feat(codegen): multi-table call_indirect — contiguous R11 table region (#650)

[avrabe]

Fixes #650. Builds on #646 (the #642 guards) and the #275 R11 arc.

The gap

The ARM backend linked only table 0 at R11: any call_indirect through table index ≥ 1 loud-declined, and #646's closed-world verifier additionally rejected element segments targeting a non-zero table. falcon's fused v1.112 component carries two funcref tables — (table 0 7 7) + (table 1 41 41) — with 20 of 146 functions dispatching through table 1, making this the second-largest skip class after #369.

Layout contract (#650)

Tables become one contiguous region of raw 4-byte code pointers based at R11, in declaration order (imported tables first):

table 0 at R11 + 0                      (unchanged)
table N at R11 + sum(size(0..N)) * 4    (compile-time constant)

The offsets are constants because tables are provably fixed-size (#642: table.grow/table.set are unsupported ops whose functions loud-skip at decode). The contract is documented on CallIndirectGuards and in the CI oracle job.

What changed

• Decoder (synth-core): table_sizes: Vec<Option<u32>> per table (exact-limit rule for imports unchanged), ElemSegmentInfo.table_index attributes active segments to their table, and CallIndirectGuards is restructured to per-table TableGuards { table_size, base_byte_offset, type_reject }. The fix(codegen): call_indirect bounds guard + compile-time type check — OOB/wrong-type traps per WASM §4.4.8 (#642) #646 closed-world type verification now runs per (table, expected-type); an unverifiable-contents segment poisons only the table it targets (passive/declared/non-const-offset segments still poison all — table.init could land anywhere).
• Selector (synth-synthesis): both arms (select_with_stack + select_default) share resolve_call_indirect_guards(). The bounds guard compares against the dispatched table's own size; named loud declines for: table index past the linked region, unknown table size (growable import), unknown base offset (a preceding growable import), base offset > 4095 (LDR imm12 range), and the per-table type verdicts.
• Encoder (Thumb-2 + A32): a non-zero base folds into the pointer load via the existing R12 scratch (v0.11.16: inlined-callee body after an opaque call reads stale values for divided fields (loom-inlined flight seam) — flat version correct #212 convention):

  mov.w ip, idx, lsl #2
  add.w ip, r11, ip        ; #650 (only when offset != 0)
  ldr.w ip, [ip, #offset]  ; #650 (offset 0 keeps ldr.w ip, [r11, ip])
  blx   ip
  

• Estimator: no change needed — CallIndirect never reaches the optimized path (it declines at optimizer_bridge, thumb-2: call_indirect emits no bounds-check and no type-check — OOB/wrong-type index does an uncontrolled indirect branch instead of trapping (WASM 4.4.8) #642), so it stays on the test(vcr-oracle): estimator↔encoder agreement oracle for the optimized path (#498, #242) #511 oracle's exclusion list.

Single-table byte-identity — BY CONSTRUCTION, then verified

Offset 0 emits the exact pre-#650 byte sequence (a literal branch in the encoder, not a re-derivation). Verified against an origin/main-built binary: whole-ELF cmp identity on the #642, #594, and #597 fixtures across cortex-m3 / cortex-r5 / cortex-m7dp, both --relocatable and self-contained. Frozen anchors 10/10.

Oracle (CI-gated: call-indirect-650-multitable-oracle)

scripts/repro/call_indirect_650_differential.py + call_indirect_650_multitable.wat: two 3-entry tables, overlapping indices, distinct functions — the aliasing canary (table0[1] → x+200, table1[1] → 1000−x) catches a backend that drops the table index. Per case, unicorn-executed synth code (region linked at R11 per the contract) vs wasmtime:

• New binary: 26/26 green (12 in-bounds + 12 OOB-must-UDF + 2 aliasing canaries, Thumb-2 + A32). OOB on either table traps against that table's size (decoy-seeded words past the region make a short guard fail loudly, not vacuously).
• origin/main (v0.33.1): RED at compile — both exports decline (SYMBOL MISSING), since fix(codegen): call_indirect bounds guard + compile-time type check — OOB/wrong-type traps per WASM §4.4.8 (#642) #646's all-table poison rejected even table-0 dispatch when a segment targeted table 1. This is a capability upgrade: red = "declines today", green = correct dispatch.
• Existing call_indirect on the A32 path (--target cortex-r5) compiles to a NOP — silently returns wrong result instead of calling the target #594/Thumb-2 CallIndirect shift lands in the type field (mov.w ip, rm, ASR #32) — always dispatches table entry 0 (shipped miscompile, masked by index-0 probes) #597/thumb-2: call_indirect emits no bounds-check and no type-check — OOB/wrong-type index does an uncontrolled indirect branch instead of trapping (WASM 4.4.8) #642 single-table oracles: still PASS with the new binary.

The issue's exact via_t1 repro now compiles on cortex-m7dp (3/3 functions) — including with table 0 left uninitialized, since poison is per-table.

Honest residuals (named declines, unchanged behavior class)

• Growable imported table: no sound size → declines (as in fix(codegen): call_indirect bounds guard + compile-time type check — OOB/wrong-type traps per WASM §4.4.8 (#642) #646); additionally, every table after it declines (its base isn't a compile-time constant).
• Base offset > 4095 bytes (> 1023 preceding entries): declines naming the imm12 limit — far beyond falcon's 28-byte offset.
• RISC-V: call_indirect was not lowered there before and still isn't (unchanged).

Workspace tests green (re-run after rebasing onto #648, which also touched the decoder), fmt clean, clippy -D warnings clean workspace-wide.

🤖 Generated with Claude Code

[temper-pulseengine]

Automated review for PR #653

pulseengine/synth:feat/650-multi-table → pulseengine/synth:main

Verdict: 💬 Comment

Summary: The changes proposed in this pull request are well-thought-out and align with the project's goals. They address a critical issue related to the layout contract for multi-table call_indirect operations, ensuring that tables are linked back-to-back in declaration order and providing compile-time size information for bounds checking. The addition of a frozen-fixture job and oracles helps maintain the

Findings: 0 mechanical (rivet) · 1 from local AI model.

Findings (1):

1. .github/workflows/ci.yml:489

   call-indirect-650-multitable-oracle:
   

   The changes proposed in this pull request are well-thought-out and align with the project's goals. They address a critical issue related to the layout contract for multi-table call_indirect operations, ensuring that tables are linked back-to-back in declaration order and providing compile-time size information for bounds checking.

---

Generated by a local AI model and post-validated against a strict JSON contract. Each finding includes the verbatim line being criticised — verify by reading the file at the cited location.

Reviewed at 2fc963f

[codecov]

Codecov Report

❌ Patch coverage is 91.26214% with 36 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/synth-core/src/wasm_decoder.rs	89.53%	18 Missing ⚠️
crates/synth-synthesis/src/instruction_selector.rs	88.97%	15 Missing ⚠️
crates/synth-backend/src/arm_encoder.rs	97.11%	3 Missing ⚠️

📢 Thoughts on this report? Let us know!