fix(thumb2): i64.popcnt epilogue clobber + i64.div_s INT64_MIN/-1 overflow trap (#632, #633)

[avrabe]

Fixes #632, fixes #633 — two shipped thumb-2 i64 miscompiles filed by gale, fixed structurally on both the Thumb-2 (cortex-m) and A32 (cortex-r5) paths.

#632 — i64.popcnt result clobbered by the expansion's own scratch-restore pop

Root cause (confirmed): it is neither the allocator choosing a "wrong" register nor the function epilogue — the I64Popcnt expansion itself saves scratch with PUSH {R3,R4,R5}, computes popcnt(lo)→R4, popcnt(hi)→R5, materializes the total with ADDS rd, R4, R5, and then restores scratch with POP {R3,R4,R5}. rd is allocator-assigned (any of R0–R8); whenever pressure lands it inside the expansion's own restore set {R3,R4,R5} (the issue's case: rd=R5), the restore destroys the result one instruction after it is produced.

Structural fix: the count is carried ACROSS the restore in R12 — encoder scratch, never allocatable (#212), never in any restore set — and moved into rd only after the pop (ADD.W R12,R4,R5; POP {R3,R4,R5}; MOV rd,R12). No choice of rd can collide, by construction. Two latent hazards in the same arm fixed alongside: the entry marshal now routes rnlo through R12 (an operand pair living at (R3,R4) previously read a clobbered R4), and the new MOV/MOV.W forms are total over rd/rnhi = R8 (the old ADDS T1 / MOVS T1 3-bit fields silently corrupted the encoding for R8 — #178/#180 class).

Expansion-family audit (pop-restore clobber class), per the #615-style sweep:

expansion	Thumb-2	A32	verdict
I64Popcnt	ADDS rd,R4,R5 before POP {R3,R4,R5}	same	AFFECTED — fixed (both ISAs)
I64DivS/DivU/RemS/RemU	result staged in R0:R1 before POP {R4-R11}/{R4-R8}/{R4-R7}; #610 fixed-ABI exit skips restored regs	same	safe
I64Rotl/Rotr	#610 fixed-ABI wrapper, no extra scratch pop	same	safe
I64Clz/I64Ctz	no scratch push/pop	same	safe
i32 Popcnt	no scratch push/pop (R11/R12 scratch)	same	safe (class-wise)

I64Popcnt was the only member of the class, on both ISAs; both are fixed here.

#633 — i64.div_s(INT64_MIN, -1) silently returned INT64_MIN instead of trapping

Root cause (confirmed): the I64DivS expansion emitted only the divide-by-zero guard. It negated the dividend (INT64_MIN wraps to itself), negated the divisor (−1→1), ran the unsigned core, and returned 0x8000000000000000 — no trap, violating WASM Core §4.3.2 idiv_s. The i32 path has the guard; the i64 path did not.

Fix: mirror the i32 overflow guard on the #610/#613 fixed-ABI wrapper path, right after the zero-divisor guard, where the dividend is in R0:R1 and the divisor in R2:R3: divisor == -1 && dividend == INT64_MIN → UDF #0 (22 bytes Thumb-2, register-independent; conditional-execution twin on A32). Emitted for div_s only.

Fix-guard twin: i64.rem_s(INT64_MIN, -1) keeps returning 0 without trapping — pinned by differential vectors (rem_s_m1(0, 0x80000000) = 0 OK, rem_s(IMIN, -1) = 0 OK) and by unit tests asserting I64RemS contains exactly one UDF (the zero-divisor trap) on both ISAs.

Oracles — red → green

scripts/repro/i64_popcnt_632_differential.py (unicorn-vs-wasmtime, symtab-based, -t cortex-m3 --relocatable), on origin/main:

popcnt64(0x7, 0x0) = 0x0 (oracle: 0x3) MISMATCH
popcnt64(0x1, 0x1) = 0x0 (oracle: 0x2) MISMATCH
popcnt64(0xffffffff, 0x0) = 0x0 (oracle: 0x20) MISMATCH
popcnt64(0xffffffff, 0xffffffff) = 0x0 (oracle: 0x40) MISMATCH
popcnt64(0x0, 0xffffffff) = 0x0 (oracle: 0x20) MISMATCH
popcnt64(0x12345678, 0x9abcdef0) = 0x0 (oracle: 0x20) MISMATCH
popcnt_direct(0xff) = 0x8 (oracle: 0x8) OK          <- issue's direct-form control
ORACLE: FAIL — 6 vector(s) wrong (#632)

post-fix: all 11 vectors OK, ORACLE: PASS (issue table (7,0)→3, (1,1)→2, (−1,0)→32, (−1,−1)→64 all exact).

scripts/repro/i64_divs_overflow_633_differential.py, on origin/main:

div_s_m1(0x0, 0x80000000) = 0x0 (oracle: TRAP) MISMATCH
div_s(0x8000000000000000, 0xffffffffffffffff) = 0x0 (oracle: TRAP) MISMATCH
rem_s_m1(0x0, 0x80000000) = 0x0 (oracle: 0x0) OK    <- twin already correct pre-fix
ORACLE: FAIL — 2 vector(s) wrong (#633)

post-fix: all 16 vectors OK, ORACLE: PASS — including 100/-1 = -100, INT64_MIN/1 and /2 (defined, no trap, both halves checked), rem_s(INT64_MIN,-1) = 0 no-trap, and div/rem-by-zero still trapping on both sides.

Gates

• Unit tests: test_632_i64_popcnt_result_survives_scratch_restore (all rd incl. {R3,R4,R5}, R8), test_632_i64_popcnt_marshal_pair_at_r3_r4, test_632_a32_i64_popcnt_result_survives_scratch_restore, test_633_i64_divs_overflow_guard_emitted, test_633_i64_rems_has_no_overflow_guard, test_633_a32_i64_divs_overflow_guard
• estimator_encoder_agreement (test(vcr-oracle): estimator↔encoder agreement oracle for the optimized path (#498, #242) #511 pin): green — I64Popcnt 172→180, I64DivS 172→194, register-independent; I64RemS unchanged at 170
• cargo test -p synth-cli --test frozen_codegen_bytes: all anchors untouched (no i64 popcnt / div_s-overflow shapes in the frozen fixtures)
• cargo test --workspace: 105 suites, 0 failures
• cargo fmt --check clean, cargo clippy --workspace --all-targets -- -D warnings clean

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!