fabi/Sylpheed
1
0
Fork 0
Code Issues 9 Pull Requests Actions Packages Projects Releases Wiki Activity

re: built-ins 26/28/29 are one family — and damage_unit looks mis-named

Browse Source 
Method-diffing settled the structure but not the semantics, so nothing is
named this time.

  26 damage_unit  vt76  sub_8226ACD0 (67)  opcode 800   97 sites
  28              vt84  sub_82268F98 (69)  opcode 801  410 sites
  29              vt88  sub_822690B0 (69)  opcode 802  164 sites
  101             vt276 sub_822691C8 (78)  opcode 802  133 sites (broadcast)

28 and 29 differ in two words only -- the opcode (0x21BA vs 0x22BA) and a
descriptor pointer 8 bytes apart -- and are otherwise instruction-identical.
All three take (unit, double). 26 differs from both by one guard: it rejects
only state 3, while 28 and 29 reject states 1 and 3.

The operand distributions separate them:

  26   97 sites   7 distinct   [0, 100]    0 x69, 80 x10, 100 x6
  28  410 sites  13 distinct   [0, 2000]   200 x116, 120 x76, 300 x74
  29  164 sites   6 distinct   [0, 100]    0 x64, 100 x53, 50 x38

26 and 29 are percentage-shaped; 28 is an absolute quantity an order of
magnitude larger.

That casts doubt on an existing name. damage_unit (26) passes 0 in 69 of its
97 calls -- dealing zero damage is a no-op, so 71% of its call sites would do
nothing, while SETTING a percentage-valued property to 0 is a natural thing
to do 69 times. 29 has the same shape. The name predates this session and I
have not withdrawn it, but it should not be relied on.

Where this stopped: the three commands' descriptors at 0x820A8D10/+8/+16
point into 0x8210E5xx, which is BELOW the disassembly DB's range (it starts
at 0x82150000) and holds no code, so that route cannot reach an execute
method. Opcodes 800-802's semantics need the interpreter command table
instead.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PMRJjbxLqZtsb5Vb7KunPE
This commit is contained in:
Sylpheed RE agent
2026-08-26 01:38:08 +00:00
parent 679812f1c9
commit 510dcf29d8
1 changed files with 45 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
docs/re/structures/isl-builtins.md
View File

@@ -140,6 +140,51 @@ and spread checks but its maximum *exceeds* the table — flag indices run 0..31
against symbol tables as small as 40 — so it is excluded, and the disassembler
now declines to resolve it rather than printing an invented name.
### 🟡 Built-ins 26 / 28 / 29 are one family — and `damage_unit` looks mis-named
Method-diffing put the structure beyond doubt but did not reach the semantics.
| built-in | vtable slot | method | opcode | sites |
|---|---|---|---|---|
| 26 `damage_unit` | 76 | `sub_8226ACD0` (67) | **800** | 97 |
| **28** | 84 | `sub_82268F98` (69) | **801** | 410 |
| **29** | 88 | `sub_822690B0` (69) | **802** | 164 |
| 101 | 276 | `sub_822691C8` (78) | 802 (broadcast) | 133 |
**28 and 29 differ in two words only** — the opcode (`0x21BA` vs `0x22BA`) and a
descriptor pointer 8 bytes apart. Otherwise instruction-identical. All three take
`(unit, double)`.
26 differs from both by one guard: it rejects only state 3, while **28 and 29
reject states 1 and 3** (2 = active, 1/3/4 = gone/dead/invalid).
#### The operand distributions separate them
| built-in | n | distinct | range | most common |
|---|---|---|---|---|
| 26 | 97 | 7 | **[0, 100]** | **0 ×69**, 80 ×10, 100 ×6 |
| 28 | 410 | 13 | **[0, 2000]** | 200 ×116, 120 ×76, 300 ×74 |
| 29 | 164 | 6 | **[0, 100]** | **0 ×64**, 100 ×53, 50 ×38 |
26 and 29 are percentage-shaped; 28 is an absolute quantity an order of magnitude
larger.
#### 🟡 `damage_unit` (26) is doubtful
**69 of its 97 calls pass 0.** Dealing zero damage is a no-op, so 71 % of the
call sites would do nothing. *Setting* a percentage-valued property to 0 is a
perfectly natural thing to do 69 times, and 29 has the same shape (0 ×64 of 164).
The existing name predates this session and is not withdrawn, but it should not
be relied on.
#### ❌ Where this stopped
The three commands' descriptors sit at `0x820A8D10` / `+8` / `+16`. Following
them lands on data pointing into `0x8210E5xx`, which is **below the disassembly
DB's range** (it starts at `0x82150000`) and contains no code — so that route
does not reach an execute method. Reaching opcodes 800–802's semantics needs the
interpreter's command table, not the command objects.
### ✅ Built-in 108 is `deploy_squadron_ex` — `deploy_squadron` plus a `1 << n` selector
1146 sites in 22 stages, the second-largest unnamed built-in. Its method