a3cb3339bc
Asking who calls the function the timeline calls enumerates every way an ISL routine
can begin. sub_822737C8(phase, base, offset) computes base + offset early on, and has
seven real call sites: the phase initialiser sub_82270DF8, the built-in stub region
(start_coroutine), the timeline walker sub_822748D0, TWICE inside sub_8226D740 -- the
per-frame engine->script drain -- and two unread, sub_82273910 and sub_82264058.
CORRECTION to my own write-up: the 0x1883 record's third word is the phase's MAIN
ENTRY, not a "size". The initialiser hands it straight to the spawner:
8227101C or r5, r22, r22 ; the record's third word
82271020 or r4, r26, r26 ; the code base
82271030 bl 0x822737C8
44 of 44 records land on the instruction stream (100%) against a 25.0% control, and
all three Stage-02 targets open with the identical prologue
`special[0]=0 ; local[0]=0 ; call builtin116(0)` -- a routine entry, not a length.
So the record is 0x1883, base, MAIN_ENTRY, 0, code_end, force_end_handler.
Seeding the main entries moves no coverage number: every one was already among the
CFG's entry points by another route. This corrects a field's meaning, not the graph.
Lead recorded rather than claimed: both of the drain's spawns take their offset from
[node+112], the first field of a drained node to be located, and the best remaining
angle on the ~15% of code nothing appears to start. It is NOT shown that those nodes
come from the trigger queue at phase+272 -- that is precisely the over-reach
isl-builtins.md already made and withdrew, so it is not asserted here.
All artefacts regenerate byte-identical; this is documentation only.
61 lines
2.6 KiB
Markdown
61 lines
2.6 KiB
Markdown
# ✅ `sub_822737C8` is the coroutine spawner — and its seven callers name the whole start-up path
|
|
|
|
Asking *who calls the thing the timeline calls* turns out to enumerate every way
|
|
an ISL routine can begin.
|
|
|
|
`sub_822737C8(phase, base, offset)` — `add r9, r4, r28` computes `base + offset`
|
|
early on, so the third argument is a phase-relative code offset.
|
|
|
|
## The seven call sites
|
|
|
|
| site | in | what it starts |
|
|
|---|---|---|
|
|
| `0x82271030` | **`sub_82270DF8`** — the phase initialiser | the phase's **main entry** (the `0x1883` record's third word) |
|
|
| `0x822724D0` | the built-in stub region | `start_coroutine`'s target |
|
|
| `0x82274934` | **`sub_822748D0`** — the timeline walker | a scheduled routine |
|
|
| **`0x8226D8D0`** | **`sub_8226D740`** — the per-frame engine→script drain | an offset from **`[node+112]`** |
|
|
| **`0x8226DA10`** | the same drain, second path | the same `[node+112]` |
|
|
| `0x82273938` | `sub_82273910` | not read |
|
|
| `0x82264080` | `sub_82264058` | not read |
|
|
|
|
## ✅ The phase's main entry — a correction
|
|
|
|
`isl-stream-entry-points.md` called the record's third word a **size**. It is
|
|
not: the initialiser hands it to the spawner as an offset.
|
|
|
|
* **44 of 44 records land on the instruction stream — 100 %, against a 25.0 %
|
|
control.**
|
|
* All three of Stage 02's targets begin with the same prologue,
|
|
`special[0] = 0 ; local[0] = 0 ; call builtin116(0)`, which is a routine entry
|
|
and not a length.
|
|
|
|
So the record reads `0x1883, base, MAIN_ENTRY, 0, code_end, force_end_handler`.
|
|
|
|
🟡 Seeding it changes nothing measurable — every main entry was **already**
|
|
among the CFG's entry points by another route — so this corrects the *meaning*
|
|
of a field without moving any coverage number.
|
|
|
|
## 🔑 The drain spawns from `[node+112]`
|
|
|
|
The two calls inside `sub_8226D740` both do
|
|
|
|
```
|
|
lwz r5, 112(r31) ; the routine offset, out of the node
|
|
lwz r4, 232(r29) ; the phase's code base
|
|
bl 0x822737C8
|
|
```
|
|
|
|
`isl-builtins.md` describes `sub_8226D740` as the per-frame engine→script drain,
|
|
and here it is spawning routines from a **code offset carried in the drained
|
|
node at `+112`**. That is the first field of a trigger-style node to be located,
|
|
and it is the most promising remaining lead on the routines nothing else starts.
|
|
|
|
## 🟡 Not settled
|
|
|
|
* **`+112` is a field of *some* node** — this does not show the node comes from
|
|
the trigger queue at `phase+272`. That link is exactly the over-reach
|
|
`isl-builtins.md` already recorded and withdrew once; it is not asserted here.
|
|
* **Two callers unread**: `sub_82273910` and `sub_82264058`.
|
|
* **Whether the drain's nodes explain the unreached routines** is untested. It
|
|
is a lead, not a result.
|