fix(#275): self-contained --cortex-m call_indirect — loud-decline the R11/linmem silent miscompile

[avrabe]

Outcome: B (loud decline) — and what the gate is

Read this first (silent-miscompile fix): the gate here is a decline oracle, NOT an execution differential. Outcome B removes the wrong dispatch, so there is nothing left to execute on the self-contained path — a generic "compile → assert linmem[0]==100" check will now find entry absent (loud-skipped), which is the fix, not a regression. An execution differential asserting linmem[0]==100/200/300 is what outcome A (the dedicated func-table) would need, and A is silicon-gated (see below).

To verify:

SYNTH=/path/to/target/debug/synth \
  python scripts/repro/call_indirect_275_selfcontained_differential.py   # ORACLE: PASS
# or, by hand:
synth compile scripts/repro/call_indirect_275_selfcontained.wat --cortex-m -t cortex-m3 -o /tmp/ci.elf
#   → warning: skipping function 'entry': ... — #275   +   "1 of 4 functions were skipped"
#   → `entry` absent from the ELF (no silent dispatch)

(The oracle defaults SYNTH to ./target/debug/synth — set it to your real target dir to avoid the stale-binary trap.)

Root cause (residual of #275, after the v0.11.33 reachability closure)

On the self-contained image path (build_multi_func_cortex_m_elf, i.e. no --relocatable — falcon's actual firmware path), call_indirect emits its guarded dispatch, but the function-pointer load is:

lsl.w  r12, idx, #2
ldr.w  r12, [r11, r12]   ; R11 = LINEAR-MEMORY base
blx    r12

The contiguous R11 funcref-table region is only ever populated by an external runtime/harness (the --relocatable layout contract). A self-contained image has no such runtime, so ldr [r11, idx*4] reads "function pointers" from linear-memory DATA — a silent miscompile (exit 0, 0 skips, garbage dispatched; the repro stored the selector to linmem[0] instead of 100/200/300).

The fix (B, the sound interim — AFD-008)

The self-contained path now declines call_indirect LOUDLY: the function is skipped with a #275 diagnostic naming the linmem collision, surfaced in the skip count, and absent from the output — never a silent colliding dispatch. "An unlowerable op must Err, never silently continue."

• Selector gains reject_self_contained_call_indirect, set by the backend from !config.relocatable, and checked at the top of resolve_call_indirect_guards (covers both the direct select_with_stack path and the optimized→direct fallback — the optimizer already declines call_indirect).
• !config.relocatable is the right discriminator: every non-relocatable ARM path (optimized abs-base, native-pointer ABI, build_cortex_m_elf) has R11=linmem with no external table provider.

Untouched: the relocatable / host-linked path

Scoped by !config.relocatable, so the --relocatable path — where a runtime places the table region at R11 — is byte-for-byte untouched:

• --relocatable compile of the same module still emits entry with the full guarded dispatch (cmp; udf; lsl.w; ldr.w r12,[r11,r12]; blx r12), both cortex-m3 (Thumb-2) and cortex-r5 (A32).
• thumb-2: call_indirect emits no bounds-check and no type-check — OOB/wrong-type index does an uncontrolled indirect branch instead of trapping (WASM 4.4.8) #642 / arm backend links only table 0 (R11); call_indirect through table index ≥1 loud-declines — blocks multi-table fused components (falcon: 20 funcs) #650 / call_indirect on a table with null (uninitialized) funcref slots loud-declines — needs sound null-slot lowering (falcon: 20 funcs, the residual after #650) #664 / call_indirect into a HETEROGENEOUS funcref table (mixed signatures) loud-declines — needs a runtime type-id check; the terminal layer of falcon's dispatch (20 funcs) #676 differentials: ORACLE: PASS (bounds trap, multi-table, null-slot, heterogeneous type-id).
• Selector unit tests construct the selector directly (flag defaults false) — unaffected.

Non-goals / upgrade path

• B does not foreclose A. When the silicon-gated dedicated-table fix lands (a Thumb-bit-set func-pointer table in a dedicated region + a non-R11 table base), the flag simply stops declining. Even a unicorn-green A would be "held for silicon" per the maintainer's own comment on this issue, so B closes the actual soundness bug now and A stays a clean follow-up.
• RISC-V has its own selector — out of scope for a --cortex-m issue (not a regression).

Gate / evidence

• crates/synth-cli/tests/call_indirect_275_selfcontained.rs — self-contained declines loudly (#275 + skip count + entry absent + func_1/2/3 still compile) and --relocatable still emits entry (both ISAs). 2/2 pass.
• scripts/repro/call_indirect_275_selfcontained{.wat,_differential.py} — decline oracle, ORACLE: PASS.
• cargo test -p synth-backend -p synth-synthesis -p synth-cli green; cargo fmt --check + cargo clippy --workspace --all-targets -- -D warnings clean.
• Frozen anchors 10/10.

Part of VCR (#242); the on-target Cortex-M long pole for jess (falcon's fused core has 61 call_indirect sites).

Refs #275, #242. DO NOT MERGE — maintainer gates (will re-run the decline oracle).

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!