fix(selector): spill rung stores before clobber — never reload a never-stored slot (#581)

[avrabe]

The bug (#581 — shipped-path silent miscompile, #518 severity class)

The direct selector's spill rung (the backend's exhaustion retry, VCR-RA-001 3b-lite) emitted a reload ldr r0, [sp,#8] of a frame slot that was never stored: scripts/repro/spill_on_exhaust_242.wat compiled --relocatable returns 0xffffd1ce for hp(1,2) where wasmtime says 0x2e37.

Named root cause

The #253 add/sub (and bitwise/const-addr) immediate folds delete the const materialization by source_line — which also deleted the spill store the const's own temp allocation emitted under the spill rung (alloc_temp_or_spill → spill_deepest_reg tags the victim's STR rX,[sp,#slot] with the const's line), leaving the victim's vstack entry marked Spilled with no store. The victim's register was then legitimately reassigned (the mul.w-adjacent clobber the issue observed), and its later pop reloaded garbage from the never-written slot.

Three sites shared the defect:

• drop_prev_const_materialization (8 fold callers: add/sub/and/or/xor + const-addr loads)
• splice_out_addr_const_materialization (the wasm linear-memory access lowering: emit base+offset instead of movw+movt+ldr for constant addresses #95 store fold)
• the perf: --relocatable direct selector bypasses synth-opt — general codegen optimization (research + stats tracking) #209 reciprocal-mult dead-divisor retain (removed by source_line across the whole function)

Fix (store-before-clobber invariant restored)

• is_const_materialization (MOVW/MOVT/MVN — the only ops the const handler emits) now filters every by-source_line drop, so a spill store sharing the const's tag survives any fold. The materialization ops are emitted after the store, so the tail walk stops there naturally; the fold itself still fires (asserted in the new unit test).
• Defensive assert_spill_reloads_have_stores at the end of select_with_stack (the internal-bug panic pattern): a reload from the reserved spill area with no preceding store to that slot panics loudly instead of compiling wrong code. Gated on area_reserved (v0.11.40 arm: spill-slot collision miscompiles dissolved k_mutex_unlock — live mutex-ptr arg clobbered by unpend() result, lock_count=0 store misses (silicon deadlock) #331 aliasing).

Red → green

scripts/repro/spill_rung_581_differential.py (unicorn vs wasmtime, direct path, symbols from the ELF symtab) runs the new minimal fixture spill_rung_581.wat (7 live binop results + i32.const 77; i32.sub fold — the smallest fold-deletes-store shape) plus the original #580 discovery fixture, 6 arg pairs each:

• main: ORACLE FAIL — minimal hp(1,2) = 0x4e vs 0x51; original hp(1,2) = 0xffffd1ce vs 0x2e37 (the recorded values)
• this branch: ORACLE PASS, 12/12

Gates

• unit fold_preserves_spill_store_581 (every spill-area reload has a matching store; the imm fold still drops the MOVW)
• frozen fixtures 3/3 bit-identical (frozen_codegen_bytes: ARM + RV32 + stack-fwd escape hatch) — the default pass never tags a spill store with a const's line, so shipped bytes are unchanged by construction
• r12_spill_496_differential.py PASS, AAPCS oracle (audit_aapcs_repro) 5/5
• cargo test -p synth-synthesis -p synth-cli green (41 test binaries, 0 failures)
• cargo fmt --check + clippy --all-targets -D warnings clean

Scope note

The fix covers all three by-source_line deletion sites in the direct selector. The defensive validator is linear-scan (store-before-reload in emission order, which is how the vstack machinery always orders them) and is defense-in-depth behind the filters — slot reuse can mask a lost second-generation store from the scan, but no such deletion path remains.

Closes #581

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!