fix(encoder): high-register Thumb ADD/ADDS/SUBS use 32-bit .W — root-cause #180, re-enable optimized memory path

[avrabe]

Summary

Root-causes and fixes the optimizer linear-memory miscompilation (#178, mitigated in #179; tracked for repair in #180). The bug was not in the optimizer lowering — it was in the Thumb encoder.

ArmOp::Add (and Adds/Subs) register-forms unconditionally emitted the 16-bit encoding, whose 3-bit register fields overflow for high registers. MemLoad/MemStore use R12 as the base+address scratch, so add ip, ip, r0 was emitted as the corrupt adds r4, r5, r1 (0x186C) — silently dropping the address operand, making every optimized pointer-deref hit a fixed address. The i64 low-word Adds/Subs ops hit the same class via R8–R11 register pairs.

Fix: guard the 16-bit form on rd/rn/rm < 8 and fall back to 32-bit ADD.W/ADDS.W/SUBS.W for high registers — exactly as the Sub handler already did. The bug was a copy-paste divergence (Add lacked the guard Sub had).

Before → after (the #178 reproducer, optimized path)

8:  186c        adds r4, r5, r1      ; ❌ operand dropped, fixed-address load

8:  eb0c 0c00   add.w ip, ip, r0     ; ✅ base + pointer operand
c:  f8dc 4000   ldr.w r4, [ip]

Changes

• arm_encoder.rs: high-register guards on Add/Adds/Subs + encode_thumb32_adds/subs_reg_raw helpers
• optimizer_bridge.rs: remove the fix(opt): decline linear-memory ops — optimized path miscompiled addresses (#178) #179 decline and the now-obsolete is_linear_memory_op
• byte-level encoder regression tests (EB0C 0C00 / EB1A 0A08 / EBBA 0A08)
• re-enable the four #[ignore]d issue_104 memory-CSE tests
• audit_optimized_aapcs: re-assert optimized memory codegen (was asserting the decline)
• wast_compile: rewrite the arm optimizer: dynamic i32.load/store address constant-folded to a fixed 0x100 — pointer params ignored (--no-optimize correct) #178 CLI test to verify the address operand is used (no corrupt 6C 18; contains add.w ip, ip, rN) — the old byte-equality premise only held under the decline

Verification

• Full workspace suite: 1282 passed, 0 failed (--exclude synth-verify per z3 quirk)
• Byte-verified via arm-none-eabi-objdump on the arm optimizer: dynamic i32.load/store address constant-folded to a fixed 0x100 — pointer params ignored (--no-optimize correct) #178 reproducer
• Clean-room verified (cold agent, 4/4 claims confirmed against the actual binary; both optimized and --no-optimize honor the r0 operand)

Follow-up (out of scope, audit-noted)

• The CMN register-form encoder (arm_encoder.rs) is unguarded for high registers but is only reached today via the immediate form (32-bit CMN.W); filed as an audit follow-up rather than a speculative fallback.

Closes #180.

🤖 Generated with Claude Code

[avrabe]

Update: two CI findings fixed in 7167951

While CI ran, two issues surfaced — both addressed:

1. Clippy (CI rust 1.96.0) flagged a collapsible_if in the pre-existing arm backend: every wasm call lowered to __meld_dispatch_import placeholder — no inlining, no relocations, non-linkable ELF #167 wast_compile test (a if let { if }). Rewritten as a let-chain.

2. encoder_no_panic fuzz found a pre-existing panic (identical code on main, unrelated to opt: repair + re-enable the optimized linear-memory path (root-cause the MemLoad ADD-register corruption) #180): a PC/R15 operand fed to a verify_reg_bits-guarded Thumb-2 op aborts under -Cdebug-assertions. Converted the 11 contract sites to a fallible reg_bits_checked() -> Result<()> (typed Err, per the fix(opt): defensive panic on unmapped vreg instead of silent R0 fallback #101/wasm_to_ir: unmapped vreg panic still trips on compiler_builtins (float::div) and gale_compute_ipi_mask after v0.2.1's #97 memset fix #120/fix(opt): ir_to_arm returns Result — panic-free optimized path, fuzz re-gated #132 pattern) + deterministic unit test. Filed as arm encoder: panics (debug_assert) on PC/R15 operand instead of returning Err — fuzz-found, pre-existing #185 (fixed here).

The empty-corpus fuzzer finds a class of pre-existing totality gaps (e.g. an ARM32 BCond offset arithmetic underflow), so Fuzz Smoke is intermittently red on any PR — it is not a required check (branch protection requires none), and these gaps predate this PR. Tracked as #186 rather than expanding this bugfix unboundedly.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!