Fix: peephole phi_coalesce removes param pre-stores across calls

The phi_coalesce peephole pass coalesces register copies like
`movq %rdi, %r12; ... movslq %r12d, %r13; movq %r13, %rdi` by
eliminating the initial copy and rewriting to use %rdi directly.
This is incorrect when a function call between the copy and the
copy-back clobbers the caller-saved source register (%rdi).

Fix: block coalescing when the source is a caller-saved register
and the destination is callee-saved. These copies save values that
must survive across function calls.

Also adds fallback param pre-store logic for promoted allocas
(where mem2reg eliminated the alloca but the register allocator
still assigned the promoted value to a callee-saved register).

SQLite status: works with CCC_NO_PEEPHOLE=1. Multiple peephole
passes still have unsound transformations affecting callee-saved
register stores. The phi_coalesce fix addresses one class but
other passes (dead store elimination, copy propagation) have
similar issues requiring a broader peephole audit.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: levkropp

src/backend/x86/codegen/peephole/passes/dead_code.rs

@@ -57,6 +57,36 @@ pub(super) fn eliminate_dead_reg_moves(store: &LineStore, infos: &mut [LineInfo]
             i += 1;
             continue;
         }
+        // Don't eliminate moves to callee-saved registers in the prologue area.
+        // The register allocator assigns param values to callee-saved regs (rbx,
+        // r12-r15), and the pre-store in emit_store_params copies ABI arg regs
+        // to them. The dead-move analysis can't see past function calls (which
+        // are barriers), so it incorrectly considers these writes dead when the
+        // next visible use is after a call. Callee-saved regs survive calls,
+        // so their pre-call writes are never truly dead.
+        // Register encoding: rbx=1 (encoded differently in peephole)
+        // We check: if the instruction is in the first few lines (prologue area)
+        // and writes to a callee-saved register, skip elimination.
+        // A simpler and more robust check: if the destination is a callee-saved
+        // register (rbx/r12/r13/r14/r15) AND source is an arg register (rdi/rsi/
+        // rdx/rcx/r8/r9), this is likely a param pre-store — don't eliminate.
+        // Protect param pre-stores: movq from ABI arg regs to callee-saved regs.
+        // These save function parameters before calls clobber the arg registers.
+        // The dead-move scanner can't see past calls (barriers), so it incorrectly
+        // considers these writes dead. Callee-saved regs survive calls.
+        // Arg regs: rdi=7, rsi=6, rdx=2, rcx=1, r8=8, r9=9
+        // Callee-saved: rbx=3, r12=12, r13=13, r14=14, r15=15
+        {
+            let trimmed = infos[i].trimmed(store.get(i));
+            if let Some((src_id, _dst_id)) = parse_reg_to_reg_movq(&infos[i], trimmed) {
+                let src_is_arg = matches!(src_id, 1 | 2 | 6 | 7 | 8 | 9);
+                let dst_is_callee = matches!(dst_reg, 3 | 12 | 13 | 14 | 15);
+                if src_is_arg && dst_is_callee {
+                    i += 1;
+                    continue;
+                }
+            }
+        }
 
         let dst_mask = 1u16 << dst_reg;
         let mut dead = false;

src/backend/x86/codegen/peephole/passes/local_patterns.rs

@@ -2111,6 +2111,14 @@ pub(super) fn coalesce_phi_register_copies(
             // Don't coalesce rax(0) or rcx(1) as SRC — they're accumulator regs
             // with heavy implicit use
             if src_family <= 1 || tmp_family <= 1 { i += 1; continue; }
+            // Don't coalesce when SRC is a caller-saved register and TMP is callee-saved.
+            // Caller-saved registers (rax=0, rcx=1, rdx=2, rsi=6, rdi=7, r8-r11=8-11)
+            // get clobbered by function calls. Coalescing away the copy to a callee-saved
+            // register loses the value across calls. This is critical for parameter
+            // pre-stores (movq %rdi, %r12) that save params before calls.
+            let src_is_caller_saved = matches!(src_family, 0 | 1 | 2 | 6 | 7 | 8 | 9 | 10 | 11);
+            let tmp_is_callee_saved = matches!(tmp_family, 3 | 5 | 12 | 13 | 14 | 15);
+            if src_is_caller_saved && tmp_is_callee_saved { i += 1; continue; }
 
             let src_bit = 1u16 << src_family;
             let tmp_bit = 1u16 << tmp_family;

src/backend/x86/codegen/prologue.rs

@@ -434,16 +434,22 @@ impl X86Codegen {
                 let has_slot = find_param_alloca(func, i)
                     .and_then(|(dest, _)| self.state.get_slot(dest.0))
                     .is_some();
+                if std::env::var("CCC_DEBUG_PARAM_STORE").is_ok() {
+                    let reg = self.reg_assignments.get(&paramref_dest.0);
+                    eprintln!("[PRE-STORE] param {} paramref_dest={} has_slot={} reg={:?}", i, paramref_dest.0, has_slot, reg);
+                }
                 if !has_slot {
                     if let Some(&phys_reg) = self.reg_assignments.get(&paramref_dest.0) {
                         // Only pre-store to callee-saved registers (PhysReg 1-5).
                         // Caller-saved registers (rdi, rsi, r8-r11) cannot be used
                         // because they overlap with ABI argument registers that
                         // haven't been saved yet.
                         let is_callee_saved = phys_reg.0 >= 1 && phys_reg.0 <= 5;
+                        if std::env::var("CCC_DEBUG_PARAM_STORE").is_ok() {
+                            let shared = reg_to_params.get(&phys_reg.0).is_some_and(|u| u.len() > 1);
+                            eprintln!("[PRE-STORE]   callee={} shared={} class={:?}", is_callee_saved, shared, class);
+                        }
                         if is_callee_saved {
-                            // Safety check: if another param's dest is also assigned
-                            // to this register, skip pre-store to avoid conflicts.
                             let shared = reg_to_params.get(&phys_reg.0)
                                 .is_some_and(|users| users.len() > 1);
                             if !shared {
@@ -452,15 +458,107 @@ impl X86Codegen {
                                     self.state.out.emit_instr_reg_reg(
                                         "    movq", X86_ARG_REGS[reg_idx], dest_reg);
                                     self.state.param_pre_stored.insert(i);
-                                    // Track the source arg register for this callee-saved reg
-                                    // so register-direct call arg loading can avoid round-trips
                                     self.param_source_regs.insert(phys_reg.0, X86_ARG_REGS[reg_idx]);
                                 } // TODO: handle StackSlot/SSE params
                             }
                         }
                     }
                     continue;
                 }
+            } else {
+                // DEBUG: dump entry block instructions for this param
+                if std::env::var("CCC_DEBUG_PARAM_STORE").is_ok() {
+                    if let Some((alloca_dest, _)) = find_param_alloca(func, i) {
+                        eprintln!("[PARAM-STORE] param {} has alloca dest={}, no ParamRef", i, alloca_dest.0);
+                        eprintln!("[PARAM-STORE] has_slot={}", self.state.get_slot(alloca_dest.0).is_some());
+                        for (bi, block) in func.blocks.iter().enumerate() {
+                            for inst in &block.instructions {
+                                match inst {
+                                    Instruction::Store { ptr, val, .. } if ptr.0 == alloca_dest.0 =>
+                                        eprintln!("[PARAM-STORE]   block[{}] Store to alloca: val={:?}", bi, val),
+                                    Instruction::Load { ptr, dest, .. } if ptr.0 == alloca_dest.0 =>
+                                        eprintln!("[PARAM-STORE]   block[{}] Load from alloca: dest={}", bi, dest.0),
+                                    Instruction::Copy { dest, src } =>
+                                        eprintln!("[PARAM-STORE]   block[{}] Copy dest={} src={:?}", bi, dest.0, src),
+                                    Instruction::ParamRef { dest, param_idx, .. } =>
+                                        eprintln!("[PARAM-STORE]   block[{}] ParamRef dest={} idx={}", bi, dest.0, param_idx),
+                                    _ => {}
+                                }
+                            }
+                        }
+                        for (&vid, &reg) in self.reg_assignments.iter() {
+                            eprintln!("[PARAM-STORE]   reg_assign: val={} -> PhysReg({})", vid, reg.0);
+                        }
+                    }
+                }
+                // No ParamRef for this param. The alloca may have been promoted
+                // by mem2reg, converting Store/Load chains to direct SSA references.
+                // After promotion, the param value flows through Copy/Cast chains.
+                //
+                // The register allocator may have assigned a promoted value to a
+                // callee-saved register. We must copy the ABI arg register to it
+                // in the prologue, because ABI registers get clobbered by calls.
+                //
+                // Strategy: find the alloca for this param, then search for Store
+                // instructions that write TO that alloca. The Store's source value
+                // (which may be a Copy from the original param) tells us which SSA
+                // value represents the parameter after store-to-load forwarding.
+                let has_slot = find_param_alloca(func, i)
+                    .and_then(|(dest, _)| self.state.get_slot(dest.0))
+                    .is_some();
+                if !has_slot {
+                    if let Some((alloca_dest, _)) = find_param_alloca(func, i) {
+                        let alloca_id = alloca_dest.0;
+                        // Collect all SSA values stored to this alloca, then
+                        // propagate through Copy chains to find all derived values.
+                        // Any of these that are register-assigned need the ABI arg
+                        // saved in the prologue.
+                        let mut param_vals: Vec<u32> = Vec::new();
+                        for block in &func.blocks {
+                            for inst in &block.instructions {
+                                if let Instruction::Store { ptr, val, .. } = inst {
+                                    if ptr.0 == alloca_id {
+                                        if let crate::ir::instruction::Operand::Value(v) = val {
+                                            param_vals.push(v.0);
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                        // Propagate through Copy chains
+                        let mut all_vals: crate::common::fx_hash::FxHashSet<u32> = param_vals.iter().copied().collect();
+                        let mut changed_prop = true;
+                        while changed_prop {
+                            changed_prop = false;
+                            for block in &func.blocks {
+                                for inst in &block.instructions {
+                                    if let Instruction::Copy { dest, src: crate::ir::instruction::Operand::Value(v) } = inst {
+                                        if all_vals.contains(&v.0) && all_vals.insert(dest.0) {
+                                            changed_prop = true;
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                        // Check if any derived value is callee-saved register-assigned
+                        for &vid in &all_vals {
+                            if let Some(&phys_reg) = self.reg_assignments.get(&vid) {
+                                let is_callee_saved = phys_reg.0 >= 1 && phys_reg.0 <= 5;
+                                if is_callee_saved {
+                                    let dest_reg = phys_reg_name(phys_reg);
+                                    if let ParamClass::IntReg { reg_idx } = class {
+                                        self.state.out.emit_instr_reg_reg(
+                                            "    movq", X86_ARG_REGS[reg_idx], dest_reg);
+                                        self.state.param_pre_stored.insert(i);
+                                        self.param_source_regs.insert(phys_reg.0, X86_ARG_REGS[reg_idx]);
+                                        break;
+                                    }
+                                }
+                            }
+                        }
+                    }
+                    continue;
+                }
             }
 
             let (slot, ty) = if let Some((dest, ty)) = find_param_alloca(func, i) {