ion: reject a fixed def that conflicts with a clobber (#266)

Fixes #222.

A clobber is a fixed late def of a throwaway vreg. When it overlaps a
fixed definition in a minimal bundle, allocation is impossible: neither
constraint can be moved or evicted. Return
`RegAllocError::TooManyLiveRegs` instead of panicking.

Replaced the verbose regression test with coverage in the existing ion
fuzzer, as requested. The generator can now emit late fixed-def/clobber
collisions. The harness checks allocation and output on a copy with the
collisions removed, then requires `TooManyLiveRegs` for the original
input. Other fuzzers retain the default generator behavior.

Validation:
- All six CI checks passed at `1e77724`: build, features, lint, no_std,
fuzz, and Cargo deny.
- 14 tests passed with `cargo test --all --all-features`; all-features
and no-default-features checks passed.
- `cargo fmt --all -- --check` passed.
- All four targets built with `cargo +nightly fuzz build`.
- Targeted ion campaign on the 5860: eight workers, 24 hours, 61,027,823
executions, all workers exited zero, no new failure artifacts.
- With the allocator fix reverted, mutation found the original panic.
The same artifact passed with the fix and passed the campaign's
preflight.

Campaign provenance note: the delivered executable had a truncated
non-loaded tail. Byte comparison against the full build confirmed that
every file-backed program segment was present and identical. The source
diff matches the recorded campaign payload. The execution count is not a
count of unique programs or exhaustive coverage.

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: agourakis82

src/fuzzing/func.rs

@@ -5,7 +5,7 @@
 
 use crate::{
     domtree, postorder, Allocation, Block, Function, Inst, InstRange, MachineEnv, Operand,
-    OperandConstraint, OperandKind, OperandPos, PReg, PRegSet, RegClass, VReg,
+    OperandConstraint, OperandKind, OperandPos, PReg, PRegSet, RegAllocError, RegClass, VReg,
 };
 
 use alloc::vec::Vec;
@@ -367,6 +367,7 @@ pub struct Options {
     pub fixed_regs: bool,
     pub fixed_nonallocatable: bool,
     pub clobbers: bool,
+    pub fixed_def_clobbers: bool,
     pub reftypes: bool,
     pub callsite_ish_constraints: bool,
     pub num_blocks: RangeInclusive<usize>,
@@ -383,6 +384,7 @@ impl Options {
         fixed_regs: false,
         fixed_nonallocatable: false,
         clobbers: false,
+        fixed_def_clobbers: false,
         reftypes: false,
         callsite_ish_constraints: false,
         num_blocks: 1..=100,
@@ -582,6 +584,22 @@ impl Func {
                     )));
                 }
 
+                if opts.fixed_def_clobbers && bool::arbitrary(u)? {
+                    // Exercise an impossible fixed output, not just allocatable functions.
+                    for operand in &operands {
+                        if let (
+                            OperandKind::Def,
+                            OperandPos::Late,
+                            OperandConstraint::FixedReg(preg),
+                        ) = (operand.kind(), operand.pos(), operand.constraint())
+                        {
+                            if preg.hw_enc() < 32 {
+                                clobbers.push(preg);
+                            }
+                        }
+                    }
+                }
+
                 builder.add_inst(
                     Block::new(block),
                     InstData {
@@ -638,6 +656,20 @@ impl Func {
 
         Ok(builder.finalize())
     }
+
+    /// An allocation error implied by the generated function's constraints.
+    pub fn expected_fail(&self) -> Option<RegAllocError> {
+        let fixed_def_clobber = self.insts.iter().any(|inst| {
+            inst.clobbers
+                .iter()
+                .any(|&preg| inst.operands.iter().any(has_fixed_def_with(preg)))
+        });
+        if fixed_def_clobber {
+            Some(RegAllocError::TooManyLiveRegs)
+        } else {
+            None
+        }
+    }
 }
 
 impl core::fmt::Debug for Func {

src/fuzzing/ion.rs

@@ -11,6 +11,7 @@ const OPTIONS: func::Options = func::Options {
     fixed_regs: true,
     fixed_nonallocatable: true,
     clobbers: true,
+    fixed_def_clobbers: true,
     reftypes: true,
     callsite_ish_constraints: true,
     ..func::Options::DEFAULT
@@ -59,12 +60,22 @@ pub fn check(t: TestCase) {
     }
 
     CTX.with(|ctx| {
-        ion::run(func, &env, &mut *ctx.borrow_mut(), *annotate, *check_ssa)
-            .expect("regalloc did not succeed");
-
-        let mut checker = checker::Checker::new(func, &env);
-        checker.prepare(&ctx.borrow().output);
-        checker.run().expect("checker failed");
+        let mut ctx = ctx.borrow_mut();
+        let result = ion::run(func, &env, &mut ctx, *annotate, *check_ssa);
+        if let Some(expected) = func.expected_fail() {
+            // The oracle currently returns only the payload-free TooManyLiveRegs variant.
+            assert!(
+                matches!(&result, Err(actual) if core::mem::discriminant(actual) == core::mem::discriminant(&expected)),
+                "expected {:?}, got {:?}",
+                expected,
+                result
+            );
+        } else {
+            result.expect("regalloc did not succeed");
+            let mut checker = checker::Checker::new(func, &env);
+            checker.prepare(&ctx.output);
+            checker.run().expect("checker failed");
+        }
     });
 }
 

src/ion/process.rs

@@ -1214,6 +1214,16 @@ impl<'a, F: Function> Env<'a, F> {
                     || lowest_cost_evict_conflict_cost.is_none()
                     || lowest_cost_evict_conflict_cost.unwrap() >= our_spill_weight)
             {
+                // A minimal bundle pinned to one physical register cannot
+                // move, and a fixed reservation on that register (a clobber
+                // is modeled as one) cannot be evicted. The overlap is
+                // illegal: a clobber must not collide with a fixed def or
+                // late use. Reject it instead of panicking.
+                if matches!(req, Requirement::FixedReg(_))
+                    && lowest_cost_evict_conflict_cost.is_none()
+                {
+                    return Err(RegAllocError::TooManyLiveRegs);
+                }
                 if matches!(req, Requirement::Register | Requirement::Limit(_)) {
                     // Check if this is a too-many-live-registers situation.
                     let range = self.ctx.bundles[bundle].ranges[0].range;