fix(intel): keep the switch index tied across a relative dispatch's base add

[r0ny123]

A switch inside brotli built by gcc at -O2 has 27 cases. SMDA resolves 2 of them, queues those 2 as blocks of the function, and leaves the other 25 case bodies unreferenced — so the gap scan finds them, sees a common function start, and books five of them as functions of their own, inside the function they belong to.

That is a false positive and a shattered function in one move, and it happens on every dispatch of this shape.

Root cause

A 64-bit relative switch ends by adding the table's base to the entry the table read produced, and the branch reads that sum:

    lea     rsi, [rip + 0x6e189]        ; table base
    mov     qword ptr [rsp], rsi        ; spilled, the dispatch is reached from several places
    cmp     dword ptr [rbx], 0x1a       ; the real bound, checked against a memory cell
    ja      default
    mov     rdi, qword ptr [rsp]        ; reloaded
    mov     eax, dword ptr [rbx]
    movsxd  rax, dword ptr [rdi + rax*4]
    add     rax, rdi
    notrack jmp rax

_findJumpTableSize starts at the branch register and follows it backwards through copies, so it ought to reach movsxd, take rax out of the scaled operand, follow that back through mov eax, dword ptr [rbx] to the cell, and return 27 from the compare against it. That is the whole point of the index tracking already in there.

It never got that far. add rax, rdi is not one of the copy mnemonics, so the walk fell into the "anything else redefines whatever it writes" arm and dropped the tie one instruction short of the table read. With nothing tied, the untied fallback answers with the first register-against-immediate compare in the window — here an unrelated compare from earlier in the function — and the table comes out sized at 2.

The bug is one step from the end of a walk that was otherwise correct, which is why this looked like the jump-table pass simply not following this shape.

Fix

The walk carries the tie across the step that adds a base to the value it overwrites, in both spellings a compiler uses: add rax, rdi (register or memory source), and a lea whose address reads the register it writes.

Only the instruction the branch reads is asked. That is where the combine sits in every shape the analyzer recognises — the four relative arms all match on it being the nearest instruction, and the pattern-C lea is in the same position. An add further back is index arithmetic: add rax, rcx before the table read makes the index a sum, and a compare bounding one summand is not a bound on it. (That narrowing is the second commit; a bound recovered too small is the worse direction, because it is trusted as exact and truncates the scan.)

Two things deliberately still redefine, and both have a test:

• An immediate source (add rax, 8) is index arithmetic, not a base.
• A write back into a memory cell (add dword ptr [rbx], eax) is not this step at all — the step recognised here ends in the register the branch reads.

lea rax, [rip + 0x2004] is how the base itself is loaded and derives nothing from rax, so it is excluded by the same rule that admits lea rcx, [r11 + rcx].

Measured

140 built C/C++ cells (gcc and clang, x86-64 ELF, 10 programs × 7 variants × 2 toolchains), 117,654 truth functions from the unstripped link's symbol table, exact-address match, macro means:

	PPV	TPR	TP	FP
before	93.740	96.968	113,438	14,123
after	93.765	96.968	113,438	14,103

20 false positives removed, no true positive lost on any cell, and 135 of the 140 cells come back bit-identical. The five that move:

cell	TP	FP
brotli_gcc-x64_O2	293 → 293	5 → 0
brotli_gcc-x64_O3	282 → 282	4 → 0
brotli_gcc-x64_O2-static	1245 → 1245	58 → 53
googletest_gcc-x64_O2-static	5820 → 5820	1793 → 1790
googletest_clang-x64_O2-static	5767 → 5767	1484 → 1481

The clang cell moves because a statically linked image pulls in gcc-built glibc.

The narrowing in the second commit changes no cell: the recovered function set is identical under both predicates, so this corpus does not contain the index-arithmetic shape and the narrowing costs nothing measured.

Second corpus, as a control on the shape. 8 built Rust cells (rustc 1.94, gnu targets, four profiles) are bit-identical — and not one dispatch on any of them changed its bound, checked by recording the recovered size at every dispatch under both trees. That is the expected result rather than a null one: LLVM leaves the bound check as the nearest register compare, so the untied fallback was already reading the right one. The shape this fixes is what gcc emits when the base is spilled across the bound check.

Bug-class sweep

The class is a value walk that reads a read-modify-write of the register it is chasing as a redefinition. Swept the other backward walks:

• aarch64/analyzers.py jump-table resolution — already correct. It adds both source registers of its merging add back into the tracked set, and ties the bound to the index register taken from the table load rather than from the branch operand.
• intel/IndirectCallAnalyzer.py and the syscall-number walk in intel/X86Backend.py — not instances. Both chase a concrete value rather than a provenance tie, so carrying either past an unmodelled write would report a wrong value. Stopping there is correct for them.
• JumpTableAnalyzer._ripRelativeBase — same, and its docstring already calls the stop deliberate.

Tests

Eight new cases in tests/testJumpTableIndexBound.py:

• the spilled-base dispatch recovers 27 where the fallback recovers 2 — with the fallback's answer asserted on the same window, so the assertion cannot pass on a bound the fallback happened to get right
• lea that reads the register it writes carries the tie; lea that only loads an address does not
• an immediate add, an add back into a tracked memory cell, and index arithmetic before the table read all still drop the tie, each with a positive control
• ShatteredSwitchTestSuite builds a 64-bit image with exactly this dispatch and a decoy compare, and asserts no case body becomes a function of its own. Before the fix two of the four do. Its control asserts the three real functions are all recovered, so an empty report cannot satisfy it.

Run against the parent commit, the load-bearing assertions fail and the controls pass.

Validation

ruff check / ruff format --check pass, full suite green on this branch rebased onto current master (1824 passed, 1 skipped, 2584 subtests), diff coverage 100% on the changed lines.

On the malpedia corpus the function set moves on one file of 155: three fragments stop being functions and become blocks, and three real routines are recovered. That corpus is not reachable from a fork PR — Evaluate & Report and Malpedia Benchmark both report skipped here — so it is recorded rather than shown by CI. The bundled Fixture Benchmark Gate is green.

Relationship to #299 and #300

This change is also sitting inside #299 and #300. Both of those were opened from branches that had my fork's master merged into them repeatedly, so their diffs are much wider than their titles suggest and they overlap each other as well.

This PR is the same change on its own, rebased onto current master, so it can be reviewed and measured for what it actually is. If you would rather take it through one of those, close this one; if you take this one, the matching hunks fall out of theirs on rebase.

The ty commit at the tip

The last commit on this branch is #302's fix, cherry-picked unchanged.

Master fails Code Quality on its own right now: 572acd7 bumped ty to 0.0.74, and its new unsound-return-statement / unsound-assignment rules become errors under [tool.ty.rules] all = "error". That is 41 errors across 15 files, none of which this PR touches — so every PR opened against master inherits a red check that says nothing about its own diff.

Carrying #302's commit here means this PR's CI reflects only this PR's work. It is the same commit, unmodified, so the moment #302 lands this one is empty and falls out on rebase — there is nothing to untangle later. If you would rather look at this branch without it, merge #302 first and I will drop it.

Checked against ty 0.0.74 itself rather than whatever an older local pin resolves to: on master it exits 1 with 41 errors, on this branch it exits 0 with none.