cleanup(riscv): allocator prefers caller-saved (lowest-free, not round-robin) (#230, v0.11.26)

[avrabe]

Audit-cycle cleanup — issue #230

The RV32 alloc_temp recycled the pool [t0..t6, s1..s6] with a monotonic next_temp round-robin. Even after #226 made it skip live registers, it kept marching forward into the callee-saved s-registers instead of reusing a just-freed low register — so short-lived expressions needlessly used s-registers and paid the #220 save/restore prologue tax.

Why it's now removable

#226 added vstack liveness tracking. With that in place, alloc_temp can simply return the lowest-indexed free temp; the pool lists caller-saved t-registers first, so a function stays in them whenever ≤7 values are simultaneously live. The s-registers become a genuine overflow reserve rather than something round-robin consumed by accident. The dead next_temp field is removed.

Before / after (measured)

	before	after
controller_step .text	440 B	368 B (−72 B, −18 instrs)
callee-saved spills	6	0
frame	48 B	16 B

Oracle — behavior frozen, verified before opening

All five differential fixtures bit-identical:

• ARM: div_const 338/338, control_step 0x00210a55, flight_seam 0x07FDF307
• RV32: control_step 0x00210a55, controller_step 0x05ff0000

165 riscv unit tests pass. The #220 callee-saved-preservation test was reworked to force s-register usage via 8 simultaneously-live values (a shorter expression now stays in t-registers), so the spill/restore invariant remains genuinely exercised.

Scope

This is the round-robin → lowest-free revert only. The broader local register allocation + constant-CSE (Opt-3 perf lever, gale #209 / task #78) stays separate.

Closes #230.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[avrabe]

Built #231 from source (v0.11.26) and ran it against the real wasm-cross-LTO leaf functions on qemu_riscv32 (-icount shift=0, min-over-200 with overhead subtraction). The caller-saved-preference win reproduces beautifully — but it exposes a signed-division miscompile on one function. Please hold the merge.

The win (real workload, not just fixtures) ✅

All three leaves now use zero callee-saved registers (were s1–s6), code shrinks, and control_step/controller_step stay bit-identical AND get faster:

fn	code v0.11.25	code v0.11.26	callee-saved (v26)	icount v25→v26	correct?
filter_axis	172 B	88 B (−49%)	none	37→25	❌ wrong (returns 0)
control_step	576 B	504 B	none	141→129	✅ 2165333
controller_step	492 B	408 B	none	114→100	✅ 97419164

(control_step icount includes my ~6-cyc s11 table trampoline.) So your prediction held: the leaf prologue tax is gone and ratios drop toward native. controller_step 2.33×→2.04×, control_step 2.27×→2.08×.

The regression ❌ — signed-div overflow guard clobbers the dividend

filter_axis (the only one of these with a signed divide by a constant — (gyro*980 + accel*20)/1000) returns 0 instead of 1088 on v0.11.26. Reproducible 3/3; the loom.wasm itself is correct (wasmtime --invoke filter_axis_decide … 1000 100 500 → 1088), so it's RV32 codegen.

v0.11.26 disasm:

20: add  t0,t0,t1      # t0 = numerator (gyro_term*980 + accel*20)   <-- live, needed by div
24: li   t1,1000        # divisor
28: bnez t1,30          # divisor != 0  -> ok
30: lui  t0,0x80000     # INT_MIN constant materialized into t0  <-- CLOBBERS numerator
34: bne  t0,t0,44       # t0==t0 always false (meant to test numerator==INT_MIN)
38: li   t0,-1          # -1 constant -> t0 clobbered again
3c: bne  t1,t0,44       # 1000 != -1 -> taken
44: div  t0,t0,t1       # t0 = (-1)/1000 = 0   <-- dividend is gone

The signed i32.div_s overflow guard (the numerator==INT_MIN && divisor==-1 check) materializes its INT_MIN and −1 comparison constants into t0 — the register holding the live numerator — so by the div the dividend is −1.

v0.11.25 got this right by keeping the numerator in a callee-saved reg clear of the guard temps:

3c: add  s2,t4,s1       # numerator in s2
4c: lui  s5,0x80000      # INT_MIN in s5
50: bne  s2,s5,60        # correctly tests numerator vs INT_MIN
54: li   s6,-1           # -1 in s6
60: div  s4,s2,s3        # numerator s2 intact  -> 1088

Root cause: the dividend's live range extends across the overflow-guard basic blocks to the div, but the new lowest-free allocator treats t0 as free after the add and hands it to the guard constants. Same class as #226 (liveness across a branch region), resurfaced because #231 changed allocation order to lowest-free. Your 5 differential fixtures evidently don't include a signed-div-by-constant leaf, so they stayed green.

Minimal repro: int32_t f(int32_t prev,int32_t gyro,int32_t accel){ return ((prev+gyro)*980 + accel*20)/1000; } → wasm → loom inline → synth compile -b riscv -t rv32imac → f(1000,100,500) returns 0, expect 1088. Happy to test a fix the instant it's pushed — I have all four leaves wired to re-measure.