kit

pass_combine.c (54369B)

---

 #include <kit/cg.h>
 #include <stdint.h>
 #include <string.h>
 
 #include "cg/ir_eval.h"
 #include "core/arena.h"
 #include "opt/opt_internal.h"
 
 enum {
   COMBINE_CG_TYPE_SEG_SHIFT = 6,
   COMBINE_CG_TYPE_SEG_MASK = (1u << COMBINE_CG_TYPE_SEG_SHIFT) - 1u,
   COMBINE_CG_TYPE_BUILTIN_SEG = 1u,
 };
 
 /* O1 combine, MIR-shaped (see mir-gen.c:8808-9146). One forward pass per BB
  * maintains last-def / last-mem-def tracking; per-BB fixpoint loop iterates
  * until no fold fires. Rewrites in this file:
  *
  *   1. Substitute producer source into consumer operand
  *      (IR_COPY / IR_LOAD_IMM / IR_CONVERT producer; into register slot,
  *       indirect base, or indirect index).
  *   2. Address-mode synthesis (IR_BINOP IADD/ISHL producer; into OPK_INDIRECT
  *       base/index/scale/ofs).
  *   3. Sink producer into single-use IR_COPY destination.
  *   4. combine_exts: fold ext-of-ext chains with size+signedness rules.
  *
  * Spill compaction (store-then-reload, etc.) and self-copy removal continue
  * to run in opt_combine_compact_block, unchanged. */
 
 /* ---- shared helpers (operand inspection / counting) ---- */
 
 static int same_reg_operand(const Operand* a, const Operand* b) {
   return a->kind == OPK_REG && b->kind == OPK_REG && a->cls == b->cls &&
          a->v.reg == b->v.reg;
 }
 
 static int frame_slot_is_spill(Func* f, FrameSlot fs) {
   if (fs == FRAME_SLOT_NONE || fs > f->nframe_slots) return 0;
   return f->frame_slots[fs - 1u].kind == FS_SPILL;
 }
 
 static int spill_local_slot(Func* f, const Operand* addr, const MemAccess* mem,
                             FrameSlot* out) {
   if (!addr || addr->kind != OPK_LOCAL) return 0;
   if (opt_mem_observable(mem)) return 0;
   if (mem->alias.kind != ALIAS_LOCAL) return 0;
   if (mem->alias.v.local_id != (i32)addr->v.frame_slot) return 0;
   if (!frame_slot_is_spill(f, addr->v.frame_slot)) return 0;
   *out = addr->v.frame_slot;
   return 1;
 }
 
 static int same_spill_access(Func* f, const Inst* a, const Inst* b,
                              FrameSlot* slot_out) {
   FrameSlot as = FRAME_SLOT_NONE;
   FrameSlot bs = FRAME_SLOT_NONE;
   if (!spill_local_slot(f, &a->opnds[0], &a->extra.mem, &as)) return 0;
   if (!spill_local_slot(f, &b->opnds[0], &b->extra.mem, &bs)) return 0;
   if (as != bs) return 0;
   if (a->extra.mem.size != b->extra.mem.size) return 0;
   if (a->extra.mem.addr_space != b->extra.mem.addr_space) return 0;
   if (slot_out) *slot_out = as;
   return 1;
 }
 
 static int load_spill_slot(Func* f, const Inst* in, FrameSlot* slot_out) {
   if ((IROp)in->op != IR_LOAD || in->nopnds < 2) return 0;
   return spill_local_slot(f, &in->opnds[1], &in->extra.mem, slot_out);
 }
 
 static int store_spill_slot(Func* f, const Inst* in, FrameSlot* slot_out) {
   if ((IROp)in->op != IR_STORE || in->nopnds < 2) return 0;
   return spill_local_slot(f, &in->opnds[0], &in->extra.mem, slot_out);
 }
 
 static int same_spill_slot_and_size(Func* f, const Inst* a, const Inst* b) {
   FrameSlot as = FRAME_SLOT_NONE;
   FrameSlot bs = FRAME_SLOT_NONE;
   if ((IROp)a->op == IR_LOAD) {
     if (!load_spill_slot(f, a, &as)) return 0;
   } else if (!store_spill_slot(f, a, &as)) {
     return 0;
   }
   if ((IROp)b->op == IR_LOAD) {
     if (!load_spill_slot(f, b, &bs)) return 0;
   } else if (!store_spill_slot(f, b, &bs)) {
     return 0;
   }
   return as == bs && a->extra.mem.size == b->extra.mem.size &&
          a->extra.mem.addr_space == b->extra.mem.addr_space;
 }
 
 static int same_phys_reg(const Operand* a, const Operand* b) {
   return a && b && a->kind == OPK_REG && b->kind == OPK_REG &&
          a->cls == b->cls && a->v.reg == b->v.reg;
 }
 
 /* Count register references inside a single operand. An OPK_INDIRECT can
  * reference the queried register twice (e.g. `[r4 + r4 * 4]`); we return the
  * true count so single-use accounting is exact. */
 static int count_operand_phys_uses(const Operand* op, const Operand* r) {
   if (!op || !r || r->kind != OPK_REG) return 0;
   if (op->kind == OPK_REG)
     return op->cls == r->cls && op->v.reg == r->v.reg ? 1 : 0;
   if (op->kind == OPK_INDIRECT) {
     if (r->cls != RC_INT) return 0;
     int n = 0;
     if (op->v.ind.base == r->v.reg) ++n;
     if (op->v.ind.index != (Reg)REG_NONE && op->v.ind.index == r->v.reg) ++n;
     return n;
   }
   return 0;
 }
 
 static int operand_uses_phys_reg(const Operand* op, const Operand* r) {
   return count_operand_phys_uses(op, r) > 0;
 }
 
 static int abi_uses_phys_reg(const CGABIValue* v, const Operand* r) {
   int n = 0;
   if (!v) return 0;
   n += count_operand_phys_uses(&v->storage, r);
   for (u32 i = 0; i < v->nparts; ++i)
     n += count_operand_phys_uses(&v->parts[i].op, r);
   return n;
 }
 
 static int inst_uses_phys_reg(const Inst* in, const Operand* r) {
   int n = 0;
   switch ((IROp)in->op) {
     case IR_COPY:
     case IR_CONVERT:
     case IR_UNOP:
     case IR_VA_ARG:
       if (in->nopnds >= 2) n += count_operand_phys_uses(&in->opnds[1], r);
       break;
     case IR_LOAD:
     case IR_ADDR_OF:
     case IR_BITFIELD_LOAD:
     case IR_ATOMIC_LOAD:
       if (in->nopnds >= 2) n += count_operand_phys_uses(&in->opnds[1], r);
       break;
     case IR_BINOP:
     case IR_CMP:
       if (in->nopnds >= 2) n += count_operand_phys_uses(&in->opnds[1], r);
       if (in->nopnds >= 3) n += count_operand_phys_uses(&in->opnds[2], r);
       break;
     case IR_STORE:
     case IR_AGG_COPY:
     case IR_AGG_SET:
     case IR_BITFIELD_STORE:
     case IR_VA_COPY:
       if (in->nopnds >= 1) n += count_operand_phys_uses(&in->opnds[0], r);
       if (in->nopnds >= 2) n += count_operand_phys_uses(&in->opnds[1], r);
       break;
     case IR_CALL: {
       IRCallAux* aux = (IRCallAux*)in->extra.aux;
       if (!aux) break;
       if (aux->use_plan_replay) {
         n += count_operand_phys_uses(&aux->plan.callee, r);
         for (u32 i = 0; i < aux->plan.nargs; ++i)
           n += count_operand_phys_uses(&aux->plan.args[i].src, r);
       } else {
         n += count_operand_phys_uses(&aux->desc.callee, r);
         for (u32 i = 0; i < aux->desc.nargs; ++i)
           n += abi_uses_phys_reg(&aux->desc.args[i], r);
       }
       break;
     }
     case IR_CMP_BRANCH:
     case IR_CONDBR:
     case IR_SWITCH:
     case IR_INDIRECT_BRANCH:
       for (u32 i = 0; i < in->nopnds; ++i)
         n += count_operand_phys_uses(&in->opnds[i], r);
       break;
     case IR_RET: {
       IRRetAux* aux = (IRRetAux*)in->extra.aux;
       if (aux && aux->present) n += abi_uses_phys_reg(&aux->val, r);
       break;
     }
     case IR_SCOPE_BEGIN:
       break;
     case IR_ALLOCA:
       if (in->nopnds >= 2) n += count_operand_phys_uses(&in->opnds[1], r);
       break;
     case IR_VA_START:
     case IR_VA_END:
       if (in->nopnds >= 1) n += count_operand_phys_uses(&in->opnds[0], r);
       break;
     case IR_ATOMIC_STORE:
       if (in->nopnds >= 1) n += count_operand_phys_uses(&in->opnds[0], r);
       if (in->nopnds >= 2) n += count_operand_phys_uses(&in->opnds[1], r);
       break;
     case IR_ATOMIC_RMW:
       if (in->nopnds >= 2) n += count_operand_phys_uses(&in->opnds[1], r);
       if (in->nopnds >= 3) n += count_operand_phys_uses(&in->opnds[2], r);
       break;
     case IR_ATOMIC_CAS:
       if (in->nopnds >= 3) n += count_operand_phys_uses(&in->opnds[2], r);
       if (in->nopnds >= 4) n += count_operand_phys_uses(&in->opnds[3], r);
       if (in->nopnds >= 5) n += count_operand_phys_uses(&in->opnds[4], r);
       break;
     case IR_ASM_BLOCK: {
       IRAsmAux* aux = (IRAsmAux*)in->extra.aux;
       if (!aux) break;
       for (u32 i = 0; i < aux->nin; ++i)
         n += count_operand_phys_uses(&aux->in_ops[i], r);
       break;
     }
     case IR_INTRINSIC: {
       IRIntrinAux* aux = (IRIntrinAux*)in->extra.aux;
       if (!aux) break;
       for (u32 i = 0; i < aux->narg; ++i)
         n += count_operand_phys_uses(&aux->args[i], r);
       break;
     }
     default:
       break;
   }
   return n;
 }
 
 static int abi_defines_phys_reg(const CGABIValue* v, const Operand* r) {
   int n = 0;
   if (!v) return 0;
   if (same_phys_reg(&v->storage, r)) ++n;
   for (u32 i = 0; i < v->nparts; ++i)
     if (same_phys_reg(&v->parts[i].op, r)) ++n;
   return n;
 }
 
 static int inst_defines_phys_reg(const Inst* in, const Operand* r) {
   if (!r || r->kind != OPK_REG) return 0;
   switch ((IROp)in->op) {
     case IR_LOAD_IMM:
     case IR_LOAD_CONST:
     case IR_LOAD_LABEL_ADDR:
     case IR_COPY:
     case IR_LOAD:
     case IR_ADDR_OF:
     case IR_TLS_ADDR_OF:
     case IR_BITFIELD_LOAD:
     case IR_BINOP:
     case IR_UNOP:
     case IR_CMP:
     case IR_CONVERT:
     case IR_ALLOCA:
     case IR_VA_ARG:
     case IR_ATOMIC_LOAD:
     case IR_ATOMIC_RMW:
       return in->nopnds >= 1 && same_phys_reg(&in->opnds[0], r);
     case IR_CALL: {
       IRCallAux* aux = (IRCallAux*)in->extra.aux;
       if (!aux) return 0;
       if (aux->use_plan_replay) {
         for (u32 i = 0; i < aux->plan.nargs; ++i)
           if (aux->plan.args[i].dst_kind == CG_CALL_PLAN_REG &&
               r->cls == aux->plan.args[i].cls &&
               r->v.reg == aux->plan.args[i].dst_reg)
             return 1;
         for (u32 i = 0; i < aux->plan.nrets; ++i)
           if ((r->cls == aux->plan.rets[i].cls &&
                r->v.reg == aux->plan.rets[i].src_reg) ||
               same_phys_reg(&aux->plan.rets[i].dst, r))
             return 1;
         return 0;
       }
       return abi_defines_phys_reg(&aux->desc.ret, r);
     }
     case IR_ATOMIC_CAS:
       return (in->nopnds >= 1 && same_phys_reg(&in->opnds[0], r)) ||
              (in->nopnds >= 2 && same_phys_reg(&in->opnds[1], r));
     case IR_ASM_BLOCK: {
       IRAsmAux* aux = (IRAsmAux*)in->extra.aux;
       if (!aux) return 0;
       for (u32 i = 0; i < aux->nout; ++i)
         if (same_phys_reg(&aux->out_ops[i], r)) return 1;
       if (r->cls < OPT_REG_CLASSES && r->v.reg < 32 &&
           (aux->clobber_mask[r->cls] & (1u << r->v.reg)))
         return 1;
       return 0;
     }
     case IR_INTRINSIC: {
       IRIntrinAux* aux = (IRIntrinAux*)in->extra.aux;
       if (!aux) return 0;
       for (u32 i = 0; i < aux->ndst; ++i)
         if (same_phys_reg(&aux->dsts[i], r)) return 1;
       return 0;
     }
     default:
       return 0;
   }
 }
 
 /* True if `in` may write to memory. Used to invalidate memory-reading
  * producers (IR_LOAD) when the consumer is past an intervening write. */
 static int inst_writes_memory(const Inst* in) {
   switch ((IROp)in->op) {
     case IR_STORE:
     case IR_AGG_COPY:
     case IR_AGG_SET:
     case IR_BITFIELD_STORE:
     case IR_ATOMIC_STORE:
     case IR_ATOMIC_RMW:
     case IR_ATOMIC_CAS:
     case IR_CALL:
     case IR_ASM_BLOCK:
     case IR_INTRINSIC:
       return 1;
     default:
       return 0;
   }
 }
 
 static int inst_reads_memory(const Inst* in) {
   switch ((IROp)in->op) {
     case IR_LOAD:
     case IR_BITFIELD_LOAD:
     case IR_ATOMIC_LOAD:
       return 1;
     default:
       return 0;
   }
 }
 
 /* ---- substitution-slot whitelist (operand positions that accept a register
  * substitute, an immediate substitute, or are valid for ext-of-ext folding)
  * ---- */
 
 typedef enum SubstKind {
   SK_REG, /* register-to-register (IR_COPY producer) */
   SK_IMM, /* register-to-immediate (IR_LOAD_IMM producer) */
   SK_CV,  /* register-to-register through identical convert (IR_CONVERT prod) */
 } SubstKind;
 
 /* Returns 1 if the given operand-index `idx` of `in` is foldable for `kind`.
  * SK_REG / SK_CV: register substitution slots. SK_IMM: immediate substitution
  * slots. */
 static int combine_subst_slot(const Inst* in, u32 idx, SubstKind kind,
                               int copy_imm_ok) {
   switch ((IROp)in->op) {
     case IR_COPY:
       /* Normally IR_COPY stays register-to-register so that, after coalescing
        * assigns src and dst the same hard reg, it becomes a self-copy combine
        * removes. The O1 path never coalesces, so folding the immediate
        * (copy_imm_ok) collapses `load_imm rT,k; copy rD,rT` into `copy rD,#k`,
        * which the emit path turns into a single `load_imm rD,k`. */
       return (kind != SK_IMM || copy_imm_ok) && idx == 1;
     case IR_UNOP:
       return kind != SK_IMM && idx == 1;
     case IR_CONVERT:
       return kind != SK_IMM && idx == 1;
     case IR_BINOP:
     case IR_CMP:
       return idx == 1 || idx == 2;
     case IR_CMP_BRANCH:
       return idx == 0 || idx == 1;
     case IR_CONDBR:
       return kind != SK_IMM && idx == 0;
     case IR_STORE:
       /* opnds[0] is the address; register subst into the indirect base/index
        * is handled separately. The data slot at idx==1 accepts reg or imm. */
       return idx == 1;
     case IR_LOAD:
     case IR_ATOMIC_LOAD:
     case IR_ATOMIC_RMW:
     case IR_BITFIELD_LOAD:
     case IR_BITFIELD_STORE:
     case IR_AGG_COPY:
     case IR_AGG_SET:
       /* OPK_INDIRECT base/index substitution is handled inside
        * subst_consumer_operands; these slots take no direct OPK_REG. */
       return 0;
     case IR_ALLOCA:
       return kind != SK_IMM && idx == 1;
     default:
       return 0;
   }
 }
 
 /* ---- per-BB tracking context ---- */
 
 typedef struct CombineCtx {
   Func* f;
   Block* bl;
   const OptHardBlockLive* hard_live;
   /* Index of the most recent inst in this BB that defined (cls, reg);
    * -1 means no definition seen this BB. */
   i32 last_def[OPT_REG_CLASSES][OPT_MAX_HARD_REGS];
   i32 last_mem_def;
   int block_change_p;
 } CombineCtx;
 
 static void ctx_reset(CombineCtx* ctx) {
   memset(ctx->last_def, 0xff, sizeof ctx->last_def); /* all -1 */
   ctx->last_mem_def = -1;
   ctx->block_change_p = 0;
 }
 
 /* True if `in` is a barrier that conservatively invalidates all prior
  * producers in this BB (modelled after the old find_single_direct_use, which
  * treats every IR_CALL as a clobber regardless of explicit ABI describes). */
 static int inst_is_clobber_barrier(const Inst* in) {
   switch ((IROp)in->op) {
     case IR_CALL:
     case IR_ASM_BLOCK:
     case IR_INTRINSIC:
       return 1;
     default:
       return 0;
   }
 }
 
 static void ctx_record_reg_def(CombineCtx* ctx, const Operand* op, i32 i) {
   if (op->kind != OPK_REG) return;
   if (op->cls >= OPT_REG_CLASSES || op->v.reg >= OPT_MAX_HARD_REGS) return;
   ctx->last_def[op->cls][op->v.reg] = i;
 }
 
 /* After processing inst at index `i`, mark each register it defines (incl.
  * implicit clobbers from CALL / ASM / INTRINSIC) as defined here. Mark
  * memory if this inst writes.
  *
  * Walks the inst's destination operand(s) directly rather than probing every
  * (cls, reg) pair. The barrier case (CALL/ASM/INTRINSIC) keeps a bulk mark
  * because explicit defs/clobbers aren't always populated in IRCallAux at
  * this point in the pipeline. */
 static void ctx_record(CombineCtx* ctx, const Inst* in, i32 i) {
   if (inst_writes_memory(in)) ctx->last_mem_def = i;
   if (inst_is_clobber_barrier(in)) {
     for (u32 c = 0; c < OPT_REG_CLASSES; ++c)
       for (u32 r = 0; r < OPT_MAX_HARD_REGS; ++r) ctx->last_def[c][r] = i;
     return;
   }
   switch ((IROp)in->op) {
     case IR_LOAD_IMM:
     case IR_LOAD_CONST:
     case IR_LOAD_LABEL_ADDR:
     case IR_COPY:
     case IR_LOAD:
     case IR_ADDR_OF:
     case IR_TLS_ADDR_OF:
     case IR_BITFIELD_LOAD:
     case IR_BINOP:
     case IR_UNOP:
     case IR_CMP:
     case IR_CONVERT:
     case IR_ALLOCA:
     case IR_VA_ARG:
     case IR_ATOMIC_LOAD:
     case IR_ATOMIC_RMW:
       if (in->nopnds >= 1) ctx_record_reg_def(ctx, &in->opnds[0], i);
       break;
     case IR_ATOMIC_CAS:
       if (in->nopnds >= 1) ctx_record_reg_def(ctx, &in->opnds[0], i);
       if (in->nopnds >= 2) ctx_record_reg_def(ctx, &in->opnds[1], i);
       break;
     default:
       break;
   }
 }
 
 /* Lookup the producer of (cls, reg) in this BB, if any. Returns -1 if no
  * definer has been seen yet in this BB. */
 static i32 ctx_producer_of(const CombineCtx* ctx, u8 cls, Reg reg) {
   if (reg >= OPT_MAX_HARD_REGS || cls >= OPT_REG_CLASSES) return -1;
   return ctx->last_def[cls][reg];
 }
 
 /* Does (cls, reg) get redefined strictly after `since_idx` (exclusive) in this
  * BB, given current ctx state? We use last_def: if last_def[cls][reg] >
  * since_idx, then yes. (since_idx is typically the producer's index.) */
 static int ctx_def_changed_since(const CombineCtx* ctx, u8 cls, Reg reg,
                                  i32 since_idx) {
   if (reg >= OPT_MAX_HARD_REGS || cls >= OPT_REG_CLASSES) return 0;
   return ctx->last_def[cls][reg] > since_idx;
 }
 
 static i32 ctx_prev_def_before(const CombineCtx* ctx, const Operand* reg,
                                i32 before_idx) {
   if (!reg || reg->kind != OPK_REG) return -1;
   for (i32 j = before_idx - 1; j >= 0; --j) {
     const Inst* prev = &ctx->bl->insts[j];
     if (inst_is_clobber_barrier(prev) || inst_defines_phys_reg(prev, reg))
       return j;
   }
   return -1;
 }
 
 static void ctx_restore_removed_def(CombineCtx* ctx, const Operand* reg,
                                     i32 removed_idx) {
   if (!reg || reg->kind != OPK_REG) return;
   if (reg->cls >= OPT_REG_CLASSES || reg->v.reg >= OPT_MAX_HARD_REGS) return;
   if (ctx->last_def[reg->cls][reg->v.reg] == removed_idx)
     ctx->last_def[reg->cls][reg->v.reg] =
         ctx_prev_def_before(ctx, reg, removed_idx);
 }
 
 /* ---- forward-scan use accounting (used for single-use checks) ---- */
 
 /* Count phys uses of `def` within the live range starting just after
  * `prod_idx`. The live range ends at the first inst that redefines `def`'s
  * physical register or that is a clobber barrier (CALL/ASM/INTRINSIC); uses
  * after that point belong to a different live range of the same physreg and
  * are irrelevant to this producer.
  *
  * `*killed_in_block_out` is set non-zero when the live range terminates
  * inside the block (caller may then skip the cross-block live-out check).
  *
  * Without this live-range scoping, reuse of a scratch physreg later in the
  * block (`sxtw x12, ...; mov x13, x12; mov x12, ...`) makes every fold look
  * multi-use and combine rejects almost everything. */
 /* True if `in` redefines or clobbers `def`'s physical register. Consults the
  * instruction's precise def/clobber set (the same one liveness uses) rather
  * than a blanket clobber-barrier test: a call clobbers only its caller-saved
  * set, so a value held in a callee-saved register survives it. Treating every
  * call as killing every register made `killed` spuriously true and let combine
  * skip the cross-block live-out check, deleting a still-live def. */
 static int inst_kills_phys_reg(Func* f, const Inst* in, const Operand* def) {
   OptHardRegSet use, d;
   if (!def || def->kind != OPK_REG || def->cls >= OPT_REG_CLASSES ||
       def->v.reg >= 32)
     return 0;
   opt_hard_inst_use_def(f, in, &use, &d);
   return (d.cls[def->cls] & (1u << def->v.reg)) != 0;
 }
 
 static int count_uses_in_live_range(Func* f, const Block* bl, i32 prod_idx,
                                     const Operand* def,
                                     int* killed_in_block_out) {
   int n = 0;
   int killed = 0;
   for (i32 i = prod_idx + 1; i < (i32)bl->ninsts; ++i) {
     const Inst* in = &bl->insts[i];
     n += inst_uses_phys_reg(in, def);
     if (inst_kills_phys_reg(f, in, def)) {
       killed = 1;
       break;
     }
   }
   if (killed_in_block_out) *killed_in_block_out = killed;
   return n;
 }
 
 static int use_after_clobber_before_redef(const Block* bl, i32 prod_idx,
                                           const Operand* def) {
   int saw_clobber = 0;
   for (i32 i = prod_idx + 1; i < (i32)bl->ninsts; ++i) {
     const Inst* in = &bl->insts[i];
     if (saw_clobber && inst_uses_phys_reg(in, def)) return 1;
     if (inst_defines_phys_reg(in, def)) return 0;
     if (inst_is_clobber_barrier(in)) saw_clobber = 1;
   }
   return 0;
 }
 
 /* ---- ConvKind helpers (for combine_exts) ---- */
 
 static u32 builtin_int_bytes(KitCgTypeId t) {
   if ((t >> COMBINE_CG_TYPE_SEG_SHIFT) != COMBINE_CG_TYPE_BUILTIN_SEG) return 0;
   KitCgBuiltinType b = (KitCgBuiltinType)(t & COMBINE_CG_TYPE_SEG_MASK);
   switch (b) {
     case KIT_CG_BUILTIN_BOOL:
     case KIT_CG_BUILTIN_I8:
       return 1;
     case KIT_CG_BUILTIN_I16:
       return 2;
     case KIT_CG_BUILTIN_I32:
       return 4;
     case KIT_CG_BUILTIN_I64:
       return 8;
     case KIT_CG_BUILTIN_I128:
       return 16;
     default:
       return 0;
   }
 }
 
 /* For an IR_CONVERT inst, decode (src_bytes, dst_bytes, sign_p). Returns 0
  * if this isn't an integer ext convert (CV_SEXT or CV_ZEXT). */
 static int ext_params(const Inst* in, u32* src_bytes_out, u32* dst_bytes_out,
                       int* sign_p_out) {
   if ((IROp)in->op != IR_CONVERT || in->nopnds < 2) return 0;
   ConvKind k = (ConvKind)in->extra.imm;
   if (k != CV_SEXT && k != CV_ZEXT) return 0;
   u32 sb = builtin_int_bytes(in->opnds[1].type);
   u32 db = builtin_int_bytes(in->opnds[0].type);
   if (!sb || !db || db < sb) return 0;
   *src_bytes_out = sb;
   *dst_bytes_out = db;
   *sign_p_out = (k == CV_SEXT);
   return 1;
 }
 
 /* Width in bytes of a scalar integer or pointer type (1..8), else 0. Mirrors
  * pass_simplify's simplify_width: builtin ints decode without the compiler,
  * pointers fall back to the type-size query. */
 static u32 combine_scalar_width_bytes(Func* f, KitCgTypeId t) {
   u32 b = builtin_int_bytes(t);
   if (b) return b > 8u ? 0u : b;
   if (f->c && kit_cg_type_kind((KitCompiler*)f->c, t) == KIT_CG_TYPE_PTR) {
     u64 sz = kit_cg_type_size((KitCompiler*)f->c, t);
     if (sz && sz <= 8u) return (u32)sz;
   }
   return 0;
 }
 
 /* Compute the constant produced by applying an integer/pointer convert `k`
  * (src width `sb`, dst width `db`, both BYTES) to immediate `imm`. Returns 0
  * for kinds that aren't a bit-preserving integer/pointer move (the float
  * conversions reinterpret the value and must not be folded this way). The
  * materialized-constant model: a load_imm puts (u64)imm into a register, so a
  * widening move/zext keeps the low `sb` bits and a trunc/narrowing keeps the
  * low `db` bits.
  *
  * The arithmetic is the shared cg/ir_eval convert core (in BITS); combine's
  * byte widths convert at the boundary. combine's BITCAST is the bit-preserving
  * register move (== ZEXT here, no equal-width requirement), so it maps to
  * CV_ZEXT rather than the shared eval's stricter equal-width BITCAST. */
 static int const_convert_value(ConvKind k, i64 imm, u32 sb, u32 db, i64* out) {
   if (!sb || !db) return 0;
   if (k == CV_BITCAST) k = CV_ZEXT;
   return kit_ir_eval_convert(k, sb * 8u, db * 8u, imm, out);
 }
 
 /* ---- producer-retarget legality (for sink rewrite) ---- */
 
 /* combine retargets the destination of a commutative producer, so it includes
  * the FP commutatives (FADD/FMUL) on top of the shared integer set. */
 static int binop_is_commutative(BinOp op) {
   return kit_ir_binop_is_commutative_int(op) || op == BO_FADD || op == BO_FMUL;
 }
 
 /* Is `producer` an op whose destination register can be safely retargeted
  * without backend consultation? Excludes ops with implicit destination
  * constraints, ABI pinning, multi-def outputs, or aux-driven dst layout. */
 static int producer_retargetable_op(IROp op) {
   switch (op) {
     case IR_BINOP:
     case IR_UNOP:
     case IR_LOAD_IMM:
     case IR_LOAD_CONST:
     case IR_LOAD:
     case IR_CONVERT:
     case IR_CMP:
     case IR_ADDR_OF:
     case IR_LOAD_LABEL_ADDR:
       return 1;
     default:
       return 0;
   }
 }
 
 /* Can `producer`'s destination be retargeted to `new_dst` without violating
  * IR shape? For binop, may signal that a commutative-swap is needed. */
 static int retarget_producer_legal(Inst* producer, const Operand* new_dst,
                                    int* swap_binop) {
   *swap_binop = 0;
   if (!new_dst || new_dst->kind != OPK_REG) return 0;
   if (producer->nopnds < 1 || producer->opnds[0].kind != OPK_REG) return 0;
   if (producer->opnds[0].cls != new_dst->cls) return 0;
   if (producer->opnds[0].type != new_dst->type) return 0;
 
   switch ((IROp)producer->op) {
     case IR_LOAD_IMM:
     case IR_LOAD_CONST:
     case IR_LOAD_LABEL_ADDR:
     case IR_ADDR_OF:
       /* Single-defining ops with no register source to alias against. */
       return 1;
     case IR_UNOP:
     case IR_CONVERT:
     case IR_LOAD:
       return 1;
     case IR_CMP:
       return 1;
     case IR_BINOP: {
       if (producer->nopnds < 3) return 0;
       int dst_is_lhs = operand_uses_phys_reg(&producer->opnds[1], new_dst);
       int dst_is_rhs = operand_uses_phys_reg(&producer->opnds[2], new_dst);
       if (!dst_is_lhs && !dst_is_rhs) return 1;
       if (dst_is_lhs) return 1;
       if (binop_is_commutative((BinOp)producer->extra.imm)) {
         *swap_binop = 1;
         return 1;
       }
       return 0;
     }
     default:
       return 0;
   }
 }
 
 static int first_return_reg(Func* f, u8 cls, Reg* out) {
   if (!f || cls >= OPT_REG_CLASSES) return 0;
   u32 mask = f->opt_ret_regs[cls];
   for (Reg r = 0; r < 32; ++r) {
     if (mask & (1u << r)) {
       *out = r;
       return 1;
     }
   }
   return 0;
 }
 
 static int ret_scalar_storage(CGABIValue* v, Operand** out) {
   if (!v || v->storage.kind != OPK_REG) return 0;
   if (v->nparts > 1) return 0;
   *out = &v->storage;
   return 1;
 }
 
 static int is_target_scratch_reg(Func* f, u8 cls, Reg reg) {
   if (!f || cls >= OPT_REG_CLASSES) return 0;
   for (u32 i = 0; i < f->opt_scratch_reg_count[cls]; ++i) {
     if (f->opt_scratch_regs[cls][i] == reg) return 1;
   }
   return 0;
 }
 
 /* ---- Rewrite 1: substitute producer source into uses ---- */
 
 /* Set the indirect's base or index to `new_reg`. */
 static void set_indirect_field(Operand* ind, Reg old_reg, Reg new_reg) {
   if (ind->v.ind.base == old_reg) ind->v.ind.base = new_reg;
   if (ind->v.ind.index != (Reg)REG_NONE && ind->v.ind.index == old_reg)
     ind->v.ind.index = new_reg;
 }
 
 /* Substitute `def` -> `src` in a single aux register slot (no slot-index
  * whitelist; caller has already restricted to SK_REG and ensured src is a
  * register). Returns 1 if rewritten. */
 static int subst_one_aux_operand(Operand* op, const Operand* def,
                                  const Operand* src) {
   if (op->kind == OPK_REG && same_phys_reg(op, def)) {
     *op = *src;
     return 1;
   }
   if (op->kind == OPK_INDIRECT && src->kind == OPK_REG && def->cls == RC_INT &&
       src->cls == RC_INT &&
       (op->v.ind.base == def->v.reg ||
        (op->v.ind.index != (Reg)REG_NONE && op->v.ind.index == def->v.reg))) {
     set_indirect_field(op, def->v.reg, src->v.reg);
     return 1;
   }
   return 0;
 }
 
 static int subst_abivalue_uses(CGABIValue* v, const Operand* def,
                                const Operand* src) {
   int n = 0;
   n += subst_one_aux_operand(&v->storage, def, src);
   for (u32 i = 0; i < v->nparts; ++i)
     n += subst_one_aux_operand((Operand*)&v->parts[i].op, def, src);
   return n;
 }
 
 /* Walk the operands of consumer `in` and try to substitute uses of `def`
  * (producer's destination, OPK_REG) with `src` (producer's source, OPK_REG
  * or OPK_IMM). For OPK_INDIRECT operands, substitution into base/index is
  * only valid for OPK_REG `src`. Returns the number of operands actually
  * rewritten. */
 static int subst_consumer_operands(Inst* in, const Operand* def,
                                    const Operand* src, SubstKind kind,
                                    int copy_imm_ok) {
   int n = 0;
   for (u32 oi = 0; oi < in->nopnds; ++oi) {
     Operand* op = &in->opnds[oi];
     /* Direct OPK_REG substitution: requires the slot to be on the whitelist. */
     if (op->kind == OPK_REG && same_phys_reg(op, def) &&
         combine_subst_slot(in, oi, kind, copy_imm_ok)) {
       *op = *src;
       ++n;
       continue;
     }
     /* Indirect base/index substitution: only OPK_REG src may land here. The
      * substitution only changes which register computes the address, not the
      * value being stored — safe for IR_STORE / IR_ATOMIC_STORE /
      * IR_BITFIELD_STORE / IR_AGG_COPY / IR_AGG_SET as well. */
     if (op->kind == OPK_INDIRECT && kind == SK_REG && src->kind == OPK_REG &&
         def->kind == OPK_REG && def->cls == RC_INT && src->cls == RC_INT &&
         (op->v.ind.base == def->v.reg ||
          (op->v.ind.index != (Reg)REG_NONE && op->v.ind.index == def->v.reg))) {
       set_indirect_field(op, def->v.reg, src->v.reg);
       ++n;
     }
   }
 
   /* Aux register uses: IR_CALL plan/desc args + callee. SK_REG only —
    * substituting an immediate or convert into an ABI-bound use would break
    * the call lowering. IR_RET is intentionally excluded: the return register
    * is live-out by ABI, so a producer copying into it stays alive even after
    * substituting val.storage, and emit_ret would emit a redundant second
    * move. */
   if (kind == SK_REG) {
     if ((IROp)in->op == IR_CALL) {
       IRCallAux* aux = (IRCallAux*)in->extra.aux;
       if (aux) {
         if (aux->use_plan_replay) {
           n += subst_one_aux_operand(&aux->plan.callee, def, src);
           for (u32 k = 0; k < aux->plan.nargs; ++k)
             n += subst_one_aux_operand(&aux->plan.args[k].src, def, src);
         } else {
           n += subst_one_aux_operand(&aux->desc.callee, def, src);
           for (u32 k = 0; k < aux->desc.nargs; ++k)
             n += subst_abivalue_uses((CGABIValue*)&aux->desc.args[k], def, src);
         }
       }
     }
   }
   return n;
 }
 
 /* Try to substitute the producer of (cls, reg) into uses of that register
  * in `in`. Returns 1 if at least one operand was rewritten. */
 static int try_substitute_for_reg(CombineCtx* ctx, Inst* in, i32 i, u8 cls,
                                   Reg reg) {
   i32 prod_idx = ctx_producer_of(ctx, cls, reg);
   if (prod_idx < 0 || prod_idx >= i) return 0;
   Inst* prod = &ctx->bl->insts[prod_idx];
   IROp pop = (IROp)prod->op;
   if (pop != IR_COPY && pop != IR_LOAD_IMM && pop != IR_CONVERT) return 0;
   if (prod->nopnds < 1 || prod->opnds[0].kind != OPK_REG) return 0;
   if (prod->opnds[0].cls != cls || prod->opnds[0].v.reg != reg) return 0;
 
   Operand def = prod->opnds[0];
   SubstKind kind;
   Operand src_op;
   memset(&src_op, 0, sizeof src_op);
   if (pop == IR_COPY) {
     if (prod->nopnds < 2 || prod->opnds[1].kind != OPK_REG) return 0;
     if (ctx_def_changed_since(ctx, prod->opnds[1].cls, prod->opnds[1].v.reg,
                               prod_idx))
       return 0;
     if (is_target_scratch_reg(ctx->f, prod->opnds[1].cls, prod->opnds[1].v.reg))
       return 0;
     kind = SK_REG;
     src_op = prod->opnds[1];
   } else if (pop == IR_LOAD_IMM) {
     kind = SK_IMM;
     src_op.kind = OPK_IMM;
     src_op.cls = def.cls;
     src_op.type = def.type;
     src_op.v.imm = prod->extra.imm;
   } else { /* IR_CONVERT */
     if (prod->nopnds < 2 || prod->opnds[1].kind != OPK_REG) return 0;
     /* Fold only when consumer is also a convert with matching shape (the
      * broader ext-of-ext rules run in try_combine_exts). */
     if ((IROp)in->op != IR_CONVERT) return 0;
     if (in->nopnds < 2 || in->opnds[1].kind != OPK_REG) return 0;
     if (in->extra.imm != prod->extra.imm) return 0;
     if (in->opnds[1].type != prod->opnds[0].type) return 0;
     if (in->opnds[0].type != prod->opnds[0].type) return 0;
     if (ctx_def_changed_since(ctx, prod->opnds[1].cls, prod->opnds[1].v.reg,
                               prod_idx))
       return 0;
     kind = SK_CV;
     src_op = prod->opnds[1];
   }
 
   /* For a register-source IR_COPY this is local copy propagation: rewriting
    * one use of the copy's dest to its source is value-safe whenever the source
    * is unchanged between the copy and this consumer — already verified by the
    * ctx_def_changed_since check above (which treats CALL/ASM/INTRINSIC as a
    * clobber of every register). The copy itself is not removed here; if all its
    * uses fold away and it is not live-out, post-combine DCE deletes it. So no
    * single-use or cross-block live-out restriction is required, which lets the
    * O1 path collapse the multi-use reg->reg copy chains it would otherwise
    * leave behind (it never runs the O2 coalescer).
    *
    * The immediate / convert producers don't propagate a register value, so
    * they keep the stricter single-use + live-out gate: substituting them into
    * every use would duplicate a (possibly multi-instruction) materialization
    * rather than shorten a copy chain. */
   if (kind != SK_REG) {
     int killed = 0;
     int uses_total =
         count_uses_in_live_range(ctx->f, ctx->bl, prod_idx, &def, &killed);
     if (uses_total != 1) return 0;
     if (!killed && opt_block_live_out_has_phys_reg(ctx->f, ctx->hard_live,
                                                    ctx->bl->id, &def))
       return 0;
   }
 
   /* O1 (no coalescing) folds immediates into IR_COPY; O2 leaves the copy
    * register-to-register so coalescing + self-copy removal handles it. */
   int copy_imm_ok = ctx->f && !ctx->f->opt_coalesce_parent;
   int n = subst_consumer_operands(in, &def, &src_op, kind, copy_imm_ok);
   if (n > 0) {
     ctx->block_change_p = 1;
     return 1;
   }
   return 0;
 }
 
 /* Mark (cls, reg) as already-attempted for this consumer so the same producer
  * is not looked up twice when a register appears in multiple operand slots
  * (e.g. `[r4 + r4*4]`, or `add r1, r4, r4`). */
 static int seen_mark(u32 seen[OPT_REG_CLASSES], u8 cls, Reg reg) {
   if (cls >= OPT_REG_CLASSES || reg >= 32) return 1;
   u32 bit = 1u << reg;
   if (seen[cls] & bit) return 1;
   seen[cls] |= bit;
   return 0;
 }
 
 static void try_substitute_aux_operand(CombineCtx* ctx, Inst* in, i32 i,
                                        const Operand* op,
                                        u32 seen[OPT_REG_CLASSES], int* any) {
   if (op->kind == OPK_REG) {
     if (!seen_mark(seen, op->cls, op->v.reg))
       *any |= try_substitute_for_reg(ctx, in, i, op->cls, op->v.reg);
   } else if (op->kind == OPK_INDIRECT) {
     if (op->v.ind.base != (Reg)REG_NONE &&
         !seen_mark(seen, RC_INT, op->v.ind.base))
       *any |= try_substitute_for_reg(ctx, in, i, RC_INT, op->v.ind.base);
     if (op->v.ind.index != (Reg)REG_NONE &&
         !seen_mark(seen, RC_INT, op->v.ind.index))
       *any |= try_substitute_for_reg(ctx, in, i, RC_INT, op->v.ind.index);
   }
 }
 
 static void try_substitute_aux_abivalue(CombineCtx* ctx, Inst* in, i32 i,
                                         const CGABIValue* v,
                                         u32 seen[OPT_REG_CLASSES], int* any) {
   try_substitute_aux_operand(ctx, in, i, &v->storage, seen, any);
   for (u32 k = 0; k < v->nparts; ++k)
     try_substitute_aux_operand(ctx, in, i, &v->parts[k].op, seen, any);
 }
 
 /* Try to substitute producers into operand slots of `in`. Walks the direct
  * operands of `in` and looks up only the producers of registers actually
  * referenced (typically 2-3 per inst). Also walks IR_CALL aux register uses
  * (args + callee) so reg->reg copies feeding call args or the callee get
  * propagated. See subst_consumer_operands for why IR_RET is excluded. */
 static int try_substitute(CombineCtx* ctx, Inst* in, i32 i) {
   int any = 0;
   u32 seen[OPT_REG_CLASSES] = {0};
   for (u32 oi = 0; oi < in->nopnds; ++oi) {
     const Operand* op = &in->opnds[oi];
     try_substitute_aux_operand(ctx, in, i, op, seen, &any);
   }
   if ((IROp)in->op == IR_CALL) {
     IRCallAux* aux = (IRCallAux*)in->extra.aux;
     if (aux) {
       if (aux->use_plan_replay) {
         try_substitute_aux_operand(ctx, in, i, &aux->plan.callee, seen, &any);
         for (u32 k = 0; k < aux->plan.nargs; ++k)
           try_substitute_aux_operand(ctx, in, i, &aux->plan.args[k].src, seen,
                                      &any);
       } else {
         try_substitute_aux_operand(ctx, in, i, &aux->desc.callee, seen, &any);
         for (u32 k = 0; k < aux->desc.nargs; ++k)
           try_substitute_aux_abivalue(
               ctx, in, i, (const CGABIValue*)&aux->desc.args[k], seen, &any);
       }
     }
   }
   return any;
 }
 
 /* ---- Rewrite 2: address-mode synthesis ---- */
 
 /* Try to fold add/shl producers into one OPK_INDIRECT operand of `in`. */
 static int try_addr_synth_one_op(CombineCtx* ctx, Inst* in, i32 i,
                                  Operand* op) {
   (void)in;
   if (op->kind != OPK_INDIRECT) return 0;
   int any = 0;
 
   /* (a/c) base producer is IR_BINOP IADD. reg+reg synthesizes a base+index
    * pair (requires no existing index, sub-rule a); reg+imm folds the immediate
    * into ofs (sub-rule c, ok with or without an existing index). */
   if (op->v.ind.base != (Reg)REG_NONE) {
     Reg b = op->v.ind.base;
     i32 prod_idx = ctx_producer_of(ctx, RC_INT, b);
     if (prod_idx >= 0 && prod_idx < i) {
       Inst* prod = &ctx->bl->insts[prod_idx];
       if ((IROp)prod->op == IR_BINOP && prod->nopnds == 3 &&
           (BinOp)prod->extra.imm == BO_IADD && prod->opnds[0].kind == OPK_REG &&
           prod->opnds[0].cls == RC_INT && prod->opnds[0].v.reg == b) {
         Operand prod_def = prod->opnds[0];
         /* Single-use within producer's live range (the only further use
          * before next redef/barrier). */
         int killed = 0;
         int uses_after = count_uses_in_live_range(ctx->f, ctx->bl, prod_idx,
                                                   &prod_def, &killed);
         if (uses_after == 1 &&
             (killed || !opt_block_live_out_has_phys_reg(
                            ctx->f, ctx->hard_live, ctx->bl->id, &prod_def))) {
           Operand lhs = prod->opnds[1];
           Operand rhs = prod->opnds[2];
           int has_no_index = (op->v.ind.index == (Reg)REG_NONE);
           /* reg + reg: base = lhs, index = rhs, scale=0. Needs an empty
            * index slot — cannot stack two indices. */
           if (has_no_index && lhs.kind == OPK_REG && rhs.kind == OPK_REG &&
               lhs.cls == RC_INT && rhs.cls == RC_INT &&
               !ctx_def_changed_since(ctx, RC_INT, lhs.v.reg, prod_idx) &&
               !ctx_def_changed_since(ctx, RC_INT, rhs.v.reg, prod_idx)) {
             op->v.ind.base = lhs.v.reg;
             op->v.ind.index = rhs.v.reg;
             op->v.ind.log2_scale = 0;
             any = 1;
           }
           /* reg + imm: base = lhs, fold imm into ofs. Safe with or without
            * an existing index — only the offset is mutated. */
           else if (lhs.kind == OPK_REG && rhs.kind == OPK_IMM &&
                    lhs.cls == RC_INT &&
                    !ctx_def_changed_since(ctx, RC_INT, lhs.v.reg, prod_idx)) {
             i64 sum = (i64)op->v.ind.ofs + rhs.v.imm;
             if (sum >= INT32_MIN && sum <= INT32_MAX) {
               op->v.ind.base = lhs.v.reg;
               op->v.ind.ofs = (i32)sum;
               any = 1;
             }
           }
           /* imm + reg: base = rhs, fold imm into ofs (commutative IADD). */
           else if (lhs.kind == OPK_IMM && rhs.kind == OPK_REG &&
                    rhs.cls == RC_INT &&
                    !ctx_def_changed_since(ctx, RC_INT, rhs.v.reg, prod_idx)) {
             i64 sum = (i64)op->v.ind.ofs + lhs.v.imm;
             if (sum >= INT32_MIN && sum <= INT32_MAX) {
               op->v.ind.base = rhs.v.reg;
               op->v.ind.ofs = (i32)sum;
               any = 1;
             }
           }
         }
       }
     }
   }
 
   /* (b) index producer is IR_BINOP ISHL reg, imm with scale=0. */
   if (op->v.ind.index != (Reg)REG_NONE && op->v.ind.log2_scale == 0) {
     Reg idx = op->v.ind.index;
     i32 prod_idx = ctx_producer_of(ctx, RC_INT, idx);
     if (prod_idx >= 0 && prod_idx < i) {
       Inst* prod = &ctx->bl->insts[prod_idx];
       if ((IROp)prod->op == IR_BINOP && prod->nopnds == 3 &&
           (BinOp)prod->extra.imm == BO_SHL && prod->opnds[0].kind == OPK_REG &&
           prod->opnds[0].cls == RC_INT && prod->opnds[0].v.reg == idx &&
           prod->opnds[1].kind == OPK_REG && prod->opnds[1].cls == RC_INT &&
           prod->opnds[2].kind == OPK_IMM) {
         i64 sh = prod->opnds[2].v.imm;
         if (sh >= 1 && sh <= 3) {
           Operand prod_def = prod->opnds[0];
           int killed = 0;
           int uses_after = count_uses_in_live_range(ctx->f, ctx->bl, prod_idx,
                                                     &prod_def, &killed);
           /* `<= 2` allows the degenerate [base == index] case where the SHL
            * dst appears twice in the same indirect; rewriting only the index
            * still yields equivalent arithmetic when base also held the SHL
            * dst (base unchanged: r*4; index rewritten: r_src*4; r*4 == r*4). */
           if (uses_after >= 1 && uses_after <= 2 &&
               (killed || !opt_block_live_out_has_phys_reg(
                              ctx->f, ctx->hard_live, ctx->bl->id, &prod_def)) &&
               !ctx_def_changed_since(ctx, RC_INT, prod->opnds[1].v.reg,
                                      prod_idx)) {
             op->v.ind.index = prod->opnds[1].v.reg;
             op->v.ind.log2_scale = (u8)sh;
             any = 1;
           }
         }
       }
     }
   }
 
   return any;
 }
 
 static int try_addr_synth(CombineCtx* ctx, Inst* in, i32 i) {
   int any = 0;
   for (u32 oi = 0; oi < in->nopnds; ++oi) {
     if (in->opnds[oi].kind == OPK_INDIRECT) {
       if (try_addr_synth_one_op(ctx, in, i, &in->opnds[oi])) {
         any = 1;
         ctx->block_change_p = 1;
       }
     }
   }
   return any;
 }
 
 /* ---- Rewrite 3: sink producer into single-use IR_COPY destination ---- */
 
 static int try_sink(CombineCtx* ctx, Inst* in, i32 i) {
   if ((IROp)in->op != IR_COPY || in->nopnds < 2) return 0;
   if (in->opnds[0].kind != OPK_REG || in->opnds[1].kind != OPK_REG) return 0;
   if (same_phys_reg(&in->opnds[0], &in->opnds[1])) return 0;
 
   Operand src = in->opnds[1];
   Operand dst = in->opnds[0];
   i32 prod_idx = ctx_producer_of(ctx, src.cls, src.v.reg);
   if (prod_idx < 0 || prod_idx >= i) return 0;
   Inst* prod = &ctx->bl->insts[prod_idx];
   if (!producer_retargetable_op((IROp)prod->op)) return 0;
   if (prod->nopnds < 1 || prod->opnds[0].kind != OPK_REG) return 0;
   if (!same_phys_reg(&prod->opnds[0], &src)) return 0;
 
   /* Producer's source operands must not have been redefined since. */
   for (u32 oi = 1; oi < prod->nopnds; ++oi) {
     const Operand* p = &prod->opnds[oi];
     if (p->kind == OPK_REG) {
       if (ctx_def_changed_since(ctx, p->cls, p->v.reg, prod_idx)) return 0;
     } else if (p->kind == OPK_INDIRECT) {
       if (ctx_def_changed_since(ctx, RC_INT, p->v.ind.base, prod_idx)) return 0;
       if (p->v.ind.index != (Reg)REG_NONE &&
           ctx_def_changed_since(ctx, RC_INT, p->v.ind.index, prod_idx))
         return 0;
     }
   }
   /* If producer reads memory, no intervening memory write. */
   if (inst_reads_memory(prod) && ctx->last_mem_def > prod_idx) return 0;
   /* Retargeting moves the producer's write to `dst` earlier. That is only
    * legal if the hard register is dead throughout the interval before the
    * copy that originally wrote it. */
   for (i32 j = prod_idx + 1; j < i; ++j) {
     Inst* mid = &ctx->bl->insts[j];
     if (inst_uses_phys_reg(mid, &dst) || inst_defines_phys_reg(mid, &dst))
       return 0;
   }
 
   /* Producer dst must have exactly one use within its live range (the copy
    * at i). If the live range terminates inside the block, the cross-block
    * live-out check is moot. */
   int killed = 0;
   int uses_total =
       count_uses_in_live_range(ctx->f, ctx->bl, prod_idx, &src, &killed);
   if (uses_total != 1) return 0;
   if (killed && use_after_clobber_before_redef(ctx->bl, prod_idx, &src))
     return 0;
   if (!killed && opt_block_live_out_has_phys_reg(ctx->f, ctx->hard_live,
                                                  ctx->bl->id, &src))
     return 0;
 
   int swap_binop = 0;
   if (!retarget_producer_legal(prod, &dst, &swap_binop)) return 0;
 
   if (swap_binop) {
     Operand tmp = prod->opnds[1];
     prod->opnds[1] = prod->opnds[2];
     prod->opnds[2] = tmp;
   }
   prod->opnds[0] = dst;
   if (prod->def != VAL_NONE) prod->def = (Val)dst.v.reg;
 
   /* Update last-def: producer no longer defines src, now defines dst. If src
    * had an earlier reaching definition in the block, keep it visible for
    * later source-availability checks. */
   ctx_restore_removed_def(ctx, &src, prod_idx);
   ctx->last_def[dst.cls][dst.v.reg] = prod_idx;
 
   /* Mark the copy NOP'd so compact removes it. */
   in->op = IR_NOP;
   in->def = VAL_NONE;
   in->ndefs = 0;
   in->defs = NULL;
   in->nopnds = 0;
   in->opnds = NULL;
   ctx->block_change_p = 1;
   return 1;
 }
 
 /* ---- Rewrite 4: combine_exts (ext-of-ext chains) ---- */
 
 static int try_combine_exts(CombineCtx* ctx, Inst* in, i32 i) {
   if ((IROp)in->op != IR_CONVERT || in->nopnds < 2) return 0;
   if (in->opnds[1].kind != OPK_REG) return 0;
   u32 sb, db;
   int outer_sign;
   if (!ext_params(in, &sb, &db, &outer_sign)) return 0;
 
   Reg src_reg = in->opnds[1].v.reg;
   u8 src_cls = in->opnds[1].cls;
   i32 prod_idx = ctx_producer_of(ctx, src_cls, src_reg);
   if (prod_idx < 0 || prod_idx >= i) return 0;
   Inst* prod = &ctx->bl->insts[prod_idx];
   u32 isb, idb;
   int inner_sign;
   if (!ext_params(prod, &isb, &idb, &inner_sign)) return 0;
   if (prod->opnds[1].kind != OPK_REG) return 0;
   if (ctx_def_changed_since(ctx, prod->opnds[1].cls, prod->opnds[1].v.reg,
                             prod_idx))
     return 0;
 
   /* Single-use of inner ext dst within its live range (only this insn). */
   Operand prod_def = prod->opnds[0];
   int killed = 0;
   int uses_total =
       count_uses_in_live_range(ctx->f, ctx->bl, prod_idx, &prod_def, &killed);
   if (uses_total != 1) return 0;
   if (!killed && opt_block_live_out_has_phys_reg(ctx->f, ctx->hard_live,
                                                  ctx->bl->id, &prod_def))
     return 0;
 
   /* Outer width `db`, inner width `idb`. Inner reads `isb` bytes. */
   u32 outer_in = sb;                  /* outer's source width */
   u32 inner_out = idb;                /* inner's output width */
   if (outer_in > inner_out) return 0; /* sanity: inner feeds outer */
 
   /* If inner is an identity-shaped convert that reads back its own def
    * register (e.g. `convert rB, rB`), the rewrite would set in.opnds[1] to
    * the same register it already holds. Reporting a change spins the
    * per-BB fixpoint forever. Skip. */
   if (prod->opnds[1].kind == OPK_REG && in->opnds[1].kind == OPK_REG &&
       prod->opnds[1].cls == in->opnds[1].cls &&
       prod->opnds[1].v.reg == in->opnds[1].v.reg)
     return 0;
 
   /* Pattern A: outer width <= inner-source width.  Outer can reach past the
    * inner ext to the inner source directly, keeping outer's signedness.
    * MIR allows any signedness combination here. */
   if (db <= isb) {
     in->opnds[1] = prod->opnds[1];
     in->opnds[1].type = prod->opnds[1].type;
     ctx->block_change_p = 1;
     return 1;
   }
 
   /* Pattern B: inner-source width < outer width. Allowed iff outer is signed
    * OR inner is unsigned; excludes the unsafe uext(sext) combination. */
   if (isb < db && (outer_sign || !inner_sign)) {
     in->opnds[1] = prod->opnds[1];
     in->opnds[1].type = prod->opnds[1].type;
     /* outer's ConvKind already encodes the outer signedness; keep it. */
     ctx->block_change_p = 1;
     return 1;
   }
 
   return 0;
 }
 
 /* ---- Existing IR_RET retarget (kept; runs in the forward pass) ---- */
 
 static int try_ret_retarget(Func* f, Block* bl, i32 i) {
   if (!f->opt_rewritten || i <= 0) return 0;
   Inst* in = &bl->insts[i];
   if ((IROp)in->op != IR_RET) return 0;
   IRRetAux* aux = (IRRetAux*)in->extra.aux;
   Operand* ret_op = NULL;
   Reg ret_reg = REG_NONE;
   if (!aux || !aux->present || !ret_scalar_storage(&aux->val, &ret_op) ||
       !first_return_reg(f, ret_op->cls, &ret_reg) || ret_reg == (Reg)REG_NONE ||
       ret_reg == ret_op->v.reg)
     return 0;
   Inst* producer = &bl->insts[i - 1u];
   Operand ret_dst = *ret_op;
   ret_dst.v.reg = ret_reg;
   int swap_binop = 0;
   if (producer->nopnds < 1 || !same_phys_reg(&producer->opnds[0], ret_op) ||
       !retarget_producer_legal(producer, &ret_dst, &swap_binop))
     return 0;
   if (swap_binop) {
     Operand tmp = producer->opnds[1];
     producer->opnds[1] = producer->opnds[2];
     producer->opnds[2] = tmp;
   }
   producer->opnds[0] = ret_dst;
   *ret_op = ret_dst;
   return 1;
 }
 
 /* ---- Rewrite 5: constant-fold a convert of a load_imm into a load_imm ----
  *
  * `load_imm rT,k ; convert rD,rT` where the convert is a bit-preserving
  * integer/pointer move collapses to `load_imm rD,k'` (k' = convert applied to
  * k). The original load_imm, now dead, is removed by post-combine DCE.
  *
  * This is the convert-shaped sibling of the load_imm-into-copy fold (see
  * try_substitute / combine_subst_slot). It matters for pointer-typed constant
  * call args (e.g. NewTreeNode((void*)0, ...)): the arg-register hint reaches
  * the convert's def but not its load_imm source, so without this the source
  * lands in a scratch and the convert emits a `mov rD, scratch`. Folding lets
  * the load_imm inherit the convert's (hinted) dst directly — `movz x0, 0`. */
 static int try_fold_const_convert(CombineCtx* ctx, Inst* in, i32 i) {
   if ((IROp)in->op != IR_CONVERT || in->nopnds < 2) return 0;
   if (in->opnds[0].kind != OPK_REG || in->opnds[1].kind != OPK_REG) return 0;
   /* Integer/pointer domain only: a load_imm produces an int-class value, and
    * the bit-preserving convert kinds we fold (BITCAST/ZEXT/SEXT/TRUNC) keep it
    * int-class. A class change (RC_INT->RC_FP, e.g. an int->float bitcast) is
    * not bit-preserving and must not collapse to a load_imm. */
   if (in->opnds[0].cls != RC_INT || in->opnds[1].cls != RC_INT) return 0;
 
   i32 prod_idx = ctx_producer_of(ctx, in->opnds[1].cls, in->opnds[1].v.reg);
   if (prod_idx < 0 || prod_idx >= i) return 0;
   Inst* prod = &ctx->bl->insts[prod_idx];
   if ((IROp)prod->op != IR_LOAD_IMM || prod->nopnds < 1 ||
       prod->opnds[0].kind != OPK_REG ||
       !same_phys_reg(&prod->opnds[0], &in->opnds[1]))
     return 0;
 
   u32 sb = combine_scalar_width_bytes(ctx->f, in->opnds[1].type);
   u32 db = combine_scalar_width_bytes(ctx->f, in->opnds[0].type);
   i64 value = 0;
   if (!const_convert_value((ConvKind)in->extra.imm, prod->extra.imm, sb, db,
                            &value))
     return 0;
 
   /* Single-use + not-live-out gate on the load_imm dst, mirroring the SK_IMM
    * gate in try_substitute_for_reg: only fold when this convert is the sole
    * use, so we replace rather than duplicate the materialization. */
   Operand src_def = prod->opnds[0];
   int killed = 0;
   if (count_uses_in_live_range(ctx->f, ctx->bl, prod_idx, &src_def, &killed) !=
       1)
     return 0;
   if (!killed && opt_block_live_out_has_phys_reg(ctx->f, ctx->hard_live,
                                                  ctx->bl->id, &src_def))
     return 0;
 
   /* Rewrite the convert in place into a load_imm of the converted constant.
    * The dst operand (opnds[0]) is the hinted arg/return reg and is kept; the
    * source operand is dropped. The dead load_imm at prod_idx is left for DCE.
    */
   in->op = (u16)IR_LOAD_IMM;
   in->type = in->opnds[0].type;
   in->nopnds = 1;
   in->extra.imm = value;
   ctx->block_change_p = 1;
   return 1;
 }
 
 /* ---- per-BB driver ---- */
 
 static int opt_combine_fold_block(Func* f, Block* bl,
                                   const OptHardBlockLive* hard_live) {
   enum { enable_o1_combine_rewrites = 1 };
   enum { enable_o1_sink_rewrites = 1 };
   CombineCtx ctx;
   ctx.f = f;
   ctx.bl = bl;
   ctx.hard_live = hard_live;
   ctx_reset(&ctx);
 
   for (i32 i = 0; i < (i32)bl->ninsts; ++i) {
     Inst* in = &bl->insts[i];
 
     if (enable_o1_combine_rewrites && try_ret_retarget(f, bl, i)) {
       ctx.block_change_p = 1;
       /* The producer's def changed; update ctx for the producer at i-1. */
       Inst* prev = &bl->insts[i - 1];
       Operand probe;
       memset(&probe, 0, sizeof probe);
       probe.kind = OPK_REG;
       for (u8 c = 0; c < OPT_REG_CLASSES; ++c) {
         probe.cls = c;
         for (Reg r = 0; r < OPT_MAX_HARD_REGS; ++r) {
           probe.v.reg = r;
           if (ctx.last_def[c][r] == i - 1 &&
               !inst_defines_phys_reg(prev, &probe))
             ctx_restore_removed_def(&ctx, &probe, i - 1);
         }
       }
       ctx_record(&ctx, prev, i - 1);
     }
 
     /* Skip NOPs left by prior sink rewrites. */
     if ((IROp)in->op == IR_NOP) continue;
 
     if (enable_o1_sink_rewrites && try_sink(&ctx, in, i)) {
       /* sink NOP'd the copy and updated ctx. */
       continue;
     }
 
     if (enable_o1_combine_rewrites) {
       try_fold_const_convert(&ctx, in, i);
       try_combine_exts(&ctx, in, i);
       try_substitute(&ctx, in, i);
       try_addr_synth(&ctx, in, i);
     }
 
     ctx_record(&ctx, in, i);
   }
   return ctx.block_change_p;
 }
 
 static int opt_combine_compact_block(Func* f, Block* bl) {
   u32 w = 0;
   int changed = 0;
   for (u32 i = 0; i < bl->ninsts; ++i) {
     Inst* in = &bl->insts[i];
 
     /* Drop NOPs (e.g. copies sunk by try_sink). */
     if ((IROp)in->op == IR_NOP) {
       changed = 1;
       continue;
     }
 
     if ((IROp)in->op == IR_COPY && in->nopnds == 2 &&
         same_reg_operand(&in->opnds[0], &in->opnds[1])) {
       changed = 1;
       continue;
     }
 
     if (w) {
       Inst* prev = &bl->insts[w - 1u];
       if ((IROp)prev->op == IR_STORE && (IROp)in->op == IR_LOAD &&
           same_spill_slot_and_size(f, prev, in) &&
           same_reg_operand(&prev->opnds[1], &in->opnds[0])) {
         changed = 1;
         continue;
       }
       if ((IROp)prev->op == IR_LOAD && (IROp)in->op == IR_STORE &&
           same_spill_slot_and_size(f, prev, in) &&
           same_reg_operand(&prev->opnds[0], &in->opnds[1])) {
         changed = 1;
         continue;
       }
       if ((IROp)prev->op == IR_LOAD && (IROp)in->op == IR_LOAD &&
           same_spill_slot_and_size(f, prev, in) &&
           same_reg_operand(&prev->opnds[0], &in->opnds[0])) {
         changed = 1;
         continue;
       }
       if ((IROp)prev->op == IR_STORE && (IROp)in->op == IR_STORE &&
           same_spill_access(f, prev, in, NULL)) {
         bl->insts[w - 1u] = *in;
         changed = 1;
         continue;
       }
     }
 
     bl->insts[w++] = *in;
   }
   bl->ninsts = w;
   return changed;
 }
 
 void opt_combine(Func* f) {
   if (!f) return;
   opt_analysis_invalidate(f, OPT_ANALYSIS_DEF_USE);
   OptHardBlockLive* hard_live = opt_maybe_build_hard_live(f);
   /* Per-BB fixpoint, matching MIR's combine loop (mir-gen.c:9037-9038). */
   /* Per-BB fixpoint with a defensive iteration cap. Each rewrite is supposed
    * to be monotonic (it only fires when it strictly improves the IR), so we
    * shouldn't hit the cap in practice — but a noisy abort beats a hang if a
    * future rewrite accidentally oscillates. */
   enum { MAX_COMBINE_ITERS = 64 };
   for (u32 b = 0; b < f->nblocks; ++b) {
     Block* bl = &f->blocks[b];
     for (int iter = 0; iter < MAX_COMBINE_ITERS; ++iter) {
       int folded = opt_combine_fold_block(f, bl, hard_live);
       int compacted = opt_combine_compact_block(f, bl);
       if (!folded && !compacted) break;
     }
   }
 }