Asking who calls the function the timeline calls enumerates every way an ISL routine
can begin. sub_822737C8(phase, base, offset) computes base + offset early on, and has
seven real call sites: the phase initialiser sub_82270DF8, the built-in stub region
(start_coroutine), the timeline walker sub_822748D0, TWICE inside sub_8226D740 -- the
per-frame engine->script drain -- and two unread, sub_82273910 and sub_82264058.
CORRECTION to my own write-up: the 0x1883 record's third word is the phase's MAIN
ENTRY, not a "size". The initialiser hands it straight to the spawner:
8227101C or r5, r22, r22 ; the record's third word
82271020 or r4, r26, r26 ; the code base
82271030 bl 0x822737C8
44 of 44 records land on the instruction stream (100%) against a 25.0% control, and
all three Stage-02 targets open with the identical prologue
`special[0]=0 ; local[0]=0 ; call builtin116(0)` -- a routine entry, not a length.
So the record is 0x1883, base, MAIN_ENTRY, 0, code_end, force_end_handler.
Seeding the main entries moves no coverage number: every one was already among the
CFG's entry points by another route. This corrects a field's meaning, not the graph.
Lead recorded rather than claimed: both of the drain's spawns take their offset from
[node+112], the first field of a drained node to be located, and the best remaining
angle on the ~15% of code nothing appears to start. It is NOT shown that those nodes
come from the trigger queue at phase+272 -- that is precisely the over-reach
isl-builtins.md already made and withdrew, so it is not asserted here.
All artefacts regenerate byte-identical; this is documentation only.
2.6 KiB
✅ sub_822737C8 is the coroutine spawner — and its seven callers name the whole start-up path
Asking who calls the thing the timeline calls turns out to enumerate every way an ISL routine can begin.
sub_822737C8(phase, base, offset) — add r9, r4, r28 computes base + offset
early on, so the third argument is a phase-relative code offset.
The seven call sites
| site | in | what it starts |
|---|---|---|
0x82271030 |
sub_82270DF8 — the phase initialiser |
the phase's main entry (the 0x1883 record's third word) |
0x822724D0 |
the built-in stub region | start_coroutine's target |
0x82274934 |
sub_822748D0 — the timeline walker |
a scheduled routine |
0x8226D8D0 |
sub_8226D740 — the per-frame engine→script drain |
an offset from [node+112] |
0x8226DA10 |
the same drain, second path | the same [node+112] |
0x82273938 |
sub_82273910 |
not read |
0x82264080 |
sub_82264058 |
not read |
✅ The phase's main entry — a correction
isl-stream-entry-points.md called the record's third word a size. It is
not: the initialiser hands it to the spawner as an offset.
- 44 of 44 records land on the instruction stream — 100 %, against a 25.0 % control.
- All three of Stage 02's targets begin with the same prologue,
special[0] = 0 ; local[0] = 0 ; call builtin116(0), which is a routine entry and not a length.
So the record reads 0x1883, base, MAIN_ENTRY, 0, code_end, force_end_handler.
🟡 Seeding it changes nothing measurable — every main entry was already among the CFG's entry points by another route — so this corrects the meaning of a field without moving any coverage number.
🔑 The drain spawns from [node+112]
The two calls inside sub_8226D740 both do
lwz r5, 112(r31) ; the routine offset, out of the node
lwz r4, 232(r29) ; the phase's code base
bl 0x822737C8
isl-builtins.md describes sub_8226D740 as the per-frame engine→script drain,
and here it is spawning routines from a code offset carried in the drained
node at +112. That is the first field of a trigger-style node to be located,
and it is the most promising remaining lead on the routines nothing else starts.
🟡 Not settled
+112is a field of some node — this does not show the node comes from the trigger queue atphase+272. That link is exactly the over-reachisl-builtins.mdalready recorded and withdrew once; it is not asserted here.- Two callers unread:
sub_82273910andsub_82264058. - Whether the drain's nodes explain the unreached routines is untested. It is a lead, not a result.