1146 sites in 22 stages, the second-largest unnamed built-in. Its method sub_822646B8 (vtable slot 300) and built-in 2's sub_822642E0 (slot 12) are 190 and 199 instructions and differ in exactly one block. Diffed instruction by instruction, 108 adds: lwz r11, 16(r29) the blob's slot-16 int cmpwi/blt/cmpwi/bgt range-check n to [0, 31] slw r21, r25, r11 r21 = 1 << n <- a 32-bit selector ... default 1 when out of range Everywhere built-in 2 passes its r21, 108 passes r20 and reserves r21 for the mask, so the bit is an EXTRA argument to the same call rather than a replacement. Both post the identical command word AB0100BA, opcode 256. The operand is always a valid bit index: over all 1146 sites slot 16 is in [0, 31], 1146 of 1146, none outside, so the out-of-range default never fires in shipped content. Fifteen distinct values clustered at 16 (531x), 31 (165x), 20 (161x) and 2 (90x); 21 of 22 stages use more than one. What the bit SELECTS is not established and the name does not claim it. There is plainly a 32-bit space -- built-in 92 reportedly allocates a free bit by OR-ing over live units, which would make 108 its "place in a named slot" counterpart -- but I have not verified that, so the name says only what is proven: the same deploy as built-in 2, with an extra selector. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PMRJjbxLqZtsb5Vb7KunPE
18 KiB
Executable File
18 KiB
Executable File