fabi/Syplheed-Reborn
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

re: sub_822737C8 is the coroutine spawner; the record's third word is the MAIN ENTRY

Browse Source 
Asking who calls the function the timeline calls enumerates every way an ISL routine
can begin.  sub_822737C8(phase, base, offset) computes base + offset early on, and has
seven real call sites: the phase initialiser sub_82270DF8, the built-in stub region
(start_coroutine), the timeline walker sub_822748D0, TWICE inside sub_8226D740 -- the
per-frame engine->script drain -- and two unread, sub_82273910 and sub_82264058.

CORRECTION to my own write-up: the 0x1883 record's third word is the phase's MAIN
ENTRY, not a "size".  The initialiser hands it straight to the spawner:

    8227101C  or  r5, r22, r22     ; the record's third word
    82271020  or  r4, r26, r26     ; the code base
    82271030  bl  0x822737C8

44 of 44 records land on the instruction stream (100%) against a 25.0% control, and
all three Stage-02 targets open with the identical prologue
`special[0]=0 ; local[0]=0 ; call builtin116(0)` -- a routine entry, not a length.
So the record is 0x1883, base, MAIN_ENTRY, 0, code_end, force_end_handler.

Seeding the main entries moves no coverage number: every one was already among the
CFG's entry points by another route.  This corrects a field's meaning, not the graph.

Lead recorded rather than claimed: both of the drain's spawns take their offset from
[node+112], the first field of a drained node to be located, and the best remaining
angle on the ~15% of code nothing appears to start.  It is NOT shown that those nodes
come from the trigger queue at phase+272 -- that is precisely the over-reach
isl-builtins.md already made and withdrew, so it is not asserted here.

All artefacts regenerate byte-identical; this is documentation only.
This commit is contained in:
Sylpheed RE agent
2026-08-27 07:22:51 +00:00
parent 4e948d0317
commit a3cb3339bc
3 changed files with 97 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
docs/re/BACKLOG.md
View File

@@ -80,6 +80,24 @@ unknown, what evidence exists, and what the first step would be. Move an item in
unread. 🟡 **Still NOT what starts the unreachable code** — 0 of the 675 targets
are unreached run-starts, so the ~15 % gap stands.
* ✅ **(2026-08-27) `sub_822737C8` IS THE COROUTINE SPAWNER — [isl-coroutine-spawner](isl-coroutine-spawner.md).**
`spawn(phase, base, offset)`; **7 call sites** that between them name the whole
start-up path: the phase initialiser, `start_coroutine`'s stub, the timeline
walker, TWICE inside **`sub_8226D740`** (the per-frame engine→script drain), and
two unread (`sub_82273910`, `sub_82264058`).
🔴 **CORRECTION: the `0x1883` record's third word is the phase's MAIN ENTRY, not
a "size"** — my label was wrong. The initialiser passes it straight to the
spawner (`or r5,r22,r22; or r4,r26,r26; bl 0x822737C8`), **44/44 land on the
instruction stream vs a 25.0 % control**, and all three Stage-02 targets share the
prologue `special[0]=0; local[0]=0; call builtin116(0)`. Record =
`0x1883, base, MAIN_ENTRY, 0, code_end, force_end_handler`. 🟡 Seeding it moves
no coverage — every main entry was already an entry point by another route.
🔑 **LEAD:** the drain's two spawns take their offset from **`[node+112]`** —
the first field of a drained node located, and the best remaining angle on the
~15 % of code nothing appears to start. 🟡 NOT shown that those nodes come from
the trigger queue at `phase+272`; that is the exact over-reach the corpus already
withdrew once, so it is not asserted.
## ✅✅ SOLVED — the mission freeze was a modal sign-in dialog (2026-08-26)
`XamShowSigninUI` opens a modal dialog and `xeXamDispatchDialog` blocks the