fix(opt): i64 lowering miscompiles memset-style loop counter on Cortex-M (#93)

[avrabe]

Closes #93.

Diagnosis

The default synth compile --target cortex-m4f (optimized) path in
crates/synth-synthesis/src/optimizer_bridge.rs had no handler for
WasmOp::I64ExtendI32U / WasmOp::I64ExtendI32S / WasmOp::I32WrapI64.
They fell through the catch-all _ => Opcode::Nop arm in wasm_to_ir,
advancing inst_id by 1 but never registering the produced i64-pair
vregs in vreg_to_arm.

When a downstream Opcode::I64ShrU / I64Shl / I64ShrS looked up its
shift-count vreg via get_arm_reg, the lookup missed the map and silently
fell back to Reg::R0 (optimizer_bridge.rs:1333):

let get_arm_reg = |vreg, map, spills| -> Reg {
    if let Some(&r) = map.get(&vreg.0) { r }
    else if spills.contains_key(&vreg.0) { Reg::R12 }
    else { Reg::R0 }   // <-- silent R0 fallback
};

The ARM emitter for the variable 64-bit shift (crates/synth-backend/src/arm_encoder.rs:2856 for I64Shl, :2938 for I64ShrU, :3019 for I64ShrS) writes to both rm_lo and rm_hi as scratch:

AND.W   rm_lo, rm_lo, #63
SUBS.W  rm_hi, rm_lo, #32   ;; bug surface: rm_hi clobbered
BPL     .large
RSB.W   rm_hi, rm_lo, #32
LSL.W   rm_hi, rn_hi, rm_hi
...

So any wasm function doing i64.shr_u of an i64.extend_i32_u-ed shift
count clobbered AAPCS first-param register R0 inside the shift
expansion. For compiler_builtins::memset, R0 is the destination
pointer, so the byte loop's pointer was destroyed every iteration →
non-terminating loop on STM32G474RE silicon at memset+0x4c (PC
bouncing between 0x...c668 and 0x...c67e).

Repro WAT (minimal)

(module
  (func (param i32) (param i32) (param i32) (param i32) (result i64)
    i64.const 0x0101010101010101         ;; the i64 fill word
    local.get 1                          ;; 32-bit count, lives in R1 (param 1)
    i64.extend_i32_u                     ;; -> i64 shift amount
    i64.shr_u                            ;; emits I64ShrU{rm_lo=Rx, rm_hi=R0!}
  )
)

The WasmOp sequence used by the regression test is the same shape; see crates/synth-synthesis/tests/issue_93_memset_i64_codegen.rs::repro_wasm_ops. Pre-fix, the optimized path emits:

I64ShrU { rd_lo: R6, rd_hi: R7, rn_lo: R5, rn_hi: R2, rm_lo: R3, rm_hi: R0 }

rm_hi: R0 is the smoking gun — that's the first AAPCS param, and the encoder writes to it inside the shift expansion. Post-fix, the same sequence allocates a callee-saved pair (R4..R11) for the shift count, leaving R0..R3 untouched.

Fix scope

Three additions, all narrow:

1. crates/synth-opt/src/lib.rs — adds three Opcode variants:
   I64ExtendI32U, I64ExtendI32S, I32WrapI64. All optimization
   passes have _ => {} wildcards, so existing passes are unaffected.

2. crates/synth-synthesis/src/optimizer_bridge.rs:

   • wasm_to_ir: handlers for the three new ops, with slot accounting
     that keeps inst_id.saturating_sub(K) arithmetic correct for
     downstream i64 ops (extend reuses the consumed i32 slot for
     dest_lo; wrap reuses the i64-lo slot and decrements inst_id
     so the natural +1 cancels with the -1 net slot delta).
   • ir_to_arm: lowerings that allocate a callee-saved consecutive
     pair via alloc_i64_pair and Mov the i32 source into the new
     dest_lo — even when the source is already in a non-param
     register — so the downstream shift's clobbered rm_lo/rm_hi
     can never be a live AAPCS param.
   • analyze_i64_local_gets: skips the i32 producer that feeds an
     I64ExtendI32U / I64ExtendI32S, otherwise the analyzer would
     mistakenly mark that LocalGet as i64 and double-load the local.

3. crates/synth-synthesis/tests/issue_93_memset_i64_codegen.rs —
   5 new regression tests:

   • issue_93_no_optimize_path_handles_repro — sanity check that
     select_with_stack is and was always correct for this input.
   • issue_93_optimized_i64_shr_u_does_not_use_r0_as_shift_count —
     the headline regression. Asserts the optimized path's I64ShrU
     emission has rm_lo/rm_hi outside R0..R3.
   • issue_93_optimized_i64_shr_u_value_and_count_are_distinct — no
     value/count register aliasing.
   • issue_93_optimized_i64_shl_does_not_use_r0_as_shift_count —
     same for I64Shl (uses local.get 2 to also exercise R2 path).
   • issue_93_optimized_i64_shr_s_does_not_use_r0_as_shift_count —
     same for I64ShrS (sign-extend variant).

   Pre-fix: 3/5 fail (one per shift variant). Post-fix: 5/5 pass.

Verification

• cargo test --workspace — all green (1095 tests, +5 from this PR)
• cargo clippy --workspace --all-targets -- -D warnings — clean
• cargo fmt --check — clean

v0.2.1 patch candidate

This is silicon-blocking for any merged-wasm bench integration that
links compiler_builtins. The patch is intentionally narrow (no
refactor, no broader regalloc rework) and targeted at the v0.2.1 patch
release line.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 99.00000% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/synth-synthesis/src/optimizer_bridge.rs	99.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!