
   opt_inst_reg_kills(f, in, &kills);
   return hard_set_has_reg(&kills, reg);
 }
 
 /* True if `in` may write to memory. Used to invalidate memory-reading
  * producers (IR_LOAD) when the consumer is past an intervening write. */
 static int inst_writes_memory(const Inst* in) {
   switch ((IROp)in->op) {
     case IR_COPY:
       return in->nopnds >= 1u && in->opnds &&
              in->opnds[0].kind == OPK_STACK;
     case IR_STORE:
     case IR_AGG_COPY:
     case IR_AGG_SET:
     case IR_BITFIELD_STORE:
     case IR_ATOMIC_STORE:
     case IR_ATOMIC_RMW:
     case IR_ATOMIC_CAS:
     case IR_CALL:
     case IR_ASM_BLOCK:
     case IR_INTRINSIC:
       return 1;
     default:
       return 0;
   }
 }
 
 static int inst_reads_memory(const Inst* in) {
   switch ((IROp)in->op) {
     case IR_COPY:
       return in->nopnds >= 2u && in->opnds &&
              in->opnds[1].kind == OPK_STACK;
     case IR_LOAD:
     case IR_BITFIELD_LOAD:
     case IR_ATOMIC_LOAD:
       return 1;
     default:
       return 0;
   }
 }
 
 /* ---- substitution-slot whitelist (operand positions that accept a register
  * substitute, an immediate substitute, or are valid for ext-of-ext folding)
  * ---- */
 
 typedef enum SubstKind {
   SK_REG, /* register-to-register (IR_COPY producer) */
   SK_IMM, /* register-to-immediate (IR_LOAD_IMM producer) */
   SK_CV,  /* register-to-register through identical convert (IR_CONVERT prod) */
 } SubstKind;
 
 /* Returns 1 if the given operand-index `idx` of `in` is foldable for `kind`.
  * SK_REG / SK_CV: register substitution slots. SK_IMM: immediate substitution
  * slots. */
 static int combine_subst_slot(const Inst* in, u32 idx, SubstKind kind,
                               int copy_imm_ok) {
   switch ((IROp)in->op) {
     case IR_COPY:
       /* Normally IR_COPY stays register-to-register so that, after coalescing
        * assigns src and dst the same hard reg, it becomes a self-copy combine
        * removes. The O1 path never coalesces, so folding the immediate
        * (copy_imm_ok) collapses `load_imm rT,k; copy rD,rT` into `copy rD,#k`,
        * which the emit path turns into a single `load_imm rD,k`. */
       return (kind != SK_IMM || copy_imm_ok) && idx == 1;
     case IR_UNOP:
       return kind != SK_IMM && idx == 1;
     case IR_CONVERT:
       return kind != SK_IMM && idx == 1;
     case IR_BINOP:
     case IR_CMP:
       return idx == 1 || idx == 2;
     case IR_CMP_BRANCH:
       return idx == 0 || idx == 1;
     case IR_CONDBR:
       return kind != SK_IMM && idx == 0;
     case IR_STORE:
       /* opnds[0] is the address; register subst into the indirect base/index
        * is handled separately. The data slot at idx==1 accepts reg or imm. */
       return idx == 1;
     case IR_LOAD:
     case IR_ATOMIC_LOAD:
     case IR_ATOMIC_RMW:
     case IR_BITFIELD_LOAD:
     case IR_BITFIELD_STORE:
     case IR_AGG_COPY:
     case IR_AGG_SET:
       /* OPK_INDIRECT base/index substitution is handled inside
        * subst_consumer_operands; these slots take no direct OPK_REG. */
       return 0;
     case IR_ALLOCA:
       return kind != SK_IMM && idx == 1;
     default:
       return 0;
   }
 }
 
 /* ---- per-BB tracking context ---- */
 
 /* W1a (O1.md): local frame-address `sub`-CSE. A bounded ring of the most
  * recently produced frame-/global-address values in this BB so a back-to-back
  * `IR_ADDR_OF rD, <same addr>` recompute (which lowers to a re-`sub xN,x29,#k`
  * frame build, or an `adrp;add`/GOT global build) can be rewritten to an
  * `IR_COPY` off the still-live earlier producer. Bounded slot count keeps the
  * scan O(1) per inst → the pass stays linear. */
 enum { COMBINE_ADDR_CSE_SLOTS = 8 };
 
 typedef struct AddrCseEntry {
   i32 inst_idx;      /* producing IR_ADDR_OF index in this BB, -1 if empty */
   Operand dst;       /* the produced address register (OPK_REG) */
   Operand addr;      /* the address operand (OPK_LOCAL / OPK_GLOBAL) */
 } AddrCseEntry;
 
 /* W5 (O1.md): local (same-block) redundant-load + pure-compute CSE. Two small
  * most-recent-wins rings:
  *
  *  - LOAD ring: the most-recently-loaded `{address, result, MemAccess}` and
  *    the register that received the value. A later plain (non-observable,
  *    non-bit-field) IR_LOAD of the IDENTICAL semantic shape, with the producer
  *    register still live and NO intervening memory write, is rewritten to an
  *    IR_COPY off the producer. Aliasing is the whole game: ANY memory write
  *    (inst_writes_memory: store/aggregate/atomic/call/asm/intrinsic) forgets
  *    the entire load ring in O(1), so a may-aliasing store between the two
  *    loads always preserves the reload. Volatile/atomic loads
  *    (opt_mem_observable) are never recorded or reused.
  *
  *  - COMPUTE ring: the most-recent pure IR_BINOP/IR_UNOP `{op, mode, result,
  *    operands}` and its destination register. A later identical pure compute
  *    whose inputs are unchanged since (and whose producer is still live) is
  *    rewritten to an IR_COPY off the producer. Pure computes touch no memory,
  *    so only register redefinitions/clobbers invalidate them (tracked via
  *    ctx->last_def, which a clobber barrier bumps for every register).
  *
  * Both rings are bounded → O(1) per inst → the pass stays linear. Each rewrite
  * is the broader, map-based same-block form distinct from the adjacent
  * store/load pairs opt_combine_compact_block already coalesces. */
 enum { COMBINE_LOAD_CSE_SLOTS = 8 };
 enum { COMBINE_COMPUTE_CSE_SLOTS = 8 };
 
 typedef struct LoadCseEntry {
   i32 inst_idx;  /* producing IR_LOAD index in this BB, -1 if empty */
   Operand dst;   /* the register that received the loaded value (OPK_REG) */
   Operand addr;  /* the load's address operand (OPK_INDIRECT/LOCAL/GLOBAL) */
   KitCgTypeId result_type;
   MemAccess mem;
 } LoadCseEntry;
 
 typedef struct ComputeCseEntry {
   i32 inst_idx; /* producing IR_BINOP/IR_UNOP index in this BB, -1 if empty */
   Operand dst;  /* the result register (OPK_REG) */
   u16 op;       /* IROp (IR_BINOP / IR_UNOP) */
   u16 flags;    /* per-instruction semantic mode */
   KitCgTypeId result_type;
   i64 sub;      /* extra.imm = BinOp/UnOp selector */
   Operand a;    /* operand 1 */
   Operand b;    /* operand 2 (kind == 0 sentinel for a unary compute) */
 } ComputeCseEntry;
 
 typedef struct CombineCtx {
   Func* f;
   Block* bl;
   NativeTarget* target; /* W6 immediate-legality oracle (may be NULL) */
   const OptHardBlockLive* hard_live;
   /* Index of the most recent inst in this BB that defined (cls, reg);
    * -1 means no definition seen this BB. */
   i32 last_def[OPT_REG_CLASSES][OPT_MAX_HARD_REGS];
   i32 last_mem_def;
   /* W1a addr-of CSE ring (most-recent-wins). */
   AddrCseEntry addr_cse[COMBINE_ADDR_CSE_SLOTS];
   u32 addr_cse_next;
   /* W5 local same-block load + pure-compute CSE rings (most-recent-wins). */
   LoadCseEntry load_cse[COMBINE_LOAD_CSE_SLOTS];
   u32 load_cse_next;
   ComputeCseEntry compute_cse[COMBINE_COMPUTE_CSE_SLOTS];
   u32 compute_cse_next;
   /* W6 cmp-immediate tracking: the constant currently held by each integer
    * hard register, if known. const_valid is a per-RC_INT-reg bit set when a
    * reaching IR_LOAD_IMM defined that register and nothing since has redefined
    * or clobbered it (incl. call/asm/machine clobbers, tracked precisely via
    * opt_inst_reg_effects). Lets a `cmp wN, wM` whose wM holds a small constant
    * fold to `cmp wN, #k`, even across a call that preserves wM (a callee-saved
    * reg). Integer-only: cmp immediates are integer. */
   i64 const_val[OPT_MAX_HARD_REGS];
   u32 const_valid;
   int block_change_p;
 } CombineCtx;
 
 static void ctx_reset(CombineCtx* ctx) {
   memset(ctx->last_def, 0xff, sizeof ctx->last_def); /* all -1 */
   ctx->last_mem_def = -1;
   for (u32 k = 0; k < COMBINE_ADDR_CSE_SLOTS; ++k)
     ctx->addr_cse[k].inst_idx = -1;
   ctx->addr_cse_next = 0;
   for (u32 k = 0; k < COMBINE_LOAD_CSE_SLOTS; ++k)
     ctx->load_cse[k].inst_idx = -1;
   ctx->load_cse_next = 0;
   for (u32 k = 0; k < COMBINE_COMPUTE_CSE_SLOTS; ++k)
     ctx->compute_cse[k].inst_idx = -1;
   ctx->compute_cse_next = 0;
   ctx->const_valid = 0;
   ctx->block_change_p = 0;
 }
 
 static void ctx_record_mask(CombineCtx* ctx, u8 cls, u32 mask, i32 i) {
   if (cls >= OPT_REG_CLASSES) return;
   while (mask) {
     Reg r = (Reg)__builtin_ctz(mask);
     ctx->last_def[cls][r] = i;
     mask &= mask - 1u;
   }
 }
 
 /* Record the canonical explicit definitions and implicit clobbers after one
  * instruction. Calls and asm no longer erase every producer: only the ABI or
  * target-declared registers are invalidated. The driver shares this instruction
  * effect with constant tracking, so the hot forward walk scans operands once. */
 static void ctx_record(CombineCtx* ctx, const Inst* in,
                        const OptHardRegSet* kills, i32 i) {
   if (inst_writes_memory(in)) ctx->last_mem_def = i;
   for (u32 cls = 0; cls < OPT_REG_CLASSES; ++cls)
     ctx_record_mask(ctx, (u8)cls, kills->cls[cls], i);
 }
 
 /* Lookup the producer of (cls, reg) in this BB, if any. Returns -1 if no
  * definer has been seen yet in this BB. */
 static i32 ctx_producer_of(const CombineCtx* ctx, u8 cls, Reg reg) {
   if (reg >= OPT_MAX_HARD_REGS || cls >= OPT_REG_CLASSES) return -1;
   return ctx->last_def[cls][reg];
 }
 
 /* Does (cls, reg) get redefined strictly after `since_idx` (exclusive) in this
  * BB, given current ctx state? We use last_def: if last_def[cls][reg] >
  * since_idx, then yes. (since_idx is typically the producer's index.) */
 static int ctx_def_changed_since(const CombineCtx* ctx, u8 cls, Reg reg,
                                  i32 since_idx) {
   if (reg >= OPT_MAX_HARD_REGS || cls >= OPT_REG_CLASSES) return 0;
   return ctx->last_def[cls][reg] > since_idx;
 }
 
 static i32 ctx_prev_def_before(const CombineCtx* ctx, const Operand* reg,
                                i32 before_idx) {
   if (!reg || reg->kind != OPK_REG) return -1;
   for (i32 j = before_idx - 1; j >= 0; --j) {
     const Inst* prev = &ctx->bl->insts[j];
     if (inst_kills_phys_reg(ctx->f, prev, reg)) return j;
   }
   return -1;
 }
 
 static void ctx_restore_removed_def(CombineCtx* ctx, const Operand* reg,
                                     i32 removed_idx) {
   if (!reg || reg->kind != OPK_REG) return;
   if (reg->cls >= OPT_REG_CLASSES || reg->v.reg >= OPT_MAX_HARD_REGS) return;
   if (ctx->last_def[reg->cls][reg->v.reg] == removed_idx)
     ctx->last_def[reg->cls][reg->v.reg] =
         ctx_prev_def_before(ctx, reg, removed_idx);
 }
 
 /* ---- forward-scan use accounting (used for single-use checks) ---- */
 
 /* Count phys uses of `def` within the live range starting just after
  * `prod_idx`. The live range ends at the first inst that redefines `def`'s
  * physical register or that is a clobber barrier (CALL/ASM/INTRINSIC); uses
  * after that point belong to a different live range of the same physreg and
  * are irrelevant to this producer.
  *
  * `*killed_in_block_out` is set non-zero when the live range terminates
  * inside the block (caller may then skip the cross-block live-out check).
  *
  * Without this live-range scoping, reuse of a scratch physreg later in the
  * block (`sxtw x12, ...; mov x13, x12; mov x12, ...`) makes every fold look
  * multi-use and combine rejects almost everything. */
 static int count_uses_in_live_range(Func* f, const Block* bl, i32 prod_idx,
                                     const Operand* def,
                                     int* killed_in_block_out) {
   int n = 0;
   int killed = 0;
   for (i32 i = prod_idx + 1; i < (i32)bl->ninsts; ++i) {
     const Inst* in = &bl->insts[i];
     CombinePhysRegEffect effect = inst_phys_reg_effect(f, in, def);
     n += effect.uses;
     if (effect.defines || effect.clobbers) {
       killed = 1;
       break;
     }
   }
   if (killed_in_block_out) *killed_in_block_out = killed;
   return n;
 }
 
 static int use_after_clobber_before_redef(Func* f, const Block* bl,
                                           i32 prod_idx, const Operand* def) {
   int saw_clobber = 0;
   for (i32 i = prod_idx + 1; i < (i32)bl->ninsts; ++i) {
     const Inst* in = &bl->insts[i];
     CombinePhysRegEffect effect = inst_phys_reg_effect(f, in, def);
     if (saw_clobber && effect.uses) return 1;
     if (effect.defines) return 0;
     if (effect.clobbers) saw_clobber = 1;
   }
   return 0;
 }
 
 /* ---- ConvKind helpers (for combine_exts) ---- */
 
 static u32 builtin_int_bytes(KitCgTypeId t) {
   KitCgBuiltinType b;
   if (t == KIT_CG_TYPE_NONE || t > (KitCgTypeId)KIT_CG_BUILTIN_COUNT) return 0;
   b = (KitCgBuiltinType)(t - 1u);
   switch (b) {
     case KIT_CG_BUILTIN_BOOL:
     case KIT_CG_BUILTIN_I8:
       return 1;
     case KIT_CG_BUILTIN_I16:
       return 2;
     case KIT_CG_BUILTIN_I32:
       return 4;
     case KIT_CG_BUILTIN_I64:
       return 8;
     case KIT_CG_BUILTIN_I128:
       return 16;
     default:
       return 0;
   }
 }
 
 /* For an IR_CONVERT inst, decode (src_bytes, dst_bytes, sign_p). Returns 0
  * if this isn't an integer ext convert (CV_SEXT or CV_ZEXT). */
 static int ext_params(const Inst* in, u32* src_bytes_out, u32* dst_bytes_out,
                       int* sign_p_out) {
   if ((IROp)in->op != IR_CONVERT || in->nopnds < 2) return 0;
   ConvKind k = (ConvKind)in->extra.imm;
   if (k != CV_SEXT && k != CV_ZEXT) return 0;
   u32 sb = builtin_int_bytes(in->opnds[1].type);
   u32 db = builtin_int_bytes(in->opnds[0].type);
   if (!sb || !db || db < sb) return 0;
   *src_bytes_out = sb;
   *dst_bytes_out = db;
   *sign_p_out = (k == CV_SEXT);
   return 1;
 }
 
 /* Width in bytes of a scalar integer or pointer type (1..8), else 0. Mirrors
  * pass_simplify's simplify_width: builtin ints decode without the compiler,
  * pointers fall back to the type-size query. */
 static u32 combine_scalar_width_bytes(Func* f, KitCgTypeId t) {
   u32 b = builtin_int_bytes(t);
   if (b) return b > 8u ? 0u : b;
   if (f->c && kit_cg_type_kind((KitCompiler*)f->c, t) == KIT_CG_TYPE_PTR) {
     u64 sz = kit_cg_type_size((KitCompiler*)f->c, t);
     if (sz && sz <= 8u) return (u32)sz;
   }
   return 0;
 }
 
 /* Compute the constant produced by applying an integer/pointer convert `k`
  * (src width `sb`, dst width `db`, both BYTES) to immediate `imm`. Returns 0
  * for kinds that aren't a bit-preserving integer/pointer move (the float
  * conversions reinterpret the value and must not be folded this way). The
  * materialized-constant model: a load_imm puts (u64)imm into a register, so a
  * widening move/zext keeps the low `sb` bits and a trunc/narrowing keeps the
  * low `db` bits.
  *
  * The arithmetic is the shared cg/ir_eval convert core (in BITS); combine's
  * byte widths convert at the boundary. combine's BITCAST is the bit-preserving
  * register move (== ZEXT here, no equal-width requirement), so it maps to
  * CV_ZEXT rather than the shared eval's stricter equal-width BITCAST. */
 static int const_convert_value(ConvKind k, i64 imm, u32 sb, u32 db, i64* out) {
   if (!sb || !db) return 0;
   if (k == CV_BITCAST) k = CV_ZEXT;
   return kit_ir_eval_convert(k, sb * 8u, db * 8u, imm, out);
 }
 
 /* ---- producer-retarget legality (for sink rewrite) ---- */
 
 /* combine retargets the destination of a commutative producer, so it includes
  * the FP commutatives (FADD/FMUL) on top of the shared integer set. */
 static int binop_is_commutative(BinOp op) {
   return kit_ir_binop_is_commutative_int(op) || op == BO_FADD || op == BO_FMUL;
 }
 
 /* Is `producer` an op whose destination register can be safely retargeted
  * without backend consultation? Excludes ops with implicit destination
  * constraints, ABI pinning, multi-def outputs, or aux-driven dst layout. */
 static int producer_retargetable_op(IROp op) {
   switch (op) {
     case IR_BINOP:
     case IR_UNOP:
     case IR_LOAD_IMM:
     case IR_LOAD_CONST:
     case IR_LOAD:
     case IR_CONVERT:
     case IR_CMP:
     case IR_ADDR_OF:
     case IR_LOAD_LABEL_ADDR:
       return 1;
     default:
       return 0;
   }
 }
 
 /* Can `producer`'s destination be retargeted to `new_dst` without violating
  * IR shape? For binop, may signal that a commutative-swap is needed. */
 static int retarget_producer_legal(Inst* producer, const Operand* new_dst,
                                    int* swap_binop) {
   *swap_binop = 0;
   if (!new_dst || new_dst->kind != OPK_REG) return 0;
   if (producer->nopnds < 1 || producer->opnds[0].kind != OPK_REG) return 0;
   if (producer->opnds[0].cls != new_dst->cls) return 0;
   if (producer->opnds[0].type != new_dst->type) return 0;
 
   switch ((IROp)producer->op) {
     case IR_LOAD_IMM:
     case IR_LOAD_CONST:
     case IR_LOAD_LABEL_ADDR:
     case IR_ADDR_OF:
       /* Single-defining ops with no register source to alias against. */
       return 1;
     case IR_UNOP:
     case IR_CONVERT:
     case IR_LOAD:
       return 1;
     case IR_CMP:
       return 1;
     case IR_BINOP: {
       if (producer->nopnds < 3) return 0;
       int dst_is_lhs = operand_uses_phys_reg(&producer->opnds[1], new_dst);
       int dst_is_rhs = operand_uses_phys_reg(&producer->opnds[2], new_dst);
       if (!dst_is_lhs && !dst_is_rhs) return 1;
       if (dst_is_lhs) return 1;
       if (binop_is_commutative((BinOp)producer->extra.imm)) {
         *swap_binop = 1;
         return 1;
       }
       return 0;
     }
     default:
       return 0;
   }
 }
 
 static int first_return_reg(Func* f, u8 cls, Reg* out) {
   if (!f || cls >= OPT_REG_CLASSES) return 0;
   u32 mask = f->opt_ret_regs[cls];
   for (Reg r = 0; r < 32; ++r) {
     if (mask & (1u << r)) {
       *out = r;
       return 1;
     }
   }
   return 0;
 }
 
 static int reg_is_emit_temp(Func* f, u8 cls, Reg reg) {
   if (!f || cls >= OPT_REG_CLASSES || reg >= OPT_MAX_HARD_REGS) return 0;
   for (u32 i = 0; i < f->emit_temp_reg_count[cls]; ++i)
     if (f->emit_temp_regs[cls][i] == reg) return 1;
   return 0;
 }
 
 static int ret_scalar_storage(CGABIValue* v, Operand** out) {
   if (!v || v->storage.kind != OPK_REG) return 0;
   if (v->nparts > 1) return 0;
   *out = &v->storage;
   return 1;
 }
 
 /* ---- Rewrite 1: substitute producer source into uses ---- */
 
 /* Retarget a direct register use through a physical copy.  The register is a
  * location; the rest of the operand belongs to the consumer and describes how
  * that location is interpreted there.  In particular, same-register-class
  * conversions can become IR_COPY, so replacing the whole operand can narrow a
  * compare or ABI move.  It would also discard consumer riders such as `shift`.
  */
 static int retarget_reg_use(Operand* use, const Operand* def,
                             const Operand* src) {
   if (!use || !def || !src || use->kind != OPK_REG ||
       src->kind != OPK_REG || !same_phys_reg(use, def) ||
       use->cls != src->cls)
     return 0;
   use->v.reg = src->v.reg;
   return 1;
 }
 
 /* Substitute a register-valued address component without confusing a MIR
  * frame-slot id for a hard-register number.  Only physical identity follows a
  * copy: the component type belongs to the use and records how those bits are
  * interpreted there.  This matters when a same-width conversion became a
  * copy (pointer source consumed as an integer ptrdiff index, for example). */
 static int set_indirect_reg(Operand* ind, Reg old_reg, const Operand* src) {
   int n = 0;
   if (!ind || !src || src->kind != OPK_REG) return 0;
   if (ind->v.ind.base_kind == OPT_INDIRECT_REG &&
       ind->v.ind.base == old_reg) {
     ind->v.ind.base = src->v.reg;
     ++n;
   }
   if (ind->v.ind.index_kind == OPT_INDIRECT_REG &&
       ind->v.ind.index != (Reg)REG_NONE &&
       ind->v.ind.index == old_reg) {
     ind->v.ind.index = src->v.reg;
     ++n;
   }
   return n;
 }
 
 /* Substitute `def` -> `src` in a single aux register slot (no slot-index
  * whitelist; caller has already restricted to SK_REG and ensured src is a
  * register). Returns 1 if rewritten. */
 static int subst_one_aux_operand(Operand* op, const Operand* def,
                                  const Operand* src) {
   if (retarget_reg_use(op, def, src)) return 1;
   if (op->kind == OPK_INDIRECT && src->kind == OPK_REG && def->cls == RC_INT &&
       src->cls == RC_INT)
     return set_indirect_reg(op, def->v.reg, src) != 0;
   return 0;
 }
 
 static int subst_abivalue_uses(CGABIValue* v, const Operand* def,
                                const Operand* src) {
   int n = 0;
   n += subst_one_aux_operand(&v->storage, def, src);
   for (u32 i = 0; i < v->nparts; ++i)
     n += subst_one_aux_operand((Operand*)&v->parts[i].op, def, src);
   return n;
 }
 
 /* Walk the operands of consumer `in` and try to substitute uses of `def`
  * (producer's destination, OPK_REG) with `src` (producer's source, OPK_REG
  * or OPK_IMM). For OPK_INDIRECT operands, substitution into base/index is
  * only valid for OPK_REG `src`. Returns the number of operands actually
  * rewritten. */
 static int subst_consumer_operands(Inst* in, const Operand* def,
                                    const Operand* src, SubstKind kind,
                                    int copy_imm_ok) {
   int n = 0;
   for (u32 oi = 0; oi < in->nopnds; ++oi) {
     Operand* op = &in->opnds[oi];
     /* Direct OPK_REG substitution: requires the slot to be on the whitelist. */
     if (op->kind == OPK_REG && same_phys_reg(op, def) &&
         combine_subst_slot(in, oi, kind, copy_imm_ok)) {
       if (kind == SK_REG) {
         if (retarget_reg_use(op, def, src)) {
           ++n;
           continue;
         }
       } else {
         *op = *src;
         ++n;
         continue;
       }
     }
     /* Indirect base/index substitution: only OPK_REG src may land here. The
      * substitution only changes which register computes the address, not the
      * value being stored — safe for IR_STORE / IR_ATOMIC_STORE /
      * IR_BITFIELD_STORE / IR_AGG_COPY / IR_AGG_SET as well. */
     if (op->kind == OPK_INDIRECT && kind == SK_REG && src->kind == OPK_REG &&
         def->kind == OPK_REG && def->cls == RC_INT && src->cls == RC_INT)
       n += set_indirect_reg(op, def->v.reg, src);
   }
 
   /* Aux register uses: IR_CALL plan/desc args + callee. SK_REG only —
    * substituting an immediate or convert into an ABI-bound use would break
    * the call lowering. IR_RET is intentionally excluded: the return register
    * is live-out by ABI, so a producer copying into it stays alive even after
    * substituting val.storage, and emit_ret would emit a redundant second
    * move. */
   if (kind == SK_REG) {
     if ((IROp)in->op == IR_CALL) {
       IRCallAux* aux = (IRCallAux*)in->extra.aux;
       if (aux) {
         if (aux->use_plan_replay) {
           n += subst_one_aux_operand(&aux->plan.callee, def, src);
           for (u32 k = 0; k < aux->plan.nargs; ++k)
             n += subst_one_aux_operand(&aux->plan.args[k].src, def, src);
         } else {
           n += subst_one_aux_operand(&aux->desc.callee, def, src);
           for (u32 k = 0; k < aux->desc.nargs; ++k)
             n += subst_abivalue_uses((CGABIValue*)&aux->desc.args[k], def, src);
         }
       }
     }
   }
   return n;
 }
 
 /* Try to substitute the producer of (cls, reg) into uses of that register
  * in `in`. Returns 1 if at least one operand was rewritten. */
 static int try_substitute_for_reg(CombineCtx* ctx, Inst* in, i32 i, u8 cls,
                                   Reg reg) {
   i32 prod_idx = ctx_producer_of(ctx, cls, reg);
   if (prod_idx < 0 || prod_idx >= i) return 0;
   Inst* prod = &ctx->bl->insts[prod_idx];
   IROp pop = (IROp)prod->op;
   if (pop != IR_COPY && pop != IR_LOAD_IMM && pop != IR_CONVERT) return 0;
   if (prod->nopnds < 1 || prod->opnds[0].kind != OPK_REG) return 0;
   if (prod->opnds[0].cls != cls || prod->opnds[0].v.reg != reg) return 0;
 
   Operand def = prod->opnds[0];
   SubstKind kind;
   Operand src_op;
   memset(&src_op, 0, sizeof src_op);
   if (pop == IR_COPY) {
     if (prod->nopnds < 2 || prod->opnds[1].kind != OPK_REG) return 0;
     if (ctx_def_changed_since(ctx, prod->opnds[1].cls, prod->opnds[1].v.reg,
                               prod_idx))
       return 0;
     kind = SK_REG;
     src_op = prod->opnds[1];
   } else if (pop == IR_LOAD_IMM) {
     kind = SK_IMM;
     src_op.kind = OPK_IMM;
     src_op.cls = def.cls;
     src_op.type = def.type;
     src_op.v.imm = prod->extra.imm;
   } else { /* IR_CONVERT */
     if (prod->nopnds < 2 || prod->opnds[1].kind != OPK_REG) return 0;
     /* Fold only when consumer is also a convert with matching shape (the
      * broader ext-of-ext rules run in try_combine_exts). */
     if ((IROp)in->op != IR_CONVERT) return 0;
     if (in->nopnds < 2 || in->opnds[1].kind != OPK_REG) return 0;
     if (in->extra.imm != prod->extra.imm) return 0;
     if (in->opnds[1].type != prod->opnds[0].type) return 0;
     if (in->opnds[0].type != prod->opnds[0].type) return 0;
     if (ctx_def_changed_since(ctx, prod->opnds[1].cls, prod->opnds[1].v.reg,
                               prod_idx))
       return 0;
     kind = SK_CV;
     src_op = prod->opnds[1];
   }
 
   /* For a register-source IR_COPY this is local copy propagation: rewriting
    * one use of the copy's dest to its source is value-safe whenever the source
    * is unchanged between the copy and this consumer — already verified by the
    * ctx_def_changed_since check above (which treats CALL/ASM/INTRINSIC as a
    * clobber of every register). The copy itself is not removed here; if all its
    * uses fold away and it is not live-out, post-combine DCE deletes it. So no
    * single-use or cross-block live-out restriction is required, which lets the
    * O1 path collapse the multi-use reg->reg copy chains it would otherwise
    * leave behind (it never runs the O2 coalescer).
    *
    * The immediate / convert producers don't propagate a register value, so
    * they keep the stricter single-use + live-out gate: substituting them into
    * every use would duplicate a (possibly multi-instruction) materialization
    * rather than shorten a copy chain. */
   if (kind != SK_REG) {
     int killed = 0;
     int uses_total =
         count_uses_in_live_range(ctx->f, ctx->bl, prod_idx, &def, &killed);
     if (uses_total != 1) return 0;
     if (!killed && opt_block_live_out_has_phys_reg(ctx->f, ctx->hard_live,
                                                    ctx->bl->id, &def))
       return 0;
   }
 
   /* O1 (no coalescing) folds immediates into IR_COPY; O2 leaves the copy
    * register-to-register so coalescing + self-copy removal handles it. */
   int copy_imm_ok =
       ctx->f && (ctx->f->opt_o1_coalescing || !ctx->f->opt_coalesce_parent);
   int n = subst_consumer_operands(in, &def, &src_op, kind, copy_imm_ok);
   if (n > 0) {
     ctx->block_change_p = 1;
     return 1;
   }
   return 0;
 }
 
 /* Mark (cls, reg) as already-attempted for this consumer so the same producer
  * is not looked up twice when a register appears in multiple operand slots
  * (e.g. `[r4 + r4*4]`, or `add r1, r4, r4`). */
 static int seen_mark(u32 seen[OPT_REG_CLASSES], u8 cls, Reg reg) {
   if (cls >= OPT_REG_CLASSES || reg >= 32) return 1;
   u32 bit = 1u << reg;
   if (seen[cls] & bit) return 1;
   seen[cls] |= bit;
   return 0;
 }
 
 static void try_substitute_aux_operand(CombineCtx* ctx, Inst* in, i32 i,
                                        const Operand* op,
                                        u32 seen[OPT_REG_CLASSES], int* any) {
   if (op->kind == OPK_REG) {
     if (!seen_mark(seen, op->cls, op->v.reg))
       *any |= try_substitute_for_reg(ctx, in, i, op->cls, op->v.reg);
   } else if (op->kind == OPK_INDIRECT) {
     if (op->v.ind.base_kind == OPT_INDIRECT_REG &&
         op->v.ind.base != (Reg)REG_NONE &&
         !seen_mark(seen, RC_INT, op->v.ind.base))
       *any |= try_substitute_for_reg(ctx, in, i, RC_INT, op->v.ind.base);
     if (op->v.ind.index_kind == OPT_INDIRECT_REG &&
         op->v.ind.index != (Reg)REG_NONE &&
         !seen_mark(seen, RC_INT, op->v.ind.index))
       *any |= try_substitute_for_reg(ctx, in, i, RC_INT, op->v.ind.index);
   }
 }
 
 static void try_substitute_aux_abivalue(CombineCtx* ctx, Inst* in, i32 i,
                                         const CGABIValue* v,
                                         u32 seen[OPT_REG_CLASSES], int* any) {
   try_substitute_aux_operand(ctx, in, i, &v->storage, seen, any);
   for (u32 k = 0; k < v->nparts; ++k)
     try_substitute_aux_operand(ctx, in, i, &v->parts[k].op, seen, any);
 }
 
 /* Try to substitute producers into operand slots of `in`. Walks the direct
  * operands of `in` and looks up only the producers of registers actually
  * referenced (typically 2-3 per inst). Also walks IR_CALL aux register uses
  * (args + callee) so reg->reg copies feeding call args or the callee get
  * propagated. See subst_consumer_operands for why IR_RET is excluded. */
 static int try_substitute(CombineCtx* ctx, Inst* in, i32 i) {
   int any = 0;
   u32 seen[OPT_REG_CLASSES] = {0};
   for (u32 oi = 0; oi < in->nopnds; ++oi) {
     const Operand* op = &in->opnds[oi];
     try_substitute_aux_operand(ctx, in, i, op, seen, &any);
   }
   if ((IROp)in->op == IR_CALL) {
     IRCallAux* aux = (IRCallAux*)in->extra.aux;
     if (aux) {
       if (aux->use_plan_replay) {
         try_substitute_aux_operand(ctx, in, i, &aux->plan.callee, seen, &any);
         for (u32 k = 0; k < aux->plan.nargs; ++k)
           try_substitute_aux_operand(ctx, in, i, &aux->plan.args[k].src, seen,
                                      &any);
       } else {
         try_substitute_aux_operand(ctx, in, i, &aux->desc.callee, seen, &any);
         for (u32 k = 0; k < aux->desc.nargs; ++k)
           try_substitute_aux_abivalue(
               ctx, in, i, (const CGABIValue*)&aux->desc.args[k], seen, &any);
       }
     }
   }
   return any;
 }
 
 /* ---- Rewrite 2: address-mode synthesis ---- */
 
 /* Try to fold add/shl producers into one OPK_INDIRECT operand of `in`. */
 static int try_addr_synth_one_op(CombineCtx* ctx, Inst* in, i32 i,
                                  Operand* op) {
   (void)in;
   if (op->kind != OPK_INDIRECT) return 0;
   int any = 0;
 
   /* (a/c) base producer is IR_BINOP IADD. reg+reg synthesizes a base+index
    * pair (requires no existing index, sub-rule a); reg+imm folds the immediate
    * into ofs (sub-rule c, ok with or without an existing index). */
   if (op->v.ind.base_kind == OPT_INDIRECT_REG &&
       op->v.ind.base != (Reg)REG_NONE) {
     Reg b = op->v.ind.base;
     i32 prod_idx = ctx_producer_of(ctx, RC_INT, b);
     if (prod_idx >= 0 && prod_idx < i) {
       Inst* prod = &ctx->bl->insts[prod_idx];
       if ((IROp)prod->op == IR_BINOP && prod->nopnds == 3 &&
           (BinOp)prod->extra.imm == BO_IADD && prod->opnds[0].kind == OPK_REG &&
           prod->opnds[0].cls == RC_INT && prod->opnds[0].v.reg == b) {
         Operand prod_def = prod->opnds[0];
         /* Single-use within producer's live range (the only further use
          * before next redef/barrier). */
         int killed = 0;
         int uses_after = count_uses_in_live_range(ctx->f, ctx->bl, prod_idx,
                                                   &prod_def, &killed);
         int single_use =
             uses_after == 1 &&
             (killed || !opt_block_live_out_has_phys_reg(
                            ctx->f, ctx->hard_live, ctx->bl->id, &prod_def));
         Operand lhs = prod->opnds[1];
         Operand rhs = prod->opnds[2];
         int has_no_index =
             op->v.ind.index_kind == OPT_INDIRECT_REG &&
             op->v.ind.index == (Reg)REG_NONE;
         /* reg + reg: base = lhs, index = rhs, scale=0. Needs an empty index
          * slot — cannot stack two indices. This synthesizes a new index, a
          * structural change, so keep the single-use guard: with other live
          * uses the add must stay, and we'd add an index without retiring it. */
         if (single_use && has_no_index && lhs.kind == OPK_REG &&
             rhs.kind == OPK_REG && lhs.cls == RC_INT && rhs.cls == RC_INT &&
             opt_indirect_index_type_valid(ctx->f, rhs.type) &&
             !producer_def_aliases_source(&prod_def, &lhs) &&
             !producer_def_aliases_source(&prod_def, &rhs) &&
             !ctx_def_changed_since(ctx, RC_INT, lhs.v.reg, prod_idx) &&
             !ctx_def_changed_since(ctx, RC_INT, rhs.v.reg, prod_idx)) {
           op->v.ind.base = lhs.v.reg;
           op->v.ind.base_type = lhs.type;
           op->v.ind.index = rhs.v.reg;
           op->v.ind.index_type = rhs.type;
           op->v.ind.log2_scale = 0;
           any = 1;
         }
         /* (W6) reg + imm: base = lhs, fold imm k into ofs (`add xN,xM,#k;
          * ldr [xN,#j]` -> `ldr [xM,#k+j]`). This rewrites only this indirect's
          * base+offset; the producer's def of xN is untouched and stays valid
          * for any other uses, so the rewrite is value-correct regardless of use
          * count. The aliasing guards (lhs unchanged since the add) still apply
          * and are independent of use count.
          *
          * Use count gates *profitability*, not correctness: when the add is
          * single-use it becomes dead (DCE retires it) and folding any in-range
          * offset is a clear win. When the add survives (other live uses), we
          * only fold an offset the target can keep inline in the access
          * (combine_offset_fold_ok) — otherwise the surviving add plus an
          * out-of-reach offset would cost an extra emit-time address build. */
         else if (lhs.kind == OPK_REG && rhs.kind == OPK_IMM &&
                  lhs.cls == RC_INT &&
                  !producer_def_aliases_source(&prod_def, &lhs) &&
                  !ctx_def_changed_since(ctx, RC_INT, lhs.v.reg, prod_idx)) {
           i64 sum = (i64)op->v.ind.ofs + rhs.v.imm;
           if (sum >= INT32_MIN && sum <= INT32_MAX &&
               (single_use ||
                combine_offset_fold_ok(ctx->target, op->type, sum))) {
             op->v.ind.base = lhs.v.reg;
             op->v.ind.base_type = lhs.type;
             op->v.ind.ofs = (i32)sum;
             any = 1;
           }
         }
         /* (W6) imm + reg: base = rhs, fold imm into ofs (commutative IADD).
          * Same reasoning as the reg+imm case — pure base/offset rewrite. */
         else if (lhs.kind == OPK_IMM && rhs.kind == OPK_REG &&
                  rhs.cls == RC_INT &&
                  !producer_def_aliases_source(&prod_def, &rhs) &&
                  !ctx_def_changed_since(ctx, RC_INT, rhs.v.reg, prod_idx)) {
           i64 sum = (i64)op->v.ind.ofs + lhs.v.imm;
           if (sum >= INT32_MIN && sum <= INT32_MAX &&
               (single_use ||
                combine_offset_fold_ok(ctx->target, op->type, sum))) {
             op->v.ind.base = rhs.v.reg;
             op->v.ind.base_type = rhs.type;
             op->v.ind.ofs = (i32)sum;
             any = 1;
           }
         }
       }
     }
   }
 
   /* (b) index producer is IR_BINOP ISHL reg, imm with scale=0. */
   if (op->v.ind.index_kind == OPT_INDIRECT_REG &&
       op->v.ind.index != (Reg)REG_NONE && op->v.ind.log2_scale == 0) {
     Reg idx = op->v.ind.index;
     i32 prod_idx = ctx_producer_of(ctx, RC_INT, idx);
     if (prod_idx >= 0 && prod_idx < i) {
       Inst* prod = &ctx->bl->insts[prod_idx];
       if ((IROp)prod->op == IR_BINOP && prod->nopnds == 3 &&
           (BinOp)prod->extra.imm == BO_SHL && prod->opnds[0].kind == OPK_REG &&
           prod->opnds[0].cls == RC_INT && prod->opnds[0].v.reg == idx &&
           prod->opnds[1].kind == OPK_REG && prod->opnds[1].cls == RC_INT &&
           prod->opnds[2].kind == OPK_IMM) {
         i64 sh = prod->opnds[2].v.imm;
         if (sh >= 1 && sh <= 3) {
           Operand prod_def = prod->opnds[0];
           int killed = 0;
           int uses_after = count_uses_in_live_range(ctx->f, ctx->bl, prod_idx,
                                                     &prod_def, &killed);
           /* `<= 2` allows the degenerate [base == index] case where the SHL
            * dst appears twice in the same indirect; rewriting only the index
            * still yields equivalent arithmetic when base also held the SHL
            * dst (base unchanged: r*4; index rewritten: r_src*4; r*4 == r*4). */
           if (uses_after >= 1 && uses_after <= 2 &&
               (killed || !opt_block_live_out_has_phys_reg(
                              ctx->f, ctx->hard_live, ctx->bl->id, &prod_def)) &&
               !producer_def_aliases_source(&prod_def, &prod->opnds[1]) &&
               !ctx_def_changed_since(ctx, RC_INT, prod->opnds[1].v.reg,
                                      prod_idx)) {
             op->v.ind.index = prod->opnds[1].v.reg;
             op->v.ind.index_type = prod->opnds[1].type;
             op->v.ind.log2_scale = (u8)sh;
             any = 1;
           }
         }
       }
     }
   }
 
   /* (L8) index producer is a single-use 32->64 widening convert (sxtw/uxtw):
    * fold the extend into the addressing mode (`[Xbase, Wm, sxtw/uxtw #scale]`),
    * one instruction instead of `sxtw xT,wS; add ...,lsl #scale; [reg]`. Runs
    * after the ISHL fold above, so an `sxtw; lsl; [reg]` chain first collapses
    * the shift into log2_scale and then this absorbs the sxtw producing that
    * index. Gated behind the target capability: only a backend that emits the
    * extended-register addressing form is handed an index_ext rider. */
   if (op->v.ind.index_kind == OPT_INDIRECT_REG &&
       op->v.ind.index != (Reg)REG_NONE &&
       op->v.ind.index_ext == OPT_IDX_EXT_NONE && ctx->target &&
       ctx->target->can_fold_extend_into_addr &&
       ctx->target->can_fold_extend_into_addr(ctx->target)) {
     Reg idx = op->v.ind.index;
     i32 prod_idx = ctx_producer_of(ctx, RC_INT, idx);
     if (prod_idx >= 0 && prod_idx < i) {
       Inst* prod = &ctx->bl->insts[prod_idx];
       u32 sb = 0, db = 0;
       int sign_p = 0;
       if (ext_params(prod, &sb, &db, &sign_p) && sb == 4u && db == 8u &&
           prod->opnds[0].kind == OPK_REG && prod->opnds[0].cls == RC_INT &&
           prod->opnds[0].v.reg == idx && prod->opnds[1].kind == OPK_REG &&
           prod->opnds[1].cls == RC_INT) {
         Operand prod_def = prod->opnds[0];
         int killed = 0;
         int uses_after = count_uses_in_live_range(ctx->f, ctx->bl, prod_idx,
                                                   &prod_def, &killed);
         /* `<= 2` mirrors the ISHL fold: tolerate the degenerate
          * [base == index] aliasing where the convert dst appears twice. The
          * convert source must be unchanged since the convert (so the W index
          * names the same 32-bit value), and must not alias the convert dst. */
         if (uses_after >= 1 && uses_after <= 2 &&
             (killed || !opt_block_live_out_has_phys_reg(
                            ctx->f, ctx->hard_live, ctx->bl->id, &prod_def)) &&
             !producer_def_aliases_source(&prod_def, &prod->opnds[1]) &&
             !ctx_def_changed_since(ctx, RC_INT, prod->opnds[1].v.reg,
                                    prod_idx)) {
           op->v.ind.index = prod->opnds[1].v.reg;
           op->v.ind.index_type = prod->opnds[1].type;
           op->v.ind.index_ext =
               sign_p ? (u8)OPT_IDX_EXT_SXTW : (u8)OPT_IDX_EXT_UXTW;
           any = 1;
         }
       }
     }
   }
 
   return any;
 }
 
 static int try_addr_synth(CombineCtx* ctx, Inst* in, i32 i) {
   int any = 0;
   for (u32 oi = 0; oi < in->nopnds; ++oi) {
     if (in->opnds[oi].kind == OPK_INDIRECT) {
       if (try_addr_synth_one_op(ctx, in, i, &in->opnds[oi])) {
         any = 1;
         ctx->block_change_p = 1;
       }
     }
   }
   return any;
 }
 
 /* ---- L7: fold a single-use left shift into the consuming ALU op ---- */
 
 /* True for the integer binops aa64 can emit as a shifted-register form
  * (`<op> rd,rn,rm,lsl #k`). ISUB is included: it is non-commutative but the
  * shifted operand is always the SECOND source (the subtrahend), which is
  * exactly where the rider sits. IMUL/div/etc. have no shifted-register form. */
 static int binop_takes_shifted_rhs(BinOp op) {
   switch (op) {
     case BO_IADD:
     case BO_ISUB:
     case BO_AND:
     case BO_OR:
     case BO_XOR:
       return 1;
     default:
       return 0;
   }
 }
 
 /* L7 recognition. When `in` is one of the shifted-register-capable binops and
  * its second source register is produced by a single-use `IR_BINOP SHL reg,imm`
  * (shift 1..4) at the SAME operand width, fold the shift into the binop by
  * rewriting opnds[2] to the shift's source register and stamping the shift
  * rider. The aa64 backend then emits the one-instruction shifted form; the dead
  * SHL is retired by mir_dce. Gated by the target capability so only a backend
  * that emits the shifted form ever receives a rider. */
 static int try_fold_shift_into_alu(CombineCtx* ctx, Inst* in, i32 i) {
   if ((IROp)in->op != IR_BINOP || in->nopnds != 3) return 0;
   if (!binop_takes_shifted_rhs((BinOp)in->extra.imm)) return 0;
   Operand* rhs = &in->opnds[2];
   if (rhs->kind != OPK_REG || rhs->cls != RC_INT || rhs->shift != 0) return 0;
   if (!ctx->target || !ctx->target->can_fold_shift_into_alu ||
       !ctx->target->can_fold_shift_into_alu(ctx->target))
     return 0;
 
   i32 prod_idx = ctx_producer_of(ctx, RC_INT, rhs->v.reg);
   if (prod_idx < 0 || prod_idx >= i) return 0;
   Inst* prod = &ctx->bl->insts[prod_idx];
   if ((IROp)prod->op != IR_BINOP || prod->nopnds != 3 ||
       (BinOp)prod->extra.imm != BO_SHL || prod->opnds[0].kind != OPK_REG ||
       prod->opnds[0].cls != RC_INT || prod->opnds[0].v.reg != rhs->v.reg ||
       prod->opnds[1].kind != OPK_REG || prod->opnds[1].cls != RC_INT ||
       prod->opnds[2].kind != OPK_IMM)
     return 0;
   i64 sh = prod->opnds[2].v.imm;
   if (sh < 1 || sh > 4) return 0;
 
   /* Width safety: the shifted-register operand shifts the rm register at the
    * CONSUMING binop's width. If the SHL produced a narrower value (e.g. a
    * 32-bit shift) than the binop reads (64-bit), the high bits of the source
    * register are not the shift's, so the inline shift would be wrong. Require
    * the shift's result width to equal the binop's result width. */
   u32 shl_w = combine_scalar_width_bytes(ctx->f, prod->opnds[0].type);
   u32 alu_w = combine_scalar_width_bytes(ctx->f, in->opnds[0].type);
   if (!shl_w || !alu_w || shl_w != alu_w) return 0;
 
   Operand prod_def = prod->opnds[0];
   int killed = 0;
   int uses_after =
       count_uses_in_live_range(ctx->f, ctx->bl, prod_idx, &prod_def, &killed);
   /* The shift def must be single-use (it dies at this binop); folding while
    * other uses survive would leave the SHL live AND add a redundant inline
    * shift. The source must be unchanged since the SHL and must not alias the
    * SHL dst (else rewriting the operand to the source changes its value). */
   if (uses_after != 1) return 0;
   if (!killed && opt_block_live_out_has_phys_reg(ctx->f, ctx->hard_live,
                                                  ctx->bl->id, &prod_def))
     return 0;
   if (producer_def_aliases_source(&prod_def, &prod->opnds[1])) return 0;
   if (ctx_def_changed_since(ctx, RC_INT, prod->opnds[1].v.reg, prod_idx))
     return 0;
 
   rhs->v.reg = prod->opnds[1].v.reg;
   rhs->shift = (u8)sh;
   ctx->block_change_p = 1;
   return 1;
 }
 
 /* ---- Rewrite 3: sink producer into single-use IR_COPY destination ---- */
 
 static int try_sink(CombineCtx* ctx, Inst* in, i32 i) {
   if ((IROp)in->op != IR_COPY || in->nopnds < 2) return 0;
   if (in->opnds[0].kind != OPK_REG || in->opnds[1].kind != OPK_REG) return 0;
   if (same_phys_reg(&in->opnds[0], &in->opnds[1])) return 0;
 
   Operand src = in->opnds[1];
   Operand dst = in->opnds[0];
   i32 prod_idx = ctx_producer_of(ctx, src.cls, src.v.reg);
   if (prod_idx < 0 || prod_idx >= i) return 0;
   Inst* prod = &ctx->bl->insts[prod_idx];
   if (!producer_retargetable_op((IROp)prod->op)) return 0;
   if (prod->nopnds < 1 || prod->opnds[0].kind != OPK_REG) return 0;
   if (!same_phys_reg(&prod->opnds[0], &src)) return 0;
 
   /* Producer's source operands must not have been redefined since. */
   for (u32 oi = 1; oi < prod->nopnds; ++oi) {
     const Operand* p = &prod->opnds[oi];
     if (p->kind == OPK_REG) {
       if (ctx_def_changed_since(ctx, p->cls, p->v.reg, prod_idx)) return 0;
     } else if (p->kind == OPK_INDIRECT) {
       if (p->v.ind.base_kind == OPT_INDIRECT_REG &&
           ctx_def_changed_since(ctx, RC_INT, p->v.ind.base, prod_idx))
         return 0;
       if (p->v.ind.index_kind == OPT_INDIRECT_REG &&
           p->v.ind.index != (Reg)REG_NONE &&
           ctx_def_changed_since(ctx, RC_INT, p->v.ind.index, prod_idx))
         return 0;
     }
   }
   /* If producer reads memory, no intervening memory write. */
   if (inst_reads_memory(prod) && ctx->last_mem_def > prod_idx) return 0;
   /* Retargeting moves the producer's write to `dst` earlier. That is only
    * legal if the hard register is dead throughout the interval before the
    * copy that originally wrote it. */
   for (i32 j = prod_idx + 1; j < i; ++j) {
     Inst* mid = &ctx->bl->insts[j];
     CombinePhysRegEffect effect = inst_phys_reg_effect(ctx->f, mid, &dst);
     if (effect.uses || effect.defines || effect.clobbers)
       return 0;
   }
 
   /* Producer dst must have exactly one use within its live range (the copy
    * at i). If the live range terminates inside the block, the cross-block
    * live-out check is moot. */
   int killed = 0;
   int uses_total =
       count_uses_in_live_range(ctx->f, ctx->bl, prod_idx, &src, &killed);
   if (uses_total != 1) return 0;
   if (killed &&
       use_after_clobber_before_redef(ctx->f, ctx->bl, prod_idx, &src))
     return 0;
   if (!killed && opt_block_live_out_has_phys_reg(ctx->f, ctx->hard_live,
                                                  ctx->bl->id, &src))
     return 0;
 
   int swap_binop = 0;
   if (!retarget_producer_legal(prod, &dst, &swap_binop)) return 0;
 
   if (swap_binop) {
     Operand tmp = prod->opnds[1];
     prod->opnds[1] = prod->opnds[2];
     prod->opnds[2] = tmp;
   }
   prod->opnds[0] = dst;
 
   /* Update last-def: producer no longer defines src, now defines dst. If src
    * had an earlier reaching definition in the block, keep it visible for
    * later source-availability checks. */
   ctx_restore_removed_def(ctx, &src, prod_idx);
   ctx->last_def[dst.cls][dst.v.reg] = prod_idx;
 
   /* Mark the copy NOP'd so compact removes it. */
   in->op = IR_NOP;
   in->def = VAL_NONE;
   in->ndefs = 0;
   in->defs = NULL;
   in->nopnds = 0;
   in->opnds = NULL;
   ctx->block_change_p = 1;
   return 1;
 }
 
 /* ---- Rewrite 4: combine_exts (ext-of-ext chains) ---- */
 
 static int try_combine_exts(CombineCtx* ctx, Inst* in, i32 i) {
   if ((IROp)in->op != IR_CONVERT || in->nopnds < 2) return 0;
   if (in->opnds[1].kind != OPK_REG) return 0;
   u32 sb, db;
   int outer_sign;
   if (!ext_params(in, &sb, &db, &outer_sign)) return 0;
 
   Reg src_reg = in->opnds[1].v.reg;
   u8 src_cls = in->opnds[1].cls;
   i32 prod_idx = ctx_producer_of(ctx, src_cls, src_reg);
   if (prod_idx < 0 || prod_idx >= i) return 0;
   Inst* prod = &ctx->bl->insts[prod_idx];
 
   /* Redundant zero-extension of a zero-extending load. A narrow integer load
    * with no MF_SEXT_LOAD rider zero-extends the whole destination register on
    * every target (sign extension is always either a separate convert or a
    * flagged sign-extending load). So a later ZEXT of that register reproduces
    * bits that are already zero -- as long as the convert keeps at least the
    * loaded bytes (`sb >= load size`), the result equals the source. Rewrite the
    * convert to a copy and let copy-prop + DCE retire it; worst case the copy
    * survives as a same-cost register move (it is never larger than the uxt). */
   if (!outer_sign && src_cls == RC_INT && (IROp)prod->op == IR_LOAD &&
       !(prod->extra.mem.flags & MF_SEXT_LOAD) && prod->extra.mem.size &&
       prod->extra.mem.size <= sb && prod->nopnds >= 1 &&
       same_reg_operand(&prod->opnds[0], &in->opnds[1])) {
     in->op = IR_COPY;
     in->nopnds = 2; /* opnds[0]=dst, opnds[1]=src already in place */
     ctx->block_change_p = 1;
     return 1;
   }
 
   /* L6 (O1-PATTERNS): the SIGNED mirror of the ZEXT-of-load fold above. A
    * narrow integer load fills the ENTIRE destination register. A backend that
    * advertises load_sext honors MF_SEXT_LOAD with a sign-extending load
    * (`ldrsb`/`ldrsh`); every backend's plain load (`ldrb`/`ldrh`) zero-extends.
    * A subsequent SXTB/SXTH/SXTW convert is then a no-op in two shapes — drop it
    * to an IR_COPY (copy-prop + DCE retire it; worst case a same-cost move):
    *
    *  (a) SEXT of a sign-extending load of equal-or-smaller width, on a target
    *      that honors MF_SEXT_LOAD (`mem.size <= sb`): the load already
    *      replicated the loaded sign bit across the whole register, so
    *      re-sign-extending from `sb >= mem.size` bytes is an identity.
    *
    *  (b) SEXT of a ZERO-extending load whose value cannot have the sign bit set
    *      in the widened position (`mem.size < sb`, STRICT): the loaded value
    *      occupies only the low `mem.size` bytes and bit `8*sb-1` is in the
    *      zeroed region, so the sign bit the SEXT replicates is guaranteed 0 ->
    *      the SEXT equals the ZEXT the load already produced -> identity. Strict
    *      `<` is required: at `mem.size == sb` the load's top byte may set the
    *      sign bit, and SEXT would then differ from the zero-extended value.
    *      (`ldrb w; sxtw x` of a 0..255 byte — lvm/sqlite.) */
   if (outer_sign && src_cls == RC_INT && (IROp)prod->op == IR_LOAD &&
       prod->extra.mem.size && prod->nopnds >= 1 &&
       same_reg_operand(&prod->opnds[0], &in->opnds[1])) {
     int sext_load = (prod->extra.mem.flags & MF_SEXT_LOAD) != 0;
     int load_sign_extends =
         sext_load && ctx->target && ctx->target->regs &&
         ctx->target->regs->load_sext;
     if ((load_sign_extends && prod->extra.mem.size <= sb) ||
         (!sext_load && prod->extra.mem.size < sb)) {
       in->op = IR_COPY;
       in->nopnds = 2; /* opnds[0]=dst, opnds[1]=src already in place */
       ctx->block_change_p = 1;
       return 1;
     }
   }
 
   u32 isb, idb;
   int inner_sign;
   if (!ext_params(prod, &isb, &idb, &inner_sign)) return 0;
   if (prod->opnds[1].kind != OPK_REG) return 0;
   if (ctx_def_changed_since(ctx, prod->opnds[1].cls, prod->opnds[1].v.reg,
                             prod_idx))
     return 0;
 
   /* Single-use of inner ext dst within its live range (only this insn). */
   Operand prod_def = prod->opnds[0];
   int killed = 0;
   int uses_total =
       count_uses_in_live_range(ctx->f, ctx->bl, prod_idx, &prod_def, &killed);
   if (uses_total != 1) return 0;
   if (!killed && opt_block_live_out_has_phys_reg(ctx->f, ctx->hard_live,
                                                  ctx->bl->id, &prod_def))
     return 0;
 
   /* Outer width `db`, inner width `idb`. Inner reads `isb` bytes. */
   u32 outer_in = sb;                  /* outer's source width */
   u32 inner_out = idb;                /* inner's output width */
   if (outer_in > inner_out) return 0; /* sanity: inner feeds outer */
 
   /* If inner is an identity-shaped convert that reads back its own def
    * register (e.g. `convert rB, rB`), the rewrite would set in.opnds[1] to
    * the same register it already holds. Reporting a change spins the
    * per-BB fixpoint forever. Skip. */
   if (prod->opnds[1].kind == OPK_REG && in->opnds[1].kind == OPK_REG &&
       prod->opnds[1].cls == in->opnds[1].cls &&
       prod->opnds[1].v.reg == in->opnds[1].v.reg)
     return 0;
 
   /* Pattern A: outer width <= inner-source width.  Outer can reach past the
    * inner ext to the inner source directly, keeping outer's signedness.
    * MIR allows any signedness combination here. */
   if (db <= isb) {
     in->opnds[1] = prod->opnds[1];
     in->opnds[1].type = prod->opnds[1].type;
     ctx->block_change_p = 1;
     return 1;
   }
 
   /* Pattern B: inner-source width < outer width. Allowed iff outer is signed
    * OR inner is unsigned; excludes the unsafe uext(sext) combination. */
   if (isb < db && (outer_sign || !inner_sign)) {
     in->opnds[1] = prod->opnds[1];
     in->opnds[1].type = prod->opnds[1].type;
     /* outer's ConvKind already encodes the outer signedness; keep it. */
     ctx->block_change_p = 1;
     return 1;
   }
 
   return 0;
 }
 
 /* Invert a CmpOp (negate the relation). Returns 0 for an op outside the
  * known total set. Kept byte-for-byte in sync with src/cg/fold.c
  * api_invert_cmp and pass_jump.c invert_cmp — including the FP rule that
  * negation flips ordered<->unordered (so the NaN outcome flips too): the
  * negation of ordered `a<b` is *unordered* `a>=b`. */
 static int combine_invert_cmp(CmpOp op, CmpOp* out) {
   switch (op) {
     case CMP_EQ: *out = CMP_NE; return 1;
     case CMP_NE: *out = CMP_EQ; return 1;
     case CMP_LT_S: *out = CMP_GE_S; return 1;
     case CMP_LE_S: *out = CMP_GT_S; return 1;
     case CMP_GT_S: *out = CMP_LE_S; return 1;
     case CMP_GE_S: *out = CMP_LT_S; return 1;
     case CMP_LT_U: *out = CMP_GE_U; return 1;
     case CMP_LE_U: *out = CMP_GT_U; return 1;
     case CMP_GT_U: *out = CMP_LE_U; return 1;
     case CMP_GE_U: *out = CMP_LT_U; return 1;
     case CMP_OEQ_F: *out = CMP_UNE_F; return 1;
     case CMP_ONE_F: *out = CMP_UEQ_F; return 1;
     case CMP_OLT_F: *out = CMP_UGE_F; return 1;
     case CMP_OLE_F: *out = CMP_UGT_F; return 1;
     case CMP_OGT_F: *out = CMP_ULE_F; return 1;
     case CMP_OGE_F: *out = CMP_ULT_F; return 1;
     case CMP_UEQ_F: *out = CMP_ONE_F; return 1;
     case CMP_UNE_F: *out = CMP_OEQ_F; return 1;
     case CMP_ULT_F: *out = CMP_OGE_F; return 1;
     case CMP_ULE_F: *out = CMP_OGT_F; return 1;
     case CMP_UGT_F: *out = CMP_OLE_F; return 1;
     case CMP_UGE_F: *out = CMP_OLT_F; return 1;
   }
   return 0;
 }
 
 /* ---- L4 (O1-PATTERNS): drop the double-cset bool re-normalize ----
  *
  * kit lowers `(a cc b)` to an IR_CMP producing a 0/1 bool in rInner, then a
  * surrounding `bool != 0` / `if (bool)` context lowers to a SECOND IR_CMP
  * `rOuter = (rInner <eq/ne> 0|1)` that re-normalizes an already-0/1 value
  * (`cmp w8,#1; cset w8,eq; cmp w8,#0; cset w8,ne` — yyjson's 573-triple
  * signature). The outer compare is redundant. When an IR_CMP's source register
  * (opnds[1]) has its most-recent same-block def being another IR_CMP (so a
  * proven 0/1 bool) and the outer compares it against imm 0 or 1 with eq/ne,
  * rewrite the outer in place:
  *
  *   (t != 0) / (t == 1): outer == inner  -> IR_COPY rOuter, rInner
  *   (t == 0) / (t != 1): outer == !inner -> recompute the inner relation
  *                        inverted on the inner's OWN operands:
  *                        IR_CMP rOuter = (inner.a invert(inner.cc) inner.b)
  *
  * The copy form lets copy-prop + DCE retire it; the inverted form drops the
  * dependency on rInner (so the inner cmp dies if single-use) and replaces two
  * cmp+cset pairs with one. Both are same-block forward peepholes off the
  * CombineCtx last-def map. Composes with L2: once the outer is a copy/inverted
  * cmp, a branch consuming rOuter folds through copy-prop / the L2 fusion on a
  * later fixpoint iteration. */
 static int try_drop_double_cmp(CombineCtx* ctx, Inst* in, i32 i) {
   if ((IROp)in->op != IR_CMP || in->nopnds < 3) return 0;
   if (in->opnds[0].kind != OPK_REG || in->opnds[1].kind != OPK_REG) return 0;
   if (in->opnds[2].kind != OPK_IMM) return 0;
   CmpOp outer = (CmpOp)in->extra.imm;
   if (outer != CMP_EQ && outer != CMP_NE) return 0;
   i64 k = in->opnds[2].v.imm;
   if (k != 0 && k != 1) return 0;
 
   Operand srcb = in->opnds[1];
   i32 prod_idx = ctx_producer_of(ctx, srcb.cls, srcb.v.reg);
   if (prod_idx < 0 || prod_idx >= i) return 0;
   Inst* inner = &ctx->bl->insts[prod_idx];
   if ((IROp)inner->op != IR_CMP || inner->nopnds < 3) return 0;
   if (inner->opnds[0].kind != OPK_REG ||
       !same_phys_reg(&inner->opnds[0], &srcb))
     return 0;
   /* The outer dst and the inner bool live in the same register class (both are
    * 0/1 integer bools); a class crossing would need a real move, not a copy. */
   if (in->opnds[0].cls != inner->opnds[0].cls) return 0;
 
   /* Whether the outer result equals the inner bool or its negation:
    *   (t != 0) -> t ;  (t == 1) -> t        (non-inverted)
    *   (t == 0) -> !t;  (t != 1) -> !t        (inverted) */
   int invert = (outer == CMP_EQ && k == 0) || (outer == CMP_NE && k == 1);
 
   if (!invert) {
     /* outer == inner: rewrite to a copy off rInner (copy-prop + DCE retire). */
     in->op = (u16)IR_COPY;
     in->opnds[1] = inner->opnds[0]; /* = srcb, already in place; keep explicit */
     in->nopnds = 2;
     in->extra.imm = 0;
     ctx->block_change_p = 1;
     return 1;
   }
 
   /* Inverted: recompute the inner relation negated on the inner's own operands.
    * That requires the inner's operands to still hold their pre-cmp values: an
    * operand must not have been redefined since the inner cmp AND must not alias
    * the inner cmp's own destination (a self-referencing `cmp w8,#1` writing w8
    * leaves w8 holding the bool, not the compared value — recomputing from it
    * would be wrong). */
   CmpOp inv;
   if (!combine_invert_cmp((CmpOp)inner->extra.imm, &inv)) return 0;
   for (u32 oi = 1; oi < 3; ++oi) {
     const Operand* p = &inner->opnds[oi];
     if (p->kind == OPK_REG) {
       if (same_phys_reg(p, &inner->opnds[0])) return 0;
       if (ctx_def_changed_since(ctx, p->cls, p->v.reg, prod_idx)) return 0;
     }
   }
   /* Keep the outer's dst (opnds[0]); replace its inputs with the inner's and
    * its CmpOp with the inverted inner relation. The dst type/class is the same
    * bool the outer already produced. */
   in->opnds[1] = inner->opnds[1];
   in->opnds[2] = inner->opnds[2];
   in->extra.imm = (i64)inv;
   ctx->block_change_p = 1;
   return 1;
 }
 
 /* ---- L2 (O1-PATTERNS): fuse cmp rD; cmp_branch(NE/EQ, rD, #0) -> cmp_branch
  *
  * A relational whose 0/1 bool was MATERIALIZED into a register (`cmp; cset
  * rD,cc`) and then re-tested by the branch (`cbnz/cbz rD`) lowers, at this
  * MIR level, to `IR_CMP rD = (a cc b)` followed by the terminator
  * `IR_CMP_BRANCH(CMP_NE|CMP_EQ, rD, #0)` (control.c synthesizes cmp_branch of
  * the bool against IMM_ZERO; cg's delayed-compare path already fuses the
  * un-materialized `if (a<b)` form upstream, so only the materialized residual
  * reaches here). The branch's NE/EQ-vs-0 just re-tests a bool the original cmp
  * already computed in flags.
  *
  * When the terminator is `IR_CMP_BRANCH(NE|EQ, rD, #0)` whose rD's most-recent
  * same-block def is a single-use IR_CMP, fuse into the cmp's own relation:
  *   cbnz (CMP_NE vs 0): branch-if-true  -> cmp_branch(cmp.op, a, b)
  *   cbz  (CMP_EQ vs 0): branch-if-false -> cmp_branch(invert(cmp.op), a, b)
  * and NOP the now-dead cmp. This is the inverse of the SSA fusion in
  * pass_o2.c (ssa_combine_fold_cmp_branch), here over the no-SSA CombineCtx
  * (last-def map + hard-live single-use). Inversion uses the full CmpOp table
  * (combine_invert_cmp), which is correct for FP too: the cset collapsed the
  * comparison to a definite 0/1 even for NaN, and the inverse op reproduces the
  * same NaN branch direction (e.g. !(a OEQ b) == a UNE b).
  *
  * Single-block, single forward pass, all guards from existing CombineCtx state
  * -> linear. */
 static int try_fuse_cmp_branch(CombineCtx* ctx, Inst* in, i32 i) {
   if ((IROp)in->op != IR_CMP_BRANCH || in->nopnds < 2) return 0;
   /* Only the block terminator carries the two CFG successors. */
   if (i != (i32)ctx->bl->ninsts - 1 || ctx->bl->nsucc < 2) return 0;
   /* Branch must test a register bool against immediate 0 with EQ/NE. */
   CmpOp brop = (CmpOp)in->extra.imm;
   if (brop != CMP_EQ && brop != CMP_NE) return 0;
   if (in->opnds[0].kind != OPK_REG) return 0;
   if (in->opnds[1].kind != OPK_IMM || in->opnds[1].v.imm != 0) return 0;
 
   Operand cond = in->opnds[0];
   i32 prod_idx = ctx_producer_of(ctx, cond.cls, cond.v.reg);
   if (prod_idx < 0 || prod_idx >= i) return 0;
   Inst* cmp = &ctx->bl->insts[prod_idx];
   if ((IROp)cmp->op != IR_CMP || cmp->nopnds < 3) return 0;
   if (cmp->opnds[0].kind != OPK_REG || !same_phys_reg(&cmp->opnds[0], &cond))
     return 0;
 
   /* Resolve the fused relation (invert for the cbz / EQ-vs-0 case). */
   CmpOp fused = (CmpOp)cmp->extra.imm;
   if (brop == CMP_EQ && !combine_invert_cmp(fused, &fused)) return 0;
 
   /* The cmp's input operands must be unchanged between the cmp and the branch
    * (an intervening inst may have redefined a register the cmp reads). */
   for (u32 oi = 1; oi < 3; ++oi) {
     const Operand* p = &cmp->opnds[oi];
     if (p->kind == OPK_REG &&
         ctx_def_changed_since(ctx, p->cls, p->v.reg, prod_idx))
       return 0;
   }
 
   /* The cmp's result must die at this branch: its sole use, not live-out. If it
    * has other uses (or escapes the block) the cmp must stay and we cannot NOP
    * it. */
   Operand cmp_def = cmp->opnds[0];
   int killed = 0;
   if (count_uses_in_live_range(ctx->f, ctx->bl, prod_idx, &cmp_def, &killed) !=
       1)
     return 0;
   if (!killed && opt_block_live_out_has_phys_reg(ctx->f, ctx->hard_live,
                                                  ctx->bl->id, &cmp_def))
     return 0;
 
   /* Fuse: rewrite the branch to test the cmp's own relation directly; NOP the
    * cmp. Successors are unchanged (succ[0]=taken, succ[1]=fallthrough). */
   Operand* opnds = arena_array(ctx->f->arena, Operand, 2);
   opnds[0] = cmp->opnds[1];
   opnds[1] = cmp->opnds[2];
   in->opnds = opnds;
   in->nopnds = 2;
   in->extra.imm = (i64)fused;
 
   cmp->op = (u16)IR_NOP;
   cmp->def = VAL_NONE;
   cmp->ndefs = 0;
   cmp->defs = NULL;
   cmp->nopnds = 0;
   cmp->opnds = NULL;
   /* The cmp no longer defines cond's register; restore its prior reaching def
    * so later same-block availability checks stay accurate. */
   ctx_restore_removed_def(ctx, &cond, prod_idx);
   ctx->block_change_p = 1;
   return 1;
 }
 
 /* ---- Rewrite 6 (W1a): local frame-address `sub`-CSE ----
  *
  * O1.md W1a. An `IR_ADDR_OF rD, <addr>` materializes a frame-slot or global
  * address into a register; on aa64 that is a `sub xN,x29,#k` (frame) or an
  * `adrp;add`/GOT build (global), on rv64 a `lui;…;add`. A back-to-back
  * `IR_ADDR_OF` of the *same* address operand recomputes the identical value.
  * While an earlier producer register is unclobbered, rewrite the recompute to
  * an `IR_COPY` off it (copy-prop + DCE retire it; worst case it is a same-cost
  * register move). The address sources are immutable — a frame slot's offset and
  * a global sym+addend never change — so no source-availability check beyond the
  * producer register being unclobbered is required.
  *
  * Bounded per-BB ring (COMBINE_ADDR_CSE_SLOTS) → O(1) per inst → linear.
  * Deliberately minimal: W1.1 (positive far-slot layout) subsumes the spill
  * far-slot case; this PR stands up the gate + structural guard and mops up the
  * `&local` / global recompute residual. */
 
 /* Two address operands name the same address iff same kind and same payload. */
 static int same_addr_operand(const Operand* a, const Operand* b) {
   if (a->kind != b->kind) return 0;
   switch (a->kind) {
     case OPK_LOCAL:
       return a->v.frame_slot == b->v.frame_slot;
     case OPK_GLOBAL:
       return a->v.global.sym == b->v.global.sym &&
              a->v.global.addend == b->v.global.addend;
     default:
       return 0;
   }
 }
 
 /* Is this an addr-of whose address is a CSE-able immutable frame/global ref? */
 static int addr_of_is_cseable(const Inst* in) {
   if ((IROp)in->op != IR_ADDR_OF || in->nopnds < 2) return 0;
   if (in->opnds[0].kind != OPK_REG) return 0;
   return in->opnds[1].kind == OPK_LOCAL || in->opnds[1].kind == OPK_GLOBAL;
 }
 
 static void addr_cse_record(CombineCtx* ctx, const Inst* in, i32 i) {
   if (!addr_of_is_cseable(in)) return;
   AddrCseEntry* e = &ctx->addr_cse[ctx->addr_cse_next];
   e->inst_idx = i;
   e->dst = in->opnds[0];
   e->addr = in->opnds[1];
   ctx->addr_cse_next = (ctx->addr_cse_next + 1u) % COMBINE_ADDR_CSE_SLOTS;
 }
 
 static int try_addr_of_cse(CombineCtx* ctx, Inst* in, i32 i) {
   if (!addr_of_is_cseable(in)) return 0;
   const Operand* addr = &in->opnds[1];
   for (u32 k = 0; k < COMBINE_ADDR_CSE_SLOTS; ++k) {
     const AddrCseEntry* e = &ctx->addr_cse[k];
     if (e->inst_idx < 0 || e->inst_idx >= i) continue;
     if (!same_addr_operand(&e->addr, addr)) continue;
     /* The producer register must still hold the address: it is this BB's live
      * producer of (cls,reg) and was not redefined/clobbered since. */
     if (ctx_producer_of(ctx, e->dst.cls, e->dst.v.reg) != e->inst_idx) continue;
     if (ctx_def_changed_since(ctx, e->dst.cls, e->dst.v.reg, e->inst_idx))
       continue;
     /* A copy of the producer reg into self is a no-op the dst already holds. */
     if (same_phys_reg(&in->opnds[0], &e->dst)) continue;
     /* Rewrite `addr_of rD, <addr>` into `copy rD, rP`. */
     in->op = (u16)IR_COPY;
     in->opnds[1] = e->dst;
     in->nopnds = 2;
     ctx->block_change_p = 1;
     return 1;
   }
   return 0;
 }
 
 /* ---- Rewrite 8 (W5): local same-block redundant-load elimination ---- */
 
 /* Two load-address operands name the same typed address iff their kind and
  * payload agree. For an OPK_INDIRECT both the base, index, scale, AND offset
  * must match; the register-unchanged-since check is applied separately by the
  * caller. */
 static int same_load_addr_operand(const Operand* a, const Operand* b) {
   if (a->kind != b->kind || a->cls != b->cls || a->type != b->type)
     return 0;
   switch (a->kind) {
     case OPK_LOCAL:
       return a->v.frame_slot == b->v.frame_slot;
     case OPK_GLOBAL:
       return a->v.global.sym == b->v.global.sym &&
              a->v.global.addend == b->v.global.addend;
     case OPK_INDIRECT:
       return a->v.ind.base == b->v.ind.base &&
              a->v.ind.index == b->v.ind.index &&
              a->v.ind.base_kind == b->v.ind.base_kind &&
              a->v.ind.index_kind == b->v.ind.index_kind &&
              a->v.ind.base_type == b->v.ind.base_type &&
              a->v.ind.index_type == b->v.ind.index_type &&
              a->v.ind.log2_scale == b->v.ind.log2_scale &&
              a->v.ind.index_ext == b->v.ind.index_ext &&
              a->v.ind.ofs == b->v.ind.ofs;
     default:
       return 0;
   }
 }
 
 /* Alias roots are optimizer metadata rather than part of the bytes returned by
  * a load, but keeping them in this deliberately conservative local key avoids
  * letting CSE erase a distinction made by an upstream alias classifier. */
 static int same_load_alias_root(const AliasRoot* a, const AliasRoot* b) {
   if (a->kind != b->kind) return 0;
   switch ((AliasKind)a->kind) {
     case ALIAS_UNKNOWN:
     case ALIAS_HEAP:
       return 1;
     case ALIAS_LOCAL:
       return a->v.local_id == b->v.local_id;
     case ALIAS_GLOBAL:
       return a->v.global == b->v.global;
     case ALIAS_PARAM:
       return a->v.param_idx == b->v.param_idx;
     case ALIAS_STRING:
       return a->v.string_id == b->v.string_id;
     default:
       return 0;
   }
 }
 
 /* Compare explicit fields rather than struct bytes: MemAccess contains padding
  * and a tagged union, so memcmp would make the key depend on inactive storage.
  * Even fields that usually do not alter the returned bits (alignment and alias
  * classification) stay in this bounded key. That keeps reuse conservative and
  * aligned with the richer memory key used by O2 GVN. */
 static int same_load_mem_access(const MemAccess* a, const MemAccess* b) {
   return a->type == b->type && a->size == b->size && a->align == b->align &&
          a->flags == b->flags && a->addr_space == b->addr_space &&
          a->bf_offset == b->bf_offset && a->bf_width == b->bf_width &&
          a->bf_signed == b->bf_signed &&
          same_load_alias_root(&a->alias, &b->alias);
 }
 
 /* Physical register identity is intentionally absent: CSE expects distinct
  * destinations. The value interpretation carried by the instruction and its
  * destination operand must nevertheless agree before a producer can be copied
  * into the later destination. */
 static int same_cse_result_shape(const Inst* in, KitCgTypeId result_type,
                                  const Operand* dst) {
   const Operand* current;
   if (!in || !dst || in->nopnds < 1) return 0;
   current = &in->opnds[0];
   return current->kind == OPK_REG && dst->kind == OPK_REG &&
          in->type == current->type && result_type == dst->type &&
          in->type == result_type && current->cls == dst->cls;
 }
 
 /* A plain, CSE-eligible IR_LOAD: dst is a register, address is a
  * direct/indirect memory operand, and the access is neither observable
  * (volatile/atomic) nor a bit-field rider. */
 static int load_is_cseable(const Inst* in) {
   if ((IROp)in->op != IR_LOAD || in->nopnds < 2) return 0;
   if (in->opnds[0].kind != OPK_REG) return 0;
   const Operand* addr = &in->opnds[1];
   /* W5 owns pointer-deref (OPK_INDIRECT) and global (OPK_GLOBAL) loads — the
    * `*p` / global-variable same-block reload. Semantic OPK_LOCAL traffic stays
    * out of this narrow CSE, while location-MIR spills are represented as
    * IR_COPY/OPK_STACK and owned by opt_combine_compact_block. Reusing either
    * here would duplicate its alias/location authority. */
   if (addr->kind != OPK_INDIRECT && addr->kind != OPK_GLOBAL) return 0;
   if (opt_mem_observable(&in->extra.mem)) return 0;
   if (in->extra.mem.bf_width != 0) return 0; /* bit-field rider */
   /* Self-clobbering load (`ldr x9, [x9, #k]`): the destination overwrites its
    * own address base/index, so after the load the address register no longer
    * holds the loaded-from pointer. The recorded `addr` operand would then match
    * a syntactically-identical later load whose base now denotes a DIFFERENT
    * address — an unsound reuse. Exclude these from both recording and reuse:
    * the same-operand check (load_addr_regs_unchanged, ctx_def_changed_since)
    * uses a strictly-greater index test and cannot see a redefinition that
    * happened AT the recorded load's own index. */
   if (in->opnds[0].cls == RC_INT && addr->kind == OPK_INDIRECT) {
     Reg d = in->opnds[0].v.reg;
     if (addr->v.ind.base_kind == OPT_INDIRECT_REG &&
         addr->v.ind.base == d)
       return 0;
     if (addr->v.ind.index_kind == OPT_INDIRECT_REG &&
         addr->v.ind.index != (Reg)REG_NONE && addr->v.ind.index == d)
       return 0;
   }
   return 1;
 }
 
 /* The address registers (base/index of an OPK_INDIRECT) must not have been
  * redefined since the earlier load produced `dst`. For a direct OPK_LOCAL /
  * OPK_GLOBAL there is no register input — the address is immutable. */
 static int load_addr_regs_unchanged(const CombineCtx* ctx, const Operand* addr,
                                     i32 since_idx) {
   if (addr->kind != OPK_INDIRECT) return 1;
   if (addr->v.ind.base_kind == OPT_INDIRECT_REG &&
       addr->v.ind.base != (Reg)REG_NONE &&
       ctx_def_changed_since(ctx, RC_INT, addr->v.ind.base, since_idx))
     return 0;
   if (addr->v.ind.index_kind == OPT_INDIRECT_REG &&
       addr->v.ind.index != (Reg)REG_NONE &&
       ctx_def_changed_since(ctx, RC_INT, addr->v.ind.index, since_idx))
     return 0;
   return 1;
 }
 
 static void load_cse_record(CombineCtx* ctx, const Inst* in, i32 i) {
   if (!load_is_cseable(in)) return;
   LoadCseEntry* e = &ctx->load_cse[ctx->load_cse_next];
   e->inst_idx = i;
   e->dst = in->opnds[0];
   e->addr = in->opnds[1];
   e->result_type = in->type;
   e->mem = in->extra.mem;
   ctx->load_cse_next = (ctx->load_cse_next + 1u) % COMBINE_LOAD_CSE_SLOTS;
 }
 
 static int try_local_load_cse(CombineCtx* ctx, Inst* in, i32 i) {
   if (!load_is_cseable(in)) return 0;
   const Operand* addr = &in->opnds[1];
   for (u32 k = 0; k < COMBINE_LOAD_CSE_SLOTS; ++k) {
     const LoadCseEntry* e = &ctx->load_cse[k];
     if (e->inst_idx < 0 || e->inst_idx >= i) continue;
     if (!same_cse_result_shape(in, e->result_type, &e->dst)) continue;
     if (!same_load_mem_access(&e->mem, &in->extra.mem)) continue;
     if (!same_load_addr_operand(&e->addr, addr)) continue;
     /* ALIASING: any memory write between the earlier load and now invalidates
      * reuse. ctx->last_mem_def is the index of the most-recent memory writer
      * (set by ctx_record for every inst_writes_memory inst, including the
      * call/asm/intrinsic clobber barrier). If it occurred after the earlier
      * load, the loaded value may have changed -> do not reuse. */
     if (ctx->last_mem_def > e->inst_idx) continue;
     /* The producer register must still hold the loaded value: it is this BB's
      * live producer of (cls,reg) and was not redefined/clobbered since. */
     if (ctx_producer_of(ctx, e->dst.cls, e->dst.v.reg) != e->inst_idx) continue;
     if (ctx_def_changed_since(ctx, e->dst.cls, e->dst.v.reg, e->inst_idx))
       continue;
     /* The address-forming registers must be unchanged since the earlier load,
      * else the two indirects compute different addresses. */
     if (!load_addr_regs_unchanged(ctx, addr, e->inst_idx)) continue;
     /* A copy of the producer reg into self is a no-op the dst already holds. */
     if (same_phys_reg(&in->opnds[0], &e->dst)) continue;
     /* Same-class reuse only (an int load into an FP reg, or vice versa, would
      * need a cross-class move, not a same-class copy). */
     if (in->opnds[0].cls != e->dst.cls) continue;
     /* Rewrite `load rD, [addr]` into `copy rD, rP`. */
     in->op = (u16)IR_COPY;
     in->flags = 0;
     in->opnds[1] = e->dst;
     in->nopnds = 2;
     ctx->block_change_p = 1;
     return 1;
   }
   return 0;
 }
 
 /* ---- Rewrite 9 (W5): local same-block pure-compute CSE ---- */
 
 /* A pure compute eligible for same-block CSE: IR_BINOP or IR_UNOP with a
  * register destination. (IR_CMP is excluded — its result feeds branch/flag
  * lowering and is not a freely-copyable register value here.) */
 static int compute_is_cseable(const Inst* in) {
   IROp op = (IROp)in->op;
   if (op != IR_BINOP && op != IR_UNOP) return 0;
   if (in->nopnds < 1 || in->opnds[0].kind != OPK_REG) return 0;
   if (op == IR_BINOP && in->nopnds < 3) return 0;
   if (op == IR_UNOP && in->nopnds < 2) return 0;
   return 1;
 }
 
 /* Two compute operands match iff identical kind+payload. Only REG and IMM
  * operands appear as binop/unop inputs at this stage; any other kind is treated
  * as non-matching (conservative). */
 static int same_compute_operand(const Operand* a, const Operand* b) {
   if (a->kind != b->kind) return 0;
   switch (a->kind) {
     case OPK_REG:
       /* The L7 shift rider is part of the operand's value: `x2` and `x2,lsl#2`
        * are different inputs, so a ridered and a riderless operand must not be
        * treated as the same compute (else CSE would drop the shift). */
       return a->cls == b->cls && a->v.reg == b->v.reg &&
              a->type == b->type && a->shift == b->shift;
     case OPK_IMM:
       return a->cls == b->cls && a->v.imm == b->v.imm &&
              a->type == b->type;
     default:
       return 0;
   }
 }
 
 /* A compute input register must be unchanged since the earlier compute produced
  * its result, else the recomputation would read different values. */
 static int compute_input_unchanged(const CombineCtx* ctx, const Operand* op,
                                    i32 since_idx) {
   if (op->kind != OPK_REG) return 1; /* immediates never change */
   return !ctx_def_changed_since(ctx, op->cls, op->v.reg, since_idx);
 }
 
 static void compute_cse_record(CombineCtx* ctx, const Inst* in, i32 i) {
   if (!compute_is_cseable(in)) return;
   ComputeCseEntry* e = &ctx->compute_cse[ctx->compute_cse_next];
   e->inst_idx = i;
   e->dst = in->opnds[0];
   e->op = in->op;
   e->flags = in->flags;
   e->result_type = in->type;
   e->sub = in->extra.imm;
   e->a = in->opnds[1];
   if ((IROp)in->op == IR_BINOP)
     e->b = in->opnds[2];
   else
     memset(&e->b, 0, sizeof e->b); /* unary sentinel: kind == 0 */
   ctx->compute_cse_next =
       (ctx->compute_cse_next + 1u) % COMBINE_COMPUTE_CSE_SLOTS;
 }
 
 static int try_local_compute_cse(CombineCtx* ctx, Inst* in, i32 i) {
   if (!compute_is_cseable(in)) return 0;
   IROp op = (IROp)in->op;
   const Operand* a = &in->opnds[1];
   const Operand* b = (op == IR_BINOP) ? &in->opnds[2] : NULL;
   for (u32 k = 0; k < COMBINE_COMPUTE_CSE_SLOTS; ++k) {
     const ComputeCseEntry* e = &ctx->compute_cse[k];
     if (e->inst_idx < 0 || e->inst_idx >= i) continue;
     if (e->op != in->op || e->flags != in->flags ||
         e->sub != in->extra.imm)
       continue;
     if (!same_cse_result_shape(in, e->result_type, &e->dst)) continue;
     if (!same_compute_operand(&e->a, a)) continue;
     if (op == IR_BINOP) {
       if (!same_compute_operand(&e->b, b)) continue;
     } else if (e->b.kind != 0) {
       continue; /* recorded as binary; this is unary -> mismatch */
     }
     /* The producer's result register must still be its live producer and
      * unchanged since (so the copy reads the same value). */
     if (ctx_producer_of(ctx, e->dst.cls, e->dst.v.reg) != e->inst_idx) continue;
     if (ctx_def_changed_since(ctx, e->dst.cls, e->dst.v.reg, e->inst_idx))
       continue;
     /* Inputs must be unchanged since the earlier compute, else its recorded
      * result no longer equals recomputing here. */
     if (!compute_input_unchanged(ctx, a, e->inst_idx)) continue;
     if (op == IR_BINOP && !compute_input_unchanged(ctx, b, e->inst_idx))
       continue;
     /* Self-copy is a no-op; skip. Same class only. */
     if (same_phys_reg(&in->opnds[0], &e->dst)) continue;
     if (in->opnds[0].cls != e->dst.cls) continue;
     /* Rewrite the recompute into `copy rD, rP`. */
     in->op = (u16)IR_COPY;
     in->flags = 0;
     in->opnds[1] = e->dst;
     in->nopnds = 2;
     in->extra.imm = 0;
     ctx->block_change_p = 1;
     return 1;
   }
   return 0;
 }
 
 /* ---- Existing IR_RET retarget (kept; runs in the forward pass) ---- */
 
 static int try_ret_retarget(Func* f, Block* bl, i32 i) {
   if (!f->opt_rewritten || i <= 0) return 0;
   Inst* in = &bl->insts[i];
   if ((IROp)in->op != IR_RET) return 0;
   IRRetAux* aux = (IRRetAux*)in->extra.aux;
   Operand* ret_op = NULL;
   Reg ret_reg = REG_NONE;
   if (!aux || !aux->present || !ret_scalar_storage(&aux->val, &ret_op) ||
       !first_return_reg(f, ret_op->cls, &ret_reg) || ret_reg == (Reg)REG_NONE ||
       reg_is_emit_temp(f, ret_op->cls, ret_reg) ||
       ret_reg == ret_op->v.reg)
     return 0;
   Inst* producer = &bl->insts[i - 1u];
   Operand ret_dst = *ret_op;
   ret_dst.v.reg = ret_reg;
   int swap_binop = 0;
   if (producer->nopnds < 1 || !same_phys_reg(&producer->opnds[0], ret_op) ||
       !retarget_producer_legal(producer, &ret_dst, &swap_binop))
     return 0;
   if (swap_binop) {
     Operand tmp = producer->opnds[1];
     producer->opnds[1] = producer->opnds[2];
     producer->opnds[2] = tmp;
   }
   producer->opnds[0] = ret_dst;
   *ret_op = ret_dst;
   return 1;
 }
 
 /* ---- Rewrite 5: constant-fold a convert of a load_imm into a load_imm ----
  *
  * `load_imm rT,k ; convert rD,rT` where the convert is a bit-preserving
  * integer/pointer move collapses to `load_imm rD,k'` (k' = convert applied to
  * k). The original load_imm, now dead, is removed by post-combine DCE.
  *
  * This is the convert-shaped sibling of the load_imm-into-copy fold (see
  * try_substitute / combine_subst_slot). It matters for pointer-typed constant
  * call args (e.g. NewTreeNode((void*)0, ...)): the arg-register hint reaches
  * the convert's def but not its load_imm source, so without this the source
  * lands in a scratch and the convert emits a `mov rD, scratch`. Folding lets
  * the load_imm inherit the convert's (hinted) dst directly — `movz x0, 0`. */
 static int try_fold_const_convert(CombineCtx* ctx, Inst* in, i32 i) {
   if ((IROp)in->op != IR_CONVERT || in->nopnds < 2) return 0;
   if (in->opnds[0].kind != OPK_REG || in->opnds[1].kind != OPK_REG) return 0;
   /* Integer/pointer domain only: a load_imm produces an int-class value, and
    * the bit-preserving convert kinds we fold (BITCAST/ZEXT/SEXT/TRUNC) keep it
    * int-class. A class change (RC_INT->RC_FP, e.g. an int->float bitcast) is
    * not bit-preserving and must not collapse to a load_imm. */
   if (in->opnds[0].cls != RC_INT || in->opnds[1].cls != RC_INT) return 0;
 
   i32 prod_idx = ctx_producer_of(ctx, in->opnds[1].cls, in->opnds[1].v.reg);
   if (prod_idx < 0 || prod_idx >= i) return 0;
   Inst* prod = &ctx->bl->insts[prod_idx];
   if ((IROp)prod->op != IR_LOAD_IMM || prod->nopnds < 1 ||
       prod->opnds[0].kind != OPK_REG ||
       !same_phys_reg(&prod->opnds[0], &in->opnds[1]))
     return 0;
 
   u32 sb = combine_scalar_width_bytes(ctx->f, in->opnds[1].type);
   u32 db = combine_scalar_width_bytes(ctx->f, in->opnds[0].type);
   i64 value = 0;
   if (!const_convert_value((ConvKind)in->extra.imm, prod->extra.imm, sb, db,
                            &value))
     return 0;
 
   /* Single-use + not-live-out gate on the load_imm dst, mirroring the SK_IMM
    * gate in try_substitute_for_reg: only fold when this convert is the sole
    * use, so we replace rather than duplicate the materialization. */
   Operand src_def = prod->opnds[0];
   int killed = 0;
   if (count_uses_in_live_range(ctx->f, ctx->bl, prod_idx, &src_def, &killed) !=
       1)
     return 0;
   if (!killed && opt_block_live_out_has_phys_reg(ctx->f, ctx->hard_live,
                                                  ctx->bl->id, &src_def))
     return 0;
 
   /* Rewrite the convert in place into a load_imm of the converted constant.
    * The dst operand (opnds[0]) is the hinted arg/return reg and is kept; the
    * source operand is dropped. The dead load_imm at prod_idx is left for DCE.
    */
   in->op = (u16)IR_LOAD_IMM;
   in->type = in->opnds[0].type;
   in->nopnds = 1;
   in->extra.imm = value;
   ctx->block_change_p = 1;
   return 1;
 }
 
 /* ---- Rewrite 7 (W6): cmp-immediate folding ----
  *
  * O1.md W6. A small constant that feeds a compare can be materialized into a
  * register too late for the emitter's inline-immediate path — e.g. when the
  * `load_imm` of the constant is separated from the `cmp` by a call barrier, the
  * constant survives in a callee-saved register and the compare reads it as a
  * register (`movz w20,#7 ; ... ; cmp w19,w20`). The emitter already routes the
  * compare's immediate slot through `operand_imm_or_reg(..., NATIVE_IMM_CMP)`, so
  * presenting the value as an OPK_IMM there collapses it to `cmp w19,#7`.
  *
  * We track, per integer hard register, the constant a reaching IR_LOAD_IMM put
  * there (const_val / const_valid). On a cmp/cmp_branch we replace an immediate-
  * slot register operand holding a target-legal constant with that immediate.
  * Tracking is invalidated precisely (opt_inst_reg_effects gives each inst's
  * def + clobber set), so a constant in a callee-saved register survives calls
  * that preserve it. Linear: O(1) bookkeeping per inst. */
 
 /* Record / invalidate the per-register known-constant state after visiting the
  * inst at index `i`. Must run for EVERY inst (called from the forward driver),
  * so the tracking stays sound across barriers and redefinitions. */
 static void ctx_track_const(CombineCtx* ctx, const Inst* in,
                             const OptHardRegSet* kills) {
   /* Any register this inst defines or clobbers no longer holds its old known
    * constant. (RC_INT only — cmp immediates are integer.) */
   ctx->const_valid &= ~kills->cls[RC_INT];
   /* A load_imm of an integer hard register records the new constant. */
   if ((IROp)in->op == IR_LOAD_IMM && in->nopnds >= 1 &&
       in->opnds[0].kind == OPK_REG && in->opnds[0].cls == RC_INT &&
       in->opnds[0].v.reg < OPT_MAX_HARD_REGS) {
     Reg r = in->opnds[0].v.reg;
     ctx->const_val[r] = in->extra.imm;
     ctx->const_valid |= 1u << r;
   }
 }
 
 static int reg_known_const(const CombineCtx* ctx, const Operand* op, i64* out) {
   if (!op || op->kind != OPK_REG || op->cls != RC_INT) return 0;
   if (op->v.reg >= OPT_MAX_HARD_REGS) return 0;
   if (!(ctx->const_valid & (1u << op->v.reg))) return 0;
   *out = ctx->const_val[op->v.reg];
   return 1;
 }
 
 /* Fold the immediate-slot operand of a cmp/cmp_branch from a register holding a
  * known constant into an inline OPK_IMM, when the target can encode it. The
  * immediate slot is opnds[2] for IR_CMP and opnds[1] for IR_CMP_BRANCH (opnds
  * before it are the materialized LHS). */
 static int try_cmp_imm_fold(CombineCtx* ctx, Inst* in) {
   if (!ctx->target || !ctx->target->imm_legal) return 0;
   u32 slot;
   if ((IROp)in->op == IR_CMP)
     slot = 2u;
   else if ((IROp)in->op == IR_CMP_BRANCH)
     slot = 1u;
   else
     return 0;
   if (slot >= in->nopnds) return 0;
   Operand* op = &in->opnds[slot];
   i64 k;
   if (!reg_known_const(ctx, op, &k)) return 0;
   u32 cmpop = (u32)in->extra.imm;
   if (!ctx->target->imm_legal(ctx->target, NATIVE_IMM_CMP, cmpop, op->type, k))
     return 0;
   KitCgTypeId type = op->type;
   u8 cls = op->cls;
   memset(op, 0, sizeof *op);
   op->kind = OPK_IMM;
   op->cls = cls;
   op->type = type;
   op->v.imm = k;
   ctx->block_change_p = 1;
   return 1;
 }
 
 /* ---- per-BB driver ---- */
 
 static int opt_combine_fold_block(Func* f, Block* bl,
                                   const OptHardBlockLive* hard_live,
                                   NativeTarget* target) {
   enum { enable_o1_combine_rewrites = 1 };
   enum { enable_o1_sink_rewrites = 1 };
   CombineCtx ctx;
   ctx.f = f;
   ctx.bl = bl;
   ctx.target = target;
   ctx.hard_live = hard_live;
   ctx_reset(&ctx);
 
   for (i32 i = 0; i < (i32)bl->ninsts; ++i) {
     Inst* in = &bl->insts[i];
 
     if (enable_o1_combine_rewrites && try_ret_retarget(f, bl, i)) {
       ctx.block_change_p = 1;
       /* The producer's destination changed. Remove every old effect no longer
        * present, then record its canonical post-rewrite effects. */
       Inst* prev = &bl->insts[i - 1];
       OptHardRegSet kills;
       opt_inst_reg_kills(f, prev, &kills);
       for (u8 c = 0; c < OPT_REG_CLASSES; ++c) {
         for (Reg r = 0; r < OPT_MAX_HARD_REGS; ++r) {
           if (ctx.last_def[c][r] == i - 1 &&
               !(kills.cls[c] & (1u << r))) {
             Operand probe;
             memset(&probe, 0, sizeof probe);
             probe.kind = OPK_REG;
             probe.cls = c;
             probe.v.reg = r;
             ctx_restore_removed_def(&ctx, &probe, i - 1);
           }
         }
       }
       ctx_record(&ctx, prev, &kills, i - 1);
     }
 
     /* Skip NOPs left by prior sink rewrites. */
     if ((IROp)in->op == IR_NOP) continue;
 
     if (enable_o1_sink_rewrites && try_sink(&ctx, in, i)) {
       /* sink NOP'd the copy and updated ctx. */
       continue;
     }
 
     if (enable_o1_combine_rewrites) {
       /* W1a addr-of CSE first: if it rewrites the addr_of into a copy, record
        * it as an ordinary reg def (not as an addr-of producer) below. */
       try_addr_of_cse(&ctx, in, i);
       try_fold_const_convert(&ctx, in, i);
       try_combine_exts(&ctx, in, i);
       /* L4: collapse a double-cset bool re-normalize (outer IR_CMP of an inner
        * 0/1 bool against 0/1) before L2/substitution see the outer's consumer. */
       try_drop_double_cmp(&ctx, in, i);
       /* L2: fuse a same-block cmp feeding the IR_CMP_BRANCH terminator into a
        * direct relational branch (run before try_cmp_imm_fold so the cmp's
        * immediate slot still folds on the fused branch). */
       try_fuse_cmp_branch(&ctx, in, i);
       try_substitute(&ctx, in, i);
       try_addr_synth(&ctx, in, i);
       /* L7: fold a single-use left shift into this binop's shifted-register
        * form. Run after substitution (so a copy-propagated rhs is resolved)
        * and after addr-synth (address shifts go into the EA, not the ALU
        * rider), and before the compute-CSE record below so the ridered operand
        * shape is what gets recorded. */
       try_fold_shift_into_alu(&ctx, in, i);
       /* W5: same-block redundant-load + pure-compute reuse. Run after
        * addr-synth so both the recorded entries and this lookup see the
        * canonical (post-fold) address/operand shapes. Each turns the redundant
        * inst into an IR_COPY off the still-live earlier producer; copy-prop +
        * DCE then retire it (worst case: a same-cost register move). */
       try_local_load_cse(&ctx, in, i);
       try_local_compute_cse(&ctx, in, i);
       /* W6: fold a register holding a known constant into a compare's inline
        * immediate slot (reads the constant tracker maintained below). */
       try_cmp_imm_fold(&ctx, in);
     }
 
     /* Track this inst as an addr-of producer for later W1a CSE (only when it is
      * still an addr-of: a prior rewrite may have turned it into a copy). Same
      * for the W5 load / pure-compute rings (recorded only when the inst is
      * still a load / binop / unop after the rewrites above). */
     addr_cse_record(&ctx, in, i);
     load_cse_record(&ctx, in, i);
     compute_cse_record(&ctx, in, i);
     {
       OptHardRegSet kills;
       opt_inst_reg_kills(f, in, &kills);
       ctx_record(&ctx, in, &kills, i);
       /* W6: update the per-register known-constant tracker for this inst
        * (after rewrites, so a load_imm produced/rewritten here is recorded). */
       ctx_track_const(&ctx, in, &kills);
     }
   }
   return ctx.block_change_p;
 }
 
 static int opt_combine_compact_block(Func* f, Block* bl) {
   u32 w = 0;
   int changed = 0;
   for (u32 i = 0; i < bl->ninsts; ++i) {
     Inst* in = &bl->insts[i];
 
     /* Drop NOPs (e.g. copies sunk by try_sink). */
     if ((IROp)in->op == IR_NOP) {
       changed = 1;
       continue;
     }
 
     if ((IROp)in->op == IR_COPY && in->nopnds == 2 &&
         same_reg_operand(&in->opnds[0], &in->opnds[1])) {
       changed = 1;
       continue;
     }
 
     if (w) {
       Inst* prev = &bl->insts[w - 1u];
       SpillAccess prev_access;
       SpillAccess in_access;
       int prev_is_spill = direct_spill_access(f, prev, &prev_access);
       int in_is_spill = direct_spill_access(f, in, &in_access);
       if (prev_is_spill && in_is_spill &&
           prev_access.kind == SPILL_ACCESS_STORE &&
           in_access.kind == SPILL_ACCESS_LOAD &&
           same_spill_shape(&prev_access, &in_access) &&
           same_reg_operand(prev_access.value, in_access.value)) {
         changed = 1;
         continue;
       }
       /* L1 (O1-PATTERNS): store->load forwarding across a register mismatch.
        * `str rX,[slot]; ldr rY,[slot]` (rX != rY, same slot+size) reloads a
        * value the just-stored register rX still holds. The store and load are
        * adjacent in the COMPACTED stream (prev is the immediately-preceding
        * kept inst; only NOPs — which clobber nothing — may have sat between
        * them), so rX is unchanged and the slot is unwritten between the two:
        * the exact no-clobber adjacency the same-reg case above relies on.
        * Rewrite the reload in place to `copy rY <- rX`; the next fold iteration
        * copy-propagates rX into rY's uses (often deleting the copy), and once
        * rX is dead with the slot unread, W8 stack-DSE + mir_dce retire the
        * store. Guard: only when the stored value is a register of the load
        * dst's class (an immediate/odd-class store is left as a real reload). */
       if (prev_is_spill && in_is_spill &&
           prev_access.kind == SPILL_ACCESS_STORE &&
           in_access.kind == SPILL_ACCESS_LOAD &&
           same_spill_shape(&prev_access, &in_access) &&
           prev_access.value->kind == OPK_REG &&
           in_access.value->kind == OPK_REG &&
           prev_access.value->cls == in_access.value->cls) {
         in->op = (u16)IR_COPY;
         in->opnds[1] = *prev_access.value;
         in->nopnds = 2;
         memset(&in->extra, 0, sizeof in->extra);
         changed = 1;
         bl->insts[w++] = *in;
         continue;
       }
       if (prev_is_spill && in_is_spill &&
           prev_access.kind == SPILL_ACCESS_LOAD &&
           in_access.kind == SPILL_ACCESS_STORE &&
           same_spill_shape(&prev_access, &in_access) &&
           same_reg_operand(prev_access.value, in_access.value)) {
         changed = 1;
         continue;
       }
       if (prev_is_spill && in_is_spill &&
           prev_access.kind == SPILL_ACCESS_LOAD &&
           in_access.kind == SPILL_ACCESS_LOAD &&
           same_spill_shape(&prev_access, &in_access) &&
           same_reg_operand(prev_access.value, in_access.value)) {
         changed = 1;
         continue;
       }
       if (prev_is_spill && in_is_spill &&
           prev_access.kind == SPILL_ACCESS_STORE &&
           in_access.kind == SPILL_ACCESS_STORE &&
           same_spill_shape(&prev_access, &in_access)) {
         bl->insts[w - 1u] = *in;
         changed = 1;
         continue;
       }
     }
 
     bl->insts[w++] = *in;
   }
   bl->ninsts = w;
   return changed;
 }
 
 /* ---- W8: same-block stack dead-store elimination ----
  *
  * O1.md W8. A forward MIR scan deletes a spill store when a later store in the
  * same block fully overwrites the same stack slot before any possible read.
  * Deliberately narrower than the parked O2 DSE: V1 handles exact direct frame
  * spill stores only (location-MIR IR_COPY/OPK_STACK, exact same
  * {slot,size,addr_space}).
  *
  * Fast design (no per-block hash table, no O(nslots) clear): dense per-FrameSlot
  * side arrays plus a `gen` counter that is bumped at block start AND on any
  * memory barrier instead of clearing the arrays. A slot's pending store is
  * "live" iff seen_gen[slot] == gen. The correctness boundary is aliasing and
  * partial overlap: any unknown memory op, call, asm, intrinsic, atomic,
  * volatile, aggregate, or non-direct local access bumps gen (forgetting all
  * pending stores in O(1)); a different size/addr-space/bit-field shape on the
  * same slot clears just that slot; a direct read of the slot clears it. A
  * deleted store is left as IR_NOP for the existing compaction + mir_dce. */
 
 typedef struct StackDseState {
   u32* seen_gen;    /* per slot (1-based): the gen at which last_store_idx was set */
   i32* last_idx;    /* per slot: index of the pending (not-yet-killed) store */
   u32* last_size;   /* per slot: byte size of the pending store */
   u16* last_aspace; /* per slot: addr_space of the pending store */
   u32 nslots;       /* f->nframe_slots */
   u32 gen;
 } StackDseState;
 
 /* A direct location-MIR spill store (IR_COPY into OPK_STACK). */
 static int dse_direct_spill_store(Func* f, const Inst* in,
                                   SpillAccess* access) {
   SpillAccess found;
   if (!direct_spill_access(f, in, &found) ||
       found.kind != SPILL_ACCESS_STORE)
     return 0;
   if (access) *access = found;
   return 1;
 }
 
 typedef struct StackDseOperandCtx {
   StackDseState* state;
   int forget_defs;
 } StackDseOperandCtx;
 
 /* Every OPK_STACK use is a real read of its spill home, including locations
  * nested in an indirect address or an aux descriptor. A non-candidate stack
  * definition also ends the simple pending-store chain. Use the canonical
  * operand walker so DSE cannot silently acquire a narrower view of MIR than
  * liveness/emission. For a candidate IR_COPY store, its one destination is the
  * new pending store and is therefore retained; any nested source use is still
  * forgotten before that store is recorded. */
 static void stack_dse_forget_operand(Func* f, Inst* in, Operand* op,
                                      int is_def, void* arg) {
   StackDseOperandCtx* ctx = (StackDseOperandCtx*)arg;
   StackDseState* st = ctx ? ctx->state : NULL;
   FrameSlot slot;
   u32 si;
   (void)f;
   (void)in;
   if (!st || !op || op->kind != OPK_STACK || (is_def && !ctx->forget_defs))
     return;
   slot = op->v.frame_slot;
   if (slot == FRAME_SLOT_NONE || slot > st->nslots) return;
   si = slot - 1u;
   if (st->seen_gen[si] == st->gen) st->seen_gen[si] = st->gen - 1u;
 }
 
 static void stack_dse_block(Func* f, Block* bl, StackDseState* st,
                             int* changed) {
   if (st->nslots == 0) return;
   ++st->gen; /* block start: forget all pending stores */
   for (u32 i = 0; i < bl->ninsts; ++i) {
     Inst* in = &bl->insts[i];
     if ((IROp)in->op == IR_NOP) continue;
 
     SpillAccess access;
     int candidate_store = dse_direct_spill_store(f, in, &access);
     StackDseOperandCtx operand_ctx;
     operand_ctx.state = st;
     operand_ctx.forget_defs = !candidate_store;
     opt_walk_inst_operands(f, in, stack_dse_forget_operand, &operand_ctx);
 
     /* Accepted direct spill store: try to kill a prior pending store of the
      * exact same key, then record this one. */
     if (candidate_store && access.slot >= 1u && access.slot <= st->nslots) {
       u32 sz = access.size;
       u16 as = access.addr_space;
       u32 si = access.slot - 1u;
       if (st->seen_gen[si] == st->gen) {
         if (st->last_size[si] == sz && st->last_aspace[si] == as) {
           /* Same {slot,size,addr_space}: the prior store is fully overwritten
            * before any read -> dead. NOP it; this store becomes the pending
            * one. */
           Inst* dead = &bl->insts[st->last_idx[si]];
           dead->op = (u16)IR_NOP;
           dead->def = VAL_NONE;
           dead->ndefs = 0;
           dead->defs = NULL;
           dead->nopnds = 0;
           dead->opnds = NULL;
           *changed = 1;
         }
         /* else: different size/addr-space shape on this slot -> the entry is
          * about to be replaced by this store's shape anyway; fall through. */
       }
       st->seen_gen[si] = st->gen;
       st->last_idx[si] = (i32)i;
       st->last_size[si] = sz;
       st->last_aspace[si] = as;
       continue;
     }
 
     /* The canonical operand walk above already consumed every explicit spill
      * read, including stack-valued arithmetic, aux operands, and spilled
      * indirect components. Any remaining plain memory read cannot alias an
      * FS_SPILL slot: those homes are allocator-private and never address-taken.
      * A struct-field/global/heap read is therefore transparent to this
      * spill-only DSE. */
     /* Any other memory writer is a full barrier: a non-spill / non-direct store
      * (handled per-slot above only for direct spill stores), an aggregate op, a
      * call/asm/intrinsic, or an atomic/volatile access. These could, in
      * principle, touch state this narrow pass does not model, so forget every
      * pending store in O(1) by bumping gen. (Plain register-only insts —
      * binop/copy/convert/load_imm/etc. — are transparent.) */
     if (inst_writes_memory(in)) {
       ++st->gen;
       continue;
     }
 
     if (inst_reads_memory(in)) continue;
   }
 }
 
 void opt_combine(Func* f, NativeTarget* target) {
   if (!f) return;
   opt_analysis_invalidate(f, OPT_ANALYSIS_DEF_USE);
   OptHardBlockLive* hard_live = opt_maybe_build_hard_live(f);
 
   /* W8 side arrays, allocated once per function (frame slots are dense). */
   StackDseState dse;
   memset(&dse, 0, sizeof dse);
   dse.nslots = f->nframe_slots;
   if (dse.nslots) {
     dse.seen_gen = arena_array(f->arena, u32, dse.nslots);
     dse.last_idx = arena_array(f->arena, i32, dse.nslots);
     dse.last_size = arena_array(f->arena, u32, dse.nslots);
     dse.last_aspace = arena_array(f->arena, u16, dse.nslots);
     memset(dse.seen_gen, 0, sizeof(u32) * dse.nslots);
     dse.gen = 0;
   }
 
   /* Per-BB fixpoint, matching MIR's combine loop (mir-gen.c:9037-9038). */
   /* Per-BB fixpoint with a defensive iteration cap. Each rewrite is supposed
    * to be monotonic (it only fires when it strictly improves the IR), so we
    * shouldn't hit the cap in practice — but a noisy abort beats a hang if a
    * future rewrite accidentally oscillates. */
   enum { MAX_COMBINE_ITERS = 64 };
   for (u32 b = 0; b < f->nblocks; ++b) {
     Block* bl = &f->blocks[b];
     for (int iter = 0; iter < MAX_COMBINE_ITERS; ++iter) {
       int folded = opt_combine_fold_block(f, bl, hard_live, target);
       /* W8 same-block stack DSE right before compaction; NOP'd stores are
        * dropped by opt_combine_compact_block (and their dead source producers
        * by the following mir_dce). */
       int dse_changed = 0;
       stack_dse_block(f, bl, &dse, &dse_changed);
       int compacted = opt_combine_compact_block(f, bl);
       if (!folded && !dse_changed && !compacted) break;
     }
   }
 }