Skip to main content

rucc_codegen/select/
x86_64.rs

1//! The x86-64 lowering table.
2//!
3//! Everything below the module comment is generated from `rules/x86-64.rules` by `rucc-rules`
4//! when this crate is built, and none of it is in the repository. The rule file is the only
5//! place the rules are written, which is what makes the table that is matched with and the
6//! table `rucc-verify` proves things about the same table.
7//!
8//! To read the rules, read the rule file. To read the automaton they compile into, build the
9//! crate and read `x86-64.rs` under the build directory, which is a file worth looking at once
10//! for the shape of it and never again.
11
12// A guard is emitted as the comparison the rule writes, so a rule saying a shift count is at
13// least zero and less than the width comes out as two comparisons rather than as a range. That
14// is deliberate: the generated line and the rule it came from should read the same, and the
15// suggestion to write it another way is advice for somebody editing code, which nobody here is.
16#![allow(clippy::manual_range_contains)]
17
18include!(concat!(env!("OUT_DIR"), "/x86-64.rs"));
19
20#[cfg(test)]
21mod tests {
22    use rucc_target::x86_64;
23
24    use super::TABLE;
25    use crate::select::Piece;
26
27    /// The prefix a rule file puts in front of a machine term, which is how it says which target
28    /// the term belongs to. It is not part of the opcode.
29    const PREFIX: &str = "x64.";
30
31    /// The two address constructors, which are not instructions. An addressing mode is an
32    /// argument to `lea` and to every memory operand after it, so it is written as a term in the
33    /// rule file and built by the selector into the instruction that takes it.
34    const AMODES: &[&str] =
35        &["amode_base_index_scale", "amode_index_scale", "amode_base", "amode_base_offset"];
36
37    /// Every head this table can write, in and under the replacements.
38    fn heads() -> Vec<&'static str> {
39        let mut found: Vec<&'static str> = TABLE
40            .rules
41            .iter()
42            .flat_map(|rule| rule.replacement.iter())
43            .filter_map(|piece| match piece {
44                Piece::App { head, .. } => Some(*head),
45                _ => None,
46            })
47            .collect();
48        found.sort_unstable();
49        found.dedup();
50        found
51    }
52
53    #[test]
54    fn every_instruction_the_table_writes_is_described() {
55        for head in heads() {
56            if AMODES.contains(&head) {
57                continue;
58            }
59            let opcode = head.strip_prefix(PREFIX).unwrap_or_else(|| {
60                panic!("{head} is neither an x86-64 term nor an addressing mode")
61            });
62            assert!(
63                x86_64::form(opcode).is_some(),
64                "{head} is selected by a rule and `rucc_target::x86_64` does not say what it \
65                 does with its operands"
66            );
67        }
68    }
69
70    /// The order the operands of a store are written in, which is the IR's and not a choice this
71    /// file makes.
72    ///
73    /// A pattern is matched against an instruction's operand list by position, so a rule that
74    /// names the address where the IR holds the value is a rule that stores to the value and
75    /// writes the address into memory. Nothing in a proof would catch it, because a proof is
76    /// about the rule file agreeing with itself, and both halves would be wrong in the same way.
77    /// `rucc_ir::Builder::store` takes the value first and the machine instruction takes it last,
78    /// which is why the two halves of one of these rules read in opposite orders.
79    #[test]
80    fn a_store_is_written_with_the_value_first_because_that_is_where_the_ir_keeps_it() {
81        let mut seen = 0;
82        for rule in TABLE.rules {
83            let Some(rest) = rule.pattern.strip_prefix("(store.") else { continue };
84            let (width, operands) = rest.split_once(' ').expect("a store takes operands");
85            assert!(
86                operands.starts_with(&format!("(value.{width} ")),
87                "line {}: {} binds something other than the value it is storing first",
88                rule.line,
89                rule.pattern
90            );
91            assert!(
92                operands.contains("(value.i64 "),
93                "line {}: {} reaches no address",
94                rule.line,
95                rule.pattern
96            );
97            seen += 1;
98        }
99        assert_eq!(seen, 16, "the store rules moved and this test did not follow them");
100    }
101
102    /// Every comparison can be made against a constant as well as against a register.
103    ///
104    /// Four comparisons in five in the corpus are against a constant, and without a rule for one
105    /// the constant is loaded into a register first, which is an instruction and a register the
106    /// machine never needed. A missing width or a missing condition would not fail anything else:
107    /// the register rule still matches, the output is still correct, and the only sign is code
108    /// that is one instruction longer in a place nobody is looking. So the two lists are counted
109    /// against each other here.
110    ///
111    /// What this cannot check is that the condition on the immediate rule is the right one, since
112    /// both halves of a wrong pair would be a consistent pair. That is what the `spec` clause is
113    /// for, and `rucc-verify` is what reads it.
114    #[test]
115    fn a_comparison_against_a_constant_is_written_for_every_one_against_a_register() {
116        let mut against_register = Vec::new();
117        let mut against_constant = Vec::new();
118        for rule in TABLE.rules {
119            let Some(rest) = rule.pattern.strip_prefix("(icmp_") else { continue };
120            let (condition, operands) = rest.split_once(".i1 ").expect("a comparison takes two");
121            let width = operands
122                .strip_prefix("(value.")
123                .and_then(|rest| rest.split_once(' '))
124                .map(|(width, _)| width)
125                .expect("a comparison reads a value first");
126            let named = format!("{condition}.{width}");
127            if operands.contains("(iconst.") {
128                // The constant is the second operand and never the first, because a comparison is
129                // not symmetric and the same condition on the other side means the opposite.
130                assert!(
131                    !operands.starts_with("(iconst."),
132                    "line {}: {} compares a constant against a value",
133                    rule.line,
134                    rule.pattern
135                );
136                against_constant.push(named);
137            } else {
138                against_register.push(named);
139            }
140        }
141        against_register.sort_unstable();
142        against_constant.sort_unstable();
143        assert_eq!(against_register, against_constant);
144        assert_eq!(against_register.len(), 40, "ten conditions at four widths");
145    }
146
147    /// The instructions the calling convention writes rather than a rule.
148    ///
149    /// Three kinds of them. Naming the register an argument arrived in, where an argument is
150    /// depends on its position in the signature and on the classification of every argument before
151    /// it, and a rule pattern sees one term and has no way to say any of that, so `crate::abi`
152    /// builds these from the convention instead. Calling a name is the same the other way round:
153    /// what its operands are is whatever the signature made them, and a call through an address is
154    /// the same instruction with one operand more.
155    ///
156    /// The second half of a value that comes back in two registers is the third. A return of one
157    /// value is a rule, because where that value goes depends on nothing but the value, which is
158    /// exactly what a rule can say. A return of two is not, because which register the second half
159    /// is in depends on the first half: the two register files are counted separately, so a
160    /// `double` and a `long` both come back at place zero and two `long`s do not.
161    const CONVENTION: &[&str] = &[
162        "arg_val_8",
163        "arg_val_16",
164        "arg_val_32",
165        "arg_val_64",
166        "arg_val_f32",
167        "arg_val_f64",
168        "arg_val_f128",
169        "ret_val2_8",
170        "ret_val2_16",
171        "ret_val2_32",
172        "ret_val2_64",
173        "ret_val2_f32",
174        "ret_val2_f64",
175        "ret_val2_f128",
176        "call",
177        "call_reg",
178    ];
179
180    /// The instructions the block layout writes rather than a rule.
181    ///
182    /// A rule sees one branch and the layout is about the order of every block in the function, so
183    /// which arm falls through is not something any pattern could say. That answer is what decides
184    /// whether the jump goes to the arm the condition is true for or the other one, and whether
185    /// there is a second jump after it, so all of these are written where the answer is.
186    ///
187    /// The comparisons are here for a second reason on top of that one. A branch on a comparison
188    /// is a comparison and a jump on the flags it set, and the flags are not a value: no pattern
189    /// could bind one and no `spec` clause could say anything about one. So the pair is put
190    /// together by the layout, out of a comparison a rule did select and the branch behind it,
191    /// which is the same argument `rucc_target::x86_64::Form::CmpSet` is one form rather than two
192    /// under.
193    /// The instructions the size directed peephole writes rather than a rule.
194    ///
195    /// [`crate::shorten`] turns a comparison of a register against zero into a test of the register
196    /// against itself, which asks the machine the same thing in one byte less, and an addition of
197    /// one into the instruction that adds one and says so in its opcode, which is another byte less.
198    /// No rule could select either. Whether the first says the same thing depends on the constant
199    /// the comparison carries and a pattern binds a value rather than reads a number out of one, and
200    /// whether the second does depends on what reads the carry behind it, which is not something a
201    /// pattern sees at all. The eight bit test is not here because the layout writes that one as
202    /// well and it is on the list below.
203    const PEEPHOLE: &[&str] = &[
204        "test_rr_16",
205        "test_rr_32",
206        "test_rr_64",
207        "inc_r_8",
208        "inc_r_16",
209        "inc_r_32",
210        "inc_r_64",
211        "dec_r_8",
212        "dec_r_16",
213        "dec_r_32",
214        "dec_r_64",
215    ];
216
217    const LAYOUT: &[&str] = &[
218        "test_rr_8",
219        "cmp_rr_8",
220        "cmp_rr_16",
221        "cmp_rr_32",
222        "cmp_rr_64",
223        "cmp_ri_8",
224        "cmp_ri_16",
225        "cmp_ri_32",
226        "cmp_ri_64",
227        "cmp_rm_8",
228        "cmp_rm_16",
229        "cmp_rm_32",
230        "cmp_rm_64",
231        "cmp_mi_8",
232        "cmp_mi_16",
233        "cmp_mi_32",
234        "cmp_mi_64",
235        "jcc_e",
236        "jcc_ne",
237        "jcc_l",
238        "jcc_le",
239        "jcc_g",
240        "jcc_ge",
241        "jcc_b",
242        "jcc_be",
243        "jcc_a",
244        "jcc_ae",
245        "jmp",
246    ];
247
248    /// The instructions the compare pass writes rather than a rule.
249    ///
250    /// The other half of the argument the comparisons above are here under. A rule selects a
251    /// comparison that keeps its answer in a byte, because that is the shape a value has. What is
252    /// left of one when the machine has already made the comparison is the byte with no comparison
253    /// in front of it, and there is no pattern for that: the term it would compute is the same term
254    /// the full comparison computes, and what makes the short one right is the instruction three
255    /// places back rather than anything about the value. So `crate::compare` writes them by name,
256    /// in place of a comparison it found was already made.
257    const COMPARE: &[&str] = &[
258        "set_e", "set_ne", "set_l", "set_le", "set_g", "set_ge", "set_b", "set_be", "set_a",
259        "set_ae",
260    ];
261
262    /// The instruction a computed `goto` is written as rather than a rule.
263    ///
264    /// The one branch `crate::lower` writes by name, and the one the block layout does not write
265    /// either. What it reads is the address, which a pattern could have bound, so it is not
266    /// exempt for the reason the branches above are. What no pattern can say is the rest of it:
267    /// how many arms the block has, which is every label of the function the program took the
268    /// address of, and a rule says what an instruction reads rather than where a block goes.
269    const LABELS: &[&str] = &["jmp_reg"];
270
271    /// The instruction the memory model writes rather than a rule.
272    ///
273    /// A barrier computes nothing, so there is no equality for the solver to discharge and no
274    /// pattern for a rule to be written as. What makes it the right answer is what the machine
275    /// promises about the order two other instructions become visible in, which is a claim about
276    /// the program around it rather than about any value. `crate::lower` writes it by name, at the
277    /// strongest ordering and nowhere else, and `crate::expand` says why the strongest is the only
278    /// one that costs anything here.
279    const BARRIER: &[&str] = &["mfence"];
280
281    /// The instruction a program stops on, which `crate::lower` writes rather than a rule.
282    ///
283    /// The first half of the barrier's reason and not the second. It computes nothing, so there is
284    /// no equality for the solver and no pattern for a rule. What makes it right is not a claim
285    /// about the order anything becomes visible in either: it is what the operating system does
286    /// with the fault, which is a fact about neither the values nor the program around it.
287    const STOP: &[&str] = &["ud2"];
288
289    /// The instructions that are a hint rather than a computation.
290    ///
291    /// The same shape of exemption the barrier gets and for a reason one step further out. A
292    /// barrier computes nothing and still has to be where it is, so there is at least a claim about
293    /// the program around it. A prefetch does not even have that: a machine that drops the whole
294    /// instruction runs the program correctly, because the only thing it can change is how long the
295    /// program takes.
296    ///
297    /// So there is no equality for the solver and no pattern for a rule, and which of the four a
298    /// program gets is decided by a number in the builtin's own arguments rather than by anything
299    /// about the value being prefetched. `crate::lower` writes them by name, out of the hint the IR
300    /// carries beside the instruction.
301    const HINT: &[&str] = &["prefetch_nta", "prefetch_t0", "prefetch_t1", "prefetch_t2"];
302
303    /// The instructions nothing but an `asm` statement asks for.
304    ///
305    /// One step further out again. A prefetch is a hint and is still something the compiler decides
306    /// to write, out of a builtin the program called. These are instructions the program wrote down
307    /// itself, by name, in a template, and nothing else in the language reaches them: there is no
308    /// builtin for either, no rule could match a term that produces one, and `crate::lower` writes
309    /// them only because [`rucc_target::x86_64::read`] found the name in a template and said which
310    /// opcode that is.
311    ///
312    /// `pause` is the hint a spin lock writes between two tries at the lock. `cpuid` is how a
313    /// program asks the processor what it can do, which there is no other way to ask, so every
314    /// program that takes a faster path on some machines than on others has one of these in it.
315    ///
316    /// The alignment is the third, and it is on this list rather than one of its own because it
317    /// meets the claim below outright: an instruction is exempt for this reason exactly when there
318    /// is nothing about it for a rule to name, and an opcode with no operands and no addressing mode
319    /// has nothing. It is not an instruction at all, which is more than the test asks and is the
320    /// reason no rule could have been written for it however the rule language grew.
321    ///
322    /// A byte out of a template is the fourth and is there for the same reason as the alignment,
323    /// one step further still: it is not an instruction, and what it holds is a byte the program
324    /// wrote out itself because its assembler was older than the instruction it wanted. There is
325    /// nothing for a rule to have said about a number a program handed the processor directly.
326    const TEMPLATE: &[&str] = &["cpuid", "pause", "align", "byte"];
327
328    /// The instructions a template asks for that are right because of the line above them.
329    ///
330    /// These are exempt for the reason the ten bytes in [`COMPARE`] are, one step further out. A
331    /// rule selects a conditional move with its comparison in front of it, because that pair is the
332    /// shape a select has. The move on its own computes the same term and what makes it right is the
333    /// comparison somewhere behind it rather than anything about its own operands, so no pattern
334    /// could say what it means. The compare pass does not write one either, because it replaces a
335    /// comparison it found was already made and there is no earlier move here to replace: what
336    /// writes one is a program that put the comparison on one line of a template and the move on the
337    /// next, which is what zstd does to keep a bounds check from becoming a branch.
338    ///
339    /// So these have operands a rule could have named, unlike everything in [`TEMPLATE`], and they
340    /// are still not instructions a rule could have been written for.
341    /// The add with carry and the subtract with borrow, which read a bit off the instruction in
342    /// front of them.
343    ///
344    /// Exempt one step further out again than [`CONDITIONAL`]. A conditional move reads the
345    /// condition state and leaves it alone, so what is missing from a rule that named one is the
346    /// comparison. These read it and write it both, and what is missing is worse than a comparison:
347    /// the bit they read is the carry out of an addition, and an addition in the IR is an addition
348    /// of a width with no carry out at all, so there is no term a rule could match that the bit is
349    /// a part of. A program gets one by writing both halves itself in a template, which is what
350    /// `add_ssaaaa` and `sub_ddmmss` in libgmp's `longlong.h` are. The form against a constant is
351    /// here for the same reason and is the same instruction with a zero where the second source is,
352    /// which `add_sssaaaa` writes for the top word of a number three words wide.
353    ///
354    /// What keeps the two halves together once they are two instructions in a block is not here. It
355    /// is `rucc_target::FlagInsts`, which the scheduler reads for exactly this, and the test below
356    /// checks the entry is there rather than trusting that somebody remembered.
357    const CARRY: &[&str] = &[
358        "adc_rr_8",
359        "adc_rr_16",
360        "adc_rr_32",
361        "adc_rr_64",
362        "sbb_rr_8",
363        "sbb_rr_16",
364        "sbb_rr_32",
365        "sbb_rr_64",
366        "adc_ri_8",
367        "adc_ri_16",
368        "adc_ri_32",
369        "adc_ri_64",
370        "sbb_ri_8",
371        "sbb_ri_16",
372        "sbb_ri_32",
373        "sbb_ri_64",
374    ];
375
376    const CONDITIONAL: &[&str] = &[
377        "cmov_e_16",
378        "cmov_e_32",
379        "cmov_e_64",
380        "cmov_ne_16",
381        "cmov_ne_32",
382        "cmov_ne_64",
383        "cmov_l_16",
384        "cmov_l_32",
385        "cmov_l_64",
386        "cmov_le_16",
387        "cmov_le_32",
388        "cmov_le_64",
389        "cmov_g_16",
390        "cmov_g_32",
391        "cmov_g_64",
392        "cmov_ge_16",
393        "cmov_ge_32",
394        "cmov_ge_64",
395        "cmov_b_16",
396        "cmov_b_32",
397        "cmov_b_64",
398        "cmov_be_16",
399        "cmov_be_32",
400        "cmov_be_64",
401        "cmov_a_16",
402        "cmov_a_32",
403        "cmov_a_64",
404        "cmov_ae_16",
405        "cmov_ae_32",
406        "cmov_ae_64",
407    ];
408
409    /// The instructions that look for a set bit, which a template asks for and nothing else does.
410    ///
411    /// These have a source and a destination a rule could have named, the way the conditional moves
412    /// above do, and the reason no rule names them is a different one again. It is not that their
413    /// meaning comes from the line in front of them: each of these says on its own exactly what it
414    /// computes. It is that [`crate::expand`] already answers the question they answer, out of
415    /// arithmetic every machine has, and it does that because what these do when the source is zero
416    /// is four different things on four families of processor. A rule that selected one would be a
417    /// rule whose answer depends on which machine ran it.
418    ///
419    /// So the only thing that reaches one is a program that wrote the name in a template, which is
420    /// what the libraries that were counting bits before there was a builtin for it all do.
421    /// `crate::lower` writes them for the reason it writes the three in [`TEMPLATE`], and they are
422    /// not on that list because they are not bare: a rule could have named these operands and the
423    /// claim that list makes would be false of them.
424    const SEARCH: &[&str] = &[
425        "bsf_16", "bsf_32", "bsf_64", "bsr_16", "bsr_32", "bsr_64", "lzcnt_32", "lzcnt_64",
426        "tzcnt_32", "tzcnt_64",
427    ];
428
429    /// The instruction that turns a register round, which a template asks for and nothing else does.
430    ///
431    /// The list above, one step simpler. A search is unselected because what it does with a source
432    /// of zero is not the same on every processor, so a rule that chose one would depend on what ran
433    /// it. A byte reversal has no such case: it means exactly one thing everywhere. What keeps it
434    /// off the rule set is a choice made once, in [`crate::expand`], which builds a reversal out of
435    /// shifts and masks so that the answer is the same on every target this compiler has rather than
436    /// good on the one that happens to have the instruction. tamnd/rucc#310 is where that trade is
437    /// written down, and the day a target grows its own reversal is the day to reopen it.
438    ///
439    /// So the only thing that reaches one is a program that wrote the name in a template, which is
440    /// what libgmp does in `gmp-impl.h` to put a limb the other way round.
441    const SWAP: &[&str] = &["bswap_32", "bswap_64"];
442
443    /// The jump out of the function a template may end with, which a template asks for and nothing
444    /// else could.
445    ///
446    /// Unselected for a reason none of the lists above give, and the plainest reason of the lot:
447    /// there is no term in the IR for it to be the answer to. A tail jump is not a computation and
448    /// it is not a branch between this function's blocks either, it is the function ending
449    /// somewhere other than at its own `ret`, and the only thing that says a function ends that way
450    /// is a program writing `jmp` at the end of a template in a function that is `naked`. See
451    /// [`rucc_target::x86_64::Step::Away`].
452    const AWAY: &[&str] = &["jmp_away"];
453
454    /// The multiply that keeps both halves of its product and the division that reads both halves
455    /// of its dividend, which a template asks for and nothing else does.
456    ///
457    /// A third reason again, and the plainest of the three. A search is unselected because its
458    /// answer depends on the processor and a reversal because a choice was made to build one out of
459    /// arithmetic. This one is unselected because there is nothing in the IR to select it from: a
460    /// multiply in C takes two values of a type and produces a value of that type, so the term a
461    /// rule would match on is the narrow product, and the wide product is not a term at all. A rule
462    /// that fired on the narrow one and wrote this would be writing an instruction that computes
463    /// twice as much as was asked for and leaves the rest in a register nobody asked about.
464    ///
465    /// So the only thing that reaches one is a program that wrote the name in a template, which is
466    /// what `umul_ppmm` in libgmp's `longlong.h` does, and what every library that is building
467    /// arithmetic out of limbs does somewhere.
468    ///
469    /// The division is the same claim upside down and is on this list because the reason is the same
470    /// one. A division in C divides a number by a number of its own width, so the term a rule would
471    /// match is the narrow one, and this compiler already has two opcodes for that: each of them
472    /// fills the high half of the dividend itself and then throws one of the two answers away. A
473    /// dividend the program filled both halves of is not a term the IR has, and `udiv_qrnnd` beside
474    /// the multiply in the same header is how long division a limb at a time is written.
475    const WIDE: &[&str] = &[
476        "mul_wide_16",
477        "mul_wide_32",
478        "mul_wide_64",
479        "imul_wide_16",
480        "imul_wide_32",
481        "imul_wide_64",
482        "div_wide_16",
483        "div_wide_32",
484        "div_wide_64",
485        "idiv_wide_16",
486        "idiv_wide_32",
487        "idiv_wide_64",
488    ];
489
490    /// The instructions that produce two values, which is one more than a rule can name.
491    ///
492    /// A rule replaces a term with a term, and a term is the value one instruction computes. A
493    /// compare and exchange computes two: what it found at the address, and whether what it found
494    /// was what the program expected. There is no way to write the second one down in the rule
495    /// language, and inventing one would be inventing a language for a single instruction.
496    ///
497    /// So `crate::lower` writes it by name, the way it writes the barrier by name, and for a reason
498    /// that is about the rule language rather than about the machine. What the solver would have
499    /// been asked to prove about it is the easy half in any case: the arithmetic is a comparison
500    /// and a select, and what is hard is that the whole of it happens at once, which is the same
501    /// claim about the program around it that a barrier makes.
502    const ATOMIC: &[&str] = &["cmpxchg_8", "cmpxchg_16", "cmpxchg_32", "cmpxchg_64"];
503
504    /// The instructions whose operation is in the payload rather than in the head.
505    ///
506    /// A different exemption from the one above, on instructions that produce one value each and so
507    /// could be named by a rule if the rule had anything to match on. The head a pattern matches is
508    /// an opcode and a type, and every read modify write in the IR is the one opcode `atomic_rmw`.
509    /// Which of the thirteen operations it performs is carried beside the instruction rather than in
510    /// its name, so a pattern written for the exchange would match the add and the nand as well, and
511    /// the rule language has no way to look at what a rule matched to tell them apart.
512    ///
513    /// Giving each operation its own opcode is the other way out and is a worse trade: it is
514    /// thirteen opcodes at four widths where the IR wants one, and every pass that treats a read
515    /// modify write as one thing would then have a list of fifty two.
516    ///
517    /// So `crate::lower` writes these by name too. Three operations here, out of the thirteen: the
518    /// bitwise ones need a loop around a compare and exchange, which is control flow and so is built
519    /// before selection rather than during it, and they are the rest of `tamnd/rucc#311`.
520    const PAYLOAD: &[&str] =
521        &["xchg_8", "xchg_16", "xchg_32", "xchg_64", "xadd_8", "xadd_16", "xadd_32", "xadd_64"];
522
523    /// The instructions a frame writes rather than a rule.
524    ///
525    /// A prologue, an epilogue, a copy, a spill and a reload are not in the program. They are what
526    /// the allocator's answer costs, so they are written after it, by `crate::finish` reading
527    /// `x86_64::FRAME`. Six of the names that describes are already reachable from a rule, since a
528    /// prologue taking its frame is a subtraction and a spill is a store, and those are not here:
529    /// this is only the ones nothing else can reach.
530    const FRAME: &[&str] = &[
531        "push_64",
532        "pop_64",
533        "ret",
534        "mov_rr_64",
535        "movaps_rr",
536        // The touch a probing prologue puts on each page as it reaches it, the landing pad a
537        // prologue opens with, and the byte that does nothing which one reserves room with. All
538        // three are written by a frame and none on a command line that did not ask for it.
539        "or_mi_8",
540        "endbr64",
541        "nop",
542    ];
543
544    /// The instructions that reach the x87 stack, which are selected but not from here.
545    ///
546    /// A third kind of exemption, and the same reason all the way down the list.
547    ///
548    /// Every one of these is written by `crate::lower`, as part of a group rather than on its own.
549    /// What one of them leaves behind and the next picks up is the top of the x87 stack, which is
550    /// not a register anything allocates from and not a value a pattern could bind, so a rule
551    /// could neither match the middle of a group nor name what its replacement produced. And an
552    /// add here reads two addresses and writes a third, where one machine IR instruction carries
553    /// one addressing mode, so the group cannot be folded into a single opcode the way
554    /// `ucomisd_set_e` folds a comparison and a `setcc` either.
555    ///
556    /// So these are exempt for the reason `FRAME` is exempt rather than for the reason the list
557    /// below is, and they will stay exempt. Two of them are not reached by anything yet all the
558    /// same: `fsub_p` and `fdiv_p` are the other direction of the subtraction and the division,
559    /// which a code generator that pushed its operands the other way round would need and this one
560    /// does not. `fabs` is a third, since C spells that as a call to a library function.
561    const X87: &[&str] = &[
562        "fld_t",
563        "fstp_t",
564        "fld_s",
565        "fld_l",
566        "fild_l",
567        "fild_ll",
568        "fstp_s",
569        "fstp_l",
570        "fistp_l",
571        "fistp_ll",
572        "fnstcw",
573        "fldcw",
574        "fadd_p",
575        "fsub_p",
576        "fsubr_p",
577        "fmul_p",
578        "fdiv_p",
579        "fdivr_p",
580        "fchs",
581        "fabs",
582        "fucomip_set_a",
583        "fucomip_set_ae",
584        "fucomip_set_b",
585        "fucomip_set_be",
586        "fucomip_set_e",
587        "fucomip_set_ne",
588        "fucomip_set_p",
589        "fucomip_set_np",
590        "fucomip_set_e_and_np",
591        "fucomip_set_ne_or_p",
592    ];
593
594    /// The instructions no rule selects yet, because the rules that selected them were taken out.
595    ///
596    /// A different kind of exemption from the three above. Those say an instruction is written
597    /// somewhere a rule cannot reach and always will be. These say nobody reaches one at all right
598    /// now, and name the work that puts the rules back.
599    ///
600    /// The rules went out under `tamnd/rucc#368`. C promotes the operands of an arithmetic
601    /// operator to `int`, so a byte add and a two byte compare are things no C program asks the
602    /// back end for, and the rules at those widths sat proved and never selected over the whole
603    /// torture corpus at every optimization level. The width narrowing pass in `tamnd/rucc#375` is
604    /// what asks for them, and the rules come back with it.
605    ///
606    /// The descriptions stayed. A description says what an x86-64 instruction is, how long it is
607    /// and how it encodes, and that is true whether or not anything selects it. Taking them out
608    /// would be deleting a correct account of the machine to make a list shorter, and putting them
609    /// back is then a second thing to get right rather than a line of a rule file.
610    const NARROW: &[&str] = &[
611        // Three of the two address forms against an immediate. The `narrow` pass does write the
612        // shape, since `char c = a | 1;` narrows to a byte `or` against a byte constant, and no
613        // rule selects these yet: the constant goes into a register and the register with
614        // register rule takes it. Their `add`, `sub` and `and` siblings do have rules and are
615        // reached by the bitfield lowering, so this is six rules missing rather than a shape
616        // nothing writes.
617        "or_ri_8",
618        "or_ri_16",
619        "xor_ri_8",
620        "xor_ri_16",
621        "imul_ri_8",
622        "imul_ri_16",
623        // The divides, which are four instructions per width because the quotient and the
624        // remainder come out of one division in two different registers. `narrow` refuses these
625        // on purpose: the most negative byte over minus one is a defined hundred and twenty eight
626        // at four bytes and is the overflow that raises at one, so narrowing a division wants a
627        // range that rules the pair out and there is no range analysis yet.
628        "idiv_quo_8",
629        "idiv_quo_16",
630        "idiv_rem_8",
631        "idiv_rem_16",
632        "div_quo_8",
633        "div_quo_16",
634        "div_rem_8",
635        "div_rem_16",
636        // The shifts by a value, whose count is in `cl` whatever the width being shifted is. The
637        // same refusal for the same kind of reason: a count of twenty is a defined shift to zero
638        // at four bytes and is poison at one, so only a count that is a constant below the narrow
639        // width narrows, and that one selects the immediate forms which do have rules.
640        "shl_rcl_8",
641        "shl_rcl_16",
642        "shr_rcl_8",
643        "shr_rcl_16",
644        "sar_rcl_8",
645        "sar_rcl_16",
646    ];
647
648    /// The arithmetic that reaches memory, which [`crate::combine`] writes: the forms that read a
649    /// source out of it and the forms that leave the answer in it.
650    ///
651    /// A function rather than a list, for the reason the compare pass's exemption is taken from the
652    /// flag description rather than typed out: the pass already writes down which instructions it
653    /// can produce, and a second copy of that here would be a second opinion about one pass.
654    ///
655    /// No rule selects one of these because a rule matches a term and one of these is two terms, a
656    /// load and an arithmetic operation, put together, or three where the answer goes back to
657    /// memory. Whether they may be put together depends on what is written between them and on
658    /// whether anything else wants what the load read, and neither is a fact about any of the
659    /// terms. That is the whole reason the pass exists and the module documentation there says it
660    /// at length.
661    fn combine() -> Vec<&'static str> {
662        let loads = crate::combine::FOLDS.iter().map(|fold| fold.into);
663        // And the instruction a load on the other side comes to, which for most rows is the one
664        // above and for a comparison is the condition the other way round.
665        let swapped = crate::combine::FOLDS.iter().filter_map(|fold| fold.swapped);
666        let stores = crate::combine::UPDATES.iter().map(|update| update.into);
667        let constants = crate::combine::BUMPS.iter().map(|bump| bump.into);
668        loads.chain(swapped).chain(stores).chain(constants).collect()
669    }
670
671    #[test]
672    fn every_instruction_exempt_from_a_rule_is_one_a_frame_really_writes() {
673        // The same claim as the one about the convention, so that this list cannot grow an opcode
674        // that no frame asks for. In the order `x86_64::FRAME` names them, the copies after the
675        // return because there is one set of them per class the allocator may spill.
676        let frame = &x86_64::FRAME;
677        let mut written = vec![frame.push, frame.pop, frame.ret];
678        for class in frame.classes {
679            written.extend([class.mov, class.load, class.store]);
680        }
681        // And the touch a probing prologue puts on a page, which the target names as an option
682        // because a target with no instruction that writes an address without changing it takes
683        // every frame in one subtraction and has nothing to exempt.
684        written.extend(frame.probe.map(|probe| probe.inst));
685        // And the landing pad and the byte that does nothing, which are options for the same
686        // reason.
687        written.extend(frame.landing);
688        written.extend(frame.pad);
689        // What is left after the ones a rule already reaches, which are the loads and the stores of
690        // both register files, since those are the same instructions a program's own reads and
691        // writes of memory are. The vector pair joined them with the rules for a quad float, and a
692        // spill of one is now the same instruction as a program reading a `_Float128` variable.
693        written.retain(|opcode| !heads().contains(&format!("{PREFIX}{opcode}").as_str()));
694        assert_eq!(written, FRAME);
695    }
696
697    #[test]
698    fn every_instruction_exempt_from_a_rule_is_one_the_convention_really_writes() {
699        // An exemption list that nothing checks is a hole, since an opcode dropped into it stops
700        // being covered by either direction of the pinning. These are the ones `crate::abi` can
701        // name, at the four integer widths and the two float formats it has names for an
702        // argument in, and no others.
703        let strip = |head: &'static str| head.strip_prefix(PREFIX).expect("an x86-64 term");
704        let named = |ty| strip(crate::abi::head_of(ty).expect("every width the pseudos cover"));
705        // The second half of a pair at place one, which is the place a rule cannot name. The first
706        // half at place zero is `ret_val_*` and is reached by a rule, so it is not on this list.
707        let second = |ty| strip(crate::abi::ret_of(ty, 1).expect("every width the pseudos cover"));
708        let widths = || {
709            [8, 16, 32, 64].into_iter().map(rucc_ir::Type::int).chain(
710                [rucc_ir::Float::F32, rucc_ir::Float::F64, rucc_ir::Float::F128]
711                    .map(rucc_ir::Type::float),
712            )
713        };
714        let written: Vec<&str> = widths()
715            .map(named)
716            .chain(widths().map(second))
717            .chain([strip(crate::abi::CALL), strip(crate::abi::CALL_REG)])
718            .collect();
719        assert_eq!(written, CONVENTION);
720    }
721
722    /// The same claim about the block layout's list, which is longer than it looks.
723    ///
724    /// A name here that the layout does not write is an opcode exempted from needing a rule and
725    /// reached by nothing, and a name the layout writes that is not here is a failing test in
726    /// `every_described_instruction_is_reachable_from_a_rule` with a misleading message. Both are
727    /// avoided by taking the list from `rucc_target::x86_64::BRANCH` rather than believing it.
728    #[test]
729    fn every_instruction_exempt_from_a_rule_is_one_the_block_layout_really_writes() {
730        let branch = &x86_64::BRANCH;
731        // Eighty entries name sixteen instructions between them, so this is a set rather than a
732        // list and both sides are sorted before they are held against each other. What the order
733        // of the list itself is for is reading it.
734        let mut written: Vec<&str> = vec![branch.test, branch.jump];
735        written.extend(branch.fused.iter().map(|fusion| fusion.cmp));
736        written.extend(branch.fused.iter().flat_map(|fusion| [fusion.if_true, fusion.if_false]));
737        written.sort_unstable();
738        written.dedup();
739        let mut exempt = LAYOUT.to_vec();
740        exempt.sort_unstable();
741        assert_eq!(written, exempt);
742    }
743
744    /// The same claim about the compare pass. What it writes is what the flag description says is
745    /// left of a comparison, so the exemption is taken from that rather than typed out twice, and
746    /// an entry added there without a rule to go with it shows up here rather than in a build that
747    /// fails somewhere else.
748    #[test]
749    fn every_instruction_exempt_from_a_rule_is_one_the_compare_pass_really_writes() {
750        let mut written: Vec<&str> =
751            x86_64::FLAGS.compares.iter().filter_map(|entry| entry.kept).collect();
752        written.sort_unstable();
753        written.dedup();
754        let mut exempt = COMPARE.to_vec();
755        exempt.sort_unstable();
756        assert_eq!(written, exempt);
757    }
758
759    /// And the same claim about the one the lowering writes, held against the name the target gave
760    /// it rather than against the spelling written above.
761    #[test]
762    fn the_instruction_a_computed_goto_is_exempt_for_is_the_one_the_target_names() {
763        assert_eq!(LABELS, [x86_64::BRANCH.indirect]);
764    }
765
766    /// The rows of the constant table that take nothing yet are exactly the narrow ones waiting on
767    /// the width narrowing, so the day `NARROW` shrinks is the day this says so.
768    ///
769    /// `crate::combine::BUMPS` has a row per instruction this machine has, which is the whole five
770    /// operations at the whole four widths. Four of those instructions arrive out of a rule that is
771    /// not written yet, so four of the rows sit there taking nothing. That is a fact worth holding
772    /// rather than a thing to notice again later.
773    #[test]
774    fn the_constant_runs_that_take_nothing_are_the_ones_no_rule_selects_yet() {
775        let written = heads();
776        let mut waiting = Vec::new();
777        for bump in crate::combine::BUMPS {
778            if !written.contains(&format!("{PREFIX}{}", bump.from).as_str()) {
779                waiting.push(bump.from);
780            }
781        }
782        assert_eq!(waiting, ["or_ri_8", "or_ri_16", "xor_ri_8", "xor_ri_16"]);
783        for from in waiting {
784            assert!(NARROW.contains(&from), "{from} is unselected and is not on the list");
785        }
786    }
787
788    #[test]
789    fn every_described_instruction_is_reachable_from_a_rule() {
790        let written = heads();
791        let combine = combine();
792        for &(opcode, _) in x86_64::INSTS {
793            if combine.contains(&opcode) {
794                continue;
795            }
796            if CONVENTION.contains(&opcode) || LAYOUT.contains(&opcode) || FRAME.contains(&opcode) {
797                continue;
798            }
799            if PEEPHOLE.contains(&opcode) {
800                continue;
801            }
802            if NARROW.contains(&opcode) || BARRIER.contains(&opcode) || X87.contains(&opcode) {
803                continue;
804            }
805            if ATOMIC.contains(&opcode) || PAYLOAD.contains(&opcode) || HINT.contains(&opcode) {
806                continue;
807            }
808            if CONDITIONAL.contains(&opcode) {
809                continue;
810            }
811            if CARRY.contains(&opcode) {
812                continue;
813            }
814            if COMPARE.contains(&opcode) || TEMPLATE.contains(&opcode) {
815                continue;
816            }
817            if SEARCH.contains(&opcode) || SWAP.contains(&opcode) || WIDE.contains(&opcode) {
818                continue;
819            }
820            if AWAY.contains(&opcode) {
821                continue;
822            }
823            if LABELS.contains(&opcode) || STOP.contains(&opcode) {
824                continue;
825            }
826            let head = format!("{PREFIX}{opcode}");
827            assert!(
828                written.contains(&head.as_str()),
829                "{opcode} is described and no rule in {} selects it",
830                TABLE.source
831            );
832        }
833    }
834
835    /// The same claim about the peephole's list, which is a claim about the target's description
836    /// rather than about this crate: every name on it is one the target really has, and every one
837    /// of them is a shorter spelling the description names, which is what says the peephole is
838    /// where it comes from. A name on the list that the peephole could never write would be an
839    /// instruction nothing writes at all, and this test is what stops that sitting there unnoticed.
840    #[test]
841    fn every_instruction_exempt_from_a_rule_is_one_the_peephole_really_writes() {
842        let tests = x86_64::SHORT.testing.iter().map(|entry| entry.into);
843        let steps = x86_64::SHORT.stepping.iter().map(|entry| entry.into);
844        let shorter: Vec<&str> = tests.chain(steps).collect();
845        for &opcode in PEEPHOLE {
846            assert!(
847                x86_64::form(opcode).is_some(),
848                "{opcode} is not an instruction this describes"
849            );
850            assert!(shorter.contains(&opcode), "{opcode} is not one the peephole writes");
851        }
852    }
853
854    /// The same claim about the barrier as the ones above make about the convention and the frame:
855    /// the list holds instructions this target really describes, and holds only the ones that have
856    /// no operands, since an instruction with an operand is one a rule could have been written for.
857    #[test]
858    fn every_instruction_exempt_from_a_rule_is_one_the_memory_model_really_writes() {
859        for &opcode in BARRIER {
860            let form = x86_64::form(opcode).expect("an instruction this target describes");
861            assert!(form.operands().is_empty(), "{opcode} has operands, so a rule could name it");
862        }
863    }
864
865    /// The same claim about the instruction a program stops on, which is the barrier's shape
866    /// exactly: no operands, because an instruction with one is an instruction a rule could have
867    /// been written for, and no addressing mode either, because it is given nothing at all.
868    #[test]
869    fn the_instruction_exempt_from_a_rule_because_it_stops_the_program_is_bare() {
870        for &opcode in STOP {
871            let form = x86_64::form(opcode).expect("an instruction this target describes");
872            assert!(form.operands().is_empty(), "{opcode} has operands, so a rule could name it");
873            assert!(!form.takes_mem(), "{opcode} is given an address and stopping needs none");
874        }
875    }
876
877    /// The same claim about the hints, with the one difference between them written down. A hint is
878    /// given an address and nothing else, so it has no operands for the reason a barrier has none
879    /// and it does carry an addressing mode, which is what a rule would have had to match on.
880    #[test]
881    fn every_instruction_exempt_from_a_rule_because_it_is_a_hint_is_given_only_an_address() {
882        for &opcode in HINT {
883            let form = x86_64::form(opcode).expect("an instruction this target describes");
884            assert!(form.operands().is_empty(), "{opcode} has operands, so a rule could name it");
885            assert!(form.takes_mem(), "{opcode} is a hint about an address and is given none");
886        }
887    }
888
889    /// The same claim about the template list. An instruction is exempt for this reason exactly
890    /// when there is nothing about it for a rule to name, and there are two ways to have nothing.
891    /// No operands and no address, which is the hint. Or every operand fixed to one register by the
892    /// description, which is the question put to the processor: a rule names the operands of a term
893    /// and binds them to the values underneath it, and an operand that can be nothing but `rax` is
894    /// not a place a value goes. Either way the whole of the claim holds, which is that there was
895    /// nowhere else for the instruction to come from.
896    #[test]
897    fn every_instruction_exempt_from_a_rule_because_only_a_template_asks_for_it_is_bare() {
898        for &opcode in TEMPLATE {
899            let form = x86_64::form(opcode).expect("an instruction this target describes");
900            let fixed = form
901                .operands()
902                .iter()
903                .all(|desc| matches!(desc.constraint, rucc_target::Constraint::Fixed(_)));
904            assert!(fixed, "{opcode} has an operand a rule could name");
905            assert!(!form.takes_mem(), "{opcode} is given an address, so a rule could name it");
906        }
907    }
908
909    /// The same claim about the bit searches, read off the description that put them there and read
910    /// both ways round. An instruction is exempt for this reason exactly when the machine describes
911    /// it as a search, so the list cannot grow an opcode that is something else, and a search this
912    /// target grows later cannot be left off the list and quietly go unselected with nobody saying
913    /// why. Nothing in the rule set selects one, which is the other half of the reason and is what
914    /// the check above would have caught in any case.
915    #[test]
916    fn every_instruction_exempt_from_a_rule_because_only_a_template_searches_for_a_bit_is_one() {
917        let written = heads();
918        for &opcode in SEARCH {
919            let form = x86_64::form(opcode).expect("an instruction this target describes");
920            assert_eq!(form, x86_64::Form::Search, "{opcode} is not a search");
921            assert!(
922                !written.contains(&format!("{PREFIX}{opcode}").as_str()),
923                "a rule in {} selects {opcode}, which only a template asks for",
924                TABLE.source
925            );
926        }
927        for &(opcode, form) in x86_64::INSTS {
928            if form == x86_64::Form::Search {
929                assert!(SEARCH.contains(&opcode), "{opcode} is a search and is not on the list");
930            }
931        }
932    }
933
934    /// The same claim about the byte reversal, read both ways round the way the searches are, and
935    /// with the one thing that is different about it checked as well: this is the instruction of its
936    /// shape that leaves the condition state alone, which is the whole reason it has a form rather
937    /// than being a unary operation, so a description that stopped saying that would stop being the
938    /// reason this list exists.
939    #[test]
940    fn every_instruction_exempt_from_a_rule_because_only_a_template_turns_a_register_round_is_one()
941    {
942        let written = heads();
943        for &opcode in SWAP {
944            let form = x86_64::form(opcode).expect("an instruction this target describes");
945            assert_eq!(form, x86_64::Form::Swap, "{opcode} is not a byte reversal");
946            assert!(
947                !(x86_64::FLAGS.writes)(opcode),
948                "{opcode} writes the condition state, so it is a unary operation after all"
949            );
950            assert!(
951                !written.contains(&format!("{PREFIX}{opcode}").as_str()),
952                "a rule in {} selects {opcode}, which only a template asks for",
953                TABLE.source
954            );
955        }
956        for &(opcode, form) in x86_64::INSTS {
957            if form == x86_64::Form::Swap {
958                assert!(SWAP.contains(&opcode), "{opcode} is a reversal and is not on the list");
959            }
960        }
961    }
962
963    /// The same claim about the two that work on a pair of registers, read both ways round and with
964    /// the thing that puts them out of reach of a rule checked rather than asserted in prose: each
965    /// writes two registers, and a rule replaces a term with a term, so there is no way to say the
966    /// second answer in the rule language at all. That is the same bar the compare and exchange is
967    /// exempt at, and this list is separate from that one because the reason it is nobody's to select
968    /// is different: an atomic is written by name where it is needed, and nothing in this compiler
969    /// needs one of these.
970    #[test]
971    fn every_instruction_exempt_from_a_rule_because_only_a_template_wants_both_halves_writes_two() {
972        let written = heads();
973        let both = [x86_64::Form::MulWide, x86_64::Form::DivWide];
974        for &opcode in WIDE {
975            let form = x86_64::form(opcode).expect("an instruction this target describes");
976            assert!(both.contains(&form), "{opcode} works on one register rather than on a pair");
977            let defs = form.operands().iter().filter(|desc| desc.role.is_def()).count();
978            assert_eq!(defs, 2, "{opcode} writes {defs} registers and a pair takes two");
979            assert!(
980                !written.contains(&format!("{PREFIX}{opcode}").as_str()),
981                "a rule in {} selects {opcode}, which only a template asks for",
982                TABLE.source
983            );
984        }
985        for &(opcode, form) in x86_64::INSTS {
986            if both.contains(&form) {
987                assert!(WIDE.contains(&opcode), "{opcode} works on a pair and is not on the list");
988            }
989        }
990    }
991
992    /// The same claim about the carry pair, and the one thing that has to be true of them that is
993    /// not true of anything else on any of these lists. An instruction here reads the condition
994    /// state and writes it, which is what makes it half of a pair and not a rewrite of its own, and
995    /// the scheduler will only keep it behind the instruction that set the bit if the target says
996    /// it reads one.
997    #[test]
998    fn every_instruction_exempt_from_a_rule_because_it_reads_a_carry_says_it_reads_the_state() {
999        let written = heads();
1000        for &opcode in CARRY {
1001            let form = x86_64::form(opcode).expect("an instruction this target describes");
1002            let pair = matches!(form, x86_64::Form::AluCarry | x86_64::Form::AluCarryI);
1003            assert!(pair, "{opcode} is not one of the pair");
1004            assert_eq!(
1005                x86_64::FLAGS.reads(opcode),
1006                Some(rucc_target::Reads::Carry),
1007                "{opcode} does not say it reads the carry, so the scheduler may move it"
1008            );
1009            assert!(
1010                (x86_64::FLAGS.writes)(opcode),
1011                "{opcode} is said to leave the condition state alone"
1012            );
1013            assert!(
1014                !written.contains(&format!("{PREFIX}{opcode}").as_str()),
1015                "a rule in {} selects {opcode}, which only a template asks for",
1016                TABLE.source
1017            );
1018        }
1019        for &(opcode, form) in x86_64::INSTS {
1020            if matches!(form, x86_64::Form::AluCarry | x86_64::Form::AluCarryI) {
1021                assert!(CARRY.contains(&opcode), "{opcode} reads a carry and is not on the list");
1022            }
1023        }
1024    }
1025
1026    /// The same claim about the conditional moves, read off the flag description the way the compare
1027    /// pass's list is taken from it rather than typed out twice. An instruction is exempt for this
1028    /// reason exactly when it reads the condition state and leaves it as it found it, which is what
1029    /// says the instruction in front of it is where its meaning comes from. One that wrote the state
1030    /// as well would be one a pattern could match on its own.
1031    #[test]
1032    fn every_instruction_exempt_from_a_rule_because_a_comparison_gives_it_its_meaning_reads_one() {
1033        for &opcode in CONDITIONAL {
1034            x86_64::form(opcode).expect("an instruction this target describes");
1035            assert!(
1036                x86_64::FLAGS.reads(opcode).is_some(),
1037                "{opcode} reads no comparison, so a rule could name it"
1038            );
1039            assert!(
1040                !(x86_64::FLAGS.writes)(opcode),
1041                "{opcode} writes the condition state, so a rule could name it"
1042            );
1043        }
1044    }
1045
1046    /// The same claim about the atomic list, read off the thing that put the entry there: an
1047    /// instruction is exempt for this reason exactly when it writes more than one value, and an
1048    /// instruction that writes one is one a rule could have been written for.
1049    #[test]
1050    fn every_instruction_exempt_from_a_rule_is_one_that_writes_more_than_one_value() {
1051        let written = heads();
1052        for &opcode in ATOMIC {
1053            let form = x86_64::form(opcode).expect("an instruction this target describes");
1054            let writes = form.operands().iter().filter(|desc| desc.role.is_def()).count();
1055            assert!(writes > 1, "{opcode} writes one value, so a rule could name it");
1056            assert!(
1057                !written.contains(&format!("{PREFIX}{opcode}").as_str()),
1058                "a rule in {} selects {opcode}, which `crate::lower` also writes by hand",
1059                TABLE.source
1060            );
1061        }
1062    }
1063
1064    /// The same claim about the payload list, read off the thing that puts an entry there.
1065    ///
1066    /// Two halves. Each of these writes one value, which is what says the reason above is not the
1067    /// reason here, so a list that grew to cover an instruction the atomic list should have had
1068    /// fails. And there really is more than one operation behind the one IR opcode, which is the
1069    /// whole of why a pattern cannot name any of them, and is a fact about the IR that would stop
1070    /// being true if the operations were ever given opcodes of their own.
1071    #[test]
1072    fn every_instruction_exempt_because_its_operation_is_beside_it_writes_one_value() {
1073        assert!(
1074            rucc_ir::RmwOp::all().count() > 1,
1075            "one operation per opcode would be a head a rule could match"
1076        );
1077        let written = heads();
1078        for &opcode in PAYLOAD {
1079            let form = x86_64::form(opcode).expect("an instruction this target describes");
1080            let writes = form.operands().iter().filter(|desc| desc.role.is_def()).count();
1081            assert_eq!(writes, 1, "{opcode} writes more than one value, so it is the other list's");
1082            assert!(
1083                !written.contains(&format!("{PREFIX}{opcode}").as_str()),
1084                "a rule in {} selects {opcode}, which `crate::lower` also writes by hand",
1085                TABLE.source
1086            );
1087        }
1088    }
1089
1090    /// The staleness rule every list in this project is kept under, on the one list here whose
1091    /// entries are meant to leave. A rule that starts selecting one of these is `tamnd/rucc#375`
1092    /// arriving, and the entry goes with it. An entry naming an instruction nothing describes is a
1093    /// misspelling, and it would sit here exempting nothing.
1094    #[test]
1095    fn an_instruction_a_rule_now_selects_is_off_the_list_of_the_ones_left_for_later() {
1096        let written = heads();
1097        for &opcode in NARROW {
1098            let head = format!("{PREFIX}{opcode}");
1099            assert!(
1100                !written.contains(&head.as_str()),
1101                "a rule in {} selects {opcode} now, so it is not waiting on tamnd/rucc#375",
1102                TABLE.source
1103            );
1104            assert!(
1105                x86_64::INSTS.iter().any(|&(described, _)| described == opcode),
1106                "{opcode} is not an instruction anything describes"
1107            );
1108        }
1109    }
1110
1111    /// The same staleness rule on the x87 pair, and one thing more that is particular to them.
1112    ///
1113    /// They are a pair. An instruction that pushes onto the x87 stack and nothing that pops off it
1114    /// again would leave the stack one deeper than the function found it, which is not a mistake
1115    /// the allocator or the block layout could catch, since neither of them knows the stack is
1116    /// there. So the two arrive together and leave together, and that is what this says.
1117    #[test]
1118    fn the_x87_stack_is_reached_by_a_pair_and_by_nothing_else() {
1119        let written = heads();
1120        for &opcode in X87 {
1121            assert!(
1122                x86_64::INSTS.iter().any(|&(described, _)| described == opcode),
1123                "{opcode} is not an instruction anything describes"
1124            );
1125            assert!(
1126                !written.contains(&format!("{PREFIX}{opcode}").as_str()),
1127                "a rule in {} selects {opcode}, which `crate::lower` also writes by hand",
1128                TABLE.source
1129            );
1130        }
1131        // One way onto the stack per format a value can be read from, one way off it per format a
1132        // value can be written to, the control word pair that is neither, and the arithmetic. The
1133        // count is here as well as in the target description because this list is what says none
1134        // of them is reachable, and a name that arrived here without its partner would be a format
1135        // this target can convert in one direction and not the other.
1136        assert_eq!(X87.len(), 30, "twelve that move a value and eighteen that work on one");
1137    }
1138}