re: derive UNIT_ARG from the implementations -- 31 built-ins take a unit, not 31 of 55

isl.py's UNIT_ARG decides whether a built-in's slot-4 operand prints as a unit name
or a raw number.  It was inferred statistically from operand ranges and, by its own
comment, listed a slot "only when the ratio stayed below 1.0" -- conservative.

The vtable base makes it a lookup instead: every unit-taking built-in's implementation
opens with lwz 324(phase) / lwz 4(argbase) / rlwinm 2,0,29 / lwzx / lwz 4(rec).  Read
directly for all 147:

  implementation indexes [phase+324] by an argument   55
  of the statistical set's 31, confirmed              31  (zero false positives)
  UNIT_ARG claims a unit, implementation does not      0
  implementation says unit, UNIT_ARG missed it        24

The 24 include builtin80, group_ratio_pct, is_engaged, set_unit_flags,
squadron_trace, wait_units_ready and deploy_and_wait.  Hand-verified by reading
builtin7, 16, 80, 105, 117 and 136.

Recorded because it nearly passed: my FIRST control -- whether the additions' operands
resolve to a symbol-table-2 index -- is worthless.  The additions score 100.0%, but so
do the 31 baseline (100.0%) AND the 92 built-ins in neither set (99.3%).  Symtab 2 is
dense enough that almost any small integer lands in it.  A control the negative class
also passes is not evidence.

The control that discriminates is the tag word: a symbol operand is a two-word pair
whose first word is the constant 1, so slot0 == 1 exactly when slot 4 is a unit --
100.0% (13677 calls) / 100.0% (140) / 2.5% (2903).  A 40x separation.

Artefacts: isl-stage02.txt and -phase-ends.txt regenerate byte-identical; -conditions
changes on 28 sites, every diff line pairing, each a raw number becoming a unit name.

Left unnamed on purpose: all 24.  builtin80 returns a small enum (tested 0..4 in a
switch) but its body past the liveness check is unread; builtin103 is a predicate over
[phase+10152]/[phase+10156]; builtin105 tests a unit record's +16 against 4.
This commit is contained in:
Sylpheed RE agent
2026-08-27 05:45:10 +00:00
parent 4f37a4eb4c
commit 8af97adbc5
4 changed files with 148 additions and 30 deletions

View File

@@ -178,8 +178,22 @@ def symbols(b, which):
# spread tests but its maximum EXCEEDS the table (flag indices run 0..31 against
# tables as small as 40), so it is excluded. Slots are only listed here when the
# ratio stayed below 1.0.
UNIT_ARG = {2, 3, 7, 12, 15, 16, 18, 19, 20, 24, 25, 26, 28, 29, 30, 47, 48,
56, 57, 58, 63, 69, 70, 79, 91, 92, 95, 105, 108, 128, 143}
# DERIVED FROM THE IMPLEMENTATIONS, not from operand ranges. Each of these
# built-ins resolves to a ScriptPhase vtable slot whose body does
# lwz rX, 324(rPhase) ; the unit array
# lwz rY, 4(rArgBase) ; local[4]
# rlwinm rY, rY, 2, 0, 29 ; x4
# lwzx ... ; -> the record
# The previous set was inferred statistically from operand ranges and listed a
# slot only "when the ratio stayed below 1.0", so it was CONSERVATIVE: all 31 of
# its entries are confirmed here (zero false positives) but it MISSED 24 more.
# Control, over all 28 stages: slot 0 is the tag constant 1 in 100.0% of the
# original 31's calls, 100.0% of the 24 additions', and only 2.5% of the 92
# built-ins in neither set.
UNIT_ARG = {2, 3, 7, 12, 15, 16, 18, 19, 20, 21, 22, 23, 24, 25, 26, 28, 29, 30,
32, 42, 44, 46, 47, 48, 49, 50, 51, 55, 56, 57, 58, 60, 61, 63, 69,
70, 72, 79, 80, 83, 91, 92, 94, 95, 101, 105, 108, 109, 117, 128,
136, 137, 141, 142, 143}
UNIT_ARG2 = {2, 18, 47, 48, 56, 79, 95, 128} # a SECOND unit index at blob[12]
UNIT_ARG3 = {128} # and a third at blob[20]
UNIT_SLOTS = {4: UNIT_ARG, 12: UNIT_ARG2, 20: UNIT_ARG3}