This repository has been archived on 2026-09-16. You can view files and clone it. You cannot open issues or pull requests or push a commit.
Files
Syplheed-Reborn/tools/re-capture/isl_report.py
Sylpheed RE agent 5ea9e38b35 re: recover ISL conditions by CFG dataflow instead of a linear walk
The linear walk's 10% unknown was a floor imposed by the method: a block entered only
by a branch has a well-defined state, just not one a straight-line pass can see.
tools/re-capture/isl_cfg.py replaces it with a worklist fixpoint that joins each
block's state over its ACTUAL predecessors -- a value survives only if every
predecessor agrees.

Over all 28 stages:
  instructions reached by the CFG          85.0%
  condition sites, unknown LHS             756 (10.00%) -> 402 (5.32%)
  of those, never reached at all           389
  joined away (predecessors disagree)       13
  both resolve but DISAGREE                161   <- linear walk was wrong here

Those 161 are on top of the 889 the previous jmp fix caught.

Two zero-results on the way, both my own bug, both caught because the number looked
wrong rather than because a test failed:

  * The first CFG run reached only 36% of instructions and made things WORSE (35%
    unknown).  Cause: the phase bases reach almost nothing.  Most routines are
    COROUTINES the engine starts from its trigger queue, with no static predecessor,
    so every start_coroutine target has to be seeded as an entry.
  * That seeding then found ZERO entries in a file with 216 start_coroutine calls,
    because the target is staged in TWO steps -- special[0] = imm, then
    local[0] = special[0] -- and I matched only the direct-immediate form.

Reachability went 36% -> 64% -> 85% as each was fixed.

The 389 still unreached are an honest limit rather than a gap: nothing in the bytecode
starts them; they are entered from the trigger queue at phase+272, by data rather than
code, so no purely static analysis reaches them.

isl_report.py conditions now uses isl_cfg; calls and phase-ends regenerate
byte-identical.  Stage 02 unknowns drop from 71 to 25.
2026-08-27 06:02:37 +00:00

143 lines
5.7 KiB
Python

#!/usr/bin/env python3
"""Regenerate the committed ISL artefacts under `docs/re/data/`.
isl_report.py <StageNN.ssb> calls -> the call-site census + a listing
The artefact was produced by an uncommitted one-off, so it drifted out of date
twice: once when operand staging was fixed (calls printed with too few
arguments) and once when three built-in names were corrected. Keeping the
generator in the tree is the point of this file.
isl_report.py <StageNN.ssb> phase-ends -> every END_PHASE with its context
isl_report.py <StageNN.ssb> conditions -> every condition site, comparand resolved
The "needs the coroutine entry points" blocker recorded here is REFUTED: the
instruction stream is FLAT and `isl.linear_offsets` reaches 25705/25705 call
sites across all 28 stages. What broke the naive linear decode was `isl.dis`
stopping at op 20 (`ret`), which in a coroutine VM is a yield, not an end of
code -- see `docs/re/isl-stream-is-flat.md`.
"""
import collections
import sys
import isl
import isl_cfg
def census(b):
cs = isl.call_sites(b)
return cs, collections.Counter(bid for _, bid, _ in cs)
def emit_calls(b, path):
cs, h = census(b)
s1, s2 = isl.symbols(b, 1), isl.symbols(b, 2)
print('# %s — ISL disassembly artefacts' % path)
print()
print('Generated by `tools/re-capture/isl_report.py calls`.')
print()
print('%d call sites, %d distinct built-ins' % (len(cs), len(h)))
for bid, n in h.most_common():
print(' builtin %-4d %5d site(s)' % (bid, n))
print()
print('## phase-control sites')
for bid, nm in ((6, 'END_PHASE'), (62, 'FORCE_END_PHASE'),
(39, 'MARK_LAST_PHASE'), (40, 'mark_not_last')):
offs = [off for off, b2, _ in cs if b2 == bid]
print('%-3d %-18s %2d: %s'
% (bid, nm, len(offs), ' '.join('0x%x' % o for o in offs)))
print()
print('## named built-ins used, by traffic')
for bid, n in h.most_common():
nm = isl.BUILTIN.get(bid)
if nm:
print(' %-3d %-24s %4d' % (bid, nm, n))
print()
print('## phase code bases')
print('Each phase has its OWN base; the file header offset is not it.')
print(' ' + ' '.join('0x%x' % x for x in isl.phase_bases(b)))
print()
print('## disassembly into the first END_PHASE')
target = [off for off, bid, _ in cs if bid == 6][0]
start = isl.resync(b, target)
print('resync from 0x%X' % start)
for line in isl.dis(b, start, 64, code_base=0x24, sym2=s2, sym1=s1):
print(line)
def emit_phase_ends(b, path):
"""Every phase-ending call with the instructions that lead into it."""
offs = isl.linear_offsets(b)
idx = {o: k for k, o in enumerate(offs)}
bases = isl.phase_bases(b)
s1, s2 = isl.symbols(b, 1), isl.symbols(b, 2)
ends = [(o, bid) for o, bid, _ in isl.call_sites(b) if bid in (6, 62)]
print('# %s — where each phase ends' % path)
print()
print('Generated by `tools/re-capture/isl_report.py phase-ends`.')
print('Decoded with `stop_at_ret=False`; a `ret` is a coroutine YIELD, so')
print('the listing continues past it.')
print()
print('phase code bases: ' + ' '.join('0x%x' % x for x in bases))
print('%d phase-ending call(s): %d END_PHASE, %d FORCE_END_PHASE'
% (len(ends), sum(1 for _, b2 in ends if b2 == 6),
sum(1 for _, b2 in ends if b2 == 62)))
for o, bid in ends:
ph = sum(1 for x in bases if x <= o)
k = idx.get(o)
if k is None:
print('\n## 0x%X builtin %d — NOT on the linear stream' % (o, bid))
continue
print('\n## phase %d — builtin %d (%s) at 0x%X'
% (ph, bid, isl.BUILTIN.get(bid, '?'), o))
for line in isl.dis(b, offs[max(0, k - 16)], 22,
code_base=bases[ph - 1], sym2=s2, sym1=s1,
stop_at_ret=False):
print(' ' + line)
def emit_conditions(b, path):
"""Every condition site with its comparand — what `data/isl-stage02-conditions.txt`
never had a generator for."""
import collections
cs = isl_cfg.conditions(b, isl.symbols(b, 1), isl.symbols(b, 2))
bases = isl.phase_bases(b)
print('# %s — condition sites, comparands resolved' % path)
print()
print('Generated by `tools/re-capture/isl_report.py conditions`.')
print()
print('The deque ops are an expression stack: `push.i` saves the comparand,')
print('the right-hand side is evaluated (its result lands in `special[0]`),')
print('`pop.i` restores the comparand into `special[1]`, then `cmp.i` compares.')
print()
print('Operands come from a CFG dataflow fixpoint (`isl_cfg.py`), joining each')
print('block over its ACTUAL predecessors — not from a linear walk.')
print()
print('%d condition sites; phase bases %s'
% (len(cs), ' '.join('0x%x' % x for x in bases)))
h = collections.Counter(c['lhs'].split('(')[0] for c in cs if c['lhs'] and '(' in c['lhs'])
print()
print('## most-tested predicates')
for k, n in h.most_common(20):
print(' %-28s %4d' % (k, n))
for ph in range(1, len(bases) + 1):
rows = [c for c in cs if c['phase'] == ph]
print()
print('## phase %d — %d sites' % (ph, len(rows)))
for c in rows:
lhs = c['lhs'] if c['lhs'] is not None else '<unknown: no static entry>'
rhs = c['rhs'] if c['rhs'] is not None else '<unknown>'
print(' 0x%06X if %s %s %s -> 0x%X'
% (c['off'], lhs, c['rel'], rhs, c['target']))
def main():
path = sys.argv[1]
b = isl.load(path)
name = path.replace('\\', '/').split('/')[-1]
{'calls': emit_calls, 'phase-ends': emit_phase_ends,
'conditions': emit_conditions}[sys.argv[2]](b, name)
if __name__ == '__main__':
main()