refactor(ast2ir): 移除全局值向量的直接推送

移除了在全局变量声明处理中对全局值向量的直接推送操作，
以优化内存管理和值引用的一致性。

fix(hir): 修复表达式索引类型检查中的空指针访问

修正了表达式处理中索引类型的获取方式，从使用类型指针改为使用类型引用，
并更新了空值检查条件以避免潜在的空指针解引用问题。

perf(hir): 优化类型大小计算性能

将类型大小计算逻辑从模块内部实现替换为使用HIR布局系统提供的统一接口，
提高计算效率和代码复用性。

refactor(hir): 统一字符串常量构建流程

重构了字符串常量的创建过程，简化了类型定义步骤并确保包含正确的空终止符。

fix(dump): 改进全局分配值转储的健壮性

添加了对空初始化值的检查，当全局分配没有初始值时显示零初始化器，
避免访问空指针导致的程序崩溃。

refactor(x86): 增强操作数编码的安全性

在x86指令编码中添加了对操作数字节对齐的断言检查，确保所有操作数都符合
字节边界对齐要求。

chore(build): 更新头文件包含路径和初始化参数

调整了头文件包含路径格式，并更新了HIR程序和模块的初始化函数签名，
传入ABI参数以支持更准确的目标平台特性。

libs/abi/include/scc_type_abi.h

@@ -1,106 +0,0 @@
-/**
- * @file scc_abi_type.h
- * @brief 目标无关的类型布局描述接口
- * @note 本模块仅定义接口。
- */
-
-#ifndef __SCC_ABI_TYPE_H__
-#define __SCC_ABI_TYPE_H__
-
-#include <scc_core.h>
-
-/**
- * @brief ABI 基础类型类别枚举。
- *
- * 用于快速查询目标预定义的基本类型属性。复杂类型（指针、数组、结构体）
- * 通过组合与递归计算。
- */
-typedef enum scc_abi_base_type_kind {
-    SCC_ABI_TYPE_VOID,
-    SCC_ABI_TYPE_VA_LIST,
-    SCC_ABI_TYPE_CHAR,
-    SCC_ABI_TYPE_I_CHAR,
-    SCC_ABI_TYPE_U_CHAR,
-    SCC_ABI_TYPE_I_SHORT,
-    SCC_ABI_TYPE_U_SHORT,
-    SCC_ABI_TYPE_I_INT,
-    SCC_ABI_TYPE_U_INT,
-    SCC_ABI_TYPE_I_LONG,
-    SCC_ABI_TYPE_U_LONG,
-    SCC_ABI_TYPE_I_LONG_LONG,
-    SCC_ABI_TYPE_U_LONG_LONG,
-    SCC_ABI_TYPE_PTR,
-    SCC_ABI_TYPE_FLOAT,
-    SCC_ABI_TYPE_DOUBLE,
-    SCC_ABI_TYPE_USIZE,
-    SCC_ABI_TYPE_ISIZE,
-    /* 可扩展：I128, F16, F128, VECTOR, ... */
-} scc_abi_base_type_kind_t;
-
-/**
- * @brief 单个类型的布局信息。
- */
-typedef struct scc_abi_type_layout {
-    int size;      /**< 类型占用的字节数 */
-    int alignment; /**< 类型的对齐要求（字节边界） */
-} scc_abi_type_layout_t;
-
-typedef struct {
-    scc_abi_base_type_kind_t kind;
-    scc_abi_type_layout_t layout;
-} scc_abi_base_type_impl_t;
-#define SCC_ABI_BASE_TYPE_IMPL(type, bytes_size, alians)                       \
-    [type] = {                                                                 \
-        .kind = type,                                                          \
-        .layout.size = bytes_size,                                             \
-        .layout.alignment = alians,                                            \
-    }
-
-/**
- * @brief 单个结构体字段的布局信息。
- * 由目标布局算法填充，用于 IR 的 getelementptr 常量索引计算。
- */
-typedef struct scc_abi_field_layout {
-    int offset;    /**< 字段相对于结构体基址的字节偏移 */
-    int size;      /**< 字段自身大小 */
-    int alignment; /**< 字段的对齐要求 */
-} scc_abi_field_layout_t;
-
-typedef SCC_VEC(scc_abi_field_layout_t) scc_abi_field_layout_vec_t;
-
-/**
- * @brief 获取基本类型的布局信息。
- *
- * 目标必须实现此函数，为每个 scc_abi_base_type_kind_t 返回正确的
- * size/alignment。
- *
- * @param kind 基本类型类别
- * @param layout 输出参数，存放布局信息
- * @return 成功返回 0，若 kind 不支持则返回 -1
- */
-static inline void
-scc_abi_get_base_type_layout(const scc_abi_base_type_impl_t *impls,
-                             scc_abi_base_type_kind_t kind,
-                             scc_abi_type_layout_t *layout) {
-    if (impls[kind].kind != kind)
-        Panic("invalid base type kind");
-    *layout = impls[kind].layout;
-}
-
-typedef struct scc_abi_type_calc scc_abi_type_calc_t;
-
-void scc_abi_compute_ast_type_layout(const scc_abi_type_calc_t *ctx, void *type,
-                                     scc_abi_type_layout_t *layout);
-
-typedef struct scc_abi_type_calc {
-    void *ctx;
-    const scc_abi_base_type_impl_t *impls;
-    /// @brief 可以是系统内置的结构,比如 struct int128_t
-    void (*compute_type_layout)(const scc_abi_type_calc_t *ctx, void *type,
-                                scc_abi_type_layout_t *layout);
-    /// @brief
-    void (*compute_field_layout)(const scc_abi_type_calc_t *ctx, void *type,
-                                 scc_abi_field_layout_vec_t *field_layouts);
-} scc_abi_type_calc_t;
-
-#endif /* __SCC_ABI_TYPE_H__ */

libs/abi/include/target/scc_abi_dummy.h

@@ -1,4 +0,0 @@
-#ifndef __SCC_ABI_DUMMY_H__
-#define __SCC_ABI_DUMMY_H__
-
-#endif /* __SCC_ABI_DUMMY_H__ */

libs/abi/include/target/scc_abi_win_x64_pc.h

@@ -1,49 +0,0 @@
-#ifndef __SCC_ABI_WIN_X64_PC_H__
-#define __SCC_ABI_WIN_X64_PC_H__
-/**
- * @brief Windows x64 ABI Type
- * @details
- * https://learn.microsoft.com/zh-cn/cpp/build/x64-software-conventions?view=msvc-180
- */
-
-#include "../scc_type_abi.h"
-
-static const scc_abi_base_type_impl_t scc_abi_base_type_impls[] = {
-    /**
-     * @brief
-     * https://learn.microsoft.com/zh-cn/cpp/build/x64-calling-convention?view=msvc-180#varargs
-     * 如果通过 vararg (例如省略号参数) 传递参数,则需遵守常规寄存器参数传递约定.
-     * 该约定规定了将第 5个及后面的参数溢出到堆栈中.
-     * 被调用方负责转储带有其地址的参数.
-     * (仅适用于浮点值)如果被调用方希望在整数寄存器中使用浮点值,则整数寄存器和浮点数寄存器都必须包含该值.
-     */
-    SCC_ABI_BASE_TYPE_IMPL(SCC_ABI_TYPE_VA_LIST, 4, 4),
-    SCC_ABI_BASE_TYPE_IMPL(SCC_ABI_TYPE_VOID, 0, 0),
-    SCC_ABI_BASE_TYPE_IMPL(SCC_ABI_TYPE_CHAR, 1, 1),
-    SCC_ABI_BASE_TYPE_IMPL(SCC_ABI_TYPE_I_CHAR, 1, 1),
-    SCC_ABI_BASE_TYPE_IMPL(SCC_ABI_TYPE_U_CHAR, 1, 1),
-    SCC_ABI_BASE_TYPE_IMPL(SCC_ABI_TYPE_I_SHORT, 2, 2),
-    SCC_ABI_BASE_TYPE_IMPL(SCC_ABI_TYPE_U_SHORT, 2, 2),
-    SCC_ABI_BASE_TYPE_IMPL(SCC_ABI_TYPE_I_INT, 4, 4),
-    SCC_ABI_BASE_TYPE_IMPL(SCC_ABI_TYPE_U_INT, 4, 4),
-    SCC_ABI_BASE_TYPE_IMPL(SCC_ABI_TYPE_I_LONG, 4, 4),
-    SCC_ABI_BASE_TYPE_IMPL(SCC_ABI_TYPE_U_LONG, 4, 4),
-    SCC_ABI_BASE_TYPE_IMPL(SCC_ABI_TYPE_I_LONG_LONG, 8, 8),
-    SCC_ABI_BASE_TYPE_IMPL(SCC_ABI_TYPE_U_LONG_LONG, 8, 8),
-    SCC_ABI_BASE_TYPE_IMPL(SCC_ABI_TYPE_PTR, 8, 8),
-    SCC_ABI_BASE_TYPE_IMPL(SCC_ABI_TYPE_FLOAT, 4, 4),
-    SCC_ABI_BASE_TYPE_IMPL(SCC_ABI_TYPE_DOUBLE, 8, 8),
-    SCC_ABI_BASE_TYPE_IMPL(SCC_ABI_TYPE_USIZE, 8, 8),
-    SCC_ABI_BASE_TYPE_IMPL(SCC_ABI_TYPE_ISIZE, 8, 8),
-};
-
-static const scc_abi_type_calc_t scc_ast_abi_impl = {
-    .impls = scc_abi_base_type_impls,
-    .ctx = nullptr,
-    .compute_type_layout = scc_abi_compute_ast_type_layout,
-    .compute_field_layout = nullptr,
-};
-#ifdef SCC_ABI_IMPLIMENT
-#endif
-
-#endif /* __SCC_ABI_WIN_X64_PC_H__ */

libs/abi/src/scc_type_abi.c

@@ -1,76 +0,0 @@
-#include <scc_ast.h>
-#include <scc_hir.h>
-#include <scc_type_abi.h>
-
-void scc_abi_compute_ast_type_layout(const scc_abi_type_calc_t *ctx, void *type,
-                                     scc_abi_type_layout_t *layout) {
-    scc_ast_qual_type_t *ast_type = type;
-    scc_abi_base_type_kind_t kind = SCC_ABI_TYPE_VOID;
-    switch (scc_ast_canon_type(ast_type)->builtin.type) {
-    case SCC_AST_BUILTIN_TYPE_VA_LIST:
-        kind = SCC_ABI_TYPE_VA_LIST;
-        break;
-    case SCC_AST_BUILTIN_TYPE_BOOL:
-        kind = SCC_ABI_TYPE_I_INT;
-        break;
-    case SCC_AST_BUILTIN_TYPE_VOID:
-        kind = SCC_ABI_TYPE_VOID;
-        break;
-    case SCC_AST_BUILTIN_TYPE_CHAR:
-        kind = SCC_ABI_TYPE_CHAR;
-        break;
-    case SCC_AST_BUILTIN_TYPE_UNSIGNED_CHAR:
-        kind = SCC_ABI_TYPE_U_CHAR;
-        break;
-    case SCC_AST_BUILTIN_TYPE_SIGNED_CHAR:
-        kind = SCC_ABI_TYPE_I_CHAR;
-        break;
-    case SCC_AST_BUILTIN_TYPE_SHORT:
-        kind = SCC_ABI_TYPE_I_SHORT;
-        break;
-    case SCC_AST_BUILTIN_TYPE_SIGNED_SHORT:
-        kind = SCC_ABI_TYPE_I_SHORT;
-        break;
-    case SCC_AST_BUILTIN_TYPE_UNSIGNED_SHORT:
-        kind = SCC_ABI_TYPE_U_SHORT;
-        break;
-    case SCC_AST_BUILTIN_TYPE_INT:
-        kind = SCC_ABI_TYPE_I_INT;
-        break;
-    case SCC_AST_BUILTIN_TYPE_SIGNED_INT:
-        kind = SCC_ABI_TYPE_I_INT;
-        break;
-    case SCC_AST_BUILTIN_TYPE_UNSIGNED_INT:
-        kind = SCC_ABI_TYPE_U_INT;
-        break;
-    case SCC_AST_BUILTIN_TYPE_LONG:
-        kind = SCC_ABI_TYPE_I_LONG;
-        break;
-    case SCC_AST_BUILTIN_TYPE_SIGNED_LONG:
-        kind = SCC_ABI_TYPE_I_LONG;
-        break;
-    case SCC_AST_BUILTIN_TYPE_UNSIGNED_LONG:
-        kind = SCC_ABI_TYPE_U_LONG;
-        break;
-    case SCC_AST_BUILTIN_TYPE_LONG_LONG:
-        kind = SCC_ABI_TYPE_I_LONG_LONG;
-        break;
-    case SCC_AST_BUILTIN_TYPE_SIGNED_LONG_LONG:
-        kind = SCC_ABI_TYPE_I_LONG_LONG;
-        break;
-    case SCC_AST_BUILTIN_TYPE_UNSIGNED_LONG_LONG:
-        kind = SCC_ABI_TYPE_U_LONG_LONG;
-        break;
-    case SCC_AST_BUILTIN_TYPE_FLOAT:
-        kind = SCC_ABI_TYPE_FLOAT;
-        break;
-    case SCC_AST_BUILTIN_TYPE_DOUBLE:
-        kind = SCC_ABI_TYPE_DOUBLE;
-        break;
-    default:
-        Panic("Unsupported AST type: %d",
-              scc_ast_canon_type(ast_type)->builtin.type);
-        break;
-    }
-    scc_abi_get_base_type_layout(ctx->impls, kind, layout);
-}

libs/ast/cbuild.toml

@@ -7,6 +7,7 @@ description = ""
 dependencies = [
     { name = "tree_dump", path = "../tree_dump" },
     { name = "scc_pos", path = "../sstream" },
+    { name = "scc_utils", path = "../../runtime/scc_utils" },
 ]
 # features = {}
 # default_features = []

libs/ast/include/scc_ast.h

@@ -2,47 +2,59 @@
 #define __SCC_AST_H__
 
 #include "scc_ast_def.h"
+#include <scc_strpool.h>
 
-typedef struct scc_ast_ctx {
+typedef struct scc_ast_module {
     scc_ast_canon_type_vec_t canonical_type_pool;
     scc_ast_canon_type_t *builtin_types[SCC_AST_BUILTIN_TYPE_COUNT];
     scc_ast_node_vec_t all_nodes;
-} scc_ast_ctx_t;
 
-void scc_ast_ctx_init(scc_ast_ctx_t *ctx);
-void scc_ast_ctx_drop(scc_ast_ctx_t *ctx);
+    /** 所有 AST 节点的 name 字符串由 name_pool 统一管理生命周期 */
+    scc_strpool_t name_pool;
+} scc_ast_module_t;
 
-scc_ast_canon_type_t *scc_ast_ctx_get_builtin_type(scc_ast_ctx_t *ctx,
+void scc_ast_module_init(scc_ast_module_t *module);
+void scc_ast_module_drop(scc_ast_module_t *module);
+
+scc_ast_canon_type_t *
+scc_ast_module_get_builtin_type(scc_ast_module_t *module,
                                 scc_ast_builtin_type_t kind);
 
-scc_ast_canon_type_t *scc_ast_ctx_alloc_type(scc_ast_ctx_t *ctx);
+scc_ast_canon_type_t *scc_ast_module_alloc_type(scc_ast_module_t *module);
 
-static inline void *scc_ast_ctx_alloc_node(scc_ast_ctx_t *ctx, usize size) {
+/**
+ * @brief 将字符串 intern 到 module 的 name_pool 中
+ * @return 指向 module 所拥有的持久化副本的指针
+ *         （在 module_drop 前始终有效）
+ */
+const char *scc_ast_module_intern(scc_ast_module_t *module, const char *str);
+
+static inline void *scc_ast_module_alloc_node(scc_ast_module_t *module,
+                                              usize size) {
     void *ptr = scc_malloc(size);
     if (ptr == nullptr) {
         Panic("Out of memory");
     }
     scc_memset(ptr, 0, size);
-    scc_vec_push(ctx->all_nodes, (scc_ast_node_t *)ptr);
+    scc_vec_push(module->all_nodes, (scc_ast_node_t *)ptr);
     return ptr;
 }
 
-#define SCC_AST_ALLOC(ctx, type)                                               \
-    ((type *)scc_ast_ctx_alloc_node(ctx, sizeof(type)))
-#define SCC_AST_ALLOC_QUAL_TYPE(ctx) SCC_AST_ALLOC(ctx, scc_ast_qual_type_t)
-#define SCC_AST_ALLOC_DECL(ctx) SCC_AST_ALLOC(ctx, scc_ast_decl_t)
-#define SCC_AST_ALLOC_EXPR(ctx) SCC_AST_ALLOC(ctx, scc_ast_expr_t)
-#define SCC_AST_ALLOC_STMT(ctx) SCC_AST_ALLOC(ctx, scc_ast_stmt_t)
+#define SCC_AST_ALLOC(module, type)                                            \
+    ((type *)scc_ast_module_alloc_node(module, sizeof(type)))
+#define SCC_AST_ALLOC_QUAL_TYPE(module) SCC_AST_ALLOC(module, scc_ast_qual_type_t)
+#define SCC_AST_ALLOC_DECL(module)     SCC_AST_ALLOC(module, scc_ast_decl_t)
+#define SCC_AST_ALLOC_EXPR(module)     SCC_AST_ALLOC(module, scc_ast_expr_t)
+#define SCC_AST_ALLOC_STMT(module)     SCC_AST_ALLOC(module, scc_ast_stmt_t)
 
-// have defined cannoical_type type
 static inline void
-scc_ast_type_builtin_init(scc_ast_qual_type_t *type, scc_ast_ctx_t *ctx,
+scc_ast_type_builtin_init(scc_ast_qual_type_t *type, scc_ast_module_t *module,
                           scc_ast_builtin_type_t builtin_type, scc_pos_t loc) {
     Assert(type != nullptr);
     type->base.loc = loc;
     type->base.type = SCC_AST_TYPE_BUILTIN;
-    type->type = scc_ast_ctx_get_builtin_type(ctx, builtin_type);
-    type->quals = (scc_ast_decl_specifier_t){0}; // FIXME
+    type->type = scc_ast_module_get_builtin_type(module, builtin_type);
+    type->quals = (scc_ast_decl_specifier_t){0};
 }
 
-#endif /* __SCC_AST_H__*/
+#endif /* __SCC_AST_H__ */

libs/ast/include/scc_ast_def.h

@@ -323,7 +323,7 @@ struct scc_ast_expr {
             scc_ast_expr_t *expr;
         } cast;
         // sizeof / _Alignof / ...
-        union {
+        struct {
             scc_ast_qual_type_t *type;
             scc_ast_expr_t *expr;
         } attr_of;

libs/ast/src/scc_ast.c

@@ -1,42 +1,49 @@
 #include <scc_ast.h>
 
-static scc_ast_canon_type_t *alloc_canonical_type(scc_ast_ctx_t *ctx) {
+static scc_ast_canon_type_t *alloc_canonical_type(scc_ast_module_t *module) {
     scc_ast_canon_type_t *type = scc_malloc(sizeof(scc_ast_canon_type_t));
     if (type == nullptr) {
         Panic("alloc_canonical_type: malloc failed");
     }
-    scc_vec_push(ctx->canonical_type_pool, type);
+    scc_vec_push(module->canonical_type_pool, type);
     return type;
 }
 
-void scc_ast_ctx_init(scc_ast_ctx_t *ctx) {
-    scc_vec_init(ctx->canonical_type_pool);
-    scc_vec_init(ctx->all_nodes);
+void scc_ast_module_init(scc_ast_module_t *module) {
+    scc_vec_init(module->canonical_type_pool);
+    scc_vec_init(module->all_nodes);
+    scc_strpool_init(&module->name_pool);
 
-    // 创建全部内置类型
     for (int i = 0; i < SCC_AST_BUILTIN_TYPE_COUNT; i += 1) {
-        scc_ast_canon_type_t *t = alloc_canonical_type(ctx);
-        t->builtin.type = (scc_ast_builtin_type_t)i; // 直接按顺序对应
-        ctx->builtin_types[i] = t;
+        scc_ast_canon_type_t *t = alloc_canonical_type(module);
+        t->builtin.type = (scc_ast_builtin_type_t)i;
+        module->builtin_types[i] = t;
     }
 }
 
-void scc_ast_ctx_drop(scc_ast_ctx_t *ctx) {
-    // 释放所有规范类型
-    scc_vec_foreach(ctx->canonical_type_pool, i) {
-        scc_free(ctx->canonical_type_pool.data[i]);
+void scc_ast_module_drop(scc_ast_module_t *module) {
+    scc_vec_foreach(module->canonical_type_pool, i) {
+        scc_free(module->canonical_type_pool.data[i]);
     }
-    scc_vec_foreach(ctx->all_nodes, i) { scc_free(ctx->all_nodes.data[i]); }
-    scc_vec_free(ctx->canonical_type_pool);
+    scc_vec_foreach(module->all_nodes, i) { scc_free(module->all_nodes.data[i]); }
+    scc_vec_free(module->canonical_type_pool);
+    scc_strpool_drop(&module->name_pool);
 }
 
 scc_ast_canon_type_t *
-scc_ast_ctx_get_builtin_type(scc_ast_ctx_t *ctx, scc_ast_builtin_type_t kind) {
+scc_ast_module_get_builtin_type(scc_ast_module_t *module,
+                                scc_ast_builtin_type_t kind) {
     assert(kind < SCC_AST_BUILTIN_TYPE_COUNT &&
            kind > SCC_AST_BUILTIN_TYPE_UNKNOWN);
-    return ctx->builtin_types[kind];
+    return module->builtin_types[kind];
 }
 
-scc_ast_canon_type_t *scc_ast_ctx_alloc_type(scc_ast_ctx_t *ctx) {
-    return alloc_canonical_type(ctx);
+scc_ast_canon_type_t *scc_ast_module_alloc_type(scc_ast_module_t *module) {
+    return alloc_canonical_type(module);
+}
+
+const char *scc_ast_module_intern(scc_ast_module_t *module, const char *str) {
+    if (str == nullptr)
+        return nullptr;
+    return scc_strpool_intern(&module->name_pool, str);
 }

libs/ast2ir/cbuild.toml

@@ -7,7 +7,7 @@ description = ""
 dependencies = [
     { name = "scc_ast", path = "../ast" },
     { name = "scc_hir", path = "../ir/hir" },
-    { name = "scc_abi", path = "../abi" },
+    { name = "type_abi", path = "../target/type_abi" },
 ]
 # features = {}
 # default_features = []

libs/ast2ir/include/scc_ast2ir.h

@@ -12,19 +12,18 @@ typedef struct {
     scc_hashtable_t continue_cache; ///< continue cache
     scc_hashtable_t symtab;         ///< symbol to ir_ref
     scc_hashtable_t type_cache; ///< scc_ast_canon_type_t* -> scc_hir_type_ref_t
-    // scc_strpool_t strpool;   ///< string pool
-    const scc_abi_type_calc_t *abi;
+    const scc_type_abi_t *type_abi;
     cbool hint_using_value; // 转换时尽可能使用value而不是alloc
 
-    scc_ast_ctx_t *ast_ctx;
+    scc_ast_module_t *ast_module;
 } scc_ast2ir_ctx_t;
 
 static inline scc_hir_module_t *scc_ast2ir_mir_module(scc_ast2ir_ctx_t *ctx) {
     return &ctx->builder.cprog->module;
 }
 
-void scc_ast2ir_ctx_init(scc_ast2ir_ctx_t *ctx, const scc_abi_type_calc_t *abi,
-                         scc_ast_ctx_t *ast_ctx, scc_hir_cprog_t *cprog);
+void scc_ast2ir_ctx_init(scc_ast2ir_ctx_t *ctx, const scc_type_abi_t *type_abi,
+                         scc_ast_module_t *ast_module, scc_hir_cprog_t *cprog);
 void scc_ast2ir_ctx_drop(scc_ast2ir_ctx_t *ctx);
 
 void scc_ast2ir_run(scc_ast2ir_ctx_t *ctx,
@@ -38,6 +37,42 @@ void scc_ast2ir_stmt(scc_ast2ir_ctx_t *ctx, const scc_ast_stmt_t *stmt);
 scc_hir_type_ref_t scc_ast2ir_type(scc_ast2ir_ctx_t *ctx,
                                    const scc_ast_qual_type_t *ast_type);
 
+scc_hir_type_ref_t
+scc_ast2ir_parse_base_type(scc_ast2ir_ctx_t *ctx,
+                           const scc_ast_qual_type_t *ast_type);
+
+// Utils
+
+// 判断 AST 参数是否为 ... 生成的假 VA_LIST 参数
+static cbool is_variadic_marker(const scc_ast_decl_t *decl_param) {
+    return decl_param->name == nullptr &&
+           decl_param->param.type->base.type == SCC_AST_TYPE_BUILTIN &&
+           scc_ast_canon_type(decl_param->param.type)->builtin.type ==
+               SCC_AST_BUILTIN_TYPE_VA_LIST;
+}
+
+// 计算函数类型中的固定参数个数（去掉尾部的 ... 标记）
+static int fixed_param_count(const scc_ast_canon_type_t *canon) {
+    int n = (int)scc_vec_size(canon->function.params);
+    if (n > 0) {
+        const scc_ast_decl_t *last =
+            scc_vec_at(canon->function.params, (usize)(n - 1));
+        if (is_variadic_marker(last))
+            return n - 1;
+    }
+    return n;
+}
+
+void emit_array_initialization(scc_ast2ir_ctx_t *ctx,
+                               scc_hir_value_ref_t array_ptr,
+                               const scc_hir_type_t *array_type,
+                               const scc_ast_expr_t *init_expr);
+
+void emit_aggregate_initialization(scc_ast2ir_ctx_t *ctx,
+                                   scc_hir_value_ref_t base_ptr,
+                                   const scc_hir_type_t *type,
+                                   const scc_ast_expr_t *init_expr);
+
 // ====== 类型提升（Type Promotion）接口 ======
 
 /**
@@ -54,8 +89,9 @@ scc_hir_type_ref_t scc_ast2ir_integer_promotion(scc_ast2ir_ctx_t *ctx,
  * 对二元算术操作的两个操作数类型找到公共类型
  * @return 公共类型的引用
  */
-scc_hir_type_ref_t scc_ast2ir_usual_arithmetic_conversion(
-    scc_ast2ir_ctx_t *ctx, scc_hir_type_ref_t t1_ref,
+scc_hir_type_ref_t
+scc_ast2ir_usual_arithmetic_conversion(scc_ast2ir_ctx_t *ctx,
+                                       scc_hir_type_ref_t t1_ref,
                                        scc_hir_type_ref_t t2_ref);
 
 /**
@@ -67,4 +103,22 @@ scc_hir_value_ref_t scc_ast2ir_emit_conversion(scc_ast2ir_ctx_t *ctx,
                                                scc_hir_value_ref_t value,
                                                scc_hir_type_ref_t target_type);
 
+// ====== 常量表达式求值 ======
+
+/**
+ * @brief 对整数常量表达式求值（C11 6.6）
+ *
+ * 递归计算 AST 表达式，得到一个编译期可确定的整数值。
+ * 支持：整数字面量、字符字面量、枚举常量、sizeof / _Alignof、
+ *       一元运算（+ - ~ !）、二元运算（算术/位/移位/关系/逻辑）、
+ *       条件表达式（?:）、强制类型转换。
+ *
+ * @param ctx    ast2ir 上下文
+ * @param result 输出参数，存放求值结果
+ * @param expr   待求值的 AST 表达式
+ * @return 成功返回 true；若表达式不是合法的常量表达式则返回 false
+ */
+cbool scc_ast2ir_eval_constant_int(scc_ast2ir_ctx_t *ctx, scc_ap_t *result,
+                                   const scc_ast_expr_t *expr);
+
 #endif /* __SCC_AST2IR_H__ */

libs/ast2ir/src/scc_ast2ir_const.c

@@ -0,0 +1,378 @@
+#include <scc_ast2ir.h>
+#include <scc_ast_def.h>
+#include <scc_ast_utils.h>
+#include <scc_hir_layout.h>
+
+/* ---------- internal helpers ---------- */
+
+static cbool is_builtin_signed(scc_ast_builtin_type_t t) {
+    switch (t) {
+    case SCC_AST_BUILTIN_TYPE_BOOL:
+    case SCC_AST_BUILTIN_TYPE_CHAR: /* implementation-defined, treat as signed */
+    case SCC_AST_BUILTIN_TYPE_SHORT:
+    case SCC_AST_BUILTIN_TYPE_INT:
+    case SCC_AST_BUILTIN_TYPE_LONG:
+    case SCC_AST_BUILTIN_TYPE_LONG_LONG:
+    case SCC_AST_BUILTIN_TYPE_SIGNED_CHAR:
+    case SCC_AST_BUILTIN_TYPE_SIGNED_SHORT:
+    case SCC_AST_BUILTIN_TYPE_SIGNED_INT:
+    case SCC_AST_BUILTIN_TYPE_SIGNED_LONG:
+    case SCC_AST_BUILTIN_TYPE_SIGNED_LONG_LONG:
+        return true;
+    default:
+        return false;
+    }
+}
+
+static cbool is_builtin_unsigned(scc_ast_builtin_type_t t) {
+    switch (t) {
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_CHAR:
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_SHORT:
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_INT:
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_LONG:
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_LONG_LONG:
+        return true;
+    default:
+        return false;
+    }
+}
+
+/* Check whether an AST qual-type is an integer type (not pointer/float/struct) */
+static cbool is_ast_integer_type(const scc_ast_qual_type_t *type) {
+    if (type->base.type != SCC_AST_TYPE_BUILTIN)
+        return false;
+    scc_ast_builtin_type_t bt = scc_ast_canon_type(type)->builtin.type;
+    return bt >= SCC_AST_BUILTIN_TYPE_BOOL &&
+           bt <= SCC_AST_BUILTIN_TYPE_UNSIGNED_LONG_LONG;
+}
+
+/*
+ * Truncate / sign-extend an AP value to match a target integer type width.
+ * Uses the ABI calculator to determine the type's size in bytes.
+ */
+static cbool apply_integer_truncation(scc_ast2ir_ctx_t *ctx, scc_ap_t *val,
+                                       const scc_ast_qual_type_t *target_type) {
+    if (!is_ast_integer_type(target_type))
+        return false;
+
+    scc_hir_type_ref_t tref = scc_ast2ir_type(ctx, target_type);
+    int bits = scc_hir_type_size(scc_ast2ir_mir_module(ctx), tref, ctx->type_abi);
+    if (bits >= (int)sizeof(scc_ap_digit) * 8)
+        return true; /* no truncation needed */
+
+    /* Extract magnitude */
+    uint64_t mag = val->data.digit;
+    uint64_t mask = ((uint64_t)1 << bits) - 1;
+    uint64_t truncated = mag & mask;
+
+    /* For signed types, sign-extend if the MSB is set */
+    scc_ast_builtin_type_t bt = scc_ast_canon_type(target_type)->builtin.type;
+    if (is_builtin_signed(bt) && (truncated >> (bits - 1)))
+        truncated |= ~mask; /* set all bits above bits-1 */
+
+    val->data.digit = truncated;
+    val->len = (val->len < 0 && truncated == 0) ? 1 : val->len;
+    return true;
+}
+
+/* ---------- unary expression ---------- */
+
+static cbool eval_unary(scc_ast2ir_ctx_t *ctx, scc_ap_t *result,
+                         const scc_ast_expr_t *expr) {
+    scc_ap_t val;
+    scc_ap_init(&val);
+
+    if (!scc_ast2ir_eval_constant_int(ctx, &val, expr->unary.operand))
+        return false;
+
+    switch (expr->unary.op) {
+    case SCC_AST_OP_UNARY_PLUS:
+        result->capacity = -1;
+        result->len = val.len;
+        result->data.digit = val.data.digit;
+        return true;
+    case SCC_AST_OP_UNARY_MINUS:
+        scc_ap_neg(result, &val);
+        return true;
+    case SCC_AST_OP_BITWISE_NOT:
+        scc_ap_not(result, &val);
+        return true;
+    case SCC_AST_OP_LOGICAL_NOT:
+        scc_ap_set_int(result, scc_ap_is_zero(&val));
+        return true;
+    default:
+        return false;
+    }
+}
+
+/* ---------- binary expression ---------- */
+
+static cbool eval_binary(scc_ast2ir_ctx_t *ctx, scc_ap_t *result,
+                          const scc_ast_expr_t *expr) {
+    scc_ap_t lhs_val, rhs_val;
+    scc_ap_init(&lhs_val);
+    scc_ap_init(&rhs_val);
+
+    if (!scc_ast2ir_eval_constant_int(ctx, &lhs_val, expr->binary.lhs))
+        return false;
+    if (!scc_ast2ir_eval_constant_int(ctx, &rhs_val, expr->binary.rhs))
+        return false;
+
+    switch (expr->binary.op) {
+    /* arithmetic */
+    case SCC_AST_OP_ADD:
+        scc_ap_add(result, &lhs_val, &rhs_val);
+        return true;
+    case SCC_AST_OP_SUB:
+        scc_ap_sub(result, &lhs_val, &rhs_val);
+        return true;
+    case SCC_AST_OP_MUL:
+        scc_ap_mul(result, &lhs_val, &rhs_val);
+        return true;
+    case SCC_AST_OP_DIV:
+        scc_ap_div(result, &lhs_val, &rhs_val);
+        return true;
+    case SCC_AST_OP_MOD:
+        scc_ap_mod(result, &lhs_val, &rhs_val);
+        return true;
+    /* bitwise */
+    case SCC_AST_OP_BITWISE_AND:
+        scc_ap_and(result, &lhs_val, &rhs_val);
+        return true;
+    case SCC_AST_OP_BITWISE_OR:
+        scc_ap_or(result, &lhs_val, &rhs_val);
+        return true;
+    case SCC_AST_OP_BITWISE_XOR:
+        scc_ap_xor(result, &lhs_val, &rhs_val);
+        return true;
+    /* shift */
+    case SCC_AST_OP_LEFT_SHIFT:
+        scc_ap_shl(result, &lhs_val, (unsigned)rhs_val.data.digit);
+        return true;
+    case SCC_AST_OP_RIGHT_SHIFT:
+        scc_ap_shr(result, &lhs_val, (unsigned)rhs_val.data.digit);
+        return true;
+    /* relational */
+    case SCC_AST_OP_EQUAL:
+        scc_ap_set_int(result, scc_ap_cmp(&lhs_val, &rhs_val) == 0);
+        return true;
+    case SCC_AST_OP_NOT_EQUAL:
+        scc_ap_set_int(result, scc_ap_cmp(&lhs_val, &rhs_val) != 0);
+        return true;
+    case SCC_AST_OP_LESS:
+        scc_ap_set_int(result, scc_ap_cmp(&lhs_val, &rhs_val) < 0);
+        return true;
+    case SCC_AST_OP_GREATER:
+        scc_ap_set_int(result, scc_ap_cmp(&lhs_val, &rhs_val) > 0);
+        return true;
+    case SCC_AST_OP_LESS_EQUAL:
+        scc_ap_set_int(result, scc_ap_cmp(&lhs_val, &rhs_val) <= 0);
+        return true;
+    case SCC_AST_OP_GREATER_EQUAL:
+        scc_ap_set_int(result, scc_ap_cmp(&lhs_val, &rhs_val) >= 0);
+        return true;
+    /* logical */
+    case SCC_AST_OP_LOGICAL_AND:
+        if (scc_ap_is_zero(&lhs_val)) {
+            scc_ap_set_int(result, 0);
+        } else {
+            scc_ap_set_int(result, !scc_ap_is_zero(&rhs_val));
+        }
+        return true;
+    case SCC_AST_OP_LOGICAL_OR:
+        if (!scc_ap_is_zero(&lhs_val)) {
+            scc_ap_set_int(result, 1);
+        } else {
+            scc_ap_set_int(result, !scc_ap_is_zero(&rhs_val));
+        }
+        return true;
+    default:
+        return false;
+    }
+}
+
+/* ---------- identifier (enum constant lookup) ---------- */
+
+static cbool eval_identifier(scc_ast2ir_ctx_t *ctx, scc_ap_t *result,
+                              const scc_ast_expr_t *expr) {
+    if (expr->identifier._target == nullptr)
+        return false;
+
+    /* Try the ast2ir_cache — enum values are stored there as HIR integer
+     * constants during scc_ast2ir_decl(SCC_AST_DECL_ENUM) */
+    scc_hir_value_ref_t cached = (scc_hir_value_ref_t)(usize)scc_hashtable_get(
+        &ctx->ast2ir_cache, expr->identifier._target);
+    if (cached != 0) {
+        scc_hir_value_t *hir_val =
+            scc_hir_module_get_value(scc_ast2ir_mir_module(ctx), cached);
+        if (hir_val != nullptr && hir_val->tag == SCC_HIR_VALUE_TAG_INTEGER) {
+            /* shallow copy — digit mode has no heap allocation */
+            result->capacity = -1;
+            result->len = hir_val->data.integer.len;
+            result->data.digit = hir_val->data.integer.data.digit;
+            return true;
+        }
+    }
+
+    /* If not cached yet, evaluate the var init recursively.
+     * This handles enum-internal forward references within a single enum decl:
+     *   enum { A = 1, B = A + 1 };  — when evaluating B, A may not be cached
+     *   yet, but we can look at A's init expression. */
+    if (expr->identifier._target->base.type == SCC_AST_DECL_VAR &&
+        expr->identifier._target->var.init != nullptr) {
+        return scc_ast2ir_eval_constant_int(ctx, result,
+                                  expr->identifier._target->var.init);
+    }
+
+    return false;
+}
+
+/* ---------- character literal evaluation ---------- */
+
+static int eval_char_literal(const scc_ast_expr_t *expr) {
+    const char *lexme = expr->literal.lexme;
+    Assert(lexme[0] == '\'');
+
+    if (lexme[1] != '\\')
+        return (unsigned char)lexme[1];
+
+    switch (lexme[2]) {
+    case 'a':
+        return '\a';
+    case 'b':
+        return '\b';
+    case 'f':
+        return '\f';
+    case 'n':
+        return '\n';
+    case 'r':
+        return '\r';
+    case 't':
+        return '\t';
+    case 'v':
+        return '\v';
+    case '\\':
+        return '\\';
+    case '\'':
+        return '\'';
+    case '"':
+        return '"';
+    case '0':
+        return '\0';
+    case 'x':
+        /* hex escape: \xNN — parse up to 2 hex digits */
+        {
+            int val = 0;
+            int j = 3;
+            while (1) {
+                char c = lexme[j];
+                unsigned d;
+                if (c >= '0' && c <= '9')
+                    d = c - '0';
+                else if (c >= 'a' && c <= 'f')
+                    d = c - 'a' + 10;
+                else if (c >= 'A' && c <= 'F')
+                    d = c - 'A' + 10;
+                else
+                    break;
+                val = val * 16 + d;
+                j++;
+            }
+            return val;
+        }
+    default:
+        /* octal: \nnn */
+        if (lexme[2] >= '0' && lexme[2] <= '7') {
+            int val = 0;
+            int j = 2;
+            while (j < 5 && lexme[j] >= '0' && lexme[j] <= '7') {
+                val = val * 8 + (lexme[j] - '0');
+                j++;
+            }
+            return val;
+        }
+        return (unsigned char)lexme[2];
+    }
+}
+
+/* ===================================================================
+ * Public API
+ * =================================================================== */
+
+cbool scc_ast2ir_eval_constant_int(scc_ast2ir_ctx_t *ctx, scc_ap_t *result,
+                                    const scc_ast_expr_t *expr) {
+    if (ctx == nullptr || result == nullptr || expr == nullptr)
+        return false;
+
+    scc_ap_init(result);
+
+    switch (expr->base.type) {
+    case SCC_AST_EXPR_INT_LITERAL:
+        scc_ap_from_cstr(result, expr->literal.lexme, 0);
+        return true;
+
+    case SCC_AST_EXPR_CHAR_LITERAL:
+        scc_ap_set_int(result, eval_char_literal(expr));
+        return true;
+
+    case SCC_AST_EXPR_BINARY:
+        return eval_binary(ctx, result, expr);
+
+    case SCC_AST_EXPR_UNARY:
+        return eval_unary(ctx, result, expr);
+
+    case SCC_AST_EXPR_COND: {
+        scc_ap_t cond_val;
+        scc_ap_init(&cond_val);
+        if (!scc_ast2ir_eval_constant_int(ctx, &cond_val, expr->cond.cond))
+            return false;
+        return scc_ast2ir_eval_constant_int(ctx, result,
+                                  scc_ap_is_zero(&cond_val)
+                                      ? expr->cond.else_expr
+                                      : expr->cond.then_expr);
+    }
+
+    case SCC_AST_EXPR_CAST: {
+        if (!scc_ast2ir_eval_constant_int(ctx, result, expr->cast.expr))
+            return false;
+        /* Truncate / sign-extend to the target type width */
+        if (!apply_integer_truncation(ctx, result, expr->cast.type))
+            return false;
+        return true;
+    }
+
+    case SCC_AST_EXPR_SIZE_OF: {
+        if (expr->attr_of.type) {
+            scc_hir_type_ref_t tref = scc_ast2ir_type(ctx, expr->attr_of.type);
+            int size = scc_hir_type_size(scc_ast2ir_mir_module(ctx), tref,
+                                          ctx->type_abi);
+            scc_ap_set_int(result, size / 8);
+            return true;
+        } else if (expr->attr_of.expr) {
+            return false;
+        } else {
+            return false;
+        }
+    }
+
+    case SCC_AST_EXPR_ALIGN_OF: {
+        if (expr->attr_of.type) {
+            scc_hir_type_ref_t tref = scc_ast2ir_type(ctx, expr->attr_of.type);
+            int align = scc_hir_type_align(scc_ast2ir_mir_module(ctx), tref,
+                                            ctx->type_abi);
+            scc_ap_set_int(result, align / 8);
+            return true;
+        } else if (expr->attr_of.expr) {
+            return false;
+        } else {
+            return false;
+        }
+    }
+
+    case SCC_AST_EXPR_IDENTIFIER:
+        return eval_identifier(ctx, result, expr);
+
+    default:
+        return false;
+    }
+}

libs/ast2ir/src/scc_ast2ir_expr.c

@@ -0,0 +1,919 @@
+#include <scc_ast2ir.h>
+#include <scc_ast_def.h>
+#include <scc_ast_utils.h>
+#include <scc_hir_builder.h>
+#include <scc_hir_def.h>
+
+// 判断是否为算术类型（整数或浮点）
+static cbool is_arithmetic_type(const scc_hir_type_t *type) {
+    Assert(type != nullptr);
+    switch (type->tag) {
+    case SCC_HIR_TYPE_i8:
+    case SCC_HIR_TYPE_i16:
+    case SCC_HIR_TYPE_i32:
+    case SCC_HIR_TYPE_i64:
+    case SCC_HIR_TYPE_i128:
+    case SCC_HIR_TYPE_u8:
+    case SCC_HIR_TYPE_u16:
+    case SCC_HIR_TYPE_u32:
+    case SCC_HIR_TYPE_u64:
+    case SCC_HIR_TYPE_u128:
+    case SCC_HIR_TYPE_f16:
+    case SCC_HIR_TYPE_f32:
+    case SCC_HIR_TYPE_f64:
+    case SCC_HIR_TYPE_f128:
+        return true;
+    default:
+        return false;
+    }
+}
+
+static inline bool scc_hir_type_is_signed(scc_hir_type_tag_t tag) {
+    switch (tag) {
+    case SCC_HIR_TYPE_i8:
+    case SCC_HIR_TYPE_i16:
+    case SCC_HIR_TYPE_i32:
+    case SCC_HIR_TYPE_i64:
+    case SCC_HIR_TYPE_i128:
+        return true;
+    case SCC_HIR_TYPE_u8:
+    case SCC_HIR_TYPE_u16:
+    case SCC_HIR_TYPE_u32:
+    case SCC_HIR_TYPE_u64:
+    case SCC_HIR_TYPE_u128:
+        return false;
+    default:
+        // 指针可以视作无符号整数
+        return false;
+    }
+}
+
+scc_hir_value_ref_t scc_ast2ir_logical_expr(scc_ast2ir_ctx_t *ctx,
+                                            const scc_ast_expr_t *expr) {
+    // scc_hir_bblock_ref_t start_block =
+    //     scc_hir_builder_current_bblock(&ctx->builder);
+
+    scc_hir_value_ref_t right_block =
+        scc_hir_builder_create_bblock(&ctx->builder, "logic_right");
+    scc_hir_value_ref_t end_block =
+        scc_hir_builder_create_bblock(&ctx->builder, "logic_end");
+
+    // 为结果创建临时存储空间
+    scc_hir_type_ref_t int32_type = scc_hir_builder_type_i32(&ctx->builder);
+    scc_hir_value_ref_t result_var =
+        scc_hir_builder_alloca(&ctx->builder, int32_type, "logic_result");
+
+    // 计算左操作数
+    scc_hir_value_ref_t left_val =
+        scc_ast2ir_expr(ctx, expr->binary.lhs, false);
+
+    scc_ap_t zero_ap;
+    scc_ap_set_int(&zero_ap, 0);
+    scc_ap_t one_ap;
+    scc_ap_set_int(&one_ap, 1);
+    scc_hir_value_ref_t zero_val =
+        scc_hir_builder_integer(&ctx->builder, int32_type, &zero_ap);
+    scc_hir_value_ref_t one_val =
+        scc_hir_builder_integer(&ctx->builder, int32_type, &one_ap);
+
+    if (expr->binary.op == SCC_AST_OP_LOGICAL_AND) {
+        // a && b
+        scc_hir_value_ref_t false_block =
+            scc_hir_builder_create_bblock(&ctx->builder, "and_false");
+
+        // 如果左操作数为0，结果为0（短路）
+        scc_hir_value_ref_t is_left_zero = scc_hir_builder_binop(
+            &ctx->builder, SCC_HIR_OP_EQ, left_val, zero_val);
+        scc_hir_builder_branch(&ctx->builder, is_left_zero, false_block,
+                               right_block);
+
+        // false_block: 左边为0，结果为0
+        scc_hir_builder_append_bblock(&ctx->builder, false_block);
+        scc_hir_builder_set_current_bblock(&ctx->builder, false_block);
+        scc_hir_builder_store(&ctx->builder, result_var, zero_val);
+        scc_hir_builder_jump(&ctx->builder, end_block);
+
+        // right_block: 左边非0，计算右边
+        scc_hir_builder_append_bblock(&ctx->builder, right_block);
+        scc_hir_builder_set_current_bblock(&ctx->builder, right_block);
+        scc_hir_value_ref_t right_val =
+            scc_ast2ir_expr(ctx, expr->binary.rhs, false);
+        scc_hir_value_ref_t is_right_zero = scc_hir_builder_binop(
+            &ctx->builder, SCC_HIR_OP_EQ, right_val, zero_val);
+        scc_hir_value_ref_t result =
+            scc_hir_builder_binop(&ctx->builder, SCC_HIR_OP_XOR, is_right_zero,
+                                  one_val); // !right == 0 ? 1 : 0
+        scc_hir_builder_store(&ctx->builder, result_var, result);
+        scc_hir_builder_jump(&ctx->builder, end_block);
+
+    } else { // SCC_AST_OP_LOGICAL_OR
+        // a || b
+        scc_hir_value_ref_t true_block =
+            scc_hir_builder_create_bblock(&ctx->builder, "or_true");
+
+        // 如果左操作数非0，结果为1（短路）
+        scc_hir_value_ref_t is_left_nonzero = scc_hir_builder_binop(
+            &ctx->builder, SCC_HIR_OP_NEQ, left_val, zero_val);
+        scc_hir_builder_branch(&ctx->builder, is_left_nonzero, true_block,
+                               right_block);
+
+        // true_block: 左边非0，结果为1
+        scc_hir_builder_append_bblock(&ctx->builder, true_block);
+        scc_hir_builder_set_current_bblock(&ctx->builder, true_block);
+        scc_hir_builder_store(&ctx->builder, result_var, one_val);
+        scc_hir_builder_jump(&ctx->builder, end_block);
+
+        // right_block: 左边为0，计算右边
+        scc_hir_builder_append_bblock(&ctx->builder, right_block);
+        scc_hir_builder_set_current_bblock(&ctx->builder, right_block);
+        scc_hir_value_ref_t right_val =
+            scc_ast2ir_expr(ctx, expr->binary.rhs, false);
+        scc_hir_value_ref_t is_right_zero = scc_hir_builder_binop(
+            &ctx->builder, SCC_HIR_OP_EQ, right_val, zero_val);
+        scc_hir_value_ref_t result =
+            scc_hir_builder_binop(&ctx->builder, SCC_HIR_OP_XOR, is_right_zero,
+                                  one_val); // !right == 0 ? 1 : 0
+        scc_hir_builder_store(&ctx->builder, result_var, result);
+        scc_hir_builder_jump(&ctx->builder, end_block);
+    }
+
+    // 设置结束块为当前块，并返回结果
+    scc_hir_builder_append_bblock(&ctx->builder, end_block);
+    scc_hir_builder_set_current_bblock(&ctx->builder, end_block);
+    return scc_hir_builder_load(&ctx->builder, result_var);
+}
+
+/**
+ * @brief
+ *
+ * @param ctx
+ * @param expr
+ * @return scc_hir_value_ref_t
+ */
+scc_hir_value_ref_t scc_ast2ir_expr(scc_ast2ir_ctx_t *ctx,
+                                    const scc_ast_expr_t *expr,
+                                    cbool is_lvalue) {
+    if (ctx == nullptr || expr == nullptr) {
+        LOG_ERROR("args is nullptr");
+        return 0;
+    }
+
+    cbool is_assign = true;
+    switch (expr->base.type) {
+    case SCC_AST_EXPR_BINARY: {
+        scc_ast_expr_t tmp_expr;
+        scc_hir_value_ref_t lhs = SCC_HIR_REF_nullptr,
+                            rhs = SCC_HIR_REF_nullptr;
+        switch (expr->binary.op) {
+        case SCC_AST_OP_ASSIGN: // =
+            rhs = scc_ast2ir_expr(ctx, expr->binary.rhs, false);
+            break;
+        case SCC_AST_OP_ASSIGN_ADD: // +=
+            scc_ast_expr_binary_init(&tmp_expr, SCC_AST_OP_ADD,
+                                     expr->binary.lhs, expr->binary.rhs,
+                                     expr->base.loc);
+            rhs = scc_ast2ir_expr(ctx, &tmp_expr, false);
+            break;
+        case SCC_AST_OP_ASSIGN_SUB: // -=
+            scc_ast_expr_binary_init(&tmp_expr, SCC_AST_OP_SUB,
+                                     expr->binary.lhs, expr->binary.rhs,
+                                     expr->base.loc);
+            rhs = scc_ast2ir_expr(ctx, &tmp_expr, false);
+            break;
+        case SCC_AST_OP_ASSIGN_MUL: // *=
+            scc_ast_expr_binary_init(&tmp_expr, SCC_AST_OP_MUL,
+                                     expr->binary.lhs, expr->binary.rhs,
+                                     expr->base.loc);
+            rhs = scc_ast2ir_expr(ctx, &tmp_expr, false);
+            break;
+        case SCC_AST_OP_ASSIGN_DIV: // /=
+            scc_ast_expr_binary_init(&tmp_expr, SCC_AST_OP_DIV,
+                                     expr->binary.lhs, expr->binary.rhs,
+                                     expr->base.loc);
+            rhs = scc_ast2ir_expr(ctx, &tmp_expr, false);
+            break;
+        case SCC_AST_OP_ASSIGN_MOD: // %=
+            scc_ast_expr_binary_init(&tmp_expr, SCC_AST_OP_MOD,
+                                     expr->binary.lhs, expr->binary.rhs,
+                                     expr->base.loc);
+            rhs = scc_ast2ir_expr(ctx, &tmp_expr, false);
+            break;
+        case SCC_AST_OP_ASSIGN_AND: // &=
+            scc_ast_expr_binary_init(&tmp_expr, SCC_AST_OP_BITWISE_AND,
+                                     expr->binary.lhs, expr->binary.rhs,
+                                     expr->base.loc);
+            rhs = scc_ast2ir_expr(ctx, &tmp_expr, false);
+            break;
+        case SCC_AST_OP_ASSIGN_XOR: // ^=
+            scc_ast_expr_binary_init(&tmp_expr, SCC_AST_OP_BITWISE_XOR,
+                                     expr->binary.lhs, expr->binary.rhs,
+                                     expr->base.loc);
+            rhs = scc_ast2ir_expr(ctx, &tmp_expr, false);
+            break;
+        case SCC_AST_OP_ASSIGN_OR: // |=
+            scc_ast_expr_binary_init(&tmp_expr, SCC_AST_OP_BITWISE_OR,
+                                     expr->binary.lhs, expr->binary.rhs,
+                                     expr->base.loc);
+            rhs = scc_ast2ir_expr(ctx, &tmp_expr, false);
+            break;
+        case SCC_AST_OP_ASSIGN_LSHIFT: // <<=
+            scc_ast_expr_binary_init(&tmp_expr, SCC_AST_OP_LEFT_SHIFT,
+                                     expr->binary.lhs, expr->binary.rhs,
+                                     expr->base.loc);
+            rhs = scc_ast2ir_expr(ctx, &tmp_expr, false);
+            break;
+        case SCC_AST_OP_ASSIGN_RSHIFT: // >>=
+            scc_ast_expr_binary_init(&tmp_expr, SCC_AST_OP_RIGHT_SHIFT,
+                                     expr->binary.lhs, expr->binary.rhs,
+                                     expr->base.loc);
+            rhs = scc_ast2ir_expr(ctx, &tmp_expr, false);
+            break;
+        default:
+            is_assign = false;
+            break;
+        }
+        if (is_assign) {
+            Assert(rhs != SCC_HIR_REF_nullptr);
+            lhs = scc_ast2ir_expr(ctx, expr->binary.lhs, true);
+            // 将 RHS 转换为 LHS 指向的类型（C11 6.5.16.1 简单赋值）
+            scc_hir_type_t *lhs_ptr_type = scc_hir_module_get_type_by_value(
+                scc_ast2ir_mir_module(ctx), lhs);
+            if (lhs_ptr_type->tag == SCC_HIR_TYPE_PTR &&
+                is_arithmetic_type(
+                    scc_hir_module_get_type(scc_ast2ir_mir_module(ctx),
+                                            lhs_ptr_type->data.pointer.base))) {
+                rhs = scc_ast2ir_emit_conversion(
+                    ctx, rhs, lhs_ptr_type->data.pointer.base);
+            }
+            scc_hir_builder_store(&ctx->builder, lhs, rhs);
+            return rhs;
+        }
+
+        if (expr->binary.op == SCC_AST_OP_LOGICAL_AND ||
+            expr->binary.op == SCC_AST_OP_LOGICAL_OR) {
+            // TODO 类型提升
+            return scc_ast2ir_logical_expr(ctx, expr);
+        }
+        if (expr->binary.op == SCC_AST_OP_COMMA) {
+            lhs = scc_ast2ir_expr(ctx, expr->binary.lhs, false);
+            rhs = scc_ast2ir_expr(ctx, expr->binary.rhs, false);
+        } else {
+            rhs = scc_ast2ir_expr(ctx, expr->binary.rhs, false);
+            lhs = scc_ast2ir_expr(ctx, expr->binary.lhs, false);
+        }
+
+        // 类型提升：对算术类型二元操作应用寻常算术转换（C11 6.3.1.8）
+        // 移位操作符不适用（仅对每个操作数单独整数提升）
+        cbool is_shift = (expr->binary.op == SCC_AST_OP_LEFT_SHIFT ||
+                          expr->binary.op == SCC_AST_OP_RIGHT_SHIFT);
+        scc_hir_type_ref_t common_type = 0;
+        if (!is_shift && expr->binary.op != SCC_AST_OP_COMMA) {
+            scc_hir_module_t *module = scc_ast2ir_mir_module(ctx);
+            scc_hir_type_ref_t lhs_type_ref =
+                scc_hir_module_get_value(module, lhs)->type;
+            scc_hir_type_ref_t rhs_type_ref =
+                scc_hir_module_get_value(module, rhs)->type;
+            Assert(lhs_type_ref != 0 && rhs_type_ref != 0);
+            scc_hir_type_t *lhs_type =
+                scc_hir_module_get_type(module, lhs_type_ref);
+            scc_hir_type_t *rhs_type =
+                scc_hir_module_get_type(module, rhs_type_ref);
+            if (is_arithmetic_type(lhs_type) && is_arithmetic_type(rhs_type)) {
+                common_type = scc_ast2ir_usual_arithmetic_conversion(
+                    ctx, lhs_type_ref, rhs_type_ref);
+                if (common_type != 0) {
+                    lhs = scc_ast2ir_emit_conversion(ctx, lhs, common_type);
+                    rhs = scc_ast2ir_emit_conversion(ctx, rhs, common_type);
+                }
+            }
+        } else if (is_shift) {
+            // 移位操作符：只进行整数提升（C11 6.5.7）
+            scc_hir_module_t *module = scc_ast2ir_mir_module(ctx);
+            scc_hir_type_ref_t lhs_type_ref =
+                scc_hir_module_get_value(module, lhs)->type;
+            scc_hir_type_ref_t promoted =
+                scc_ast2ir_integer_promotion(ctx, lhs_type_ref);
+            if (promoted != 0)
+                lhs = scc_ast2ir_emit_conversion(ctx, lhs, promoted);
+        }
+
+        // 映射操作符
+        scc_hir_op_type_t op;
+        switch (expr->binary.op) {
+            /* clang-format off */
+        case SCC_AST_OP_ADD:            op = SCC_HIR_OP_ADD; break;
+        case SCC_AST_OP_SUB:            op = SCC_HIR_OP_SUB; break;
+        case SCC_AST_OP_MUL:            op = SCC_HIR_OP_MUL; break;
+        case SCC_AST_OP_DIV:            op = SCC_HIR_OP_DIV; break;
+        case SCC_AST_OP_MOD:            op = SCC_HIR_OP_MOD; break;
+        case SCC_AST_OP_BITWISE_AND:    op = SCC_HIR_OP_AND; break;
+        case SCC_AST_OP_BITWISE_OR:     op = SCC_HIR_OP_OR;  break;
+        case SCC_AST_OP_BITWISE_XOR:    op = SCC_HIR_OP_XOR; break;
+        case SCC_AST_OP_LEFT_SHIFT:     op = SCC_HIR_OP_SHL; break;
+        case SCC_AST_OP_RIGHT_SHIFT:    {
+            scc_hir_module_t *module = scc_ast2ir_mir_module(ctx);
+            scc_hir_type_ref_t type_ref = scc_hir_module_get_value(module, lhs)->type;
+            scc_hir_type_t *type = scc_hir_module_get_type(module, type_ref);
+            op = scc_hir_type_is_signed(type->tag) ? SCC_HIR_OP_SAR : SCC_HIR_OP_SHR;
+            break;
+        }
+        case SCC_AST_OP_EQUAL:          op = SCC_HIR_OP_EQ;  break;
+        case SCC_AST_OP_NOT_EQUAL:      op = SCC_HIR_OP_NEQ; break;
+        case SCC_AST_OP_LESS: {
+            scc_hir_module_t *module = scc_ast2ir_mir_module(ctx);
+            scc_hir_type_ref_t tr = common_type ? common_type : scc_hir_module_get_value(module, lhs)->type;
+            scc_hir_type_t *t = scc_hir_module_get_type(module, tr);
+            op = scc_hir_type_is_signed(t->tag) ? SCC_HIR_OP_LT : SCC_HIR_OP_ULT;
+            break;
+        }
+        case SCC_AST_OP_LESS_EQUAL: {
+            scc_hir_module_t *module = scc_ast2ir_mir_module(ctx);
+            scc_hir_type_ref_t tr = common_type ? common_type : scc_hir_module_get_value(module, lhs)->type;
+            scc_hir_type_t *t = scc_hir_module_get_type(module, tr);
+            op = scc_hir_type_is_signed(t->tag) ? SCC_HIR_OP_LE : SCC_HIR_OP_ULE;
+            break;
+        }
+        case SCC_AST_OP_GREATER: {
+            scc_hir_module_t *module = scc_ast2ir_mir_module(ctx);
+            scc_hir_type_ref_t tr = common_type ? common_type : scc_hir_module_get_value(module, lhs)->type;
+            scc_hir_type_t *t = scc_hir_module_get_type(module, tr);
+            op = scc_hir_type_is_signed(t->tag) ? SCC_HIR_OP_GT : SCC_HIR_OP_UGT;
+            break;
+        }
+        case SCC_AST_OP_GREATER_EQUAL: {
+            scc_hir_module_t *module = scc_ast2ir_mir_module(ctx);
+            scc_hir_type_ref_t tr = common_type ? common_type : scc_hir_module_get_value(module, lhs)->type;
+            scc_hir_type_t *t = scc_hir_module_get_type(module, tr);
+            op = scc_hir_type_is_signed(t->tag) ? SCC_HIR_OP_GE : SCC_HIR_OP_UGE;
+            break;
+        }
+        case SCC_AST_OP_COMMA: {
+            // 逗号运算符：计算左表达式，丢弃结果，返回右表达式
+            return rhs;
+        }
+        /* 逻辑操作符 */
+        case SCC_AST_OP_LOGICAL_OR:  // ||
+        case SCC_AST_OP_LOGICAL_AND: // &&
+            UNREACHABLE();
+            return 0;
+        /* clang-format on */
+        default:
+            LOG_FATAL("Unsupported binary operator: %d", expr->binary.op);
+            return 0;
+        }
+        // 创建操作节点
+        return scc_hir_builder_binop(&ctx->builder, op, lhs, rhs);
+    } break;
+    case SCC_AST_EXPR_UNARY: {
+        if (expr->unary.op == SCC_AST_OP_ADDRESS_OF) {
+            return scc_ast2ir_expr(ctx, expr->unary.operand, true);
+        } else if (expr->unary.op == SCC_AST_OP_INDIRECTION) {
+            // 从地址取值
+            scc_hir_value_ref_t ptr =
+                scc_ast2ir_expr(ctx, expr->unary.operand, false);
+            if (is_lvalue) {
+                // 作为左值使用（如 *ptr = ...），直接返回指针值（地址）
+                return ptr;
+            } else {
+                // 作为右值使用（如 x = *ptr），加载指针指向的值
+                return scc_hir_builder_load(&ctx->builder, ptr);
+            }
+        }
+        scc_hir_value_ref_t operand =
+            scc_ast2ir_expr(ctx, expr->unary.operand, is_lvalue);
+        switch (expr->unary.op) {
+        case SCC_AST_OP_UNARY_PLUS:
+            /* just pass */
+            return operand;
+        case SCC_AST_OP_UNARY_MINUS: {
+            // 负号
+            // 实现为0 - operand
+            scc_hir_type_ref_t type_ref =
+                scc_hir_builder_type_i32(&ctx->builder);
+            scc_ap_t value;
+            scc_ap_set_int(&value, 0);
+            scc_hir_value_ref_t zero_ref =
+                scc_hir_builder_integer(&ctx->builder, type_ref, &value);
+            return scc_hir_builder_binop(&ctx->builder, SCC_HIR_OP_SUB,
+                                         zero_ref, operand);
+        }
+        case SCC_AST_OP_ADDRESS_OF:
+        case SCC_AST_OP_INDIRECTION:
+            UNREACHABLE();
+            break;
+        case SCC_AST_OP_BITWISE_NOT:
+            // 按位取反
+            return scc_hir_builder_binop(&ctx->builder, SCC_HIR_OP_NOT, operand,
+                                         0);
+        case SCC_AST_OP_LOGICAL_NOT: {
+            // 逻辑非
+            // 实现为与0比较
+            scc_hir_type_ref_t type_ref =
+                scc_hir_builder_type_i32(&ctx->builder);
+            scc_ap_t value;
+            scc_ap_set_int(&value, 0);
+            scc_hir_value_ref_t zero_ref =
+                scc_hir_builder_integer(&ctx->builder, type_ref, &value);
+            return scc_hir_builder_binop(&ctx->builder, SCC_HIR_OP_EQ, zero_ref,
+                                         operand);
+        }
+        case SCC_AST_OP_PREFIX_INCREMENT:
+        case SCC_AST_OP_PREFIX_DECREMENT: {
+            // 获取左值地址
+            scc_hir_value_ref_t addr =
+                scc_ast2ir_expr(ctx, expr->unary.operand, true);
+            scc_hir_value_ref_t old_val =
+                scc_hir_builder_load(&ctx->builder, addr);
+            scc_hir_type_ref_t old_type =
+                scc_hir_module_get_value(
+                    scc_hir_builder_get_module(&ctx->builder), old_val)
+                    ->type;
+
+            // 整数提升：C11 6.3.1.1，对 short/char 等类型提升为 int
+            scc_hir_type_ref_t promoted_type_ref =
+                scc_ast2ir_integer_promotion(ctx, old_type);
+            scc_hir_value_ref_t promoted = old_val;
+            if (promoted_type_ref != 0) {
+                promoted =
+                    scc_ast2ir_emit_conversion(ctx, old_val, promoted_type_ref);
+            } else {
+                promoted_type_ref = old_type;
+            }
+
+            scc_hir_value_ref_t one = scc_hir_builder_integer(
+                &ctx->builder, promoted_type_ref,
+                &(scc_ap_t){.data.digit = 1, .capacity = -1});
+            scc_hir_op_type_t op =
+                (expr->unary.op == SCC_AST_OP_PREFIX_INCREMENT)
+                    ? SCC_HIR_OP_ADD
+                    : SCC_HIR_OP_SUB;
+            scc_hir_value_ref_t new_val =
+                scc_hir_builder_binop(&ctx->builder, op, promoted, one);
+
+            // 如果原类型不是提升后的类型，需要截断回原类型再存储
+            scc_hir_value_ref_t stored_val = new_val;
+            if (promoted_type_ref != old_type) {
+                stored_val = scc_ast2ir_emit_conversion(ctx, new_val, old_type);
+            }
+            scc_hir_builder_store(&ctx->builder, addr, stored_val);
+            Assert(new_val != SCC_HIR_REF_nullptr);
+            return new_val; // 表达式的值是提升后的新值（符合 C 标准）
+        } break;
+        case SCC_AST_OP_POSTFIX_INCREMENT:
+        case SCC_AST_OP_POSTFIX_DECREMENT: {
+            // 获取左值地址
+            scc_hir_value_ref_t addr =
+                scc_ast2ir_expr(ctx, expr->unary.operand, true);
+            scc_hir_value_ref_t old_val =
+                scc_hir_builder_load(&ctx->builder, addr);
+            scc_hir_type_ref_t old_type =
+                scc_hir_module_get_value(
+                    scc_hir_builder_get_module(&ctx->builder), old_val)
+                    ->type;
+
+            // 整数提升（C11 6.3.1.1）
+            scc_hir_type_ref_t promoted_type_ref =
+                scc_ast2ir_integer_promotion(ctx, old_type);
+            scc_hir_value_ref_t promoted = old_val;
+            if (promoted_type_ref != 0) {
+                promoted =
+                    scc_ast2ir_emit_conversion(ctx, old_val, promoted_type_ref);
+            } else {
+                promoted_type_ref = old_type;
+            }
+
+            scc_hir_value_ref_t one = scc_hir_builder_integer(
+                &ctx->builder, promoted_type_ref,
+                &(scc_ap_t){.data.digit = 1, .capacity = -1});
+            scc_hir_op_type_t op =
+                (expr->unary.op == SCC_AST_OP_POSTFIX_INCREMENT)
+                    ? SCC_HIR_OP_ADD
+                    : SCC_HIR_OP_SUB;
+            scc_hir_value_ref_t new_val =
+                scc_hir_builder_binop(&ctx->builder, op, promoted, one);
+
+            scc_hir_value_ref_t stored_val = new_val;
+            if (promoted_type_ref != old_type) {
+                stored_val = scc_ast2ir_emit_conversion(ctx, new_val, old_type);
+            }
+            scc_hir_builder_store(&ctx->builder, addr, stored_val);
+
+            // 后缀返回旧值的提升后版本（C11 6.5.2.4）
+            return promoted;
+        } break;
+        default:
+            LOG_FATAL("Unsupported unary operator: %d", expr->unary.op);
+            return 0;
+        }
+        UNREACHABLE();
+    } break;
+    case SCC_AST_EXPR_COND: {
+        scc_hir_type_ref_t true_type = SCC_HIR_REF_nullptr;
+        scc_hir_type_ref_t false_type = SCC_HIR_REF_nullptr;
+
+        scc_hir_value_ref_t true_block =
+            scc_hir_builder_bblock(&ctx->builder, "cond_true");
+        scc_hir_value_ref_t false_block =
+            scc_hir_builder_bblock(&ctx->builder, "cond_false");
+        scc_hir_value_ref_t merge_block =
+            scc_hir_builder_bblock(&ctx->builder, "cond_merge");
+
+        scc_hir_value_ref_t cond_node =
+            scc_ast2ir_expr(ctx, expr->cond.cond, false);
+        scc_hir_builder_branch(&ctx->builder, cond_node, true_block,
+                               false_block);
+
+        // 生成true分支
+        scc_hir_builder_set_current_bblock(&ctx->builder, true_block);
+        scc_hir_value_ref_t true_val =
+            scc_ast2ir_expr(ctx, expr->cond.then_expr, false);
+
+        true_type = scc_hir_module_get_value(
+                        scc_hir_builder_get_module(&ctx->builder), true_val)
+                        ->type;
+        Assert(true_type != SCC_HIR_REF_nullptr);
+        scc_hir_value_ref_t result_slot =
+            scc_hir_builder_alloca(&ctx->builder, true_type, "cond_result");
+
+        scc_hir_builder_store(&ctx->builder, result_slot, true_val);
+        scc_hir_builder_jump(&ctx->builder, merge_block);
+
+        // 生成false分支
+        scc_hir_builder_set_current_bblock(&ctx->builder, false_block);
+        scc_hir_value_ref_t false_val =
+            scc_ast2ir_expr(ctx, expr->cond.else_expr, false);
+        false_type = scc_hir_module_get_value(
+                         scc_hir_builder_get_module(&ctx->builder), false_val)
+                         ->type;
+        Assert(false_type != SCC_HIR_REF_nullptr);
+
+        scc_hir_builder_store(&ctx->builder, result_slot, false_val);
+        scc_hir_builder_jump(&ctx->builder, merge_block);
+
+        //  合并并返回
+        scc_hir_builder_set_current_bblock(&ctx->builder, merge_block);
+        if (true_type != false_type) {
+            LOG_ERROR("Type mismatch in conditional expression");
+            // FIXME need panic
+        }
+        return scc_hir_builder_load(&ctx->builder, result_slot);
+    } break;
+    case SCC_AST_EXPR_CALL: {
+        // 转换参数
+        scc_hir_value_ref_vec_t args;
+        scc_vec_init(args);
+
+        // 获取函数类型信息用于参数转换。
+        scc_hir_func_ref_t callee_func =
+            (scc_hir_func_ref_t)(usize)scc_hashtable_get(
+                &ctx->symtab, expr->call.callee->identifier._target->name);
+        scc_hir_type_ref_t func_type_ref = SCC_HIR_REF_nullptr;
+        cbool is_variadic = false;
+        int fixed_count = 0;
+        Assert(callee_func != SCC_HIR_REF_nullptr);
+        scc_hir_func_t *hir_func =
+            scc_hir_module_get_func(scc_ast2ir_mir_module(ctx), callee_func);
+        scc_hir_func_meta_t *meta = SCC_HIR_FUNC_META(hir_func);
+        is_variadic = meta->is_variadic;
+        func_type_ref = meta->type;
+        if (func_type_ref != SCC_HIR_REF_nullptr) {
+            const scc_hir_type_t *ft = scc_hir_module_get_type(
+                scc_ast2ir_mir_module(ctx), func_type_ref);
+            if (ft != nullptr && ft->tag == SCC_HIR_TYPE_FUNC)
+                fixed_count = (int)ft->data.function.params.size;
+        }
+
+        scc_vec_foreach(expr->call.args, i) {
+            scc_ast_expr_t *arg_expr = scc_vec_at(expr->call.args, i);
+            scc_hir_value_ref_t arg_node;
+            arg_node = scc_ast2ir_expr(ctx, arg_expr, false);
+            if ((int)i < fixed_count) {
+                // 固定参数：转换为形参类型
+                // 每次迭代重新获取指针（scc_ast2ir_expr 可能触发 types 向量
+                // realloc）
+                scc_hir_module_t *module = scc_ast2ir_mir_module(ctx);
+                const scc_hir_type_t *ft =
+                    scc_hir_module_get_type(module, func_type_ref);
+                scc_hir_type_ref_t param_type =
+                    scc_vec_at(ft->data.function.params, i);
+                arg_node =
+                    scc_ast2ir_emit_conversion(ctx, arg_node, param_type);
+            } else if (is_variadic) {
+                // 可变参数：只应用默认参数提升（C11 6.5.2.2）
+                // 整数提升：char/short → int
+                scc_hir_module_t *module = scc_ast2ir_mir_module(ctx);
+
+                scc_hir_value_t *arg_value =
+                    scc_hir_module_get_value(module, arg_node);
+                Assert(arg_value != nullptr);
+                scc_hir_type_ref_t arg_type_ref = arg_value->type;
+                Assert(arg_type_ref != 0);
+                scc_hir_type_tag_t arg_tag =
+                    scc_hir_module_get_type(module, arg_type_ref)->tag;
+                scc_hir_type_ref_t promoted =
+                    scc_ast2ir_integer_promotion(ctx, arg_type_ref);
+                if (promoted != 0) {
+                    arg_node =
+                        scc_ast2ir_emit_conversion(ctx, arg_node, promoted);
+                } else if (arg_tag == SCC_HIR_TYPE_f32) {
+                    // float → double（默认参数提升）
+                    scc_hir_type_t f64_desc;
+                    scc_hir_type_init(&f64_desc, SCC_HIR_TYPE_f64);
+                    scc_hir_type_ref_t f64_ref =
+                        scc_hir_builder_type(&ctx->builder, &f64_desc);
+                    arg_node =
+                        scc_ast2ir_emit_conversion(ctx, arg_node, f64_ref);
+                }
+                // 指针、i32/i64 等保持不变
+            }
+            scc_vec_push(args, arg_node);
+        }
+
+        // 创建调用节点（需要查找函数定义）
+        if (!callee_func) {
+            LOG_ERROR("Function %s not found",
+                      expr->call.callee->identifier._target->name);
+        }
+        scc_hir_value_ref_t node = scc_hir_builder_call(
+            &ctx->builder, callee_func, args.data, args.size);
+        scc_vec_free(args);
+        return node;
+    }
+    case SCC_AST_EXPR_ARRAY_SUBSCRIPT: {
+        // 1. 计算数组/指针基址（右值，得到地址）
+        scc_hir_value_ref_t base_ptr =
+            scc_ast2ir_expr(ctx, expr->subscript.array, true);
+        // 2. 计算下标值
+        scc_hir_value_ref_t index =
+            scc_ast2ir_expr(ctx, expr->subscript.index, false);
+        // 保证 index 至少 64 位，防止后端寄存器分配时宽度错误
+        scc_hir_type_ref_t idx_type =
+            scc_hir_module_get_value(scc_ast2ir_mir_module(ctx), index)->type;
+        if (idx_type != SCC_CFG_ID_nullptr &&
+            scc_hir_module_type_size(scc_ast2ir_mir_module(ctx), idx_type) <
+                sizeof(void *) * 8) {
+            scc_hir_type_t ptrw_desc;
+            scc_hir_type_init(&ptrw_desc, SCC_HIR_TYPE_u64);
+            scc_hir_type_ref_t ptrw_ref =
+                scc_hir_builder_type(&ctx->builder, &ptrw_desc);
+            index = scc_ast2ir_emit_conversion(ctx, index, ptrw_ref);
+        }
+        // 3. 生成 getptr（GEP）
+        scc_hir_value_ref_t elem_ptr =
+            scc_hir_builder_get_elem_ptr(&ctx->builder, base_ptr, index);
+        // 4. 根据左值/右值返回
+        if (is_lvalue) {
+            return elem_ptr; // 作为左值：返回地址
+        } else {
+            return scc_hir_builder_load(&ctx->builder,
+                                        elem_ptr); // 作为右值：加载值
+        }
+    }
+    case SCC_AST_EXPR_MEMBER: {
+        // 1. 获取基对象的左值（地址）
+        scc_hir_value_ref_t base_ptr =
+            scc_ast2ir_expr(ctx, expr->member.base, true);
+        // 2. 通过偏移生成字段地址
+        //    需要基对象类型来计算索引：假设 sema 填好了 _target_idx
+        usize field_idx = expr->member._target_idx;
+        scc_ap_t idx_ap;
+        scc_ap_set_int(&idx_ap, field_idx);
+        scc_hir_value_ref_t idx_val = scc_hir_builder_integer(
+            &ctx->builder, scc_hir_builder_type_u64(&ctx->builder), &idx_ap);
+        scc_hir_value_ref_t field_ptr =
+            scc_hir_builder_get_elem_ptr(&ctx->builder, base_ptr, idx_val);
+        if (is_lvalue)
+            return field_ptr;
+        else
+            return scc_hir_builder_load(&ctx->builder, field_ptr);
+    }
+    case SCC_AST_EXPR_PTR_MEMBER: {
+        // 1. 计算指针值（obj->field 等价于 (*obj).field）
+        scc_hir_value_ref_t obj_ptr =
+            scc_ast2ir_expr(ctx, expr->member.base, false);
+        // 2. 解引用得到对象地址，再访问成员
+        //    但更简单：先 load 出对象值？不对：obj
+        //    是指向结构体的指针，我们需要指针的地址？ 实际上，obj->field 相当于
+        //    (*(obj)).field，所以可以直接用 obj 作为基地址进行 get_elem_ptr
+        //    因为 get_elem_ptr 接收一个指针，obj 本身就是指向结构体的指针。
+        usize field_idx = expr->member._target_idx;
+        scc_ap_t idx_ap;
+        scc_ap_set_int(&idx_ap, field_idx);
+        scc_hir_value_ref_t idx_val = scc_hir_builder_integer(
+            &ctx->builder, scc_hir_builder_type_u64(&ctx->builder), &idx_ap);
+        scc_hir_value_ref_t field_ptr =
+            scc_hir_builder_get_elem_ptr(&ctx->builder, obj_ptr, idx_val);
+        if (is_lvalue)
+            return field_ptr;
+        else
+            return scc_hir_builder_load(&ctx->builder, field_ptr);
+    }
+    case SCC_AST_EXPR_CAST: {
+        // 1. 转换操作数（右值）
+        scc_hir_value_ref_t operand =
+            scc_ast2ir_expr(ctx, expr->cast.expr, false);
+
+        // 2. 转换目标类型为 IR 类型
+        scc_hir_type_ref_t target_type = scc_ast2ir_type(ctx, expr->cast.type);
+
+        // 3. 确定转换模式（SEXT / ZEXT / TRUNC）
+        // 这里用简单的启发式：根据大小变化决定
+        scc_hir_type_t *src_type = scc_hir_module_get_type_by_value(
+            scc_ast2ir_mir_module(ctx), operand);
+        usize src_size =
+            scc_hir_module_type_size(scc_ast2ir_mir_module(ctx), operand);
+        usize dst_size =
+            scc_hir_module_type_size(scc_ast2ir_mir_module(ctx), target_type);
+
+        int conv_kind;
+        if (dst_size > src_size) {
+            // 目标更大，需要扩展。根据源类型有无符号决定符号扩展还是零扩展
+            conv_kind = scc_hir_type_is_signed(src_type->tag)
+                            ? SCC_HIR_CONV_SEXT
+                            : SCC_HIR_CONV_ZEXT;
+        } else if (dst_size < src_size) {
+            conv_kind = SCC_HIR_CONV_TRUNC;
+        } else {
+            // 同大小，可以视为 NOP 转换，或者直接返回操作数
+            return operand; // 或创建一个 CONV_SEXT 也没问题
+        }
+
+        // 4. 构造转换节点
+        scc_hir_value_t conv_node = {
+            .tag = SCC_HIR_VALUE_TAG_CONV,
+            .type = target_type,
+            .data.conv.operand = operand,
+            .data.conv.target_type = target_type,
+            .data.conv.conv_type = conv_kind,
+        };
+        return scc_hir_module_add_value(scc_ast2ir_mir_module(ctx), &conv_node);
+    }
+    case SCC_AST_EXPR_SIZE_OF: {
+        // 1. 将 sizeof 的操作数（类型或表达式）转换为 IR 类型
+        scc_hir_type_ref_t hir_type;
+        if (expr->attr_of.type) {
+            // sizeof(type)
+            hir_type = scc_ast2ir_type(ctx, expr->attr_of.type);
+        } else if (expr->attr_of.expr) {
+            // sizeof expression：计算表达式类型
+            // 注意：sizeof
+            // 不对表达式求值，只需类型，这里假设语义分析已经标注了类型
+            scc_hir_value_ref_t dummy =
+                scc_ast2ir_expr(ctx, expr->attr_of.expr, false);
+            hir_type =
+                scc_hir_module_get_value(scc_ast2ir_mir_module(ctx), dummy)
+                    ->type;
+        } else {
+            scc_ap_t val;
+            val.data.digit = 0;
+            LOG_ERROR("[ast2ir] unsupported");
+            return scc_hir_builder_integer(
+                &ctx->builder, scc_hir_builder_type_u64(&ctx->builder), &val);
+        }
+
+        // 2. 计算大小
+        usize dst_size =
+            scc_hir_module_type_size(scc_ast2ir_mir_module(ctx), hir_type);
+
+        scc_ap_t val;
+        val.data.digit = dst_size / 8;
+        return scc_hir_builder_integer(
+            &ctx->builder, scc_hir_builder_type_u64(&ctx->builder), &val);
+    }
+    case SCC_AST_EXPR_ALIGN_OF: {
+        TODO();
+        // return scc_hir_builder_integer(
+        //     &ctx->builder, scc_hir_builder_type_u64(&ctx->builder), val);
+    }
+    case SCC_AST_EXPR_COMPOUND: {
+        // 1. 从 base 子节点取得类型（base 一定是 SCC_AST_EXPR_LVALUE）
+        Assert(expr->compound.base != nullptr);
+        Assert(expr->compound.base->base.type == SCC_AST_EXPR_LVALUE);
+        scc_ast_qual_type_t *ast_type = expr->compound.base->lvalue.type;
+        scc_hir_type_ref_t type_ref = scc_ast2ir_type(ctx, ast_type);
+        const scc_hir_type_t *type =
+            scc_hir_module_get_type(scc_ast2ir_mir_module(ctx), type_ref);
+
+        // 2. 分配栈上临时存储
+        scc_hir_value_ref_t storage =
+            scc_hir_builder_alloca(&ctx->builder, type_ref, "compound_literal");
+
+        // 3. 根据类型调用对应的初始化函数
+        if (type->tag == SCC_HIR_TYPE_ARRAY) {
+            emit_array_initialization(ctx, storage, type, expr);
+        } else if (type->tag == SCC_HIR_TYPE_STRUCT ||
+                   type->tag == SCC_HIR_TYPE_UNION) {
+            emit_aggregate_initialization(ctx, storage, type, expr);
+        } else {
+            // 标量：取初始化列表的第一个值
+            Assert(expr->compound.rhs_exprs.size > 0);
+            scc_ast_expr_t *init_expr = scc_vec_at(expr->compound.rhs_exprs, 0);
+            scc_hir_value_ref_t val = scc_ast2ir_expr(ctx, init_expr, false);
+            scc_hir_builder_store(&ctx->builder, storage, val);
+        }
+
+        // 4. 根据左值 / 右值返回
+        if (is_lvalue) {
+            return storage; // 左值
+        } else {
+            // 右值：数组退化为首元素指针，结构体暂时返回地址
+            if (type->tag == SCC_HIR_TYPE_ARRAY) {
+                return scc_hir_builder_get_elem_ptr(&ctx->builder, storage,
+                                                    SCC_HIR_REF_nullptr);
+            } else if (type->tag == SCC_HIR_TYPE_STRUCT ||
+                       type->tag == SCC_HIR_TYPE_UNION) {
+                return storage; // 调用者会 memcpy
+            } else {
+                return scc_hir_builder_load(&ctx->builder, storage);
+            }
+        }
+    } break;
+    case SCC_AST_EXPR_LVALUE: {
+        UNREACHABLE(); // should only appear as compound.base
+    } break;
+    case SCC_AST_EXPR_BUILTIN: {
+        TODO();
+    } break;
+    case SCC_AST_EXPR_INT_LITERAL: {
+        // FIXME maybe using some array to int;
+        scc_hir_type_ref_t type_ref = scc_hir_builder_type_i32(&ctx->builder);
+        scc_ap_t value;
+        scc_ap_from_cstr(&value, expr->literal.lexme, 0);
+        return scc_hir_builder_integer(&ctx->builder, type_ref, &value);
+    }
+    // SCC_AST_EXPR_FLOAT_LITERAL,  // 浮点字面量
+    case SCC_AST_EXPR_CHAR_LITERAL: {
+        // FIXME just 'a' '\n'
+        const char *lexme = expr->literal.lexme;
+        Assert(lexme[0] == '\'');
+        i8 int_lit = 0;
+        if (lexme[1] == '\\') {
+            switch (lexme[2]) {
+            case 'a':
+                int_lit = '\a';
+                break;
+            case 'b':
+                int_lit = '\b';
+                break;
+            case 'f':
+                int_lit = '\f';
+                break;
+            case 'n':
+                int_lit = '\n';
+                break;
+            case 'r':
+                int_lit = '\r';
+            }
+        } else {
+            int_lit = lexme[1];
+        }
+        scc_ap_t value;
+        // FIXME i32 maybe false, we need i8 or u8
+        scc_hir_type_ref_t type_ref = scc_hir_builder_type_i32(&ctx->builder);
+        scc_ap_set_int(&value, int_lit);
+        return scc_hir_builder_integer(&ctx->builder, type_ref, &value);
+    }
+    case SCC_AST_EXPR_STRING_LITERAL: {
+        // const_string 返回指向常量区字符串的指针，左右值都返回此指针
+        scc_hir_value_ref_t value =
+            scc_hir_builder_const_string(&ctx->builder, expr->literal.lexme,
+                                         scc_strlen(expr->literal.lexme));
+        return value;
+    }
+    case SCC_AST_EXPR_IDENTIFIER: {
+        if (expr->identifier._target == nullptr) {
+            LOG_ERROR("unknown identifier %s", expr->identifier.name);
+        }
+        // FIXME hack hashtable
+        scc_hir_value_ref_t in = (scc_hir_value_ref_t)(usize)scc_hashtable_get(
+            &ctx->ast2ir_cache, expr->identifier._target);
+        Assert(in != 0);
+        if (is_lvalue) {
+            return in;
+        } else {
+            // 右值：如果是数组类型，退化为指针（返回地址）
+            scc_hir_type_t *ir_type = scc_hir_module_get_type_by_value(
+                scc_ast2ir_mir_module(ctx), in);
+            if (ir_type->tag == SCC_HIR_TYPE_PTR) {
+                scc_hir_type_t *target_type = scc_hir_module_get_type(
+                    scc_ast2ir_mir_module(ctx), ir_type->data.pointer.base);
+                if (target_type->tag == SCC_HIR_TYPE_ARRAY) {
+                    // 生成 getptr 获取数组首地址
+                    return scc_hir_builder_get_elem_ptr(&ctx->builder, in,
+                                                        SCC_HIR_REF_nullptr);
+                } else {
+                    // 标量类型：加载值
+                    return scc_hir_builder_load(&ctx->builder, in);
+                }
+            } else {
+                return in;
+            }
+        }
+    }
+
+    default:
+        LOG_FATAL("Unsupported expression type: %d", expr->base.type);
+        return 0;
+    }
+    UNREACHABLE();
+}

libs/ast2ir/src/scc_ast2ir_promote.c

@@ -179,8 +179,9 @@ scc_hir_type_ref_t scc_ast2ir_integer_promotion(scc_ast2ir_ctx_t *ctx,
  *    d. 如果有符号类型可以表示无符号类型的所有值，无符号转换为有符号
  *    e. 否则，两个都转换为有符号类型的无符号版本
  */
-scc_hir_type_ref_t scc_ast2ir_usual_arithmetic_conversion(
-    scc_ast2ir_ctx_t *ctx, scc_hir_type_ref_t t1_ref,
+scc_hir_type_ref_t
+scc_ast2ir_usual_arithmetic_conversion(scc_ast2ir_ctx_t *ctx,
+                                       scc_hir_type_ref_t t1_ref,
                                        scc_hir_type_ref_t t2_ref) {
     scc_hir_module_t *module = scc_ast2ir_mir_module(ctx);
     scc_hir_type_t *t1 = scc_hir_module_get_type(module, t1_ref);
@@ -200,13 +201,9 @@ scc_hir_type_ref_t scc_ast2ir_usual_arithmetic_conversion(
     scc_hir_type_ref_t p2_ref = scc_ast2ir_integer_promotion(ctx, t2_ref);
 
     scc_hir_type_tag_t tag1 =
-        (p1_ref != 0)
-            ? scc_hir_module_get_type(module, p1_ref)->tag
-            : t1->tag;
+        (p1_ref != 0) ? scc_hir_module_get_type(module, p1_ref)->tag : t1->tag;
     scc_hir_type_tag_t tag2 =
-        (p2_ref != 0)
-            ? scc_hir_module_get_type(module, p2_ref)->tag
-            : t2->tag;
+        (p2_ref != 0) ? scc_hir_module_get_type(module, p2_ref)->tag : t2->tag;
 
     // 如果提升后相同，直接返回
     if (tag1 == tag2)
@@ -252,6 +249,7 @@ scc_hir_type_ref_t scc_ast2ir_usual_arithmetic_conversion(
  * - 返回 -1 表示无需转换（同类型同大小）
  */
 static int determine_conv_kind(scc_hir_type_tag_t src, scc_hir_type_tag_t dst) {
+    Assert(SCC_HIR_TYPE_VALID(src) && SCC_HIR_TYPE_VALID(dst));
     if (src == dst)
         return -1;
 
@@ -302,10 +300,8 @@ scc_hir_value_ref_t scc_ast2ir_emit_conversion(scc_ast2ir_ctx_t *ctx,
                                                scc_hir_value_ref_t value,
                                                scc_hir_type_ref_t target_type) {
     scc_hir_module_t *module = scc_ast2ir_mir_module(ctx);
-    scc_hir_type_t *src_type =
-        scc_hir_module_get_type_by_value(module, value);
-    scc_hir_type_t *dst_type =
-        scc_hir_module_get_type(module, target_type);
+    scc_hir_type_t *src_type = scc_hir_module_get_type_by_value(module, value);
+    scc_hir_type_t *dst_type = scc_hir_module_get_type(module, target_type);
 
     if (src_type == nullptr || dst_type == nullptr)
         return value;

libs/ast2ir/src/scc_ast2ir_type.c

@@ -0,0 +1,106 @@
+#include <scc_ast2ir.h>
+
+static int ast_base_type_size(const scc_type_abi_t *abi,
+                               scc_ast_builtin_type_t bt) {
+    switch (bt) {
+    case SCC_AST_BUILTIN_TYPE_VOID:
+        return 0;
+    case SCC_AST_BUILTIN_TYPE_VA_LIST:
+        return abi->va_list_size;
+    case SCC_AST_BUILTIN_TYPE_BOOL:
+        return 1;
+    case SCC_AST_BUILTIN_TYPE_CHAR:
+    case SCC_AST_BUILTIN_TYPE_SIGNED_CHAR:
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_CHAR:
+        return abi->char_size;
+    case SCC_AST_BUILTIN_TYPE_SHORT:
+    case SCC_AST_BUILTIN_TYPE_SIGNED_SHORT:
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_SHORT:
+        return abi->short_size;
+    case SCC_AST_BUILTIN_TYPE_INT:
+    case SCC_AST_BUILTIN_TYPE_SIGNED_INT:
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_INT:
+        return abi->int_size;
+    case SCC_AST_BUILTIN_TYPE_LONG:
+    case SCC_AST_BUILTIN_TYPE_SIGNED_LONG:
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_LONG:
+        return abi->long_size;
+    case SCC_AST_BUILTIN_TYPE_LONG_LONG:
+    case SCC_AST_BUILTIN_TYPE_SIGNED_LONG_LONG:
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_LONG_LONG:
+        return abi->long_long_size;
+    case SCC_AST_BUILTIN_TYPE_FLOAT:
+        return abi->float_size;
+    case SCC_AST_BUILTIN_TYPE_DOUBLE:
+        return abi->double_size;
+    case SCC_AST_BUILTIN_TYPE_LONG_DOUBLE:
+        return abi->long_double_size;
+    default:
+        Panic("Unsupported AST builtin type: %d", bt);
+        return 0;
+    }
+}
+
+static cbool is_signed_builtin(scc_ast_builtin_type_t bt) {
+    switch (bt) {
+    case SCC_AST_BUILTIN_TYPE_BOOL:
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_CHAR:
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_SHORT:
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_INT:
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_LONG:
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_LONG_LONG:
+        return false;
+    default:
+        return true;
+    }
+}
+
+scc_hir_type_ref_t
+scc_ast2ir_parse_base_type(scc_ast2ir_ctx_t *ctx,
+                           const scc_ast_qual_type_t *ast_type) {
+    scc_ast_builtin_type_t bt = scc_ast_canon_type(ast_type)->builtin.type;
+    int size = ast_base_type_size(ctx->type_abi, bt);
+
+    if (bt == SCC_AST_BUILTIN_TYPE_VOID ||
+        bt == SCC_AST_BUILTIN_TYPE_VA_LIST) {
+        return scc_hir_builder_type_void(&ctx->builder);
+    }
+
+    cbool is_signed = is_signed_builtin(bt);
+
+    // 浮点类型
+    switch (bt) {
+    case SCC_AST_BUILTIN_TYPE_FLOAT:
+    case SCC_AST_BUILTIN_TYPE_DOUBLE:
+    case SCC_AST_BUILTIN_TYPE_LONG_DOUBLE:
+        switch (size) {
+        case 4:
+            return scc_hir_builder_type_f32(&ctx->builder);
+        case 8:
+            return scc_hir_builder_type_f64(&ctx->builder);
+        default:
+            Panic("Unsupported float size: %d", size);
+        }
+    default:
+        break;
+    }
+
+    // 整数类型
+    switch (size) {
+    case 1:
+        return is_signed ? scc_hir_builder_type_i8(&ctx->builder)
+                         : scc_hir_builder_type_u8(&ctx->builder);
+    case 2:
+        return is_signed ? scc_hir_builder_type_i16(&ctx->builder)
+                         : scc_hir_builder_type_u16(&ctx->builder);
+    case 4:
+        return is_signed ? scc_hir_builder_type_i32(&ctx->builder)
+                         : scc_hir_builder_type_u32(&ctx->builder);
+    case 8:
+        return is_signed ? scc_hir_builder_type_i64(&ctx->builder)
+                         : scc_hir_builder_type_u64(&ctx->builder);
+    default:
+        Panic("Unsupported integer size: %d", size);
+        return SCC_HIR_REF_nullptr;
+    }
+}

libs/ast2ir/src/scc_ast2ir_utils.c

@@ -0,0 +1,102 @@
+#include <scc_ast2ir.h>
+
+// 辅助函数：生成数组初始化代码
+void emit_array_initialization(scc_ast2ir_ctx_t *ctx,
+                               scc_hir_value_ref_t array_ptr,
+                               const scc_hir_type_t *array_type,
+                               const scc_ast_expr_t *init_expr) {
+    Assert(array_type->tag == SCC_HIR_TYPE_ARRAY);
+    scc_hir_type_ref_t elem_type_ref = array_type->data.array.base;
+    const scc_hir_type_t *elem_type =
+        scc_hir_module_get_type(scc_ast2ir_mir_module(ctx), elem_type_ref);
+    usize array_len = array_type->data.array.len;
+
+    // 字符串字面量初始化：直接 memcpy
+    if (init_expr->base.type == SCC_AST_EXPR_STRING_LITERAL) {
+        scc_hir_value_ref_t str_val = scc_ast2ir_expr(ctx, init_expr, false);
+        scc_ap_t len_ap;
+        scc_ap_set_int(&len_ap, array_len);
+        scc_hir_value_ref_t len_ref = scc_hir_builder_integer(
+            &ctx->builder, scc_hir_builder_type_u64(&ctx->builder), &len_ap);
+        scc_hir_builder_builtin_memcpy(&ctx->builder, array_ptr, str_val,
+                                       len_ref);
+        return;
+    }
+
+    // 复合初始化：逐个元素 store
+    if (init_expr->base.type != SCC_AST_EXPR_COMPOUND) {
+        Panic("unsupported initializer for array");
+    }
+
+    // 遍历初始化列表
+    usize idx = 0;
+    scc_vec_foreach(init_expr->compound.rhs_exprs, i) {
+        scc_ast_expr_t *elem_expr =
+            scc_vec_at(init_expr->compound.rhs_exprs, i);
+        Assert(elem_expr != nullptr);
+        if (idx >= array_len)
+            break; // 防止溢出
+
+        // 生成元素地址：array_ptr + idx * elem_size
+        scc_ap_t offset_ap;
+        scc_ap_set_int(&offset_ap, idx);
+        scc_hir_value_ref_t idx_val = scc_hir_builder_integer(
+            &ctx->builder, scc_hir_builder_type_u64(&ctx->builder), &offset_ap);
+        scc_hir_value_ref_t elem_ptr =
+            scc_hir_builder_get_elem_ptr(&ctx->builder, array_ptr, idx_val);
+
+        // 递归处理：如果元素本身是数组且初始化表达式是复合初始化，需要嵌套处理
+        if (elem_type->tag == SCC_HIR_TYPE_ARRAY &&
+            elem_expr->base.type == SCC_AST_EXPR_COMPOUND) {
+            // 递归调用自身，但注意 elem_ptr 已经是子数组的首地址
+            emit_array_initialization(ctx, elem_ptr, elem_type, elem_expr);
+        } else {
+            // 标量元素：计算右值并 store
+            scc_hir_value_ref_t val = scc_ast2ir_expr(ctx, elem_expr, false);
+            scc_hir_builder_store(&ctx->builder, elem_ptr, val);
+        }
+        idx++;
+    }
+    // 如果初始化列表元素少于数组长度，剩余元素默认零初始化（C 标准要求）
+    // 这里简单忽略，实际可生成 memset 循环，但为简化暂不处理
+}
+
+void emit_aggregate_initialization(scc_ast2ir_ctx_t *ctx,
+                                   scc_hir_value_ref_t base_ptr,
+                                   const scc_hir_type_t *type,
+                                   const scc_ast_expr_t *init_expr) {
+    Assert(type->tag == SCC_HIR_TYPE_STRUCT || type->tag == SCC_HIR_TYPE_UNION);
+    if (init_expr->base.type != SCC_AST_EXPR_COMPOUND) {
+        Panic("expected compound initializer");
+    }
+    usize idx = 0;
+    scc_vec_foreach(init_expr->compound.rhs_exprs, i) {
+        if (idx >= type->data.aggregate.fields.size)
+            break;
+        scc_ast_expr_t *field_init =
+            scc_vec_at(init_expr->compound.rhs_exprs, i);
+        scc_hir_type_ref_t field_type_ref =
+            scc_vec_at(type->data.aggregate.fields, idx);
+        const scc_hir_type_t *field_type =
+            scc_hir_module_get_type(scc_ast2ir_mir_module(ctx), field_type_ref);
+
+        scc_ap_t idx_ap;
+        scc_ap_set_int(&idx_ap, idx);
+        scc_hir_value_ref_t idx_val = scc_hir_builder_integer(
+            &ctx->builder, scc_hir_builder_type_u64(&ctx->builder), &idx_ap);
+        scc_hir_value_ref_t field_ptr =
+            scc_hir_builder_get_elem_ptr(&ctx->builder, base_ptr, idx_val);
+
+        if (field_type->tag == SCC_HIR_TYPE_ARRAY) {
+            emit_array_initialization(ctx, field_ptr, field_type, field_init);
+        } else if (field_type->tag == SCC_HIR_TYPE_STRUCT ||
+                   field_type->tag == SCC_HIR_TYPE_UNION) {
+            emit_aggregate_initialization(ctx, field_ptr, field_type,
+                                          field_init);
+        } else {
+            scc_hir_value_ref_t val = scc_ast2ir_expr(ctx, field_init, false);
+            scc_hir_builder_store(&ctx->builder, field_ptr, val);
+        }
+        idx++;
+    }
+}

libs/ir/cfg/src/scc_cfg.c

@@ -75,7 +75,7 @@ scc_cfg_module_unsafe_get_symbol(const scc_cfg_module_t *module,
     if (id == SCC_CFG_ID_nullptr) {
         Panic("nullptr symbol id");
     }
-    if (id >= scc_vec_size(module->bblocks)) {
+    if (id >= scc_vec_size(module->symbols)) {
         Panic("invalid symbol id");
     }
     return &scc_vec_at(module->symbols, id);
@@ -88,17 +88,29 @@ scc_cfg_symbol_id_t scc_cfg_module_lookup_symbol(const scc_cfg_module_t *module,
 }
 
 void scc_cfg_bblock_add_pred(scc_cfg_bblock_t *bb,
-                             scc_cfg_bblock_id_t pred_id) {}
+                             scc_cfg_bblock_id_t pred_id) {
+    (void)bb;
+    (void)pred_id;
+}
 
 void scc_cfg_bblock_remove_pred(scc_cfg_bblock_t *bb,
-                                scc_cfg_bblock_id_t pred_id) {}
+                                scc_cfg_bblock_id_t pred_id) {
+    (void)bb;
+    (void)pred_id;
+}
 
-void scc_cfg_bblock_clear_pred(scc_cfg_bblock_t *bb) {}
+void scc_cfg_bblock_clear_pred(scc_cfg_bblock_t *bb) { (void)bb; }
 
 void scc_cfg_bblock_add_succ(scc_cfg_bblock_t *bb,
-                             scc_cfg_bblock_id_t succ_id) {}
+                             scc_cfg_bblock_id_t succ_id) {
+    (void)bb;
+    (void)succ_id;
+}
 
 void scc_cfg_bblock_remove_succ(scc_cfg_bblock_t *bb,
-                                scc_cfg_bblock_id_t succ_id) {}
+                                scc_cfg_bblock_id_t succ_id) {
+    (void)bb;
+    (void)succ_id;
+}
 
-void scc_cfg_bblock_clear_succs(scc_cfg_bblock_t *bb) {}
+void scc_cfg_bblock_clear_succs(scc_cfg_bblock_t *bb) { (void)bb; }

libs/ir/hir/cbuild.toml

@@ -8,6 +8,7 @@ dependencies = [
     { name = "scc_cfg", path = "../cfg" },
     { name = "scc_utils", path = "../../../runtime/scc_utils" },
     { name = "tree_dump", path = "../../tree_dump" },
+    { name = "type_abi", path = "../../target/type_abi" },
 ]
 # dependencies = []
 # features = {}

libs/ir/hir/include/scc_hir_def.h

@@ -48,7 +48,9 @@ typedef enum scc_hir_type_tag {
     SCC_HIR_TYPE_STRUCT,
     SCC_HIR_TYPE_UNION,
     SCC_HIR_TYPE_VECTOR, // TODO SIMD
+    SCC_HIR_TYPE_COUNT,
 } scc_hir_type_tag_t;
+#define SCC_HIR_TYPE_VALID(tag) ((tag) < SCC_HIR_TYPE_COUNT && (tag) >= 0)
 
 struct scc_hir_type {
     scc_hir_type_tag_t tag;
@@ -134,6 +136,14 @@ typedef enum {
     SCC_HIR_OP_SHR,
     /// Shift right arithmetic.
     SCC_HIR_OP_SAR,
+    /// Unsigned greater than.
+    SCC_HIR_OP_UGT,
+    /// Unsigned less than.
+    SCC_HIR_OP_ULT,
+    /// Unsigned greater than or equal to.
+    SCC_HIR_OP_UGE,
+    /// Unsigned less than or equal to.
+    SCC_HIR_OP_ULE,
 } scc_hir_op_type_t;
 
 typedef enum {

libs/ir/hir/include/scc_hir_layout.h

@@ -0,0 +1,39 @@
+#ifndef __SCC_HIR_LAYOUT_H__
+#define __SCC_HIR_LAYOUT_H__
+
+#include "scc_hir_module.h"
+#include <scc_type_abi.h>
+
+#define SCC_ALIGN_UP(x, align) (((x) + (align) - 1) & ~((align) - 1))
+
+/// 结构体/联合体字段布局
+typedef struct scc_hir_field_layout {
+    int offset;
+    int size;
+    int align;
+} scc_hir_field_layout_t;
+
+/// 聚合体布局结果 (FLEX)
+typedef struct scc_hir_aggregate_layout {
+    int size;
+    int align;
+    int field_count;
+    scc_hir_field_layout_t fields[];
+} scc_hir_aggregate_layout_t;
+
+int scc_hir_type_size(scc_hir_module_t *mod, scc_hir_type_ref_t type,
+                      const scc_type_abi_t *abi);
+
+int scc_hir_type_align(scc_hir_module_t *mod, scc_hir_type_ref_t type,
+                       const scc_type_abi_t *abi);
+
+int scc_hir_field_offset(scc_hir_module_t *mod, scc_hir_type_ref_t type,
+                         int field_idx, const scc_type_abi_t *abi);
+
+scc_hir_aggregate_layout_t *scc_hir_aggregate_layout(scc_hir_module_t *mod,
+                                                     scc_hir_type_ref_t type,
+                                                     const scc_type_abi_t *abi);
+
+void scc_hir_aggregate_layout_free(scc_hir_aggregate_layout_t *layout);
+
+#endif /* __SCC_HIR_LAYOUT_H__ */

libs/ir/hir/include/scc_hir_module.h

@@ -4,9 +4,11 @@
 #include "scc_hir_def.h"
 #include <scc_cfg.h>
 #include <scc_hashtable.h>
+#include <scc_type_abi.h>
 
 typedef struct {
     scc_cfg_module_t cfg_module;
+    const scc_type_abi_t *abi;
 
     scc_cfg_id_t value_uid;
     scc_cfg_id_t type_uid;
@@ -20,7 +22,7 @@ typedef struct {
     SCC_VEC(scc_hir_func_meta_t *) funcs_meta;
 } scc_hir_module_t;
 
-void scc_hir_module_init(scc_hir_module_t *ctx);
+void scc_hir_module_init(scc_hir_module_t *ctx, const scc_type_abi_t *abi);
 void scc_hir_module_drop(scc_hir_module_t *ctx);
 scc_hir_type_ref_t scc_hir_module_add_type(scc_hir_module_t *ctx,
                                            const scc_hir_type_t *type);
@@ -38,7 +40,7 @@ scc_hir_bblock_t *scc_hir_module_get_bblock(scc_hir_module_t *ctx,
                                             scc_hir_bblock_ref_t ref);
 scc_hir_func_t *scc_hir_module_get_func(scc_hir_module_t *ctx,
                                         scc_hir_func_ref_t ref);
-usize scc_hir_module_type_size(scc_hir_module_t *ctx, scc_hir_type_t *type);
+usize scc_hir_module_type_size(scc_hir_module_t *ctx, scc_hir_type_ref_t ref);
 
 static inline scc_hir_type_t *
 scc_hir_module_get_type_by_value(scc_hir_module_t *ctx,

libs/ir/hir/include/scc_hir_prog.h

@@ -1,7 +1,6 @@
 #ifndef __SCC_HIR_PROG_H__
 #define __SCC_HIR_PROG_H__
 
-#include "scc_hir_def.h"
 #include "scc_hir_module.h"
 
 typedef struct scc_hir_cprog {
@@ -11,7 +10,7 @@ typedef struct scc_hir_cprog {
     scc_hir_func_ref_vec_t func_decls;   /* 所有函数包括定义的声明 */
 } scc_hir_cprog_t;
 
-void scc_hir_cprog_init(scc_hir_cprog_t *in);
+void scc_hir_cprog_init(scc_hir_cprog_t *in, const scc_type_abi_t *abi);
 void scc_hir_cprog_drop(scc_hir_cprog_t *in);
 
 #endif /* __SCC_HIR_PROG_H__ */

libs/ir/hir/src/scc_hir_builder.c

@@ -285,21 +285,7 @@ scc_hir_type_ref_t scc_hir_builder_type(scc_hir_builder_t *builder,
 scc_hir_value_ref_t scc_hir_builder_const_string(scc_hir_builder_t *builder,
                                                  const char *str, usize len) {
     SCC_HIR_BUILDER_CHECK_NO_BORROW(builder);
-    scc_hir_type_ref_t u8_type = scc_hir_builder_type_u8(builder);
-    scc_hir_type_t array_type = {
-        .tag = SCC_HIR_TYPE_ARRAY,
-        .data.array.base = u8_type,
-        .data.array.len = len - 1, // 包含 nullptr 结尾
-    };
-    scc_hir_type_ref_t array_type_ref =
-        scc_hir_builder_type(builder, &array_type);
 
-    // 5. 创建聚合节点
-    scc_hir_value_t const_array_value = {
-        .tag = SCC_HIR_VALUE_TAG_ARRAY,
-        .type = array_type_ref,
-        .data.const_array.base_type = u8_type,
-    };
     scc_str_t buf;
     scc_str_init(&buf);
     // FIXME content to real string
@@ -334,6 +320,9 @@ scc_hir_value_ref_t scc_hir_builder_const_string(scc_hir_builder_t *builder,
                 case '"':
                     scc_str_append_ch(&buf, '"');
                     break;
+                case '0':
+                    scc_str_append_ch(&buf, '\0');
+                    break;
                 default:
                     LOG_WARN("Unknown escape sequence: \\%c", str[i]);
                     scc_str_append_ch(&buf, str[i]);
@@ -345,8 +334,23 @@ scc_hir_value_ref_t scc_hir_builder_const_string(scc_hir_builder_t *builder,
             }
         }
     }
-    scc_str_append_ch(&buf, '\0');
-    usize buf_len = scc_str_len(&buf);
+    usize buf_len = scc_str_len(&buf) + 1;
+
+    scc_hir_type_ref_t u8_type = scc_hir_builder_type_u8(builder);
+    scc_hir_type_t array_type = {
+        .tag = SCC_HIR_TYPE_ARRAY,
+        .data.array.base = u8_type,
+        .data.array.len = buf_len, // 包含 '\0' 结尾
+    };
+
+    scc_hir_type_ref_t array_type_ref =
+        scc_hir_builder_type(builder, &array_type);
+    scc_hir_value_t const_array_value = {
+        .tag = SCC_HIR_VALUE_TAG_ARRAY,
+        .type = array_type_ref,
+        .data.const_array.base_type = u8_type,
+    };
+
     scc_vec_unsafe_from_buffer(const_array_value.data.const_array.fields,
                                (u8 *)scc_str_move_cstr(&buf), buf_len);
     scc_hir_value_ref_t const_array_ref =

libs/ir/hir/src/scc_hir_dump.c

@@ -49,7 +49,9 @@ static const char *get_op_str(scc_hir_op_type_t op) {
         [SCC_HIR_OP_AND] = "&",       [SCC_HIR_OP_OR] = "|",
         [SCC_HIR_OP_XOR] = "^",       [SCC_HIR_OP_NOT] = "~",
         [SCC_HIR_OP_SHL] = "<<",      [SCC_HIR_OP_SHR] = ">>",
-        [SCC_HIR_OP_SAR] = ">>a",
+        [SCC_HIR_OP_SAR] = ">>a",     [SCC_HIR_OP_ULT] = "u<",
+        [SCC_HIR_OP_ULE] = "u<=",     [SCC_HIR_OP_UGT] = "u>",
+        [SCC_HIR_OP_UGE] = "u>=",
     };
     if (op >= 0 && (usize)op < sizeof(ops) / sizeof(ops[0]) && ops[op])
         return ops[op];
@@ -325,7 +327,11 @@ void scc_hir_dump_value_linear(scc_hir_dump_t *ctx,
     case SCC_HIR_VALUE_TAG_GLOBAL_ALLOC:
         scc_tree_dump_append_fmt(ctx->dump_ctx, "global %s", value->name);
         scc_tree_dump_begin_line(ctx->dump_ctx);
+        if (value->data.global_alloc.value) {
             scc_hir_dump_value_linear(ctx, value->data.global_alloc.value);
+        } else {
+            scc_tree_dump_append(ctx->dump_ctx, "<zero initializer>");
+        }
         break;
     case SCC_HIR_VALUE_TAG_ARRAY:
         scc_tree_dump_append(ctx->dump_ctx, "const_array ");

libs/ir/hir/src/scc_hir_layout.c

@@ -0,0 +1,249 @@
+#include <scc_hir_layout.h>
+
+int scc_hir_type_align(scc_hir_module_t *mod, scc_hir_type_ref_t ref,
+                       const scc_type_abi_t *abi) {
+    scc_hir_type_t *type = scc_hir_module_get_type(mod, ref);
+    if (!type)
+        return 0;
+
+    switch (type->tag) {
+    case SCC_HIR_TYPE_void:
+    case SCC_HIR_TYPE_FUNC:
+    case SCC_HIR_TYPE_unknown:
+        return 1; // void/func 不占空间, 对齐为 1
+
+    case SCC_HIR_TYPE_i8:
+    case SCC_HIR_TYPE_u8:
+        return scc_type_abi_get_type_align(abi, 1) * 8;
+    case SCC_HIR_TYPE_i16:
+    case SCC_HIR_TYPE_u16:
+    case SCC_HIR_TYPE_f16:
+        return scc_type_abi_get_type_align(abi, 2) * 8;
+    case SCC_HIR_TYPE_i32:
+    case SCC_HIR_TYPE_u32:
+    case SCC_HIR_TYPE_f32:
+        return scc_type_abi_get_type_align(abi, 4) * 8;
+    case SCC_HIR_TYPE_i64:
+    case SCC_HIR_TYPE_u64:
+    case SCC_HIR_TYPE_f64:
+        return scc_type_abi_get_type_align(abi, 8) * 8;
+    case SCC_HIR_TYPE_i128:
+    case SCC_HIR_TYPE_u128:
+    case SCC_HIR_TYPE_f128:
+        return scc_type_abi_get_type_align(abi, 16) * 8;
+
+    case SCC_HIR_TYPE_PTR:
+        return abi->ptr_align * 8;
+
+    case SCC_HIR_TYPE_ARRAY: {
+        return scc_hir_type_align(mod, type->data.array.base, abi);
+    }
+
+    case SCC_HIR_TYPE_STRUCT: {
+        int max_align_bits = 0;
+        for (usize i = 0; i < scc_vec_size(type->data.aggregate.fields); i++) {
+            scc_hir_type_ref_t fr = scc_vec_at(type->data.aggregate.fields, i);
+            int fa_bits = scc_hir_type_align(mod, fr, abi);
+            int fs_bits = scc_hir_type_size(mod, fr, abi);
+            int fa2_bits = scc_type_abi_get_field_align(abi, fs_bits / 8, fa_bits / 8) * 8;
+            if (fa2_bits > max_align_bits)
+                max_align_bits = fa2_bits;
+        }
+        return scc_type_abi_get_aggregate_align(abi, max_align_bits / 8) * 8;
+    }
+
+    case SCC_HIR_TYPE_UNION: {
+        int max_align_bits = 0;
+        for (usize i = 0; i < scc_vec_size(type->data.aggregate.fields); i++) {
+            scc_hir_type_ref_t fr = scc_vec_at(type->data.aggregate.fields, i);
+            int fs_bits = scc_hir_type_size(mod, fr, abi);
+            int fa_bits = scc_hir_type_align(mod, fr, abi);
+            (void)fs_bits;
+            if (fa_bits > max_align_bits)
+                max_align_bits = fa_bits;
+        }
+        return scc_type_abi_get_aggregate_align(abi, max_align_bits / 8) * 8;
+    }
+
+    default:
+        return 1;
+    }
+}
+
+int scc_hir_type_size(scc_hir_module_t *mod, scc_hir_type_ref_t ref,
+                      const scc_type_abi_t *abi) {
+    scc_hir_type_t *type = scc_hir_module_get_type(mod, ref);
+    if (!type)
+        return 0;
+
+    switch (type->tag) {
+    case SCC_HIR_TYPE_void:
+    case SCC_HIR_TYPE_FUNC:
+    case SCC_HIR_TYPE_unknown:
+        return 0;
+
+    case SCC_HIR_TYPE_i8:
+    case SCC_HIR_TYPE_u8:
+        return 8;
+    case SCC_HIR_TYPE_i16:
+    case SCC_HIR_TYPE_u16:
+    case SCC_HIR_TYPE_f16:
+        return 16;
+    case SCC_HIR_TYPE_i32:
+    case SCC_HIR_TYPE_u32:
+    case SCC_HIR_TYPE_f32:
+        return 32;
+    case SCC_HIR_TYPE_i64:
+    case SCC_HIR_TYPE_u64:
+    case SCC_HIR_TYPE_f64:
+        return 64;
+    case SCC_HIR_TYPE_i128:
+    case SCC_HIR_TYPE_u128:
+    case SCC_HIR_TYPE_f128:
+        return 128;
+
+    case SCC_HIR_TYPE_PTR:
+        return abi->ptr_size * 8;
+
+    case SCC_HIR_TYPE_ARRAY: {
+        int es_bits = scc_hir_type_size(mod, type->data.array.base, abi);
+        return es_bits * (int)type->data.array.len;
+    }
+
+    case SCC_HIR_TYPE_STRUCT: {
+        int offset_bits = 0, max_align_bits = 0;
+        for (usize i = 0; i < scc_vec_size(type->data.aggregate.fields); i++) {
+            scc_hir_type_ref_t fr = scc_vec_at(type->data.aggregate.fields, i);
+            int fs_bits = scc_hir_type_size(mod, fr, abi);
+            int fa_bits = scc_hir_type_align(mod, fr, abi);
+            int fa2_bits = scc_type_abi_get_field_align(abi, fs_bits / 8, fa_bits / 8) * 8;
+            offset_bits = SCC_ALIGN_UP(offset_bits, fa2_bits);
+            offset_bits += fs_bits;
+            if (fa2_bits > max_align_bits)
+                max_align_bits = fa2_bits;
+        }
+        return SCC_ALIGN_UP(offset_bits,
+                            scc_type_abi_get_aggregate_align(abi, max_align_bits / 8) * 8);
+    }
+
+    case SCC_HIR_TYPE_UNION: {
+        int max_size_bits = 0, max_align_bits = 0;
+        for (usize i = 0; i < scc_vec_size(type->data.aggregate.fields); i++) {
+            scc_hir_type_ref_t fr = scc_vec_at(type->data.aggregate.fields, i);
+            int fs_bits = scc_hir_type_size(mod, fr, abi);
+            int fa_bits = scc_hir_type_align(mod, fr, abi);
+            if (fs_bits > max_size_bits)
+                max_size_bits = fs_bits;
+            if (fa_bits > max_align_bits)
+                max_align_bits = fa_bits;
+        }
+        return SCC_ALIGN_UP(max_size_bits,
+                            scc_type_abi_get_aggregate_align(abi, max_align_bits / 8) * 8);
+    }
+
+    default:
+        return 0;
+    }
+}
+
+int scc_hir_field_offset(scc_hir_module_t *mod, scc_hir_type_ref_t ref,
+                         int field_idx, const scc_type_abi_t *abi) {
+    scc_hir_type_t *type = scc_hir_module_get_type(mod, ref);
+    if (!type || (type->tag != SCC_HIR_TYPE_STRUCT &&
+                  type->tag != SCC_HIR_TYPE_UNION))
+        return 0;
+
+    if (type->tag == SCC_HIR_TYPE_UNION)
+        return 0; // union 所有字段偏移为 0
+
+    int offset_bits = 0;
+    int count = (int)scc_vec_size(type->data.aggregate.fields);
+    if (field_idx >= count)
+        return 0;
+
+    for (int i = 0; i < count; i++) {
+        scc_hir_type_ref_t fr = scc_vec_at(type->data.aggregate.fields, (usize)i);
+        int fs_bits = scc_hir_type_size(mod, fr, abi);
+        int fa_bits = scc_hir_type_align(mod, fr, abi);
+        int fa2_bits = scc_type_abi_get_field_align(abi, fs_bits / 8, fa_bits / 8) * 8;
+        offset_bits = SCC_ALIGN_UP(offset_bits, fa2_bits);
+        if (i == field_idx)
+            return offset_bits;
+        offset_bits += fs_bits;
+    }
+    return 0;
+}
+
+scc_hir_aggregate_layout_t *
+scc_hir_aggregate_layout(scc_hir_module_t *mod, scc_hir_type_ref_t ref,
+                         const scc_type_abi_t *abi) {
+    scc_hir_type_t *type = scc_hir_module_get_type(mod, ref);
+    if (!type || (type->tag != SCC_HIR_TYPE_STRUCT &&
+                  type->tag != SCC_HIR_TYPE_UNION))
+        return NULL;
+
+    int fc = (int)scc_vec_size(type->data.aggregate.fields);
+
+    if (type->tag == SCC_HIR_TYPE_UNION) {
+        int max_size_bits = 0, max_align_bits = 0;
+        for (usize i = 0; i < scc_vec_size(type->data.aggregate.fields); i++) {
+            scc_hir_type_ref_t fr = scc_vec_at(type->data.aggregate.fields, i);
+            int fs_bits = scc_hir_type_size(mod, fr, abi);
+            int fa_bits = scc_hir_type_align(mod, fr, abi);
+            if (fs_bits > max_size_bits)
+                max_size_bits = fs_bits;
+            if (fa_bits > max_align_bits)
+                max_align_bits = fa_bits;
+        }
+
+        scc_hir_aggregate_layout_t *al =
+            scc_malloc(sizeof(scc_hir_aggregate_layout_t) +
+                       (usize)fc * sizeof(scc_hir_field_layout_t));
+        al->size = SCC_ALIGN_UP(max_size_bits, max_align_bits);
+        al->align = max_align_bits;
+        al->field_count = fc;
+        for (int i = 0; i < fc; i++) {
+            scc_hir_type_ref_t fr =
+                scc_vec_at(type->data.aggregate.fields, (usize)i);
+            int fs_bits = scc_hir_type_size(mod, fr, abi);
+            int fa_bits = scc_hir_type_align(mod, fr, abi);
+            al->fields[i].offset = 0;
+            al->fields[i].size = fs_bits;
+            al->fields[i].align = fa_bits;
+        }
+        return al;
+    }
+
+    // STRUCT
+    scc_hir_aggregate_layout_t *al =
+        scc_malloc(sizeof(scc_hir_aggregate_layout_t) +
+                   (usize)fc * sizeof(scc_hir_field_layout_t));
+    al->field_count = fc;
+
+    int offset_bits = 0, max_align_bits = 0;
+    for (int i = 0; i < fc; i++) {
+        scc_hir_type_ref_t fr =
+            scc_vec_at(type->data.aggregate.fields, (usize)i);
+        int fs_bits = scc_hir_type_size(mod, fr, abi);
+        int fa_bits = scc_hir_type_align(mod, fr, abi);
+        int fa2_bits = scc_type_abi_get_field_align(abi, fs_bits / 8, fa_bits / 8) * 8;
+        offset_bits = SCC_ALIGN_UP(offset_bits, fa2_bits);
+
+        al->fields[i].offset = offset_bits;
+        al->fields[i].size = fs_bits;
+        al->fields[i].align = fa_bits;
+
+        offset_bits += fs_bits;
+        if (fa2_bits > max_align_bits)
+            max_align_bits = fa2_bits;
+    }
+
+    al->size = SCC_ALIGN_UP(offset_bits,
+                            scc_type_abi_get_aggregate_align(abi, max_align_bits / 8) * 8);
+    al->align = scc_type_abi_get_aggregate_align(abi, max_align_bits / 8) * 8;
+    return al;
+}
+
+void scc_hir_aggregate_layout_free(scc_hir_aggregate_layout_t *layout) {
+    scc_free(layout);
+}

libs/ir/hir/src/scc_hir_module.c

@@ -1,7 +1,10 @@
+#include <scc_hir_layout.h>
 #include <scc_hir_module.h>
 
-void scc_hir_module_init(scc_hir_module_t *ctx) {
+void scc_hir_module_init(scc_hir_module_t *ctx, const scc_type_abi_t *abi) {
     scc_cfg_module_init(&ctx->cfg_module);
+    Assert(abi != nullptr);
+    ctx->abi = abi;
 
     scc_vec_init(ctx->values);
     scc_vec_init(ctx->types);
@@ -18,6 +21,18 @@ void scc_hir_module_init(scc_hir_module_t *ctx) {
 }
 
 void scc_hir_module_drop(scc_hir_module_t *ctx) {
+    // 释放函数元数据
+    for (usize i = 0; i < ctx->funcs_meta.size; i++) {
+        scc_free(ctx->funcs_meta.data[i]);
+    }
+    scc_vec_free(ctx->funcs_meta);
+
+    // 释放基本块元数据
+    for (usize i = 0; i < ctx->bblock_meta.size; i++) {
+        scc_free(ctx->bblock_meta.data[i]);
+    }
+    scc_vec_free(ctx->bblock_meta);
+
     scc_cfg_module_drop(&ctx->cfg_module);
 
     // 释放所有实体的内部内存
@@ -36,19 +51,6 @@ void scc_hir_module_drop(scc_hir_module_t *ctx) {
         }
     }
 
-    // TODO free
-    // ctx->cfg_module.funcs;
-    // for (usize i = 1; i < ctx->bblocks.size; i++) {
-    //     scc_hir_bblock_t *bblock = &ctx->bblocks.data[i];
-    //     scc_vec_free(bblock->instrs);
-    // }
-
-    // for (usize i = 1; i < ctx->funcs.size; i++) {
-    //     scc_hir_func_t *func = &ctx->funcs.data[i];
-    //     scc_vec_free(func->params);
-    //     scc_vec_free(func->bblocks);
-    // }
-
     scc_vec_free(ctx->values);
     scc_vec_free(ctx->types);
     scc_hashtable_drop(&ctx->uid2value);
@@ -127,45 +129,7 @@ scc_hir_func_t *scc_hir_module_get_func(scc_hir_module_t *ctx,
     return scc_cfg_module_unsafe_get_func(&ctx->cfg_module, ref);
 }
 
-usize scc_hir_module_type_size(scc_hir_module_t *ctx, scc_hir_type_t *type) {
-    Assert(type != nullptr);
-    switch (type->tag) {
-    case SCC_HIR_TYPE_unknown:
-    case SCC_HIR_TYPE_void:
-        return 0;
-    case SCC_HIR_TYPE_i8:
-    case SCC_HIR_TYPE_u8:
-        return 1;
-    case SCC_HIR_TYPE_i16:
-    case SCC_HIR_TYPE_u16:
-        return 2;
-    case SCC_HIR_TYPE_f32:
-    case SCC_HIR_TYPE_i32:
-    case SCC_HIR_TYPE_u32:
-        return 4;
-    case SCC_HIR_TYPE_f64:
-    case SCC_HIR_TYPE_i64:
-    case SCC_HIR_TYPE_u64:
-        return 8;
-    case SCC_HIR_TYPE_FUNC:
-    case SCC_HIR_TYPE_PTR: {
-        // TODO
-        // 目标指针大小，可以定义为 8（64位）或从 ABI 获取
-        // 假设你的目标架构是 64 位
-        return 8;
-    }
-    case SCC_HIR_TYPE_ARRAY: {
-        usize elem_size = scc_hir_module_type_size(
-            ctx, scc_hir_module_get_type(ctx, type->data.array.base));
-        return elem_size * type->data.array.len;
-    }
-    case SCC_HIR_TYPE_STRUCT:
-    case SCC_HIR_TYPE_UNION:
-        // 暂时无法计算，保守返回 0 或报错
-        LOG_ERROR("Cannot compute size of struct/union without layout info");
-        return 0;
-    default:
-        LOG_ERROR("Unknown type tag %d", type->tag);
-        return 0;
-    }
+usize scc_hir_module_type_size(scc_hir_module_t *ctx, scc_hir_type_ref_t ref) {
+    Assert(ref != 0);
+    return scc_hir_type_size(ctx, ref, ctx->abi);
 }

libs/ir/hir/src/scc_hir_prog.c

@@ -1,10 +1,11 @@
 #include <scc_hir_prog.h>
 
-void scc_hir_cprog_init(scc_hir_cprog_t *in) {
+void scc_hir_cprog_init(scc_hir_cprog_t *in, const scc_type_abi_t *abi) {
+    Assert(abi != nullptr);
     scc_vec_init(in->func_decls);
     scc_vec_init(in->func_defs);
     scc_vec_init(in->global_vals);
-    scc_hir_module_init(&in->module);
+    scc_hir_module_init(&in->module, abi);
 }
 
 void scc_hir_cprog_drop(scc_hir_cprog_t *in) {

libs/ir/lir/include/scc_lir.h

@@ -65,10 +65,10 @@ typedef struct scc_lir_instr {
 #define SCC_LIR_ARG(n)                                                         \
     ((scc_lir_val_t){.kind = SCC_LIR_INSTR_KIND_ARG, .data.arg = (n)})
 
-#define SCC_LIR_SIZE_8 1
-#define SCC_LIR_SIZE_16 2
-#define SCC_LIR_SIZE_32 4
-#define SCC_LIR_SIZE_64 8
+#define SCC_LIR_SIZE_8 8
+#define SCC_LIR_SIZE_16 16
+#define SCC_LIR_SIZE_32 32
+#define SCC_LIR_SIZE_64 64
 
 typedef enum {
     SCC_LIR_EXT_NONE,
@@ -163,7 +163,7 @@ typedef enum {
 typedef scc_cfg_bblock_id_t scc_lir_bblock_id_t;
 typedef struct scc_lir_ins {
     scc_lir_op_t op;
-    u8 size;
+    u8 size_bits;
     scc_lir_ext_t ext;
     scc_lir_val_t to;
     scc_lir_val_t arg0;
@@ -207,12 +207,12 @@ typedef struct scc_lir_ins {
         } parallel_copy;
 
         struct scc_lir_alloca {
-            int size_bytes;
-            int align_bytes;
+            int size_bits;
+            int align_bits;
         } alloca;
 
         struct scc_lir_extend {
-            int from_size; // 源类型宽度（字节）
+            int from_size_bits; // 源类型宽度（位）
         } extend;
 
         struct {

libs/ir/lir/src/scc_hir2lir.c

@@ -5,6 +5,7 @@
 
 #include <scc_hashtable.h>
 #include <scc_hir2lir.h>
+#include <scc_hir_layout.h>
 
 /* ---------- 转换上下文 ---------- */
 typedef struct {
@@ -90,7 +91,7 @@ static void ir_type_to_lir_size_ext(scc_hir_type_t *type, u8 *out_size,
         *out_ext = SCC_LIR_EXT_NONE;
         break;
     default:
-        Panic("unsupported IR type in lowering");
+        Panic("unsupported IR type in lowering at %d", type->tag);
     }
 }
 
@@ -174,7 +175,6 @@ static scc_lir_cond_t map_cmp_cond(scc_hir_op_type_t op, cbool is_float) {
             Panic("invalid float cmp");
         }
     } else {
-        // 默认为有符号比较 (无符号需额外处理类型)
         switch (op) {
         case SCC_HIR_OP_EQ:
             return SCC_LIR_COND_EQ;
@@ -188,6 +188,14 @@ static scc_lir_cond_t map_cmp_cond(scc_hir_op_type_t op, cbool is_float) {
             return SCC_LIR_COND_SGT;
         case SCC_HIR_OP_GE:
             return SCC_LIR_COND_SGE;
+        case SCC_HIR_OP_ULT:
+            return SCC_LIR_COND_ULT;
+        case SCC_HIR_OP_ULE:
+            return SCC_LIR_COND_ULE;
+        case SCC_HIR_OP_UGT:
+            return SCC_LIR_COND_UGT;
+        case SCC_HIR_OP_UGE:
+            return SCC_LIR_COND_UGE;
         default:
             Panic("invalid int cmp");
         }
@@ -196,6 +204,54 @@ static scc_lir_cond_t map_cmp_cond(scc_hir_op_type_t op, cbool is_float) {
 }
 
 static scc_lir_op_t map_binop(scc_hir_op_type_t op, cbool is_float) {
+    switch (op) {
+    case SCC_HIR_OP_EMPTY:
+        return SCC_LIR_NOP;
+    /// Not equal to.
+    case SCC_HIR_OP_NEQ:
+    /// Equal to.
+    case SCC_HIR_OP_EQ:
+    /// Greater than.
+    case SCC_HIR_OP_GT:
+    /// Less than.
+    case SCC_HIR_OP_LT:
+    /// Greater than or equal to.
+    case SCC_HIR_OP_GE:
+    /// Less than or equal to.
+    case SCC_HIR_OP_LE:
+    /// Unsigned greater than.
+    case SCC_HIR_OP_UGT:
+    /// Unsigned less than.
+    case SCC_HIR_OP_ULT:
+    /// Unsigned greater than or equal to.
+    case SCC_HIR_OP_UGE:
+    /// Unsigned less than or equal to.
+    case SCC_HIR_OP_ULE:
+        return SCC_LIR_CMP;
+    /// Bitwise AND.
+    case SCC_HIR_OP_AND:
+        return SCC_LIR_AND;
+    /// Bitwise OR.
+    case SCC_HIR_OP_OR:
+        return SCC_LIR_OR;
+    /// Bitwise XOR.
+    case SCC_HIR_OP_XOR:
+        return SCC_LIR_XOR;
+    /// Bitwise NOT.
+    case SCC_HIR_OP_NOT:
+        return SCC_LIR_NOT;
+    /// Shift left logical.
+    case SCC_HIR_OP_SHL:
+        return SCC_LIR_SHL;
+    /// Shift right logical.
+    case SCC_HIR_OP_SHR:
+        return SCC_LIR_SHR;
+    /// Shift right arithmetic.
+    case SCC_HIR_OP_SAR:
+        return SCC_LIR_SAR;
+    default:
+        break;
+    }
     if (is_float) {
         switch (op) {
         case SCC_HIR_OP_ADD:
@@ -206,6 +262,9 @@ static scc_lir_op_t map_binop(scc_hir_op_type_t op, cbool is_float) {
             return SCC_LIR_FMUL;
         case SCC_HIR_OP_DIV:
             return SCC_LIR_FDIV;
+        case SCC_HIR_OP_MOD:
+            TODO();
+            return SCC_LIR_FNEG;
         default:
             Panic("unsupported float binop");
         }
@@ -221,20 +280,8 @@ static scc_lir_op_t map_binop(scc_hir_op_type_t op, cbool is_float) {
             return SCC_LIR_DIV_S;
         case SCC_HIR_OP_MOD:
             return SCC_LIR_REM_S;
-        case SCC_HIR_OP_AND:
-            return SCC_LIR_AND;
-        case SCC_HIR_OP_OR:
-            return SCC_LIR_OR;
-        case SCC_HIR_OP_XOR:
-            return SCC_LIR_XOR;
-        case SCC_HIR_OP_SHL:
-            return SCC_LIR_SHL;
-        case SCC_HIR_OP_SHR:
-            return SCC_LIR_SHR;
-        case SCC_HIR_OP_SAR:
-            return SCC_LIR_SAR;
         default:
-            return SCC_LIR_CMP;
+            Panic("unsupported binop");
         }
     }
     return SCC_LIR_NOP;
@@ -248,7 +295,7 @@ static int ensure_vreg(ir2lir_ctx_t *ctx, scc_lir_val_t *val) {
     // 分配新的虚拟寄存器
     int new_vreg = ++(SCC_LIR_FUNC_META(ctx->current_func)->vregs_count);
     scc_lir_instr_t mov = {.op = SCC_LIR_MOV,
-                           .size = SCC_LIR_SIZE_64, // 地址宽度
+                           .size_bits = SCC_LIR_SIZE_64, // 地址宽度
                            .to = SCC_LIR_VREG(new_vreg),
                            .arg0 = *val};
     scc_lir_builder_add_instr(ctx, &mov);
@@ -265,10 +312,10 @@ static void translate_hir_value(ir2lir_ctx_t *ctx, scc_hir_value_t *value,
         return;
 
     scc_hir_type_t *ty = scc_hir_module_get_type(ctx->hir_module, value->type);
-    u8 size = 0;
+    u8 size_bits = 0;
     scc_lir_ext_t ext = SCC_LIR_EXT_NONE;
     if (ty != nullptr) {
-        ir_type_to_lir_size_ext(ty, &size, &ext);
+        ir_type_to_lir_size_ext(ty, &size_bits, &ext);
     }
     bool is_float = (ext == SCC_LIR_EXT_FLOAT);
 
@@ -277,12 +324,15 @@ static void translate_hir_value(ir2lir_ctx_t *ctx, scc_hir_value_t *value,
     switch (value->tag) {
     case SCC_HIR_VALUE_TAG_OP: {
         scc_lir_val_t lhs = ir_value_to_lir_operand(ctx, value->data.op.lhs);
-        scc_lir_val_t rhs = ir_value_to_lir_operand(ctx, value->data.op.rhs);
+        scc_lir_val_t rhs = SCC_LIR_NONE();
+        if (value->data.op.rhs != SCC_HIR_REF_nullptr) {
+            rhs = ir_value_to_lir_operand(ctx, value->data.op.rhs);
+        }
         scc_lir_op_t op = map_binop(value->data.op.op, is_float);
 
         scc_lir_instr_t instr = {
             .op = op,
-            .size = size,
+            .size_bits = size_bits,
             .ext = ext,
             .to = SCC_LIR_VREG(dst_vreg),
             .arg0 = lhs,
@@ -297,7 +347,7 @@ static void translate_hir_value(ir2lir_ctx_t *ctx, scc_hir_value_t *value,
         scc_lir_val_t addr =
             ir_value_to_lir_operand(ctx, value->data.load.target);
         scc_lir_instr_t instr = {.op = SCC_LIR_LOAD,
-                                 .size = size,
+                                 .size_bits = size_bits,
                                  .ext = ext,
                                  .to = SCC_LIR_VREG(dst_vreg),
                                  .arg0 = addr};
@@ -308,12 +358,21 @@ static void translate_hir_value(ir2lir_ctx_t *ctx, scc_hir_value_t *value,
             ir_value_to_lir_operand(ctx, value->data.store.value);
         scc_lir_val_t addr =
             ir_value_to_lir_operand(ctx, value->data.store.target);
+        /* 修复: 使用目标指针的元素类型确定 store 宽度而非源值类型 */
+        scc_hir_type_t *ptr_type = scc_hir_module_get_type_by_value(
+            ctx->hir_module, value->data.store.target);
+        if (ptr_type && ptr_type->tag == SCC_HIR_TYPE_PTR) {
+            scc_hir_type_t *elem_type = scc_hir_module_get_type(
+                ctx->hir_module, ptr_type->data.pointer.base);
+            ir_type_to_lir_size_ext(elem_type, &size_bits, &ext);
+        } else {
             ty = scc_hir_module_get_type_by_value(ctx->hir_module,
                                                   value->data.store.value);
-        ir_type_to_lir_size_ext(ty, &size, &ext);
+            ir_type_to_lir_size_ext(ty, &size_bits, &ext);
+        }
         scc_lir_instr_t instr = {.op = SCC_LIR_STORE,
                                  .ext = ext,
-                                 .size = size,
+                                 .size_bits = size_bits,
                                  .arg0 = data,
                                  .arg1 = addr};
         scc_lir_builder_add_instr(ctx, &instr);
@@ -328,40 +387,39 @@ static void translate_hir_value(ir2lir_ctx_t *ctx, scc_hir_value_t *value,
         // 2. 获取元素类型和大小
         scc_hir_type_t *ptr_type =
             scc_hir_module_get_type(ctx->hir_module, value->type);
-        scc_hir_type_t *pointee = NULL;
+        scc_hir_type_ref_t pointee = SCC_CFG_ID_nullptr;
         if (ptr_type->tag == SCC_HIR_TYPE_PTR) {
-            pointee = scc_hir_module_get_type(ctx->hir_module,
-                                              ptr_type->data.pointer.base);
+            pointee = ptr_type->data.pointer.base;
         } else if (ptr_type->tag == SCC_HIR_TYPE_ARRAY) {
             // 数组名退化为指针，元素类型为数组的元素类型
-            pointee = scc_hir_module_get_type(ctx->hir_module,
-                                              ptr_type->data.array.base);
+            pointee = ptr_type->data.array.base;
         } else {
             Panic("GET_ELEM_PTR on non-pointer/array type");
         }
-        int elem_size = scc_hir_module_type_size(ctx->hir_module, pointee);
+        int elem_size_bits = scc_hir_module_type_size(ctx->hir_module, pointee);
 
         int dst_vreg = get_vreg_for_value(ctx, value_ref);
         scc_lir_instr_t instr = {
             .op = SCC_LIR_LOAD_ADDR,
-            .size = SCC_LIR_SIZE_64,
+            .size_bits = SCC_LIR_SIZE_64,
             .to = SCC_LIR_VREG(dst_vreg),
             .arg0 = base,
             .arg1 = index,
-            .metadata.addr.scale = elem_size,
+            // FIXME
+            .metadata.addr.scale = elem_size_bits / 8,
             .metadata.addr.offset = 0,
         };
         scc_lir_builder_add_instr(ctx, &instr);
     } break;
     case SCC_HIR_VALUE_TAG_ALLOC: {
         Assert(ty != nullptr);
-        scc_hir_type_t *alloc_ty =
-            scc_hir_module_get_type(ctx->hir_module, ty->data.pointer.base);
-        int alloc_size = scc_hir_module_type_size(ctx->hir_module, alloc_ty);
+        int alloc_size_bits =
+            scc_hir_module_type_size(ctx->hir_module, ty->data.pointer.base);
         scc_lir_instr_t instr = {.op = SCC_LIR_ALLOCA,
-                                 .size = alloc_size,
+                                 .size_bits = SCC_LIR_SIZE_64,
                                  .to = SCC_LIR_VREG(dst_vreg),
-                                 .metadata.alloca = {alloc_size, 1}};
+                                 // FIXME
+                                 .metadata.alloca = {alloc_size_bits, 8}};
         scc_lir_builder_add_instr(ctx, &instr);
     } break;
     case SCC_HIR_VALUE_TAG_CALL: {
@@ -382,7 +440,7 @@ static void translate_hir_value(ir2lir_ctx_t *ctx, scc_hir_value_t *value,
         int is_direct_call = sym->kind == SCC_CFG_SYMBOL_KIND_FUNC;
         scc_lir_instr_t instr = (scc_lir_instr_t){
             .op = is_direct_call ? SCC_LIR_CALL : SCC_LIR_CALL_INDIRECT,
-            .size = size,
+            .size_bits = size_bits,
             .to = SCC_LIR_VREG(dst_vreg),
             .metadata.call = {.args = lir_args,
                               .arg_count = arg_count,
@@ -439,24 +497,23 @@ static void translate_hir_value(ir2lir_ctx_t *ctx, scc_hir_value_t *value,
         // TRUNC 用 SCC_LIR_MOV 截断
         if (value->data.conv.conv_type == SCC_HIR_CONV_TRUNC) {
             scc_lir_instr_t instr = {.op = SCC_LIR_MOV,
-                                     .size = size,
+                                     .size_bits = size_bits,
                                      .to = SCC_LIR_VREG(dst_vreg),
                                      .arg0 = src};
             scc_lir_builder_add_instr(ctx, &instr);
         } else {
             // 计算源类型宽度
-            scc_hir_type_t *src_type = scc_hir_module_get_type(
-                ctx->hir_module,
-                scc_hir_module_get_value(ctx->hir_module,
-                                         value->data.conv.operand)
+            int from_size_bits = scc_hir_module_type_size(
+                ctx->hir_module, scc_hir_module_get_value(
+                                     ctx->hir_module, value->data.conv.operand)
                                      ->type);
-            int from_size = scc_hir_module_type_size(ctx->hir_module, src_type);
             scc_lir_instr_t instr = {.op = SCC_LIR_EXTEND,
-                                     .size = size,
+                                     .size_bits = size_bits,
                                      .ext = conv_ext,
                                      .to = SCC_LIR_VREG(dst_vreg),
                                      .arg0 = src,
-                                     .metadata.extend.from_size = from_size};
+                                     .metadata.extend.from_size_bits =
+                                         from_size_bits};
             scc_lir_builder_add_instr(ctx, &instr);
         }
     } break;
@@ -609,13 +666,27 @@ void scc_hir2lir(scc_lir_module_t *module, scc_hir_cprog_t *cprog) {
         scc_hir_value_ref_t gv_ref = scc_vec_at(cprog->global_vals, i);
         scc_hir_value_t *galloc =
             scc_hir_module_get_value(&cprog->module, gv_ref);
-        Assert(galloc->tag == SCC_HIR_VALUE_TAG_GLOBAL_ALLOC);
+        Assert(galloc != nullptr &&
+               galloc->tag == SCC_HIR_VALUE_TAG_GLOBAL_ALLOC);
         scc_hir_value_t *val = scc_hir_module_get_value(
             &cprog->module, galloc->data.global_alloc.value);
+        scc_lir_symbol_id_t id = SCC_CFG_ID_nullptr;
+
+        int size = scc_hir_module_type_size(&cprog->module, val->type);
+        Assert(size > 0);
+        if (val == nullptr) {
+            // TODO char == 8 bit
+            id = scc_lir_module_add_data(module, galloc->name,
+                                         SCC_CFG_SYMBOL_KIND_DATA, nullptr,
+                                         size / 8, 0);
+        } else {
             scc_hir_buffer_t *data = &val->data.const_array.fields;
-        scc_lir_symbol_id_t id = scc_lir_module_add_data(
+            Assert(scc_vec_size(*data) * 8 == size);
+            // TODO char == 8 bit
+            id = scc_lir_module_add_data(
                 module, galloc->name, SCC_CFG_SYMBOL_KIND_DATA,
-            scc_vec_unsafe_get_data(*data), scc_vec_size(*data), 0);
+                scc_vec_unsafe_get_data(*data), size / 8, 0);
+        }
         Assert(id != SCC_CFG_ID_nullptr);
     }
 

libs/ir/lir/src/scc_lir_dump.c

@@ -135,7 +135,7 @@ void scc_lir_dump_ins(scc_lir_dump_ctx_t *ctx, const scc_lir_instr_t *ins) {
     scc_tree_dump_node(td, "%s", op_to_string(ins->op));
 
     // 输出宽度和扩展标志
-    dump_size_ext(ctx, ins->size, ins->ext);
+    dump_size_ext(ctx, ins->size_bits, ins->ext);
     scc_tree_dump_append(td, " ");
 
     switch (ins->op) {
@@ -165,8 +165,8 @@ void scc_lir_dump_ins(scc_lir_dump_ctx_t *ctx, const scc_lir_instr_t *ins) {
         break;
     case SCC_LIR_ALLOCA:
         scc_tree_dump_append_fmt(td, "(sz=%zd,al=%zd) => ",
-                                 ins->metadata.alloca.size_bytes,
-                                 ins->metadata.alloca.align_bytes);
+                                 ins->metadata.alloca.size_bits,
+                                 ins->metadata.alloca.align_bits);
         dump_operand(ctx, &ins->to);
         break;
     case SCC_LIR_EXTEND: {
@@ -182,8 +182,8 @@ void scc_lir_dump_ins(scc_lir_dump_ctx_t *ctx, const scc_lir_instr_t *ins) {
             ext_name = "ext";
             break;
         }
-        scc_tree_dump_append_fmt(td, "%s(%d<-%d) ", ext_name, ins->size * 8,
-                                 ins->metadata.extend.from_size * 8);
+        scc_tree_dump_append_fmt(td, "%s(%d<-%d) ", ext_name, ins->size_bits,
+                                 ins->metadata.extend.from_size_bits);
         dump_operand(ctx, &ins->to);
         scc_tree_dump_append(td, " <- ");
         dump_operand(ctx, &ins->arg0);

libs/ir/lir/src/scc_lir_module.c

@@ -1,16 +1,28 @@
 #include <scc_lir_module.h>
 
 void scc_lir_module_init(scc_lir_module_t *lir_module) {
-    // FIXME
-    // lir_module->lir_module
     scc_vec_init(lir_module->func_metas);
     scc_vec_init(lir_module->symbol_metas);
 }
 
 void scc_lir_module_drop(scc_lir_module_t *lir_module) {
-    // FIXME memory leak
+    for (usize i = 0; i < scc_vec_size(lir_module->func_metas); i++) {
+        scc_free(lir_module->func_metas.data[i]);
+    }
+    for (usize i = 0; i < scc_vec_size(lir_module->symbol_metas); i++) {
+        scc_lir_symbol_meta_t *meta = lir_module->symbol_metas.data[i];
+        usize cfg_idx = i + 1; /* cfg_module.symbols[0] is null sentinel */
+        if (cfg_idx < scc_vec_size(lir_module->cfg_module.symbols)) {
+            scc_cfg_symbol_t *sym = &lir_module->cfg_module.symbols.data[cfg_idx];
+            if (sym->kind == SCC_CFG_SYMBOL_KIND_DATA && meta->data.init_data) {
+                scc_free(meta->data.init_data);
+            }
+        }
+        scc_free(meta);
+    }
     scc_vec_free(lir_module->func_metas);
     scc_vec_free(lir_module->symbol_metas);
+    scc_cfg_module_drop(&lir_module->cfg_module);
 }
 
 scc_lir_symbol_t *

libs/ir/mir/include/arch/scc_x86_mir.h

@@ -52,7 +52,7 @@ static inline scc_x86_operand_value_t scc_x86_op_slot(int slot_id, u8 size) {
     o.mem.scale = 1;
     o.mem.disp.displacement = slot_id;
     o.mem.disp.displacement_bits = 0;
-    o.size = size;
+    o.size_bits = size;
     return o;
 }
 

libs/ir/mir/include/arch/scc_x86_reg_alloc.h

@@ -3,6 +3,15 @@
 
 #include "../core_pass/scc_reg_alloc.h"
 
+/* 默认位掩码策略：R8/R9 被排除（ABI 参数寄存器），剩余 6 个通用寄存器 */
 void scc_reg_alloc_fill_arch_x86(scc_reg_alloc_op_t *ops);
 
+/*
+ * 顺序分配策略：光标递增，永不回收。
+ * 池中包含 R8-R15（共 8 个寄存器），每分配一个光标前进一格。
+ * release_reg 为空操作；寄存器耗尽后 acquire_reg 返回 -1，
+ * 由分配器回退为纯栈操作。
+ */
+void scc_reg_alloc_fill_seq_x86(scc_reg_alloc_op_t *ops);
+
 #endif /* __SCC_X86_REG_ALLOC_H__ */

libs/ir/mir/include/scc_mir.h

@@ -14,8 +14,8 @@ typedef struct scc_mir_instr {
     int opcode;
     union {
         struct {
-            int size;
-            int align;
+            int size_bits;
+            int align_bits;
             int vreg;
         } alloc;
     } data;
@@ -82,7 +82,9 @@ static inline int scc_mir_vreg_lookup(const scc_mir_func_t *func, int vreg,
 static inline scc_mir_stack_slot_t *
 scc_mir_unsafe_slot(const scc_mir_func_t *func, int slot) {
     Assert(slot > 0);
-    return &scc_vec_at(SCC_MIR_FUNC_META(func)->stack_slots, slot);
+    scc_mir_func_meta_t *meta = SCC_MIR_FUNC_META(func);
+    Assert((usize)slot < scc_vec_size(meta->stack_slots));
+    return &scc_vec_at(meta->stack_slots, slot);
 }
 
 #endif /* __SCC_MIR_H__ */

libs/ir/mir/src/arch/scc_x86_isel.c

@@ -98,34 +98,34 @@ void scc_x86_instr_dump(scc_tree_dump_t *td, const scc_mir_func_t *func,
             scc_tree_dump_append(td, "<?>");
             break;
         }
-        scc_tree_dump_append_fmt(td, ".(%zu)", op->size);
+        scc_tree_dump_append_fmt(td, ".(%zu)", op->size_bits);
     }
 }
 
 // 将 LIR 值转换为 x86 操作数
 scc_x86_operand_value_t scc_x86_lir_val_to_mir_op(scc_x86_64_isel_t *isel,
                                                   const scc_lir_val_t *val,
-                                                  u8 size) {
+                                                  u8 size_bits) {
     scc_x86_operand_value_t op = {0};
     switch (val->kind) {
     case SCC_LIR_INSTR_KIND_NONE:
         op.kind = SCC_X86_OPR_NONE;
         break;
     case SCC_LIR_INSTR_KIND_VREG:
-        op = scc_x86_op_vreg(val->data.reg, size);
+        op = scc_x86_op_vreg(val->data.reg, size_bits);
         int id = 0;
         int ret = scc_mir_vreg_lookup(isel->func, val->data.reg, &id);
         if (ret > 0) {
-            op = scc_x86_op_preg(id, size);
+            op = scc_x86_op_preg(id, size_bits);
         } else if (ret < 0) {
-            op = scc_x86_op_slot(id, size);
+            op = scc_x86_op_slot(id, size_bits);
         }
         break;
     case SCC_LIR_INSTR_KIND_IMM:
-        op = scc_x86_op_imm(val->data.imm.data.digit, size);
+        op = scc_x86_op_imm(val->data.imm.data.digit, size_bits);
         break;
     case SCC_LIR_INSTR_KIND_FIMM:
-        op = scc_x86_op_imm(*(i64 *)&val->data.fimm, size);
+        op = scc_x86_op_imm(*(i64 *)&val->data.fimm, size_bits);
         break;
     case SCC_LIR_INSTR_KIND_SYMBOL:
         op = scc_x86_op_reloc_global_relrip(val->data.symbol, 0);
@@ -133,7 +133,7 @@ scc_x86_operand_value_t scc_x86_lir_val_to_mir_op(scc_x86_64_isel_t *isel,
     case SCC_LIR_INSTR_KIND_ARG:
         Assert(isel->abi_lowering.lower_param);
         isel->abi_lowering.lower_param(isel, val, &op);
-        op.size = size;
+        op.size_bits = size_bits;
         break;
     default:
         Panic("unsupported lir instr kind %d", val->kind);
@@ -144,8 +144,19 @@ scc_x86_operand_value_t scc_x86_lir_val_to_mir_op(scc_x86_64_isel_t *isel,
 
 // 虚拟临时寄存器分配（简单递增）
 static scc_x86_operand_value_t new_vreg_temp(scc_x86_64_isel_t *isel,
-                                             int size) {
-    return scc_x86_op_vreg(scc_mir_alloc_vreg(isel->func), size);
+                                             int size_bits) {
+    return scc_x86_op_vreg(scc_mir_alloc_vreg(isel->func), size_bits);
+}
+
+/* 确保操作数为寄存器: IMM → 加载到临时虚拟寄存器 */
+static scc_x86_operand_value_t ensure_reg(scc_x86_64_isel_t *isel,
+                                          scc_x86_operand_value_t op) {
+    if (op.kind == SCC_X86_OPR_IMM) {
+        scc_x86_operand_value_t tmp = new_vreg_temp(isel, op.size_bits);
+        scc_x86_emit_move(isel, tmp, op);
+        return tmp;
+    }
+    return op;
 }
 
 static scc_x86_iform_t cond_to_setcc(scc_lir_cond_t cond) {
@@ -191,8 +202,8 @@ static void emit_binary_op(scc_x86_64_isel_t *isel, scc_lir_op_t op,
                            scc_x86_operand_value_t src1) {
     emit_copy_if_needed(isel, dst, src0);
 
-    Assert(src0.size == src1.size);
-    int is_8b = src0.size == 1;
+    Assert(src0.size_bits == src1.size_bits);
+    // int is_8b = src0.size_bits == 8;
     int is_imm = src1.kind == SCC_X86_OPR_IMM;
     scc_x86_iform_t opcode;
     switch (op) {
@@ -231,7 +242,7 @@ void scc_x86_emit_load(scc_x86_64_isel_t *isel, scc_x86_operand_value_t dst,
                        scc_x86_operand_value_t src) {
     scc_x86_operand_value_t tmp_reg = dst;
     if (dst.kind != SCC_X86_OPR_REG) {
-        tmp_reg = new_vreg_temp(isel, src.size);
+        tmp_reg = new_vreg_temp(isel, src.size_bits);
     }
     scc_x86_emit_load_to_vec(&isel->instrs, tmp_reg, src);
     if (dst.kind != SCC_X86_OPR_REG) {
@@ -242,7 +253,7 @@ void scc_x86_emit_load(scc_x86_64_isel_t *isel, scc_x86_operand_value_t dst,
 void scc_x86_emit_store(scc_x86_64_isel_t *isel, scc_x86_operand_value_t dst,
                         scc_x86_operand_value_t src) {
     if (src.kind == SCC_X86_OPR_MEM) {
-        scc_x86_operand_value_t tmp_reg = new_vreg_temp(isel, src.size);
+        scc_x86_operand_value_t tmp_reg = new_vreg_temp(isel, src.size_bits);
         scc_x86_emit_load(isel, tmp_reg, src);
         src = tmp_reg;
     }
@@ -253,8 +264,8 @@ static void emit_load_addr(scc_x86_64_isel_t *isel, scc_x86_operand_value_t dst,
                            scc_x86_operand_value_t base,
                            scc_x86_operand_value_t index, int scale,
                            i64 offset) {
-    usize size = dst.size;
-    Assert(size == 8);
+    usize size_bits = dst.size_bits;
+    Assert(size_bits == 64);
     // 前置断言：dst 必须是寄存器
     Assert(dst.kind == SCC_X86_OPR_REG);
     // scale 必须是 1,2,4,8 之一
@@ -268,11 +279,11 @@ static void emit_load_addr(scc_x86_64_isel_t *isel, scc_x86_operand_value_t dst,
     } break;
     case SCC_X86_OPR_RELOC: {
         Assert(base.reloc.target == SCC_X86_RELOC_TARGET_SYMBOL);
-        base_reg = new_vreg_temp(isel, 8);
+        base_reg = new_vreg_temp(isel, 64);
         scc_x86_emit_move(isel, base_reg, base);
     } break;
     case SCC_X86_OPR_MEM: {
-        base_reg = new_vreg_temp(isel, 8);
+        base_reg = new_vreg_temp(isel, 64);
         scc_x86_emit_move(isel, base_reg, base);
     } break;
     default: {
@@ -287,15 +298,15 @@ static void emit_load_addr(scc_x86_64_isel_t *isel, scc_x86_operand_value_t dst,
     } break;
     case SCC_X86_OPR_RELOC: {
         Assert(index.reloc.target == SCC_X86_RELOC_TARGET_SYMBOL);
-        index_reg = new_vreg_temp(isel, 8);
+        index_reg = new_vreg_temp(isel, 64);
         scc_x86_emit_move(isel, index_reg, index);
     } break;
     case SCC_X86_OPR_MEM: {
-        index_reg = new_vreg_temp(isel, 8);
+        index_reg = new_vreg_temp(isel, 64);
         scc_x86_emit_move(isel, index_reg, index);
     } break;
     case SCC_X86_OPR_IMM: {
-        index_reg = new_vreg_temp(isel, index.size);
+        index_reg = new_vreg_temp(isel, index.size_bits);
         scc_x86_emit_move(isel, index_reg, index);
     } break;
     default: {
@@ -309,18 +320,18 @@ static void emit_load_addr(scc_x86_64_isel_t *isel, scc_x86_operand_value_t dst,
                                        .scale = scale,
                                        .disp.displacement = offset,
                                        .disp.displacement_bits = 8},
-                       size);
+                       size_bits);
     scc_x86_emit_move(isel, dst, mem_op);
 }
 
 static void sel_mir(scc_x86_64_isel_t *isel, const scc_lir_instr_t *instr) {
-    u8 size = instr->size;
+    u8 size_bits = instr->size_bits;
     scc_x86_operand_value_t dst =
-        scc_x86_lir_val_to_mir_op(isel, &instr->to, size);
+        scc_x86_lir_val_to_mir_op(isel, &instr->to, size_bits);
     scc_x86_operand_value_t src0 =
-        scc_x86_lir_val_to_mir_op(isel, &instr->arg0, size);
+        scc_x86_lir_val_to_mir_op(isel, &instr->arg0, size_bits);
     scc_x86_operand_value_t src1 =
-        scc_x86_lir_val_to_mir_op(isel, &instr->arg1, size);
+        scc_x86_lir_val_to_mir_op(isel, &instr->arg1, size_bits);
 
     switch (instr->op) {
         /* ---- 数据移动 ---- */
@@ -343,9 +354,11 @@ static void sel_mir(scc_x86_64_isel_t *isel, const scc_lir_instr_t *instr) {
         break;
     /* ---- 一元运算 ---- */
     case SCC_LIR_NEG:
+        emit_copy_if_needed(isel, dst, src0);
         add_instr_1(isel, SCC_X86_IFORM_NEG_GPRV, dst);
         break;
     case SCC_LIR_NOT:
+        emit_copy_if_needed(isel, dst, src0);
         add_instr_1(isel, SCC_X86_IFORM_NOT_GPRV, dst);
         break;
     /* ---- 算术/逻辑二元运算 ---- */
@@ -360,7 +373,7 @@ static void sel_mir(scc_x86_64_isel_t *isel, const scc_lir_instr_t *instr) {
     case SCC_LIR_MUL:
         emit_copy_if_needed(isel, dst, src0);
         if (src1.kind == SCC_X86_OPR_IMM) {
-            scc_x86_operand_value_t op = new_vreg_temp(isel, size);
+            scc_x86_operand_value_t op = new_vreg_temp(isel, size_bits);
             scc_x86_emit_move(isel, op, src1);
             src1 = op;
         }
@@ -388,7 +401,7 @@ static void sel_mir(scc_x86_64_isel_t *isel, const scc_lir_instr_t *instr) {
             }
             add_instr_2(isel, iform, dst, src1);
         } else {
-            scc_x86_operand_value_t cl = scc_x86_op_preg(SCC_X86_REG_CL, 1);
+            scc_x86_operand_value_t cl = scc_x86_op_preg(SCC_X86_REG_CL, 8);
             scc_x86_emit_move(isel, cl, src1);
             scc_x86_iform_t iform;
             switch (instr->op) {
@@ -413,15 +426,24 @@ static void sel_mir(scc_x86_64_isel_t *isel, const scc_lir_instr_t *instr) {
     case SCC_LIR_DIV_U:
     case SCC_LIR_REM_S:
     case SCC_LIR_REM_U: {
-        scc_x86_operand_value_t rax = scc_x86_op_preg(SCC_X86_REG_RAX, size);
-        scc_x86_operand_value_t rdx = scc_x86_op_preg(SCC_X86_REG_RDX, size);
-
-        scc_x86_emit_move(isel, rax, src0);
+        scc_x86_operand_value_t rax =
+            scc_x86_op_preg(SCC_X86_REG_RAX, size_bits);
+        scc_x86_operand_value_t rdx =
+            scc_x86_op_preg(SCC_X86_REG_RDX, size_bits);
 
         if (instr->op == SCC_LIR_DIV_S || instr->op == SCC_LIR_REM_S) {
+            if (size_bits < 64) {
+                // TODO 可能需要在lir进行size对齐
+                scc_x86_operand_value_t rax64 =
+                    scc_x86_op_preg(SCC_X86_REG_RAX, 64);
+                add_instr_2(isel, SCC_X86_IFORM_MOVSXD_GPRV_GPRZ, rax64, src0);
+            } else {
+                scc_x86_emit_move(isel, rax, src0);
+            }
             add_instr_0(isel, SCC_X86_IFORM_CQO);
         } else {
-            scc_x86_operand_value_t zero = scc_x86_op_imm(0, size);
+            scc_x86_emit_move(isel, rax, src0);
+            scc_x86_operand_value_t zero = scc_x86_op_imm(0, size_bits);
             scc_x86_emit_move(isel, rdx, zero);
         }
 
@@ -429,7 +451,12 @@ static void sel_mir(scc_x86_64_isel_t *isel, const scc_lir_instr_t *instr) {
             (instr->op == SCC_LIR_DIV_S || instr->op == SCC_LIR_REM_S)
                 ? SCC_X86_IFORM_IDIV_GPRV
                 : SCC_X86_IFORM_DIV_GPRV;
-        add_instr_1(isel, div_if, src1);
+        scc_x86_operand_value_t divisor = src1;
+        if (src1.kind == SCC_X86_OPR_IMM) {
+            divisor = new_vreg_temp(isel, size_bits);
+            scc_x86_emit_move(isel, divisor, src1);
+        }
+        add_instr_1(isel, div_if, divisor);
 
         if (instr->op == SCC_LIR_REM_S || instr->op == SCC_LIR_REM_U)
             scc_x86_emit_move(isel, dst, rdx);
@@ -439,16 +466,22 @@ static void sel_mir(scc_x86_64_isel_t *isel, const scc_lir_instr_t *instr) {
 
     /* ---- 比较指令 ---- */
     case SCC_LIR_CMP: {
-        Assert(src0.size == src1.size);
+        Assert(src0.size_bits == src1.size_bits);
+        if (src0.kind == SCC_X86_OPR_IMM) {
+            scc_x86_operand_value_t tmp_reg =
+                new_vreg_temp(isel, src0.size_bits);
+            scc_x86_emit_move(isel, tmp_reg, src0);
+            src0 = tmp_reg;
+        }
         if (scc_x86_op_is_vreg(&src0) && src1.kind == SCC_X86_OPR_IMM)
             // SCC_X86_IFORM_CMP_GPR8_IMMB_82R7 历史遗留指令在amd64中已不再使用
             add_instr_2(isel,
-                        src0.size == 1 ? SCC_X86_IFORM_CMP_GPR8_IMMB_80R7
+                        src0.size_bits == 8 ? SCC_X86_IFORM_CMP_GPR8_IMMB_80R7
                                             : SCC_X86_IFORM_CMP_GPRV_IMMZ,
                         src0, src1);
         else if (scc_x86_op_is_vreg(&src0) && scc_x86_op_is_vreg(&src1))
             add_instr_2(isel,
-                        src0.size == 1 ? SCC_X86_IFORM_CMP_GPR8_GPR8_3A
+                        src0.size_bits == 8 ? SCC_X86_IFORM_CMP_GPR8_GPR8_3A
                                             : SCC_X86_IFORM_CMP_GPRV_GPRV_3B,
                         src0, src1);
         else
@@ -456,10 +489,10 @@ static void sel_mir(scc_x86_64_isel_t *isel, const scc_lir_instr_t *instr) {
 
         scc_x86_iform_t setcc = cond_to_setcc(instr->metadata.cond);
         add_instr_1(isel, setcc, dst);
-        if (size > 1) {
-            scc_x86_operand_value_t one = scc_x86_op_imm(1, size);
+        if (size_bits > 8) {
+            scc_x86_operand_value_t one = scc_x86_op_imm(1, size_bits);
             add_instr_2(isel,
-                        src1.size == 1 ? SCC_X86_IFORM_AND_GPR8_IMMB_82R4
+                        src1.size_bits == 8 ? SCC_X86_IFORM_AND_GPR8_IMMB_82R4
                                             : SCC_X86_IFORM_AND_GPRV_IMMZ,
                         dst, one);
         }
@@ -471,10 +504,10 @@ static void sel_mir(scc_x86_64_isel_t *isel, const scc_lir_instr_t *instr) {
             scc_x86_op_reloc_block(instr->metadata.br.true_target, 0);
         scc_x86_operand_value_t false_bb =
             scc_x86_op_reloc_block(instr->metadata.br.false_target, 0);
-        true_bb.size = instr->size;
-        false_bb.size = instr->size;
+        true_bb.size_bits = instr->size_bits;
+        false_bb.size_bits = instr->size_bits;
         add_instr_2(isel,
-                    src0.size == 1 ? SCC_X86_IFORM_TEST_GPR8_GPR8
+                    src0.size_bits == 8 ? SCC_X86_IFORM_TEST_GPR8_GPR8
                                         : SCC_X86_IFORM_TEST_GPRV_GPRV,
                     src0, src0);
         add_instr_1(isel, SCC_X86_IFORM_JNZ_RELBRZ, true_bb);
@@ -490,48 +523,50 @@ static void sel_mir(scc_x86_64_isel_t *isel, const scc_lir_instr_t *instr) {
     /* ---- 栈分配 ---- */
     case SCC_LIR_ALLOCA: {
         scc_x86_operand_value_t op =
-            scc_x86_lir_val_to_mir_op(isel, &instr->to, instr->size);
+            scc_x86_lir_val_to_mir_op(isel, &instr->to, instr->size_bits);
         scc_mir_x86_instr_t x86instr;
         x86instr.instr.opcode = SCC_MIR_PSEUDO_ALLOCA;
         Assert(op.kind == SCC_X86_OPR_REG);
         x86instr.instr.data.alloc.vreg = op.reg;
-        x86instr.instr.data.alloc.size = instr->metadata.alloca.size_bytes;
-        x86instr.instr.data.alloc.align = instr->metadata.alloca.align_bytes;
+        x86instr.instr.data.alloc.size_bits = instr->metadata.alloca.size_bits;
+        x86instr.instr.data.alloc.align_bits =
+            instr->metadata.alloca.align_bits;
         scc_vec_push(isel->instrs, x86instr);
         scc_mir_vreg_map2slot(isel->func, instr->to.data.reg,
-                              instr->metadata.alloca.size_bytes,
-                              instr->metadata.alloca.align_bytes
-                                  ? instr->metadata.alloca.align_bytes
+                              instr->metadata.alloca.size_bits,
+                              instr->metadata.alloca.align_bits
+                                  ? instr->metadata.alloca.align_bits
                                   : 8);
         break;
     }
 
     /* ---- 类型扩展 ---- */
     case SCC_LIR_EXTEND: {
-        int from_size = instr->metadata.extend.from_size;
+        int from_size_bits = instr->metadata.extend.from_size_bits;
         scc_x86_operand_value_t ext_src =
-            scc_x86_lir_val_to_mir_op(isel, &instr->arg0, from_size);
+            scc_x86_lir_val_to_mir_op(isel, &instr->arg0, from_size_bits);
+        ext_src = ensure_reg(isel, ext_src);
 
         if (instr->ext == SCC_LIR_EXT_ZEXT) {
-            if (from_size == 4) {
+            if (from_size_bits == 32) {
                 // 32→64: x86-64 写32位寄存器自动零扩展到64位
                 scc_x86_emit_move(isel, dst, ext_src);
             } else {
-                scc_x86_iform_t iform = (from_size == 1)
+                scc_x86_iform_t iform = (from_size_bits == 8)
                                             ? SCC_X86_IFORM_MOVZX_GPRV_GPR8
                                             : SCC_X86_IFORM_MOVZX_GPRV_GPR16;
                 add_instr_2(isel, iform, dst, ext_src);
             }
         } else if (instr->ext == SCC_LIR_EXT_SEXT) {
             scc_x86_iform_t iform;
-            switch (from_size) {
-            case 1:
+            switch (from_size_bits) {
+            case 8:
                 iform = SCC_X86_IFORM_MOVSX_GPRV_GPR8;
                 break;
-            case 2:
+            case 16:
                 iform = SCC_X86_IFORM_MOVSX_GPRV_GPR16;
                 break;
-            case 4:
+            case 32:
                 iform = SCC_X86_IFORM_MOVSXD_GPRV_GPRZ;
                 break;
             default:
@@ -569,18 +604,18 @@ static void sel_mir(scc_x86_64_isel_t *isel, const scc_lir_instr_t *instr) {
 
         // 将 dest 的地址放入 RDI
         scc_x86_operand_value_t dest_op =
-            scc_x86_lir_val_to_mir_op(isel, &dest_val, 8);
-        scc_x86_emit_move(isel, scc_x86_op_preg(SCC_X86_REG_RDI, 8), dest_op);
+            scc_x86_lir_val_to_mir_op(isel, &dest_val, 64);
+        scc_x86_emit_move(isel, scc_x86_op_preg(SCC_X86_REG_RDI, 64), dest_op);
 
         // 将 src 的地址放入 RSI
         scc_x86_operand_value_t src_op =
-            scc_x86_lir_val_to_mir_op(isel, &src_val, 8);
-        scc_x86_emit_move(isel, scc_x86_op_preg(SCC_X86_REG_RSI, 8), src_op);
+            scc_x86_lir_val_to_mir_op(isel, &src_val, 64);
+        scc_x86_emit_move(isel, scc_x86_op_preg(SCC_X86_REG_RSI, 64), src_op);
 
         // 长度处理保持不变...
         scc_x86_operand_value_t len_op =
-            scc_x86_lir_val_to_mir_op(isel, &instr->metadata.memcpy.size, 8);
-        scc_x86_emit_move(isel, scc_x86_op_preg(SCC_X86_REG_RCX, 8), len_op);
+            scc_x86_lir_val_to_mir_op(isel, &instr->metadata.memcpy.size, 64);
+        scc_x86_emit_move(isel, scc_x86_op_preg(SCC_X86_REG_RCX, 64), len_op);
 
         add_instr_0(isel, SCC_X86_IFORM_REP_MOVSB);
     } break;
@@ -601,9 +636,9 @@ static void sel_func(const scc_lir_module_t *lir_module,
         scc_lir_instr_vec_t *instrs = SCC_LIR_BBLOCK_VALUES(bb);
         scc_vec_foreach(*instrs, i) {
             scc_lir_instr_t *ins = &scc_vec_at(*instrs, i);
-            // HACK BR size
+            // HACK BR size_bits
             if (ins->op == SCC_LIR_BR) {
-                ins->size = scc_vec_at(*instrs, i - 1).size;
+                ins->size_bits = scc_vec_at(*instrs, i - 1).size_bits;
             }
             sel_mir(isel, ins);
         }

libs/ir/mir/src/arch/scc_x86_mir.c

@@ -3,51 +3,67 @@
 static inline scc_x86_iform_t
 scc_mir_x86_mov_reg_mem(scc_x86_operand_value_t op0,
                         scc_x86_operand_value_t op1) {
-    Assert(op0.size == op1.size);
+    Assert(op0.size_bits == op1.size_bits);
     Assert(op0.kind == SCC_X86_OPR_REG && op1.kind == SCC_X86_OPR_MEM);
-    return op0.size == 1 ? SCC_X86_IFORM_MOV_GPR8_MEMB
+    return op0.size_bits == 8 ? SCC_X86_IFORM_MOV_GPR8_MEMB
                               : SCC_X86_IFORM_MOV_GPRV_MEMV;
 }
 static inline scc_x86_iform_t
 scc_mir_x86_mov_reg_reg(scc_x86_operand_value_t op0,
                         scc_x86_operand_value_t op1) {
-    Assert(op0.size == op1.size);
+    Assert(op0.size_bits == op1.size_bits);
     Assert(op0.kind == SCC_X86_OPR_REG && op1.kind == SCC_X86_OPR_REG);
-    return op0.size == 1 ? SCC_X86_IFORM_MOV_GPR8_GPR8_8A
+    return op0.size_bits == 8 ? SCC_X86_IFORM_MOV_GPR8_GPR8_8A
                               : SCC_X86_IFORM_MOV_GPRV_GPRV_8B;
 }
 
 static inline scc_x86_iform_t
 scc_mir_x86_mov_reg_imm(scc_x86_operand_value_t op0,
                         scc_x86_operand_value_t op1) {
-    Assert(op0.size == op1.size);
+    Assert(op0.size_bits == op1.size_bits);
     Assert(op0.kind == SCC_X86_OPR_REG && op1.kind == SCC_X86_OPR_IMM);
-    return op0.size == 1 ? SCC_X86_IFORM_MOV_GPR8_IMMB_B0
+    return op0.size_bits == 8 ? SCC_X86_IFORM_MOV_GPR8_IMMB_B0
                               : SCC_X86_IFORM_MOV_GPRV_IMMV;
 }
 static inline scc_x86_iform_t
 scc_mir_x86_mov_mem_reg(scc_x86_operand_value_t op0,
                         scc_x86_operand_value_t op1) {
-    Assert(op0.size == op1.size);
+    Assert(op0.size_bits == op1.size_bits);
     Assert(op0.kind == SCC_X86_OPR_MEM && op1.kind == SCC_X86_OPR_REG);
-    return op0.size == 1 ? SCC_X86_IFORM_MOV_MEMB_GPR8
+    return op0.size_bits == 8 ? SCC_X86_IFORM_MOV_MEMB_GPR8
                               : SCC_X86_IFORM_MOV_MEMV_GPRV;
 }
+
 static inline scc_x86_iform_t
 scc_mir_x86_mov_mem_imm(scc_x86_operand_value_t op0,
                         scc_x86_operand_value_t op1) {
-    Assert(op0.size == op1.size);
+    Assert(op0.size_bits == op1.size_bits);
     Assert(op0.kind == SCC_X86_OPR_MEM && op1.kind == SCC_X86_OPR_IMM);
-    return op0.size == 1 ? SCC_X86_IFORM_MOV_MEMB_IMMB
+    return op0.size_bits == 8 ? SCC_X86_IFORM_MOV_MEMB_IMMB
                               : SCC_X86_IFORM_MOV_MEMV_IMMZ;
 }
 
+static inline u8 get_op_size_bits(scc_x86_operand_value_t op, cbool get_value) {
+    if (get_value) {
+        return op.size_bits;
+    }
+    if (op.kind == SCC_X86_OPR_MEM) {
+        return 64;
+    }
+    if (op.kind == SCC_X86_OPR_RELOC && op.reloc.kind == SCC_X86_OPR_MEM) {
+        return 64;
+    }
+    return op.size_bits;
+}
+
 void scc_x86_emit_move_to_vec(scc_mir_x86_instr_vec_t *vec,
                               scc_x86_operand_value_t dst,
                               scc_x86_operand_value_t src) {
-    if (dst.size != src.size) {
-        LOG_WARN("Mismatched register sizes for move %d != %d", dst.size,
-                 src.size);
+    u8 dst_size = get_op_size_bits(dst, false);
+    u8 src_size = get_op_size_bits(src, false);
+    if (dst_size != src_size) {
+        LOG_FATAL("Mismatched register sizes for move %d != %d", dst_size,
+                  src_size);
     }
     scc_mir_x86_instr_t ins;
     if (dst.kind == SCC_X86_OPR_REG) {
@@ -60,7 +76,7 @@ void scc_x86_emit_move_to_vec(scc_mir_x86_instr_vec_t *vec,
         } else if (src.kind == SCC_X86_OPR_MEM ||
                    (src.kind == SCC_X86_OPR_RELOC &&
                     src.reloc.target == SCC_X86_RELOC_TARGET_SYMBOL)) {
-            Assert(dst.size == 8);
+            Assert(dst_size == 64);
             scc_mir_x86_instr_2(&ins, SCC_X86_IFORM_LEA_GPRV_AGEN, dst, src,
                                 scc_pos_create());
         } else {
@@ -85,8 +101,11 @@ void scc_x86_emit_move_to_vec(scc_mir_x86_instr_vec_t *vec,
 void scc_x86_emit_load_to_vec(scc_mir_x86_instr_vec_t *vec,
                               scc_x86_operand_value_t dst,
                               scc_x86_operand_value_t src_addr) {
-    if (dst.size != src_addr.size) {
-        LOG_WARN("Mismatched sizes for load %d != %d", dst.size, src_addr.size);
+    u8 dst_size = get_op_size_bits(dst, false);
+    u8 src_addr_size = get_op_size_bits(src_addr, true);
+    if (dst_size != src_addr_size) {
+        LOG_FATAL("Mismatched sizes for load %d != %d", dst_size,
+                  src_addr_size);
     }
     Assert(dst.kind == SCC_X86_OPR_REG);
     scc_x86_operand_value_t mem_op;
@@ -99,9 +118,9 @@ void scc_x86_emit_load_to_vec(scc_mir_x86_instr_vec_t *vec,
                     .index = SCC_X86_REG_INVALID,
                     .scale = 1,
                     .disp.displacement = 0,
-                    .disp.displacement_bits = src_addr.size * 8,
+                    .disp.displacement_bits = src_addr_size,
                 },
-            .size = src_addr.size,
+            .size_bits = src_addr_size,
         };
     } else if (src_addr.kind == SCC_X86_OPR_MEM) {
         mem_op = src_addr;
@@ -117,9 +136,11 @@ void scc_x86_emit_load_to_vec(scc_mir_x86_instr_vec_t *vec,
 void scc_x86_emit_store_to_vec(scc_mir_x86_instr_vec_t *vec,
                                scc_x86_operand_value_t dst_addr,
                                scc_x86_operand_value_t src) {
-    if (dst_addr.size != src.size) {
-        LOG_WARN("Mismatched sizes for store %d != %d", dst_addr.size,
-                 src.size);
+    u8 dst_addr_size = get_op_size_bits(dst_addr, true);
+    u8 src_size = get_op_size_bits(src, false);
+    if (dst_addr_size != src_size) {
+        LOG_FATAL("Mismatched sizes for store %d != %d", dst_addr_size,
+                  src_size);
     }
     scc_x86_operand_value_t mem_op;
     if (dst_addr.kind == SCC_X86_OPR_REG) {
@@ -131,9 +152,9 @@ void scc_x86_emit_store_to_vec(scc_mir_x86_instr_vec_t *vec,
                     .index = SCC_X86_REG_INVALID,
                     .scale = 1,
                     .disp.displacement = 0,
-                    .disp.displacement_bits = dst_addr.size * 8,
+                    .disp.displacement_bits = dst_addr_size,
                 },
-            .size = dst_addr.size,
+            .size_bits = dst_addr_size,
         };
     } else if (dst_addr.kind == SCC_X86_OPR_MEM) {
         mem_op = dst_addr;

libs/ir/mir/src/arch/scc_x86_reg_alloc.c

@@ -73,16 +73,25 @@ static void get_implicit_regs(void *ctx, int opcode, const int **uses,
     }
 }
 
-/* ========== 寄存器池 ========== */
+/* ========== 默认寄存器池（位掩码策略） ========== */
 
-static const int reg_pool[] = {
-    SCC_X86_REG_R8,  SCC_X86_REG_R9,  SCC_X86_REG_R10, SCC_X86_REG_R11,
-    SCC_X86_REG_R12, SCC_X86_REG_R13, SCC_X86_REG_R14, SCC_X86_REG_R15};
+/*
+ * R8/R9 被排除在通用寄存器池之外，因为它们被 Win64 ABI 用作参数传递寄存器
+ * （RCX=arg0, RDX=arg1, R8=arg2, R9=arg3）。
+ * 如果把它们放在池中，当 lower_call 发出 MOV R8, vreg 时，
+ * 分配器可能把 R8 分配给源 vreg，导致冗余的 MOV R8, R8。
+ *
+ * 可用寄存器: R10, R11, R12, R13, R14, R15
+ */
+static const int reg_pool[] = {SCC_X86_REG_R10, SCC_X86_REG_R11,
+                               SCC_X86_REG_R12, SCC_X86_REG_R13,
+                               SCC_X86_REG_R14, SCC_X86_REG_R15};
+#define REG_POOL_SIZE ((int)SCC_ARRLEN(reg_pool))
 static uint32_t reg_mask = 0;
 
 static int acquire_reg(void *ctx) {
     (void)ctx;
-    for (int i = 0; i < SCC_ARRLEN(reg_pool); i++)
+    for (int i = 0; i < REG_POOL_SIZE; i++)
         if (!(reg_mask & (1u << i))) {
             reg_mask |= (1u << i);
             return reg_pool[i];
@@ -92,7 +101,7 @@ static int acquire_reg(void *ctx) {
 
 static void release_reg(void *ctx, int preg) {
     (void)ctx;
-    for (int i = 0; i < SCC_ARRLEN(reg_pool); i++)
+    for (int i = 0; i < REG_POOL_SIZE; i++)
         if (reg_pool[i] == preg) {
             reg_mask &= ~(1u << i);
             return;
@@ -101,7 +110,7 @@ static void release_reg(void *ctx, int preg) {
 
 static void mark_reg_used(void *ctx, int preg) {
     (void)ctx;
-    for (int i = 0; i < SCC_ARRLEN(reg_pool); i++)
+    for (int i = 0; i < REG_POOL_SIZE; i++)
         if (reg_pool[i] == preg) {
             reg_mask |= (1u << i);
             return;
@@ -113,13 +122,64 @@ static void clean_mark_regs(void *ctx) {
     reg_mask = 0;
 }
 
+/* ========== 顺序分配策略（光标，永不回收） ========== */
+
+/*
+ * 顺序分配策略：按固定顺序分配寄存器（R8 → R9 → ... → R15），
+ * 一旦分配就永不回收（release_reg 为空操作）。
+ * 当所有 8 个寄存器耗尽后，acquire_reg 返回 -1，
+ * 分配器将 vreg 直接替换为栈槽（spill/reload 由内存操作数隐式完成）。
+ *
+ * 包含 R8/R9 是安全的，因为顺序分配避免了冲突：
+ * - 如果 R8 已被分配，参数 MOV R8, vreg 中的 vreg 会分配下一个可用寄存器（如
+ * R10）， 然后通过 MOV R8, R10 将值移入 R8。
+ * - 如果 R8 尚未分配，参数 MOV R8, vreg 的 vreg 会分配到 R8，
+ *   产生 MOV R8, R8（空操作），这在功能上是正确的。
+ */
+static const int seq_pool[] = {
+    SCC_X86_REG_R8,  SCC_X86_REG_R9,  SCC_X86_REG_R10, SCC_X86_REG_R11,
+    SCC_X86_REG_R12, SCC_X86_REG_R13, SCC_X86_REG_R14, SCC_X86_REG_R15};
+#define SEQ_POOL_SIZE ((int)SCC_ARRLEN(seq_pool))
+static int seq_cursor = 0;
+
+static int seq_acquire_reg(void *ctx) {
+    (void)ctx;
+    if (seq_cursor < SEQ_POOL_SIZE)
+        return seq_pool[seq_cursor++];
+    return -1; /* 寄存器耗尽 */
+}
+
+static void seq_release_reg(void *ctx, int preg) {
+    (void)ctx;
+    (void)preg;
+    /* 永不回收：释放为空操作 */
+}
+
+static void seq_mark_reg_used(void *ctx, int preg) {
+    (void)ctx;
+    for (int i = seq_cursor; i < SEQ_POOL_SIZE; i++)
+        if (seq_pool[i] == preg) {
+            /* 将光标移到该寄存器之后（燃烧） */
+            if (i + 1 > seq_cursor)
+                seq_cursor = i + 1;
+            return;
+        }
+}
+
+static void seq_clean_mark_regs(void *ctx) {
+    (void)ctx;
+    seq_cursor = 0;
+}
+
+/* ========== 指令迭代器（两种策略共享） ========== */
+
 static void x86_alloc_iter_begin(scc_reg_alloc_iter_t *iter) {
     iter->op_idx = 0;
     iter->op_sub_idx = 0;
 }
 
 static cbool x86_alloc_iter_next(scc_reg_alloc_iter_t *iter, int *out_vreg,
-                                 int *out_size,
+                                 int *out_size_bits,
                                  scc_reg_op_access_t *out_access) {
     const scc_mir_x86_instr_t *ins = (const scc_mir_x86_instr_t *)iter->instr;
     scc_x86_iform_t opcode = ins->x86_instr.opcode;
@@ -128,10 +188,10 @@ static cbool x86_alloc_iter_next(scc_reg_alloc_iter_t *iter, int *out_vreg,
     while (iter->op_idx < num_ops) {
         const scc_x86_operand_value_t *op =
             &ins->x86_instr.operands[iter->op_idx];
-        scc_reg_op_access_t base_access = SCC_REG_ALLOC_OP_ACCESS_READWRITE;
-        // base_access = get_operand_access(opcode, iter->op_idx);
+        scc_reg_op_access_t base_access =
+            get_operand_access(opcode, iter->op_idx);
 
-        *out_size = op->size;
+        *out_size_bits = op->size_bits;
         if (op->kind == SCC_X86_OPR_REG) {
             if (iter->op_sub_idx == 0 && scc_x86_op_is_vreg(op)) {
                 *out_vreg = scc_x86_op_get_vreg(op);
@@ -144,7 +204,7 @@ static cbool x86_alloc_iter_next(scc_reg_alloc_iter_t *iter, int *out_vreg,
             continue;
         } else if (op->kind == SCC_X86_OPR_MEM) {
             const scc_x86_mem_t *mem = &op->mem;
-            *out_size = 8;
+            *out_size_bits = 64;
             // 子索引 0: 基址寄存器
             if (iter->op_sub_idx == 0) {
                 if (mem->base != SCC_X86_REG_INVALID &&
@@ -223,6 +283,8 @@ static void x86_alloc_iter_end(scc_reg_alloc_iter_t *iter) {
     (void)iter; // 无需清理
 }
 
+/* ========== 回调表填充 ========== */
+
 void scc_reg_alloc_fill_arch_x86(scc_reg_alloc_op_t *ops) {
     ops->acquire_reg = acquire_reg;
     ops->release_reg = release_reg;
@@ -240,3 +302,21 @@ void scc_reg_alloc_fill_arch_x86(scc_reg_alloc_op_t *ops) {
     ops->emit_reload = emit_reload;
     ops->emit_copy = emit_copy;
 }
+
+void scc_reg_alloc_fill_seq_x86(scc_reg_alloc_op_t *ops) {
+    ops->acquire_reg = seq_acquire_reg;
+    ops->release_reg = seq_release_reg;
+    ops->mark_reg_used = seq_mark_reg_used;
+    ops->clean_mark_regs = seq_clean_mark_regs;
+
+    ops->alloc_iter_begin = x86_alloc_iter_begin;
+    ops->alloc_iter_next = x86_alloc_iter_next;
+    ops->alloc_iter_replace_preg = x86_alloc_iter_replace_preg;
+    ops->alloc_iter_replace_slot = x86_alloc_iter_replace_slot;
+    ops->alloc_iter_end = x86_alloc_iter_end;
+    ops->get_implicit_regs = get_implicit_regs;
+
+    ops->emit_spill = emit_spill;
+    ops->emit_reload = emit_reload;
+    ops->emit_copy = emit_copy;
+}

libs/ir/mir/src/reg_alloc/reg_alloc.c

@@ -49,6 +49,7 @@ static void alloc_instr(scc_reg_alloc_ctx_t *ctx,
         if (mapping == 0)
             slot = scc_mir_vreg_map2slot(ctx->func, vreg, size, 8);
         preg = ops->acquire_reg(ctx);
+        if (preg >= 0) {
             scc_vec_push(allocated, preg);
 
             if (access == SCC_REG_ALLOC_OP_ACCESS_READ ||
@@ -59,6 +60,10 @@ static void alloc_instr(scc_reg_alloc_ctx_t *ctx,
                 ops->emit_spill(&after, preg, slot, size);
 
             ops->alloc_iter_replace_preg(&iter, preg, size);
+        } else {
+            /* 寄存器耗尽（顺序策略）：vreg 直接使用栈槽 */
+            ops->alloc_iter_replace_slot(&iter, slot, size);
+        }
     }
     ops->alloc_iter_end(&iter);
 

libs/ir/mir/src/scc_mir_dump.c

@@ -23,7 +23,7 @@ void scc_mir_dump_bblock(scc_mir_dump_ctx_t *ctx, const scc_mir_func_t *func,
             switch (instr->opcode) {
             case SCC_MIR_PSEUDO_ALLOCA:
                 scc_tree_dump_append_fmt(td, "  alloca(%d)",
-                                         instr->data.alloc.size);
+                                         instr->data.alloc.size_bits);
                 break;
             default:
                 break;

libs/ir/mir/src/scc_mir_module.c

@@ -8,7 +8,24 @@ void scc_mir_module_init(scc_mir_module_t *mir_module) {
 }
 
 void scc_mir_module_drop(scc_mir_module_t *mir_module) {
-    // FIXME memory leak
+    for (usize i = 0; i < scc_vec_size(mir_module->func_metas); i++) {
+        scc_mir_func_meta_t *meta = mir_module->func_metas.data[i];
+        scc_vec_free(meta->stack_slots);
+        scc_hashtable_drop(&meta->vreg2physic);
+        scc_free(meta);
+    }
+    for (usize i = 0; i < scc_vec_size(mir_module->symbol_metas); i++) {
+        scc_mir_symbol_meta_t *meta = mir_module->symbol_metas.data[i];
+        usize cfg_idx = i + 1;
+        if (cfg_idx < scc_vec_size(mir_module->cfg_module.symbols)) {
+            scc_cfg_symbol_t *sym = &mir_module->cfg_module.symbols.data[cfg_idx];
+            if (sym->kind == SCC_CFG_SYMBOL_KIND_DATA && meta->data.init_data) {
+                scc_free(meta->data.init_data);
+            }
+        }
+        scc_free(meta);
+    }
     scc_vec_free(mir_module->func_metas);
     scc_vec_free(mir_module->symbol_metas);
+    scc_cfg_module_drop(&mir_module->cfg_module);
 }

libs/ir/mir/src/target/win64_abi.c

@@ -41,7 +41,7 @@ static void frame_layout_impl(scc_frame_layout_t *ctx,
                             .index = SCC_X86_REG_INVALID,
                             .scale = 1,
                         },
-                        op->size);
+                        op->size_bits);
                 }
             }
         }
@@ -82,7 +82,7 @@ static void frame_layout_impl(scc_frame_layout_t *ctx,
                             .index = SCC_X86_REG_INVALID,
                             .scale = 1,
                         },
-                        op->size);
+                        op->size_bits);
                 }
             }
         }
@@ -118,7 +118,7 @@ static void prologue(scc_mir_instr_vec_t *userdata,
         /// FILL to shadow space
     }
 
-    u8 size = 8;
+    u8 size = 64;
     // sub rsp, frame_size
     if (frame_size > 0) {
         scc_mir_x86_instr_2(&instr, SCC_X86_IFORM_SUB_GPRV_IMMZ,
@@ -141,7 +141,7 @@ static void epilogue(scc_mir_instr_vec_t *userdata,
     */
     scc_mir_func_meta_t *meta = SCC_MIR_FUNC_META(func);
     int frame_size = meta->frame_size;
-    u8 size = 8;
+    u8 size = 64;
     // add rsp, frame_size
     if (frame_size > 0) {
         scc_mir_x86_instr_2(&instr, SCC_X86_IFORM_ADD_GPRV_IMMZ,
@@ -171,10 +171,14 @@ void scc_win_pc_x64_prolog_epilog_init(scc_prolog_epilog_t *ctx) {
     ctx->need_epilog = need_epilog;
 }
 
+/*
+windows x64 calling convention
+https://learn.microsoft.com/zh-cn/cpp/build/x64-calling-convention?view=msvc-180#varargs
+*/
 static void lower_call(void *userdata, const scc_lir_instr_t *instr) {
     scc_x86_64_isel_t *isel = userdata;
 
-    u8 size = 8;
+    u8 size = 64;
     scc_mir_func_meta_t *meta = SCC_MIR_FUNC_META(isel->func);
     int call_stack_size = instr->metadata.call.arg_count * 8;
     if (meta->frame_size < call_stack_size) {
@@ -229,7 +233,7 @@ static void lower_call(void *userdata, const scc_lir_instr_t *instr) {
         Panic("unhandled opcode");
     }
 
-    int ret_size = instr->size;
+    int ret_size = instr->size_bits;
     scc_x86_operand_value_t ret_reg =
         scc_x86_lir_val_to_mir_op(isel, &instr->to, ret_size);
     if (ret_reg.kind != SCC_X86_OPR_NONE && ret_size != 0) {
@@ -261,7 +265,7 @@ static void lower_param(void *userdata, const scc_lir_val_t *val,
                         void *out_op) {
     scc_x86_operand_value_t *out = out_op;
     Assert(val->kind == SCC_LIR_INSTR_KIND_ARG);
-    u8 size = 8;
+    u8 size = 64;
     switch (val->data.arg) {
     case 0:
         *out = scc_x86_op_preg(SCC_X86_REG_RCX, size);
@@ -288,10 +292,10 @@ static void lower_ret(void *userdata, const scc_lir_instr_t *instr) {
     scc_x86_64_isel_t *isel = userdata;
     scc_lir_val_t ret_val = instr->metadata.ret_val;
     u8 size = 0;
-    if (instr->size) {
-        size = instr->size;
+    if (instr->size_bits) {
+        size = instr->size_bits;
     } else {
-        size = 8;
+        size = 64;
     }
     if (ret_val.kind != SCC_LIR_INSTR_KIND_NONE) {
         scc_x86_emit_move(isel, scc_x86_op_preg(SCC_X86_REG_RAX, size),

libs/ir2mcode/src/scc_ir2mcode.c

@@ -9,7 +9,6 @@
 #include <x86/scc_x86_reg.h>
 
 scc_x86_reg_t mir_x86_trans_gpr(scc_x86_reg_t reg, u8 size) {
-    size *= 8;
     if (size == 0) {
         return reg;
     }
@@ -77,7 +76,7 @@ void mir_x86_to_mcode(scc_mcode_t *mcode, scc_reloc_vec_t *relocs,
             }
         } else if (op_ptr->kind == SCC_X86_OPR_REG) {
             ops[i].kind = SCC_X86_OPR_REG;
-            ops[i].reg = mir_x86_trans_gpr(op_ptr->reg, op_ptr->size);
+            ops[i].reg = mir_x86_trans_gpr(op_ptr->reg, op_ptr->size_bits);
         } else {
             ops[i] = *op_ptr;
         }

libs/lexer/include/scc_lexer.h

@@ -21,10 +21,14 @@ typedef struct scc_lexer {
     scc_lexer_tok_ring_t ring;
     int ring_ref_count;
     int jump_macro;
+    int max_token_len; /**< 最大 token 长度, 0=不限制 */
 } scc_lexer_t;
 
 void scc_lexer_init(scc_lexer_t *lexer, scc_sstream_ring_t *stream_ref);
 
+/** @brief 设置最大 token 长度限制, 超过时报错。0=不限制(默认) */
+void scc_lexer_set_max_token_len(scc_lexer_t *lexer, int max_len);
+
 /**
  * @brief 获取原始token
  * @param[in] lexer 词法分析器实例

libs/lexer/src/lexer.c

@@ -44,6 +44,11 @@ void scc_lexer_init(scc_lexer_t *lexer, scc_sstream_ring_t *stream_ref) {
     lexer->stream_ref = stream_ref;
     lexer->ring_ref_count = 0;
     lexer->jump_macro = false;
+    lexer->max_token_len = 0; /* 0=不限制, 兼容旧行为 */
+}
+
+void scc_lexer_set_max_token_len(scc_lexer_t *lexer, int max_len) {
+    lexer->max_token_len = max_len;
 }
 
 static inline cbool is_whitespace(int ch) {
@@ -80,6 +85,11 @@ static inline cbool next_char(scc_lexer_t *lexer, scc_str_t *lexeme,
     scc_ring_next(*lexer->stream_ref, *out, ok);
     if (!ok)
         return false;
+    if (lexer->max_token_len > 0 &&
+        scc_str_len(lexeme) >= (usize)lexer->max_token_len) {
+        LOG_ERROR("token exceeds maximum length (%d)", lexer->max_token_len);
+        return false;
+    }
     scc_str_append_ch(lexeme, out->character);
     return true;
 }

libs/mcode/include/scc_mcode.h

@@ -35,6 +35,42 @@ static inline void scc_mcode_drop(scc_mcode_t *mcode) {
     mcode->is_littel_endian = true;
 }
 
+/**
+ * @brief 接管一个现有缓冲区的所有权作为 mcode 的代码数据
+ *
+ * 释放 mcode 原有的 code 缓冲区, 然后将 buf 的内部指针/容量/大小
+ * 转移到 mcode->code。调用后 buf 被重新初始化(空向量)。
+ * 避免拷贝大块代码数据。
+ */
+static inline void scc_mcode_adopt_buf(scc_mcode_t *mcode,
+                                        scc_mcode_buff_t *buf) {
+    scc_vec_free(mcode->code);
+    mcode->code.size = buf->size;
+    mcode->code.cap = buf->cap;
+    mcode->code.data = buf->data;
+    buf->size = 0;
+    buf->cap = 0;
+    buf->data = NULL;
+}
+
+/**
+ * @brief 释放 mcode 内部 code 缓冲区的所有权到目标向量
+ *
+ * 将 mcode->code 的数据指针/容量/大小转移到 out 向量,
+ * 然后 mcode->code 被重新初始化(空向量)。
+ * 避免拷贝大块代码数据。
+ */
+static inline void scc_mcode_disown_buf(scc_mcode_t *mcode,
+                                         scc_mcode_buff_t *out) {
+    scc_vec_free(*out);
+    out->size = mcode->code.size;
+    out->cap = mcode->code.cap;
+    out->data = mcode->code.data;
+    mcode->code.size = 0;
+    mcode->code.cap = 0;
+    mcode->code.data = NULL;
+}
+
 static inline void scc_mcode_add_u8(scc_mcode_t *mcode, u8 data) {
     scc_vec_push(mcode->code, data);
 }

libs/mcode/include/x86/scc_x86_encode.h

@@ -45,26 +45,28 @@ typedef struct {
         scc_x86_mem_t mem;
         scc_x86_reloc_op_t reloc;
     };
-    u8 size;
+    u8 size_bits;
 } scc_x86_operand_value_t;
 
 static inline scc_x86_operand_value_t scc_x86_op_preg(scc_x86_reg_t reg,
-                                                      u8 size) {
+                                                      u8 size_bits) {
+    Assert(size_bits % 8 == 0);
     scc_x86_operand_value_t o = {
         .kind = SCC_X86_OPR_REG,
         .reg = reg,
-        .size = size,
+        .size_bits = size_bits,
     };
     return o;
 }
 static inline scc_x86_reg_t scc_x86_op_vreg_reg(int vreg) {
     return (int)SCC_X86_REG_COUNT + vreg;
 }
-static inline scc_x86_operand_value_t scc_x86_op_vreg(int vreg, u8 size) {
+static inline scc_x86_operand_value_t scc_x86_op_vreg(int vreg, u8 size_bits) {
+    Assert(size_bits % 8 == 0);
     scc_x86_operand_value_t o = {
         .kind = SCC_X86_OPR_REG,
         .reg = scc_x86_op_vreg_reg(vreg),
-        .size = size,
+        .size_bits = size_bits,
     };
     return o;
 }
@@ -72,24 +74,26 @@ static inline scc_x86_operand_value_t scc_x86_op_relbr(i32 rel) {
     scc_x86_operand_value_t o = {
         .kind = SCC_X86_OPR_RELBR,
         .brdisp = rel,
-        .size = 4,
+        .size_bits = 32,
     };
     return o;
 }
-static inline scc_x86_operand_value_t scc_x86_op_imm(i64 imm, u8 size) {
+static inline scc_x86_operand_value_t scc_x86_op_imm(i64 imm, u8 size_bits) {
+    Assert(size_bits % 8 == 0);
     scc_x86_operand_value_t o = {
         .kind = SCC_X86_OPR_IMM,
         .simm0 = imm,
-        .size = size,
+        .size_bits = size_bits,
     };
     return o;
 }
 static inline scc_x86_operand_value_t scc_x86_op_mem(scc_x86_mem_t mem,
-                                                     u8 size) {
+                                                     u8 size_bits) {
+    Assert(size_bits % 8 == 0);
     scc_x86_operand_value_t o = {
         .kind = SCC_X86_OPR_MEM,
         .mem = mem,
-        .size = size,
+        .size_bits = size_bits,
     };
     return o;
 }
@@ -102,7 +106,7 @@ scc_x86_op_reloc_global_imm(const char *sym, i64 addend) {
     op.reloc.target = SCC_X86_RELOC_TARGET_SYMBOL;
     op.reloc.global_name = sym;
     op.reloc.addend = addend;
-    op.size = 0;
+    op.size_bits = 0;
     return op;
 }
 
@@ -113,7 +117,7 @@ scc_x86_op_reloc_global_relrip(const char *sym, i64 addend) {
     op.reloc.target = SCC_X86_RELOC_TARGET_SYMBOL;
     op.reloc.global_name = sym;
     op.reloc.addend = addend;
-    op.size = 4;
+    op.size_bits = 32;
     return op;
 }
 
@@ -125,7 +129,7 @@ scc_x86_op_reloc_global_relbr(const char *sym, i64 addend) {
     op.reloc.target = SCC_X86_RELOC_TARGET_SYMBOL;
     op.reloc.global_name = sym;
     op.reloc.addend = addend;
-    op.size = 4;
+    op.size_bits = 32;
     return op;
 }
 
@@ -137,7 +141,7 @@ static inline scc_x86_operand_value_t scc_x86_op_reloc_block(int bid,
     op.reloc.target = SCC_X86_RELOC_TARGET_BBLOCK;
     op.reloc.bblock_id = bid;
     op.reloc.addend = addend;
-    op.size = 4;
+    op.size_bits = 32;
     return op;
 }
 
@@ -151,7 +155,7 @@ scc_x86_op_reloc_global_mem(const char *sym, i64 addend) {
     op.reloc.global_name = sym;
     op.reloc.addend = addend;
     // 编码时需生成 RIP 相对寻址的 ModRM/SIB
-    op.size = 0;
+    op.size_bits = 0;
     return op;
 }
 

libs/mcode/src/scc_x86_encode.c

@@ -61,10 +61,10 @@ static int infer_operand_width(const scc_x86_iform_info_t *info,
     for (int i = 0; i < info->num_explicit_ops; i++) {
         if (ops[i].kind == SCC_X86_OPR_REG && !info->ops[i].is_implicit) {
             uint16_t w;
-            if (ops[i].size > 0 && ops[i].reg >= SCC_X86_REG_R8 &&
+            if (ops[i].size_bits > 0 && ops[i].reg >= SCC_X86_REG_R8 &&
                 ops[i].reg <= SCC_X86_REG_R15) {
-                /* R8-R15：宽度由 size 字段推导 */
-                w = ops[i].size * 8;
+                /* R8-R15：宽度由 size_bits 字段推导（单位：bit） */
+                w = ops[i].size_bits;
             } else {
                 w = scc_reg_width(ops[i].reg);
             }

libs/parser/include/scc_parser.h

@@ -14,7 +14,7 @@ typedef struct scc_parser {
     scc_lexer_tok_ring_t *ring;
     usize checkpoint;
 
-    scc_ast_ctx_t *ast_ctx;
+    scc_ast_module_t *ast_module;
     scc_sema_ctx_t *sema_ctx;
     int owned_sema;
     scc_ast_translation_unit_t *translation_unit;
@@ -28,7 +28,7 @@ typedef struct scc_parser {
  * @param callbacks 语义分析回调(可为 nullptr)
  */
 void scc_parser_init(scc_parser_t *parser, scc_lexer_tok_ring_t *tok_ring,
-                     scc_ast_ctx_t *ast_ctx, scc_sema_ctx_t *callbacks);
+                     scc_ast_module_t *ast_module, scc_sema_ctx_t *callbacks);
 
 /**
  * @brief 销毁解析器

libs/parser/include/scc_sema.h

@@ -29,7 +29,7 @@ struct scc_sema_ctx {
     scc_sema_callback_t on_expr;
     scc_sema_callback_t on_type;
     scc_sema_got_type_t got_type;
-    scc_ast_ctx_t *ast_ctx;
+    scc_ast_module_t *ast_module;
 
     scc_ast_stmt_vec_t break_stack;
     scc_ast_stmt_vec_t continue_stack;
@@ -37,7 +37,7 @@ struct scc_sema_ctx {
     void *context;
 };
 
-void scc_sema_init(scc_sema_ctx_t *sema_ctx, scc_ast_ctx_t *ast_ctx);
+void scc_sema_init(scc_sema_ctx_t *sema_ctx, scc_ast_module_t *ast_module);
 void scc_sema_drop(scc_sema_ctx_t *sema_ctx);
 
 #endif /* __SCC_SEMA_H__ */

libs/parser/include/sema_symtab.h

@@ -2,6 +2,7 @@
 #define __SCC_SEMA_SYMTAB_H__
 
 #include <scc_ast.h>
+#include <scc_strpool.h>
 #include <scc_utils.h>
 
 typedef struct scc_parser_scope {
@@ -12,6 +13,7 @@ typedef struct scc_parser_scope {
 typedef struct {
     scc_sema_scope_t root_scope;
     scc_sema_scope_t *current_scope;
+    scc_strpool_t name_pool; /* 拥有符号名（生成的标签名等）的生命周期 */
 } scc_sema_symtab_t;
 
 void scc_sema_symtab_init(scc_sema_symtab_t *symtab);

libs/parser/src/parse_decl.c

@@ -187,7 +187,7 @@ scc_ast_expr_t *scc_parse_initializer(scc_parser_t *parser,
     scc_pos_t pos = tok.loc;
     scc_lexer_tok_drop(&tok);
 
-    init = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+    init = SCC_AST_ALLOC_EXPR(parser->ast_module);
     Assert(init != nullptr);
     scc_ast_expr_vec_t lhs_exprs;
     scc_vec_init(lhs_exprs);
@@ -203,9 +203,9 @@ scc_ast_expr_t *scc_parse_initializer(scc_parser_t *parser,
             tok_ptr = scc_parser_peek(parser);
             if (tok_ptr && tok_ptr->type == SCC_TOK_IDENT) {
                 scc_parser_next_consume(parser, &tok);
-                lhs = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+                lhs = SCC_AST_ALLOC_EXPR(parser->ast_module);
                 Assert(lhs != nullptr);
-                scc_ast_expr_member_init(lhs, ptr, scc_str_as_cstr(&tok.lexeme),
+                scc_ast_expr_member_init(lhs, ptr, scc_ast_module_intern(parser->ast_module, scc_str_as_cstr(&tok.lexeme)),
                                          tok.loc);
                 if (!scc_parser_consume_if(parser, SCC_TOK_ASSIGN)) {
                     ptr = lhs;
@@ -231,7 +231,7 @@ scc_ast_expr_t *scc_parse_initializer(scc_parser_t *parser,
             if (!scc_parser_consume_if(parser, SCC_TOK_R_BRACKET)) {
                 SCC_ERROR(scc_parser_got_current_pos(parser), "Expected ']'");
             }
-            lhs = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+            lhs = SCC_AST_ALLOC_EXPR(parser->ast_module);
             Assert(lhs != nullptr);
             scc_ast_expr_array_subscript_init(lhs, ptr, idx, tok_ptr->loc);
             if (!scc_parser_consume_if(parser, SCC_TOK_ASSIGN)) {
@@ -285,7 +285,7 @@ CONTINUE:
     if (tok_ptr->type == SCC_TOK_ASSIGN) {
         scc_parser_next_consume(parser, nullptr);
         // TODO maybe memory leak
-        scc_ast_expr_t *lvalue = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+        scc_ast_expr_t *lvalue = SCC_AST_ALLOC_EXPR(parser->ast_module);
         scc_ast_expr_lvalue_init(lvalue, decl->var.type, decl->base.loc);
         decl->var.init = scc_parse_initializer(parser, lvalue);
     } else if (tok_ptr->type == SCC_TOK_L_BRACE) {
@@ -348,7 +348,7 @@ CONTINUE:
     } else if (tok_ptr->type == SCC_TOK_COMMA) {
         scc_parser_next_consume(parser, nullptr);
         if (decl_list == nullptr) {
-            decl_list = SCC_AST_ALLOC_DECL(parser->ast_ctx);
+            decl_list = SCC_AST_ALLOC_DECL(parser->ast_module);
             Assert(decl_list != nullptr);
             scc_vec_push(decl_list_vec, decl);
         } else {
@@ -365,7 +365,9 @@ CONTINUE:
     }
 
 RETURN:
+    scc_vec_free(decl_list_vec);
     return decl;
 ERROR:
+    scc_vec_free(decl_list_vec);
     return nullptr;
 }

libs/parser/src/parse_expr.c

@@ -371,7 +371,7 @@ static scc_ast_expr_t *parse_expression_with_precedence(scc_parser_t *parser,
             return nullptr;
         }
 
-        scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+        scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
         Assert(expr != nullptr);
         // FIXME pos
         scc_ast_expr_binary_init(expr, op, left, right, left->base.loc);
@@ -410,7 +410,7 @@ scc_ast_expr_t *scc_parse_assignment_expression(scc_parser_t *parser) {
             return nullptr;
         }
 
-        scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+        scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
         Assert(expr != nullptr);
         scc_ast_expr_binary_init(expr, op, left, right, pos);
         left = expr;
@@ -456,7 +456,7 @@ static scc_ast_expr_t *parse_conditional_expression(scc_parser_t *parser) {
             return nullptr;
         }
 
-        scc_ast_expr_t *cond = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+        scc_ast_expr_t *cond = SCC_AST_ALLOC_EXPR(parser->ast_module);
         Assert(cond != nullptr);
         scc_ast_expr_cond_init(cond, cond_expr, then_expr, else_expr, pos);
         cond_expr = cond;
@@ -481,13 +481,13 @@ static scc_ast_expr_t *parse_cast_expression(scc_parser_t *parser) {
                 scc_ast_expr_t *operand = parse_cast_expression(parser);
                 if (!operand) {
                     // FIXME postfix-expression
-                    scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+                    scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
                     // FIXME pos
                     scc_ast_expr_lvalue_init(expr, type, type->base.loc);
                     operand = scc_parse_initializer(parser, expr);
                     return operand;
                 }
-                scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+                scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
                 Assert(expr != nullptr);
                 // FIXME pos
                 scc_ast_expr_cast_init(expr, type, operand, type->base.loc);
@@ -559,7 +559,7 @@ static scc_ast_expr_t *parse_unary_expression(scc_parser_t *parser) {
             return nullptr;
         }
 
-        scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+        scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
         Assert(expr != nullptr);
         scc_ast_expr_unary_init(expr, op, operand, pos);
         return expr;
@@ -588,7 +588,7 @@ static scc_ast_expr_t *parse_sizeof_expression(scc_parser_t *parser) {
         return nullptr;
     }
 
-    scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+    scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
 
     if (next->type == SCC_TOK_L_PAREN) {
         scc_parser_store(parser);
@@ -643,7 +643,7 @@ static scc_ast_expr_t *parse_postfix_expression(scc_parser_t *parser) {
         if (!scc_parser_consume_if(parser, SCC_TOK_R_PAREN)) {
             SCC_ERROR(scc_parser_got_current_pos(parser), "Expected ')'");
         }
-        scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+        scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
         scc_ast_expr_lvalue_init(expr, type, pos);
         left = scc_parse_initializer(parser, expr);
         return left;
@@ -672,7 +672,7 @@ static scc_ast_expr_t *parse_postfix_expression(scc_parser_t *parser) {
                 parser_sync(parser);
                 return nullptr;
             }
-            scc_ast_expr_t *subscript = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+            scc_ast_expr_t *subscript = SCC_AST_ALLOC_EXPR(parser->ast_module);
             Assert(subscript != nullptr);
             scc_ast_expr_array_subscript_init(subscript, left, index, pos);
             left = subscript;
@@ -709,7 +709,7 @@ static scc_ast_expr_t *parse_postfix_expression(scc_parser_t *parser) {
                     return nullptr;
                 }
             }
-            scc_ast_expr_t *call = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+            scc_ast_expr_t *call = SCC_AST_ALLOC_EXPR(parser->ast_module);
             Assert(call != nullptr);
             scc_ast_expr_call_init(call, left, &args, pos);
             left = call;
@@ -729,9 +729,9 @@ static scc_ast_expr_t *parse_postfix_expression(scc_parser_t *parser) {
                 parser_sync(parser);
                 return nullptr;
             }
-            const char *name = scc_str_as_cstr(&ident_tok.lexeme);
+            const char *name = scc_ast_module_intern(parser->ast_module, scc_str_as_cstr(&ident_tok.lexeme));
 
-            scc_ast_expr_t *member = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+            scc_ast_expr_t *member = SCC_AST_ALLOC_EXPR(parser->ast_module);
             Assert(member != nullptr);
             if (op_tok.type == SCC_TOK_DOT) {
                 scc_ast_expr_member_init(member, left, name, ident_tok.loc);
@@ -750,7 +750,7 @@ static scc_ast_expr_t *parse_postfix_expression(scc_parser_t *parser) {
             if (!scc_parser_next_consume(parser, &op_tok))
                 return left;
             scc_ast_expr_op_t op = map_token_to_unary_op(op_tok.type, false);
-            scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+            scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
             Assert(expr != nullptr);
             scc_ast_expr_unary_init(expr, op, left, op_tok.loc);
             scc_lexer_tok_drop(&op_tok);
@@ -785,36 +785,36 @@ static scc_ast_expr_t *parse_primary_expression(scc_parser_t *parser) {
     case SCC_TOK_IDENT: {
         if (!scc_parser_next_consume(parser, &tok))
             return nullptr;
-        expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+        expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
         Assert(expr != nullptr);
-        scc_ast_expr_identifier_init(expr, scc_str_as_cstr(&tok.lexeme),
+        scc_ast_expr_identifier_init(expr, scc_ast_module_intern(parser->ast_module, scc_str_as_cstr(&tok.lexeme)),
                                      tok.loc);
         break;
     }
     case SCC_TOK_INT_LITERAL: {
         if (!scc_parser_next_consume(parser, &tok))
             return nullptr;
-        expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+        expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
         Assert(expr != nullptr);
-        scc_ast_expr_literal_int_init(expr, scc_str_as_cstr(&tok.lexeme), false,
+        scc_ast_expr_literal_int_init(expr, scc_ast_module_intern(parser->ast_module, scc_str_as_cstr(&tok.lexeme)), false,
                                       tok.loc);
         break;
     }
     case SCC_TOK_FLOAT_LITERAL: {
         if (!scc_parser_next_consume(parser, &tok))
             return nullptr;
-        expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+        expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
         Assert(expr != nullptr);
-        scc_ast_expr_literal_float_init(expr, scc_str_as_cstr(&tok.lexeme),
+        scc_ast_expr_literal_float_init(expr, scc_ast_module_intern(parser->ast_module, scc_str_as_cstr(&tok.lexeme)),
                                         false, tok.loc);
         break;
     }
     case SCC_TOK_CHAR_LITERAL: {
         if (!scc_parser_next_consume(parser, &tok))
             return nullptr;
-        expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+        expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
         Assert(expr != nullptr);
-        scc_ast_expr_literal_char_init(expr, scc_str_as_cstr(&tok.lexeme),
+        scc_ast_expr_literal_char_init(expr, scc_ast_module_intern(parser->ast_module, scc_str_as_cstr(&tok.lexeme)),
                                        false, tok.loc);
         break;
     }
@@ -835,10 +835,12 @@ static scc_ast_expr_t *parse_primary_expression(scc_parser_t *parser) {
             scc_str_append(&string, &tmp);
         }
 
-        expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+        const char *pooled_str = scc_ast_module_intern(parser->ast_module, scc_str_as_cstr(&string));
+        scc_str_drop(&string);
+        expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
         Assert(expr != nullptr);
         // FIXME loc
-        scc_ast_expr_literal_string_init(expr, scc_str_as_cstr(&string), true,
+        scc_ast_expr_literal_string_init(expr, pooled_str, false,
                                          tok.loc);
         break;
     }
@@ -880,7 +882,7 @@ scc_ast_expr_t *scc_parse_expression(scc_parser_t *parser) {
             parser_sync(parser);
             return nullptr;
         }
-        scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+        scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
         Assert(expr != nullptr);
         scc_ast_expr_binary_init(expr, SCC_AST_OP_COMMA, left, right, pos);
         left = expr;

libs/parser/src/parse_stmt.c

@@ -83,9 +83,9 @@ static scc_ast_stmt_t *parse_label_statement(scc_parser_t *parser,
         Panic("expect stmt");
     }
 
-    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_ctx);
+    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_module);
     Assert(stmt != nullptr);
-    scc_ast_stmt_label_init(stmt, scc_str_as_cstr(&tok.lexeme), statement, pos);
+    scc_ast_stmt_label_init(stmt, scc_ast_module_intern(parser->ast_module, scc_str_as_cstr(&tok.lexeme)), statement, pos);
     return stmt;
 }
 
@@ -114,7 +114,7 @@ static scc_ast_stmt_t *parse_case_statement(scc_parser_t *parser,
         Panic("expect stmt");
     }
 
-    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_ctx);
+    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_module);
     scc_ast_stmt_case_init(stmt, expr, statement, pos);
     return stmt;
 }
@@ -136,7 +136,7 @@ static scc_ast_stmt_t *parse_default_statement(scc_parser_t *parser,
         Panic("expect stmt");
     }
 
-    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_ctx);
+    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_module);
     scc_ast_stmt_default_init(stmt, statement, pos);
     return stmt;
 }
@@ -168,7 +168,7 @@ static scc_ast_stmt_t *parse_compound_statement(scc_parser_t *parser,
     }
     scc_sema_stmt(parser, scc_ast_stmt_t_END, nullptr);
 
-    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_ctx);
+    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_module);
     scc_ast_stmt_compound_init(stmt, &block_items, pos);
     return stmt;
 }
@@ -188,7 +188,7 @@ static scc_ast_stmt_t *parse_if_statement(scc_parser_t *parser, scc_pos_t pos) {
         opt_else = nullptr;
     }
 
-    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_ctx);
+    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_module);
     scc_ast_stmt_if_init(stmt, expression, statement, opt_else, pos);
     return stmt;
 }
@@ -198,7 +198,7 @@ static scc_ast_stmt_t *parse_switch_statement(scc_parser_t *parser,
     if (!scc_parser_consume_if(parser, SCC_TOK_SWITCH)) {
         return nullptr;
     }
-    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_ctx);
+    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_module);
     stmt->base.type = SCC_AST_STMT_SWITCH;
 
     scc_ast_expr_t *expression = ast_parse_paren_expression(parser);
@@ -216,7 +216,7 @@ static scc_ast_stmt_t *parse_while_statement(scc_parser_t *parser,
     if (!scc_parser_consume_if(parser, SCC_TOK_WHILE)) {
         return nullptr;
     }
-    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_ctx);
+    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_module);
     stmt->base.type = SCC_AST_STMT_WHILE;
 
     scc_ast_expr_t *expression = ast_parse_paren_expression(parser);
@@ -234,7 +234,7 @@ static scc_ast_stmt_t *parse_do_while_statement(scc_parser_t *parser,
     if (!scc_parser_consume_if(parser, SCC_TOK_DO)) {
         return nullptr;
     }
-    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_ctx);
+    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_module);
     stmt->base.type = SCC_AST_STMT_DO_WHILE;
 
     scc_sema_stmt(parser, scc_ast_stmt_t_BEGIN, stmt);
@@ -272,7 +272,7 @@ static scc_ast_stmt_t *parse_for_statement(scc_parser_t *parser,
         SCC_ERROR(scc_parser_got_current_pos(parser),
                   "Expected '(' before like `( expression )` .");
     }
-    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_ctx);
+    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_module);
     stmt->base.type = SCC_AST_STMT_FOR;
 
     scc_ast_node_t *init = nullptr;
@@ -314,12 +314,12 @@ static scc_ast_stmt_t *parse_for_statement(scc_parser_t *parser,
 
 static scc_ast_stmt_t *parse_jump_statement(scc_parser_t *parser,
                                             scc_pos_t pos) {
-    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_ctx);
+    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_module);
 
     if (scc_parser_consume_if(parser, SCC_TOK_GOTO)) {
         scc_lexer_tok_t tok = {0};
         if (scc_parser_next_consume(parser, &tok)) {
-            scc_ast_stmt_goto_init(stmt, scc_str_as_cstr(&tok.lexeme), pos);
+            scc_ast_stmt_goto_init(stmt, scc_ast_module_intern(parser->ast_module, scc_str_as_cstr(&tok.lexeme)), pos);
         } else {
             SCC_ERROR(scc_parser_got_current_pos(parser),
                       "Expected label after goto.");
@@ -345,7 +345,7 @@ static scc_ast_stmt_t *parse_expression_statement(scc_parser_t *parser,
                                                   scc_pos_t pos) {
 
     if (scc_parser_consume_if(parser, SCC_TOK_SEMICOLON)) {
-        scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_ctx);
+        scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_module);
         scc_ast_stmt_expr_init(stmt, nullptr, pos);
         return stmt;
     }
@@ -355,7 +355,7 @@ static scc_ast_stmt_t *parse_expression_statement(scc_parser_t *parser,
         return nullptr;
     }
 
-    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_ctx);
+    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_module);
     scc_ast_stmt_expr_init(stmt, expr, pos);
 
     if (!scc_parser_consume_if(parser, SCC_TOK_SEMICOLON)) {

libs/parser/src/parse_type.c

@@ -526,9 +526,9 @@ static scc_ast_qual_type_t *build_type_from_info(scc_parser_t *parser,
         }
     }
 
-    scc_ast_ctx_get_builtin_type(parser->ast_ctx, builtin);
-    scc_ast_qual_type_t *type = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_ctx);
-    scc_ast_type_builtin_init(type, parser->ast_ctx, builtin, pos);
+    scc_ast_module_get_builtin_type(parser->ast_module, builtin);
+    scc_ast_qual_type_t *type = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_module);
+    scc_ast_type_builtin_init(type, parser->ast_module, builtin, pos);
     return type;
 }
 
@@ -551,7 +551,7 @@ static scc_ast_qual_type_t *parse_record_type(scc_parser_t *parser,
     if (tok_ptr->type == SCC_TOK_IDENT) {
         scc_parser_next_consume(parser, &tok);
         tok_ptr = scc_parser_peek(parser);
-        name = scc_str_as_cstr(&tok.lexeme);
+        name = scc_ast_module_intern(parser->ast_module, scc_str_as_cstr(&tok.lexeme));
     } else if (tok_ptr->type != SCC_TOK_L_BRACE) {
         SCC_ERROR(scc_parser_got_current_pos(parser),
                   "Expected name in struct/union/enum specifier");
@@ -581,8 +581,8 @@ static scc_ast_qual_type_t *parse_record_type(scc_parser_t *parser,
 
     type = scc_parse_got_type(parser, scc_str_as_cstr(&symbol_name));
     if (type == nullptr) {
-        scc_ast_canon_type_t *canon = scc_ast_ctx_alloc_type(parser->ast_ctx);
-        scc_ast_decl_t *decl = SCC_AST_ALLOC_DECL(parser->ast_ctx);
+        scc_ast_canon_type_t *canon = scc_ast_module_alloc_type(parser->ast_module);
+        scc_ast_decl_t *decl = SCC_AST_ALLOC_DECL(parser->ast_module);
 
         scc_ast_node_kind_t decl_kind;
         switch (type_kind) {
@@ -607,7 +607,7 @@ static scc_ast_qual_type_t *parse_record_type(scc_parser_t *parser,
         }
 
         scc_ast_qual_type_t *qual_type =
-            SCC_AST_ALLOC_QUAL_TYPE(parser->ast_ctx);
+            SCC_AST_ALLOC_QUAL_TYPE(parser->ast_module);
         _scc_ast_type_record_init(qual_type, canon, type_kind, name, decl,
                                   *pos);
         scc_parse_type_sema(parser, qual_type);
@@ -747,10 +747,10 @@ static scc_ast_qual_type_t *parse_enum_type(scc_parser_t *parser) {
             }
 
             scc_ast_decl_t *enum_item_decl =
-                SCC_AST_ALLOC_DECL(parser->ast_ctx);
+                SCC_AST_ALLOC_DECL(parser->ast_module);
             Assert(enum_item_decl != nullptr);
             scc_ast_decl_val_init(enum_item_decl, type,
-                                  scc_str_as_cstr(&tok.lexeme), enum_item_init,
+                                  scc_ast_module_intern(parser->ast_module, scc_str_as_cstr(&tok.lexeme)), enum_item_init,
                                   tok.loc);
             scc_vec_push(decl->record.fields, enum_item_decl);
 
@@ -939,14 +939,14 @@ parse_pointer(scc_parser_t *parser, scc_ast_qual_type_t *pointee,
     scc_pos_t pos = tok_ptr->loc;
     scc_parser_next_consume(parser, nullptr);
 
-    scc_ast_qual_type_t *pointer = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_ctx);
+    scc_ast_qual_type_t *pointer = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_module);
     if (pointee == nullptr) {
         Assert(delay_pointee_ptr != nullptr);
         *delay_pointee_ptr = pointer;
         pointee = pointer;
     }
 
-    scc_ast_canon_type_t *canon = scc_ast_ctx_alloc_type(parser->ast_ctx);
+    scc_ast_canon_type_t *canon = scc_ast_module_alloc_type(parser->ast_module);
     scc_ast_type_pointer_init(pointer, canon, pointee, pos);
     pointer->quals = parse_type_qualifier_list(parser, pointer->quals);
 
@@ -981,7 +981,7 @@ static void parse_parameter_type_list(scc_parser_t *parser,
         }
 
         // TODO Check validation
-        param = SCC_AST_ALLOC_DECL(parser->ast_ctx);
+        param = SCC_AST_ALLOC_DECL(parser->ast_module);
         Assert(param != nullptr);
         scc_ast_decl_param_init(param, decl->var.type, decl->name,
                                 scc_vec_size(*params), decl->base.loc);
@@ -998,11 +998,11 @@ static void parse_parameter_type_list(scc_parser_t *parser,
         scc_parser_next_consume(parser, nullptr);
         tok_ptr = scc_parser_peek(parser);
         if (tok_ptr->type == SCC_TOK_ELLIPSIS) {
-            param = SCC_AST_ALLOC_DECL(parser->ast_ctx);
+            param = SCC_AST_ALLOC_DECL(parser->ast_module);
             Assert(param != nullptr);
             // FIXME
-            type = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_ctx);
-            scc_ast_type_builtin_init(type, parser->ast_ctx,
+            type = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_module);
+            scc_ast_type_builtin_init(type, parser->ast_module,
                                       SCC_AST_BUILTIN_TYPE_VA_LIST,
                                       tok_ptr->loc);
             scc_ast_decl_param_init(param, type, nullptr, scc_vec_size(*params),
@@ -1112,7 +1112,7 @@ parse_direct_declarator(scc_parser_t *parser, scc_ast_qual_type_t *base,
                         scc_lexer_tok_t *tok_ident) {
     const scc_lexer_tok_t *tok_ptr = nullptr;
     scc_ast_qual_type_t *ret = nullptr;
-    scc_ast_canon_type_t *canon = scc_ast_ctx_alloc_type(parser->ast_ctx);
+    scc_ast_canon_type_t *canon = scc_ast_module_alloc_type(parser->ast_module);
     // direct-abstract-declarator
     tok_ptr = scc_parser_peek(parser);
     if (tok_ptr == nullptr) {
@@ -1137,7 +1137,7 @@ parse_direct_declarator(scc_parser_t *parser, scc_ast_qual_type_t *base,
         if (parse_function_parameters_start(parser)) {
             scc_ast_decl_vec_t params;
             parse_function_parameters(parser, &params);
-            ret = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_ctx);
+            ret = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_module);
             // FIXME
             scc_ast_type_function_init(ret, canon, base, &params,
                                        base->base.loc);
@@ -1162,7 +1162,7 @@ parse_direct_declarator(scc_parser_t *parser, scc_ast_qual_type_t *base,
     } else if (tok_ptr->type == SCC_TOK_L_BRACKET) {
         // [] SCC_TOK_L_BRACKET
         scc_ast_expr_t *size = parse_array_size_type(parser);
-        scc_ast_qual_type_t *ret = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_ctx);
+        scc_ast_qual_type_t *ret = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_module);
         base =
             parse_direct_declarator(parser, base, delay_pointee_ptr, tok_ident);
         // FIXME
@@ -1202,7 +1202,7 @@ parse_direct_abstract_declarator(scc_parser_t *parser,
                                  scc_ast_qual_type_t **delay_pointee_ptr) {
     const scc_lexer_tok_t *tok_ptr = nullptr;
     scc_ast_qual_type_t *ret = nullptr;
-    scc_ast_canon_type_t *canon = scc_ast_ctx_alloc_type(parser->ast_ctx);
+    scc_ast_canon_type_t *canon = scc_ast_module_alloc_type(parser->ast_module);
     // direct-abstract-declarator
     tok_ptr = scc_parser_peek(parser);
     if (tok_ptr == nullptr) {
@@ -1216,7 +1216,7 @@ parse_direct_abstract_declarator(scc_parser_t *parser,
         if (parse_function_parameters_start(parser)) {
             scc_ast_decl_vec_t params;
             parse_function_parameters(parser, &params);
-            ret = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_ctx);
+            ret = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_module);
             // FIXME
             scc_ast_type_function_init(ret, canon, base, &params,
                                        base->base.loc);
@@ -1237,7 +1237,7 @@ parse_direct_abstract_declarator(scc_parser_t *parser,
     } else if (tok_ptr->type == SCC_TOK_L_BRACKET) {
         // [] SCC_TOK_L_BRACKET
         scc_ast_expr_t *size = parse_array_size_type(parser);
-        scc_ast_qual_type_t *ret = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_ctx);
+        scc_ast_qual_type_t *ret = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_module);
         base =
             parse_direct_abstract_declarator(parser, base, delay_pointee_ptr);
         // FIXME
@@ -1254,14 +1254,14 @@ scc_ast_decl_t *scc_parse_declarator(scc_parser_t *parser,
     scc_ast_qual_type_t *decl_type =
         parse_declarator(parser, type, nullptr, &decl_name_tok);
     scc_ast_decl_t *decl = nullptr;
-    decl = SCC_AST_ALLOC_DECL(parser->ast_ctx);
+    decl = SCC_AST_ALLOC_DECL(parser->ast_module);
     Assert(decl != nullptr);
     Assert(decl_name_tok.type == SCC_TOK_IDENT ||
            decl_name_tok.type == SCC_TOK_UNKNOWN);
 
     // FIXME memory leak
     const char *name = decl_name_tok.type == SCC_TOK_IDENT
-                           ? scc_str_as_cstr(&decl_name_tok.lexeme)
+                           ? scc_ast_module_intern(parser->ast_module, scc_str_as_cstr(&decl_name_tok.lexeme))
                            : nullptr;
 
     if (decl_type->base.type == SCC_AST_TYPE_FUNCTION) {
@@ -1288,7 +1288,7 @@ scc_ast_decl_t *scc_parse_declarator(scc_parser_t *parser,
     //         decl = scc_ast_canon_type(decl_type)->record.decl;
     //     } else {
     //         // TODO();
-    //         // decl = SCC_AST_ALLOC_DECL(parser->ast_ctx);
+    //         // decl = SCC_AST_ALLOC_DECL(parser->ast_module);
     //         // scc_ast_decl_unsafe_val_init(decl, type, nullptr, nullptr,
     //         //                              decl_type->base.loc);
     //     }

libs/parser/src/scc_parser.c

@@ -20,10 +20,10 @@ static scc_ast_qual_type_t *dummy_got_type_callback(scc_sema_ctx_t *context,
     assigned_val = value ? value : default
 
 void scc_parser_init(scc_parser_t *parser, scc_lexer_tok_ring_t *tok_ring,
-                     scc_ast_ctx_t *ast_ctx, scc_sema_ctx_t *sema_ctx) {
+                     scc_ast_module_t *ast_module, scc_sema_ctx_t *sema_ctx) {
     Assert(parser != nullptr && tok_ring != nullptr);
-    Assert(ast_ctx != nullptr);
-    parser->ast_ctx = ast_ctx;
+    Assert(ast_module != nullptr);
+    parser->ast_module = ast_module;
 
     parser->ring = tok_ring;
     parser->errcode = 0;

libs/parser/src/scc_sema.c

@@ -31,14 +31,15 @@ static void symtab_add_symbol(scc_sema_symtab_t *sema_symtab,
 
     if (decl->name == nullptr)
         return;
-    // FIXME memory leak
     scc_str_t name = scc_str_empty();
     gen_symbol_name(decl, &name);
     if (scc_str_is_empty(&name)) {
         scc_sema_symtab_add_symbol(sema_symtab, decl->name, ast_node_ref);
     } else {
-        scc_sema_symtab_add_symbol(sema_symtab, scc_str_as_cstr(&name),
-                                   ast_node_ref);
+        const char *pooled = scc_strpool_intern(&sema_symtab->name_pool,
+                                                scc_str_as_cstr(&name));
+        scc_sema_symtab_add_symbol(sema_symtab, pooled, ast_node_ref);
+        scc_str_drop(&name);
     }
 }
 
@@ -291,8 +292,8 @@ static scc_ast_qual_type_t *got_type_callback(scc_sema_ctx_t *sema_ctx,
     return nullptr;
 }
 
-void scc_sema_init(scc_sema_ctx_t *sema_ctx, scc_ast_ctx_t *ast_ctx) {
-    sema_ctx->ast_ctx = ast_ctx;
+void scc_sema_init(scc_sema_ctx_t *sema_ctx, scc_ast_module_t *ast_module) {
+    sema_ctx->ast_module = ast_module;
     scc_sema_symtab_t *sema_symtab = scc_malloc(sizeof(scc_sema_symtab_t));
     if (sema_symtab == nullptr) {
         LOG_FATAL("out of memory");
@@ -311,25 +312,23 @@ void scc_sema_init(scc_sema_ctx_t *sema_ctx, scc_ast_ctx_t *ast_ctx) {
     scc_vec_init(sema_ctx->break_stack);
     scc_vec_init(sema_ctx->continue_stack);
 
-    // FIXME memory leak
-
-    scc_ast_qual_type_t *type = SCC_AST_ALLOC_QUAL_TYPE(sema_ctx->ast_ctx);
-    scc_ast_type_builtin_init(type, sema_ctx->ast_ctx,
+    scc_ast_qual_type_t *type = SCC_AST_ALLOC_QUAL_TYPE(sema_ctx->ast_module);
+    scc_ast_type_builtin_init(type, sema_ctx->ast_module,
                               SCC_AST_BUILTIN_TYPE_VA_LIST, scc_pos_create());
     scc_sema_symtab_add_symbol(sema_symtab, "__scc_builtin_va_list",
                                &type->base);
 
-    scc_ast_decl_t *decl = SCC_AST_ALLOC_DECL(sema_ctx->ast_ctx);
+    scc_ast_decl_t *decl = SCC_AST_ALLOC_DECL(sema_ctx->ast_module);
     scc_ast_decl_val_init(decl, type, "__scc_builtin__", nullptr,
                           scc_pos_create());
     scc_sema_symtab_add_symbol(sema_symtab, "__func__", &decl->base);
 
     scc_ast_qual_type_t *built_func_type =
-        SCC_AST_ALLOC_QUAL_TYPE(sema_ctx->ast_ctx);
+        SCC_AST_ALLOC_QUAL_TYPE(sema_ctx->ast_module);
     // FIXME hack
     built_func_type->base.type = SCC_AST_TYPE_FUNCTION;
 
-    scc_ast_decl_t *builin_func = SCC_AST_ALLOC_DECL(sema_ctx->ast_ctx);
+    scc_ast_decl_t *builin_func = SCC_AST_ALLOC_DECL(sema_ctx->ast_module);
     scc_ast_decl_func_init(builin_func, built_func_type, "__scc_builtin_func",
                            nullptr, scc_pos_create());
     scc_sema_symtab_add_symbol(sema_symtab, "__scc_builtin_va_start",
@@ -348,8 +347,9 @@ void scc_sema_drop(scc_sema_ctx_t *sema_ctx) {
     scc_vec_free(sema_ctx->break_stack);
     scc_vec_free(sema_ctx->continue_stack);
 
-    // FIXME drop obj
     if (sema_ctx->context) {
         scc_sema_symtab_drop(sema_ctx->context);
+        scc_free(sema_ctx->context);
+        sema_ctx->context = nullptr;
     }
 }

libs/parser/src/sema_symtab.c

@@ -5,13 +5,19 @@ void scc_sema_symtab_init(scc_sema_symtab_t *symtab) {
 
     scc_hashtable_cstr_init(&symtab->root_scope.symbols);
     symtab->current_scope = &symtab->root_scope;
+    scc_strpool_init(&symtab->name_pool);
 }
 
 void scc_sema_symtab_drop(scc_sema_symtab_t *symtab) {
     while (symtab->current_scope != nullptr) {
         scc_hashtable_drop(&symtab->current_scope->symbols);
+        scc_sema_scope_t *scope = symtab->current_scope;
         symtab->current_scope = symtab->current_scope->parent;
+        if (scope != &symtab->root_scope) {
+            scc_free(scope);
         }
+    }
+    scc_strpool_drop(&symtab->name_pool);
 }
 
 void scc_sema_symtab_enter_scope(scc_sema_symtab_t *symtab) {
@@ -30,8 +36,10 @@ void scc_sema_symtab_leave_scope(scc_sema_symtab_t *symtab) {
         LOG_ERROR("out of scope");
         return;
     }
-    scc_hashtable_drop(&symtab->current_scope->symbols);
+    scc_sema_scope_t *scope = symtab->current_scope;
+    scc_hashtable_drop(&scope->symbols);
     symtab->current_scope = symtab->current_scope->parent;
+    scc_free(scope);
 }
 
 scc_ast_node_t *scc_sema_symtab_add_symbol(scc_sema_symtab_t *symtab,

libs/pproc/src/pproc_include.c

@@ -1,5 +1,6 @@
 #include <pproc_expand.h>
 #include <scc_core_ring.h>
+#include <scc_path.h>
 #include <scc_pproc.h>
 
 static int switch_file_stack(scc_pproc_t *pp, scc_str_t *fname, scc_pos_t *pos,
@@ -100,6 +101,19 @@ void scc_pproc_parse_include(scc_pproc_t *pp, scc_lexer_tok_t *include_tok,
         scc_str_append_ch(&fname, includename[i]);
     }
     int is_system = includename[0] == '<';
+
+    /* 安全检查：拒绝绝对路径和路径穿越 */
+    const char *fname_cstr = scc_str_as_cstr(&fname);
+    if (scc_path_check_include_safe(fname_cstr) != 0) {
+        SCC_ERROR(pos,
+                  "unsafe include filename: '%s' (absolute path and '..' "
+                  "are not allowed)",
+                  fname_cstr);
+        scc_str_drop(&line);
+        scc_str_drop(&fname);
+        return;
+    }
+
     if (switch_file_stack(pp, &fname, &pos, is_system)) {
         // LOG_ERROR()
     }

libs/target/elf/cbuild.toml

@@ -1,9 +1,9 @@
 [package]
-name = "scc_abi"
+name = "scc_elf"
 version = "0.1.0"
 authors = []
 description = ""
 
-# dependencies = []
+dependencies = [{ name = "scc_utils", path = "../../../runtime/scc_utils" }]
 # features = {}
 # default_features = []

libs/target/pe/src/scc_pe_builder.c

@@ -23,6 +23,11 @@ static u32 reserve_file(scc_pe_builder_t *builder, u32 len, u32 align) {
 
     builder->file_offset = reserve_align(builder->file_offset, align);
     u32 offset = builder->file_offset;
+    /* TODO overflow check: u32 溢出保护, 设计未定暂用简单检查 */
+    if (builder->file_offset + len < builder->file_offset) {
+        LOG_FATAL("reserve_file: u32 overflow (offset=%u len=%u)",
+                  builder->file_offset, len);
+    }
     builder->file_offset += len;
     LOG_INFO("reserve_file %u bytes at %u [%u]", len, offset,
              builder->file_offset);
@@ -35,6 +40,11 @@ static u32 reserve_virtual(scc_pe_builder_t *builder, u32 len, u32 align) {
     }
 
     u32 offset = builder->virtual_offset;
+    /* TODO overflow check: u32 溢出保护, 设计未定暂用简单检查 */
+    if (builder->virtual_offset + len < builder->virtual_offset) {
+        LOG_FATAL("reserve_virtual: u32 overflow (offset=%u len=%u)",
+                  builder->virtual_offset, len);
+    }
     builder->virtual_offset += len;
     builder->virtual_offset = reserve_align(builder->virtual_offset, align);
     LOG_INFO("reserve_virtual %u bytes at %u [%u]", len, offset,

libs/target/pe/src/scc_pe_idata.c

@@ -63,13 +63,19 @@ void scc_pe_idata_builder_init(scc_pe_idata_builder_t *builder,
 }
 
 u32 scc_pe_reserve_idata(scc_pe_idata_builder_t *builder) {
+    /* TODO overflow check: idata_size 为 u32, 乘法可能溢出,
+       设计未定暂不插入 stdint 类型, 仅做简单防护 */
     u32 idata_size = (scc_vec_size(builder->idata_libs) + 1) *
                      sizeof(IMAGE_IMPORT_DESCRIPTOR);
 
     scc_vec_foreach(builder->idata_libs, i) {
         scc_pe_idata_lib_t *lib = &scc_vec_at(builder->idata_libs, i);
-        idata_size += (scc_vec_size(lib->symbol_names) + 1) * 2 *
+        u32 thunk_size = (scc_vec_size(lib->symbol_names) + 1) * 2 *
                          sizeof(IMAGE_THUNK_DATA64);
+        if (idata_size + thunk_size < idata_size) {
+            LOG_FATAL("scc_pe_reserve_idata: u32 overflow");
+        }
+        idata_size += thunk_size;
         scc_winpe_hnt_builder_push(&builder->hnt_builder, lib->name, 0);
 
         scc_vec_foreach(lib->symbol_names, j) {
@@ -78,6 +84,9 @@ u32 scc_pe_reserve_idata(scc_pe_idata_builder_t *builder) {
         }
     }
     builder->hnt_builder.section_offset = idata_size;
+    if (idata_size + scc_vec_size(builder->hnt_builder.data) < idata_size) {
+        LOG_FATAL("scc_pe_reserve_idata: u32 overflow on hnt data");
+    }
     idata_size += scc_vec_size(builder->hnt_builder.data);
 
     scc_vec_realloc(builder->buffer, idata_size);

libs/target/sccf2target/src/sccf2pe.c

@@ -6,6 +6,7 @@
 typedef struct {
     scc_hashtable_t str2libsym;
     scc_pe_idata_lib_vec_t idata_libs;
+    scc_strpool_t pool; /* owns all interned symbol names and library names */
     const char *find_path;
 } pe_idata_lib_ctx_t;
 
@@ -24,11 +25,18 @@ static void load_from_def(pe_idata_lib_ctx_t *ctx, const char *file_path,
     const char *fname = scc_str_as_cstr(&fpath);
     scc_file_t fp = scc_fopen(fname, SCC_FILE_READ);
     if (fp == nullptr) {
+        scc_str_drop(&fpath);
         return;
     }
     LOG_TRACE("load_from_def file read sucessful: %s", fname);
 
     usize fsize = scc_fsize(fp);
+    if (fsize == 0) {
+        scc_fclose(fp);
+        scc_str_drop(&fpath);
+        return;
+    }
+
     char *buffer = scc_malloc(fsize);
     Assert(buffer != nullptr);
 
@@ -36,10 +44,9 @@ static void load_from_def(pe_idata_lib_ctx_t *ctx, const char *file_path,
     Assert(read_size == fsize);
     scc_fclose(fp);
 
-    // scc_pe_name_vec_t symbol_names;
     usize line = 0;
-    // FIXME
     buffer[fsize - 1] = '\0';
+    const char *dll_pooled = scc_strpool_intern(&ctx->pool, dll_name);
     for (usize i = 0; i < fsize; i += 1) {
         if (buffer[i] == '\n') {
             line += 1;
@@ -56,15 +63,18 @@ static void load_from_def(pe_idata_lib_ctx_t *ctx, const char *file_path,
                 break;
             }
         }
-        // FIXME memory leak
-        scc_hashtable_set(&ctx->str2libsym, buffer + i, (void *)dll_name);
+        const char *sym_pooled = scc_strpool_intern(&ctx->pool, buffer + i);
+        scc_hashtable_set(&ctx->str2libsym, sym_pooled, (void *)dll_pooled);
     }
+    scc_free(buffer);
+    scc_str_drop(&fpath);
 }
 
 static void pe_idata_lib_init(pe_idata_lib_ctx_t *ctx, const char *find_path) {
     // Got .dll.def
 
     scc_hashtable_cstr_init(&ctx->str2libsym);
+    scc_strpool_init(&ctx->pool);
     scc_vec_init(ctx->idata_libs);
     ctx->find_path = find_path;
     load_from_def(ctx, ctx->find_path, "msvcrt.dll");
@@ -202,8 +212,7 @@ void sccf2pe(scc_pe_builder_t *builder, const sccf_t *sccf) {
 
     scc_mcode_t mcode;
     scc_mcode_init(&mcode, SCC_MCODE_ARCH_X86_64);
-    // FIXME hack
-    mcode.code = *(scc_mcode_buff_t *)code_data;
+    scc_mcode_adopt_buf(&mcode, (scc_mcode_buff_t *)code_data);
     scc_vec_foreach(relocs, i) {
         sccf_reloc_t *reloc = &scc_vec_at(relocs, i);
         if (reloc->reloc_type == SCCF_RELOC_TYPE_EMPTY) {
@@ -233,7 +242,7 @@ void sccf2pe(scc_pe_builder_t *builder, const sccf_t *sccf) {
         scc_x86_patch(&mcode, SCC_X86_PATCH_PC32, reloc->offset + reloc->addend,
                       (i64)rva - (i64)code_range.virual_address);
     }
-    *(scc_mcode_buff_t *)code_data = mcode.code;
+    scc_mcode_disown_buf(&mcode, (scc_mcode_buff_t *)code_data);
 
     scc_pe_write_header(builder, &config);
     if (code_data != nullptr) {
@@ -249,4 +258,12 @@ void sccf2pe(scc_pe_builder_t *builder, const sccf_t *sccf) {
     scc_pe_write_section(builder, &idata_range,
                          scc_vec_unsafe_get_data(idata_buffer),
                          scc_vec_size(idata_buffer));
+
+    // Cleanup
+    scc_vec_foreach(idata_lib_ctx.idata_libs, i) {
+        scc_vec_free(scc_vec_at(idata_lib_ctx.idata_libs, i).symbol_names);
+    }
+    scc_vec_free(idata_lib_ctx.idata_libs);
+    scc_hashtable_drop(&idata_lib_ctx.str2libsym);
+    scc_strpool_drop(&idata_lib_ctx.pool);
 }

libs/target/sccf2target/tests/test_sccf2pe_run.c

@@ -2,6 +2,7 @@
 #include <sccf2pe.h>
 #include <sccf_builder.h>
 #include <stdio.h>
+#include <x86/scc_x86_patch.h>
 
 int main() {
     char data[] = "Hello, World from SCC PE Builder!\n\0";
@@ -56,13 +57,13 @@ int main() {
                                           .offset = 7,
                                           .sect_type = SCCF_SECT_CODE,
                                           .sym_idx = str_idx,
-                                          .reloc_type = SCCF_RELOC_TYPE_REL});
+                                          .reloc_type = SCC_X86_OPR_RELBR});
     sccf_builder_add_reloc(&builder,
                            (sccf_reloc_t){.addend = 4,
                                           .offset = 13,
                                           .sect_type = SCCF_SECT_CODE,
                                           .sym_idx = puts_idx,
-                                          .reloc_type = SCCF_RELOC_TYPE_REL});
+                                          .reloc_type = SCC_X86_OPR_RELBR});
     const sccf_t *sccf = sccf_builder_to_sccf(&builder);
 
     scc_pe_builder_t pe_builder;

libs/target/type_abi/cbuild.toml

@@ -0,0 +1,9 @@
+[package]
+name        = "type_abi"
+version     = "0.1.0"
+authors     = []
+description = ""
+
+dependencies = [
+    { name = "scc_core", path = "../../../runtime/scc_core" },
+]

libs/target/type_abi/include/scc_type_abi.h

@@ -0,0 +1,53 @@
+#ifndef __SCC_TYPE_ABI_H__
+#define __SCC_TYPE_ABI_H__
+
+#include <scc_core.h>
+
+/// 类型布局的三个本质可变点
+typedef struct scc_type_abi scc_type_abi_t;
+
+struct scc_type_abi {
+    int ptr_size;
+    int ptr_align;
+    int endian;  // 0 = little, 1 = big
+
+    // C 类型大小 (AST → HIR 时需要)
+    int char_size;
+    int short_size;
+    int int_size;
+    int long_size;
+    int long_long_size;
+    int float_size;
+    int double_size;
+    int long_double_size;
+    int va_list_size;
+
+    // byte_size → 对齐。NULL = 自然对齐 (return byte_size)
+    int (*type_align)(int byte_size);
+
+    // 字段对齐覆盖。NULL = 用 type_align 的值
+    int (*field_align)(int field_size, int natural_align);
+
+    // 聚合体总对齐。NULL = max 字段 align
+    int (*aggregate_align)(int max_field_align);
+};
+
+static inline int scc_type_abi_get_type_align(const scc_type_abi_t *abi,
+                                               int byte_size) {
+    return abi->type_align ? abi->type_align(byte_size) : byte_size;
+}
+
+static inline int scc_type_abi_get_field_align(const scc_type_abi_t *abi,
+                                                int field_size,
+                                                int natural_align) {
+    return abi->field_align ? abi->field_align(field_size, natural_align)
+                            : natural_align;
+}
+
+static inline int scc_type_abi_get_aggregate_align(const scc_type_abi_t *abi,
+                                                    int max_field_align) {
+    return abi->aggregate_align ? abi->aggregate_align(max_field_align)
+                                : max_field_align;
+}
+
+#endif /* __SCC_TYPE_ABI_H__ */

libs/target/type_abi/include/scc_type_abi_systemv_x64.h

@@ -0,0 +1,27 @@
+#ifndef __SCC_TYPE_ABI_SYSTEMV_X64_H__
+#define __SCC_TYPE_ABI_SYSTEMV_X64_H__
+
+#include "scc_type_abi.h"
+
+/// SystemV x86-64: long = 8, long_double = 16, 全部自然对齐
+static const scc_type_abi_t SCC_TYPE_ABI_SYSTEMV_X64 = {
+    .ptr_size = 8,
+    .ptr_align = 8,
+    .endian = 0,
+
+    .char_size = 1,
+    .short_size = 2,
+    .int_size = 4,
+    .long_size = 8,   // SysV: long = 8 bytes
+    .long_long_size = 8,
+    .float_size = 4,
+    .double_size = 8,
+    .long_double_size = 16,  // SysV x86-64: long double = 80-bit extended precision, padded to 16
+    .va_list_size = 8,
+
+    .type_align = NULL,
+    .field_align = NULL,
+    .aggregate_align = NULL,
+};
+
+#endif /* __SCC_TYPE_ABI_SYSTEMV_X64_H__ */

libs/target/type_abi/include/scc_type_abi_win_x64.h

@@ -0,0 +1,35 @@
+#ifndef __SCC_TYPE_ABI_WIN_X64_H__
+#define __SCC_TYPE_ABI_WIN_X64_H__
+
+#include "scc_type_abi.h"
+
+/// Win64: ≥16B 类型在 struct 中对齐到 8 而非 16
+int scc_win64_field_align(int field_size, int natural_align);
+#ifdef __SCC_TYPE_ABI_WIN_X64_IMPL__
+int scc_win64_field_align(int field_size, int natural_align) {
+    (void)field_size;
+    return natural_align >= 16 ? 8 : natural_align;
+}
+#endif
+
+static const scc_type_abi_t SCC_TYPE_ABI_WIN_X64 = {
+    .ptr_size = 8,
+    .ptr_align = 8,
+    .endian = 0,
+
+    .char_size = 1,
+    .short_size = 2,
+    .int_size = 4,
+    .long_size = 4, // Win64: long = 4 bytes
+    .long_long_size = 8,
+    .float_size = 4,
+    .double_size = 8,
+    .long_double_size = 8,
+    .va_list_size = 4,
+
+    .type_align = NULL,
+    .field_align = scc_win64_field_align,
+    .aggregate_align = NULL,
+};
+
+#endif /* __SCC_TYPE_ABI_WIN_X64_H__ */

runtime/ap/cbuild.toml

@@ -4,6 +4,6 @@ version = "0.1.0"
 authors     = []
 description = ""
 
-# dependencies = []
+dependencies = [{ name = "core", path = "../scc_core" }]
 # features = {}
 # default_features = []

runtime/ap/include/ap.h

@@ -4,7 +4,7 @@
  * @brief Arbitrary Precision Library
  *
  */
-#ifdef __SCC__
+#ifndef __NO_SCC_RUNTIME__
 #include <scc_core.h>
 #define SCC_AP_DIGIT u64
 #define SCC_AP_PANIC Panic
@@ -49,21 +49,21 @@ typedef struct {
 } scc_ap_t;
 
 static inline void scc_ap_init(scc_ap_t *ap) {
-    ap->len = 0;
     ap->capacity = -1;
     ap->len = 1;
     ap->data.digit = 0;
 }
 
 static inline void scc_ap_set_int(scc_ap_t *ap, int val) {
+    ap->capacity = -1;
+    SCC_AP_ASSERT(sizeof(scc_ap_digit) >= sizeof(int));
     if (val < 0) {
         ap->len = -1;
+        ap->data.digit = (scc_ap_digit)(-(int64_t)val);
     } else {
         ap->len = 1;
+        ap->data.digit = (scc_ap_digit)val;
     }
-    SCC_AP_ASSERT(sizeof(scc_ap_digit) >= sizeof(int));
-    ap->capacity = -1;
-    ap->data.digit = val;
 }
 
 void scc_ap_drop(scc_ap_t *ap);
@@ -77,13 +77,20 @@ void scc_ap_mul(scc_ap_t *to, const scc_ap_t *from_a, const scc_ap_t *from_b);
 void scc_ap_div(scc_ap_t *to, const scc_ap_t *from_a, const scc_ap_t *from_b);
 void scc_ap_mod(scc_ap_t *to, const scc_ap_t *from_a, const scc_ap_t *from_b);
 
-/**
- * @brief equal
- *
- * @param a
- * @param b
- * @return int
- */
+void scc_ap_shl(scc_ap_t *to, const scc_ap_t *from, unsigned shift);
+void scc_ap_shr(scc_ap_t *to, const scc_ap_t *from, unsigned shift);
+void scc_ap_lshr(scc_ap_t *to, const scc_ap_t *from, unsigned shift);
+
+void scc_ap_and(scc_ap_t *to, const scc_ap_t *a, const scc_ap_t *b);
+void scc_ap_or(scc_ap_t *to, const scc_ap_t *a, const scc_ap_t *b);
+void scc_ap_xor(scc_ap_t *to, const scc_ap_t *a, const scc_ap_t *b);
+void scc_ap_not(scc_ap_t *to, const scc_ap_t *from);
+
+void scc_ap_neg(scc_ap_t *to, const scc_ap_t *from);
+
+int scc_ap_cmp(const scc_ap_t *a, const scc_ap_t *b);
+int scc_ap_is_zero(const scc_ap_t *ap);
+
 int scc_ap_eql(const scc_ap_t *a, const scc_ap_t *b);
 
 typedef void (*ap_dump_fn)(const char ch, void *user_data);

runtime/ap/src/ap.c

@@ -1,48 +1,394 @@
 #include <ap.h>
 
-static void *scc_ap_alloc(size_t size) {
-    void *p = SCC_AP_MALLOC(size);
-    SCC_AP_ASSERT(p != NULL);
-    return p;
+/*
+ * Fast-path (hack) implementation: all values stored in single-digit mode.
+ * data.digit holds the absolute magnitude as u64, len sign indicates sign.
+ * Arithmetic is done via isize with explicit overflow checks — anything
+ * out of isize range triggers SCC_AP_PANIC.
+ */
+
+/* ---------- internal helpers ---------- */
+
+/* Convert from sign-magnitude (digit mode) to isize */
+static isize ap_to_isize(const scc_ap_t *ap) {
+    SCC_AP_ASSERT(ap != nullptr);
+    SCC_AP_ASSERT(ap->capacity == -1);
+    uint64_t mag = ap->data.digit;
+    if (ap->len < 0) {
+        if (mag == 0)
+            return 0;
+        if (mag == (uint64_t)INTPTR_MAX + 1)
+            return INTPTR_MIN;
+        SCC_AP_ASSERT(mag <= (uint64_t)INTPTR_MAX);
+        return -(isize)(int64_t)mag;
+    }
+    SCC_AP_ASSERT(mag <= (uint64_t)INTPTR_MAX);
+    return (isize)(int64_t)mag;
 }
 
-/* 重新分配内存 */
-static void *scc_ap_realloc_data(void *old, size_t new_size) {
-    void *p = SCC_AP_REALLOC(old, new_size);
-    SCC_AP_ASSERT(p != NULL);
-    return p;
+/* Store isize value into sign-magnitude (digit mode) */
+static void ap_from_isize(scc_ap_t *ap, isize val) {
+    ap->capacity = -1;
+    if (val < 0) {
+        ap->len = -1;
+        ap->data.digit = (scc_ap_digit)(-(uint64_t)(int64_t)val);
+    } else {
+        ap->len = 1;
+        ap->data.digit = (scc_ap_digit)val;
+    }
 }
 
+/* Checked addition */
+static isize ap_add_isize(isize a, isize b) {
+    if (b > 0 && a > INTPTR_MAX - b)
+        SCC_AP_PANIC("scc_ap_add: positive overflow");
+    if (b < 0 && a < INTPTR_MIN - b)
+        SCC_AP_PANIC("scc_ap_add: negative overflow");
+    return a + b;
+}
+
+/* Checked subtraction: a - b */
+static isize ap_sub_isize(isize a, isize b) {
+    /* a - b = a + (-b); -INTPTR_MIN overflows, handle specially */
+    if (b == INTPTR_MIN) {
+        if (a < 0)
+            SCC_AP_PANIC("scc_ap_sub: overflow (a - INTPTR_MIN, a < 0)");
+        SCC_AP_PANIC("scc_ap_sub: overflow (a - INTPTR_MIN, a >= 0)");
+    }
+    return ap_add_isize(a, -b);
+}
+
+/* Checked multiplication */
+static isize ap_mul_isize(isize a, isize b) {
+    if (a == 0 || b == 0)
+        return 0;
+    if (a == 1)
+        return b;
+    if (b == 1)
+        return a;
+
+    /* Determine sign of result */
+    int sign = ((a < 0) == (b < 0)) ? 1 : -1;
+
+    /* Absolute values as uint64 */
+    uint64_t ua = (a == INTPTR_MIN)
+                      ? (uint64_t)INTPTR_MAX + 1
+                      : (uint64_t)(a < 0 ? -(int64_t)a : (int64_t)a);
+    uint64_t ub = (b == INTPTR_MIN)
+                      ? (uint64_t)INTPTR_MAX + 1
+                      : (uint64_t)(b < 0 ? -(int64_t)b : (int64_t)b);
+
+    /* Overflow threshold */
+    uint64_t limit =
+        (sign > 0) ? (uint64_t)INTPTR_MAX : (uint64_t)INTPTR_MAX + 1;
+
+    if (ua != 0 && ub > limit / ua)
+        SCC_AP_PANIC("scc_ap_mul: overflow");
+
+    isize result = (isize)(ua * ub);
+    return (sign > 0) ? result : -result;
+}
+
+/* Checked division */
+static isize ap_div_isize(isize a, isize b) {
+    if (b == 0)
+        SCC_AP_PANIC("scc_ap_div: division by zero");
+    if (a == INTPTR_MIN && b == -1)
+        SCC_AP_PANIC("scc_ap_div: overflow (INTPTR_MIN / -1)");
+    return a / b;
+}
+
+/* Checked modulo */
+static isize ap_mod_isize(isize a, isize b) {
+    if (b == 0)
+        SCC_AP_PANIC("scc_ap_mod: modulo by zero");
+    if (a == INTPTR_MIN && b == -1)
+        SCC_AP_PANIC("scc_ap_mod: overflow (INTPTR_MIN %% -1)");
+    return a % b;
+}
+
+/* ---------- public API ---------- */
+
 void scc_ap_drop(scc_ap_t *ap) {
-    SCC_AP_ASSERT(ap);
-    // SCC_AP_FREE(ap->data);
+    SCC_AP_ASSERT(ap != nullptr);
+    /* In digit mode (capacity == -1), there's no heap allocation to free */
     scc_ap_init(ap);
 }
 
-void scc_ap_with_bits(scc_ap_t *ap, int bits) {}
-
-void scc_ap_from_string(scc_ap_t *ap, const char *str, int len, int base) {
-    SCC_AP_ASSERT(base == 10);
-    SCC_AP_ASSERT(ap && str);
-    if (len == 0) {
-        scc_ap_set_int(ap, 0);
-    }
-    // FIXME
-    int int_lit = 0;
-    for (int i = 0; i < len; i += 1) {
-        int_lit = int_lit * 10 + (str[i] - '0');
-    }
-    scc_ap_set_int(ap, int_lit);
+void scc_ap_with_bits(scc_ap_t *ap, int bits) {
+    SCC_AP_ASSERT(ap != nullptr);
+    if (bits > (int)(sizeof(scc_ap_digit) * 8))
+        SCC_AP_PANIC(
+            "scc_ap_with_bits: request %d bits but digit only has %zu bits",
+            bits, sizeof(scc_ap_digit) * 8);
+    (void)ap;
+    /* Fast path: always stays in digit mode */
 }
 
-void scc_ap_set_digit(scc_ap_t *ap, scc_ap_digit digit) {}
+void scc_ap_from_string(scc_ap_t *ap, const char *str, int len, int base) {
+    SCC_AP_ASSERT(ap != nullptr && str != nullptr);
 
-void scc_ap_add_impl(scc_ap_t *to, const scc_ap_t *from_a,
-                     const scc_ap_t *from_b) {}
+    /* len < 0 means null-terminated */
+    if (len < 0) {
+        len = 0;
+        while (str[len] != '\0')
+            len++;
+    }
+    if (len == 0) {
+        ap_from_isize(ap, 0);
+        return;
+    }
 
-void scc_ap_add(scc_ap_t *to, const scc_ap_t *from_a, const scc_ap_t *from_b) {}
+    int i = 0;
+    int sign = 1;
 
-void scc_ap_sub(scc_ap_t *to, const scc_ap_t *from_a, const scc_ap_t *from_b) {}
+    /* Optional leading sign */
+    if (str[i] == '-') {
+        sign = -1;
+        i++;
+    } else if (str[i] == '+') {
+        i++;
+    }
 
-typedef void (*ap_dump_fn)(const char ch, void *user_data);
-int scc_ap_dump(scc_ap_t *ap, ap_dump_fn dump_fn, void *user_data) { return 0; }
+    if (i >= len) {
+        ap_from_isize(ap, 0);
+        return;
+    }
+
+    /* ---------- base auto-detection ---------- */
+    /* hex: 0x / 0X */
+    if ((base == 0 || base == 16) &&
+        (i + 2 < len && str[i] == '0' &&
+         (str[i + 1] == 'x' || str[i + 1] == 'X'))) {
+        base = 16;
+        i += 2;
+    }
+    /* binary: 0b / 0B */
+    if ((base == 0 || base == 2) &&
+        (i + 2 < len && str[i] == '0' &&
+         (str[i + 1] == 'b' || str[i + 1] == 'B'))) {
+        base = 2;
+        i += 2;
+    }
+    if (base == 0) {
+        if (i < len && str[i] == '0') {
+            base = 8;
+            i++;
+        } else {
+            base = 10;
+        }
+    }
+
+    /* ---------- parse digits ---------- */
+    uint64_t val = 0;
+    for (; i < len; i++) {
+        char ch = str[i];
+        unsigned d;
+        if (ch >= '0' && ch <= '9')
+            d = (unsigned)(ch - '0');
+        else if (ch >= 'a' && ch <= 'f')
+            d = (unsigned)(ch - 'a' + 10);
+        else if (ch >= 'A' && ch <= 'F')
+            d = (unsigned)(ch - 'A' + 10);
+        else
+            break;
+        if ((int)d >= base)
+            break;
+
+        /* overflow check: val * base + d <= UINT64_MAX */
+        if (val > (UINT64_MAX - d) / (unsigned)base)
+            SCC_AP_PANIC("scc_ap_from_string: overflow");
+        val = val * (unsigned)base + d;
+    }
+
+    ap->capacity = -1;
+    ap->data.digit = val;
+    ap->len = (sign < 0 && val > 0) ? -1 : 1;
+}
+
+void scc_ap_set_digit(scc_ap_t *ap, scc_ap_digit digit) {
+    SCC_AP_ASSERT(ap != nullptr);
+    if (digit > (scc_ap_digit)INTPTR_MAX)
+        SCC_AP_PANIC("scc_ap_set_digit: value %llu exceeds isize range",
+                     (unsigned long long)digit);
+    ap->capacity = -1;
+    ap->data.digit = digit;
+    ap->len = 1;
+}
+
+void scc_ap_add(scc_ap_t *to, const scc_ap_t *from_a, const scc_ap_t *from_b) {
+    SCC_AP_ASSERT(to != nullptr && from_a != nullptr && from_b != nullptr);
+    isize a = ap_to_isize(from_a);
+    isize b = ap_to_isize(from_b);
+    ap_from_isize(to, ap_add_isize(a, b));
+}
+
+void scc_ap_sub(scc_ap_t *to, const scc_ap_t *from_a, const scc_ap_t *from_b) {
+    SCC_AP_ASSERT(to != nullptr && from_a != nullptr && from_b != nullptr);
+    isize a = ap_to_isize(from_a);
+    isize b = ap_to_isize(from_b);
+    ap_from_isize(to, ap_sub_isize(a, b));
+}
+
+void scc_ap_mul(scc_ap_t *to, const scc_ap_t *from_a, const scc_ap_t *from_b) {
+    SCC_AP_ASSERT(to != nullptr && from_a != nullptr && from_b != nullptr);
+    isize a = ap_to_isize(from_a);
+    isize b = ap_to_isize(from_b);
+    ap_from_isize(to, ap_mul_isize(a, b));
+}
+
+void scc_ap_div(scc_ap_t *to, const scc_ap_t *from_a, const scc_ap_t *from_b) {
+    SCC_AP_ASSERT(to != nullptr && from_a != nullptr && from_b != nullptr);
+    isize a = ap_to_isize(from_a);
+    isize b = ap_to_isize(from_b);
+    ap_from_isize(to, ap_div_isize(a, b));
+}
+
+void scc_ap_mod(scc_ap_t *to, const scc_ap_t *from_a, const scc_ap_t *from_b) {
+    SCC_AP_ASSERT(to != nullptr && from_a != nullptr && from_b != nullptr);
+    isize a = ap_to_isize(from_a);
+    isize b = ap_to_isize(from_b);
+    ap_from_isize(to, ap_mod_isize(a, b));
+}
+
+void scc_ap_shl(scc_ap_t *to, const scc_ap_t *from, unsigned shift) {
+    SCC_AP_ASSERT(to != nullptr && from != nullptr);
+    SCC_AP_ASSERT(from->capacity == -1);
+    if (shift >= sizeof(scc_ap_digit) * 8)
+        SCC_AP_PANIC("scc_ap_shl: shift %u exceeds digit width (%zu bits)",
+                     shift, sizeof(scc_ap_digit) * 8);
+    /* left shift = multiply by 2^shift */
+    isize val = ap_to_isize(from);
+    isize result = ap_mul_isize(val, (isize)1 << shift);
+    ap_from_isize(to, result);
+}
+
+void scc_ap_shr(scc_ap_t *to, const scc_ap_t *from, unsigned shift) {
+    SCC_AP_ASSERT(to != nullptr && from != nullptr);
+    SCC_AP_ASSERT(from->capacity == -1);
+    if (shift >= sizeof(scc_ap_digit) * 8)
+        SCC_AP_PANIC("scc_ap_shr: shift %u exceeds digit width (%zu bits)",
+                     shift, sizeof(scc_ap_digit) * 8);
+    /* arithmetic right shift — uses >> on isize (arithmetic on GCC/MSVC/Clang) */
+    isize val = ap_to_isize(from);
+    ap_from_isize(to, val >> shift);
+}
+
+void scc_ap_lshr(scc_ap_t *to, const scc_ap_t *from, unsigned shift) {
+    SCC_AP_ASSERT(to != nullptr && from != nullptr);
+    SCC_AP_ASSERT(from->capacity == -1);
+    if (shift >= sizeof(scc_ap_digit) * 8)
+        SCC_AP_PANIC("scc_ap_lshr: shift %u exceeds digit width (%zu bits)",
+                     shift, sizeof(scc_ap_digit) * 8);
+    /*
+     * logical right shift: reinterpret the signed value as uint64 bit pattern,
+     * shift right, store as non-negative magnitude.
+     */
+    uint64_t bits;
+    if (from->len < 0) {
+        /* negative → two's complement bit pattern */
+        bits = -(uint64_t)(int64_t)from->data.digit;
+    } else {
+        bits = from->data.digit;
+    }
+    to->capacity = -1;
+    to->data.digit = bits >> shift;
+    to->len = 1;
+}
+
+/* ---------- bitwise ---------- */
+
+void scc_ap_and(scc_ap_t *to, const scc_ap_t *a, const scc_ap_t *b) {
+    SCC_AP_ASSERT(to != nullptr && a != nullptr && b != nullptr);
+    ap_from_isize(to, ap_to_isize(a) & ap_to_isize(b));
+}
+
+void scc_ap_or(scc_ap_t *to, const scc_ap_t *a, const scc_ap_t *b) {
+    SCC_AP_ASSERT(to != nullptr && a != nullptr && b != nullptr);
+    ap_from_isize(to, ap_to_isize(a) | ap_to_isize(b));
+}
+
+void scc_ap_xor(scc_ap_t *to, const scc_ap_t *a, const scc_ap_t *b) {
+    SCC_AP_ASSERT(to != nullptr && a != nullptr && b != nullptr);
+    ap_from_isize(to, ap_to_isize(a) ^ ap_to_isize(b));
+}
+
+void scc_ap_not(scc_ap_t *to, const scc_ap_t *from) {
+    SCC_AP_ASSERT(to != nullptr && from != nullptr);
+    ap_from_isize(to, ~ap_to_isize(from));
+}
+
+/* ---------- unary arithmetic ---------- */
+
+void scc_ap_neg(scc_ap_t *to, const scc_ap_t *from) {
+    SCC_AP_ASSERT(to != nullptr && from != nullptr);
+    isize val = ap_to_isize(from);
+    if (val == INTPTR_MIN)
+        SCC_AP_PANIC("scc_ap_neg: overflow (INTPTR_MIN)");
+    ap_from_isize(to, -val);
+}
+
+/* ---------- comparison ---------- */
+
+int scc_ap_cmp(const scc_ap_t *a, const scc_ap_t *b) {
+    SCC_AP_ASSERT(a != nullptr && b != nullptr);
+    isize va = ap_to_isize(a);
+    isize vb = ap_to_isize(b);
+    if (va < vb) return -1;
+    if (va > vb) return 1;
+    return 0;
+}
+
+int scc_ap_is_zero(const scc_ap_t *ap) {
+    SCC_AP_ASSERT(ap != nullptr);
+    return ap->data.digit == 0;
+}
+
+int scc_ap_eql(const scc_ap_t *a, const scc_ap_t *b) {
+    SCC_AP_ASSERT(a != nullptr && b != nullptr);
+    SCC_AP_ASSERT(a->capacity == -1 && b->capacity == -1);
+    if (a->len != b->len) {
+        /* -0 == +0 */
+        if (a->data.digit == 0 && b->data.digit == 0)
+            return 1;
+        return 0;
+    }
+    return a->data.digit == b->data.digit;
+}
+
+int scc_ap_dump(scc_ap_t *ap, ap_dump_fn dump_fn, void *user_data) {
+    SCC_AP_ASSERT(ap != nullptr && dump_fn != nullptr);
+    SCC_AP_ASSERT(ap->capacity == -1);
+
+    isize val = ap_to_isize(ap);
+
+    if (val == 0) {
+        dump_fn('0', user_data);
+        return 0;
+    }
+
+    /* Buffer large enough for INT64_MIN "-9223372036854775808" */
+    char buf[24];
+    int pos = sizeof(buf);
+
+    if (val < 0) {
+        dump_fn('-', user_data);
+        /* Work with positive magnitude to avoid overflow when printing */
+        uint64_t mag = ap->data.digit;
+        while (mag > 0) {
+            buf[--pos] = (char)('0' + (mag % 10));
+            mag /= 10;
+        }
+    } else {
+        uint64_t mag = (uint64_t)val;
+        while (mag > 0) {
+            buf[--pos] = (char)('0' + (mag % 10));
+            mag /= 10;
+        }
+    }
+
+    for (int i = pos; i < (int)sizeof(buf); i++)
+        dump_fn(buf[i], user_data);
+
+    return 0;
+}

runtime/ap/tests/test_ap_panic.c

@@ -0,0 +1,184 @@
+#include <ap.h>
+#include <stdio.h>
+#include <string.h>
+#include <utest/acutest.h>
+
+/*
+ * Panic / overflow tests — each test calls SCC_AP_PANIC which aborts the
+ * process. Run this file separately from the normal tests.
+ */
+
+/* ---------- helper: attempt an operation and report result ---------- */
+
+#define TRY_PANIC(call, label)                                                    \
+    do {                                                                          \
+        fprintf(stderr, "  " label " ... ");                                      \
+        call;                                                                     \
+        fprintf(stderr, "FAIL (no panic)\n");                                     \
+        TEST_CHECK(0 && "expected panic");                                        \
+    } while (0)
+
+void test_add_overflow_positive(void) {
+    scc_ap_t a, b, r;
+    scc_ap_init(&a);
+    scc_ap_init(&b);
+    scc_ap_init(&r);
+    scc_ap_from_string(&a, "9223372036854775807", -1, 10);
+    scc_ap_set_int(&b, 1);
+    TRY_PANIC(scc_ap_add(&r, &a, &b), "INTPTR_MAX + 1");
+}
+
+void test_add_overflow_negative(void) {
+    scc_ap_t a, b, r;
+    scc_ap_init(&a);
+    scc_ap_init(&b);
+    scc_ap_init(&r);
+    scc_ap_from_string(&a, "-9223372036854775808", -1, 10);
+    scc_ap_set_int(&b, -1);
+    TRY_PANIC(scc_ap_add(&r, &a, &b), "INTPTR_MIN + (-1)");
+}
+
+void test_mul_overflow(void) {
+    scc_ap_t a, b, r;
+    scc_ap_init(&a);
+    scc_ap_init(&b);
+    scc_ap_init(&r);
+    scc_ap_from_string(&a, "4611686018427387904", -1, 10); /* INT64_MAX/2 + 1 */
+    scc_ap_set_int(&b, 2);
+    TRY_PANIC(scc_ap_mul(&r, &a, &b), "(INT64_MAX/2+1) * 2");
+}
+
+void test_div_by_zero(void) {
+    scc_ap_t a, b, r;
+    scc_ap_init(&a);
+    scc_ap_init(&b);
+    scc_ap_init(&r);
+    scc_ap_set_int(&a, 1);
+    scc_ap_set_int(&b, 0);
+    TRY_PANIC(scc_ap_div(&r, &a, &b), "1 / 0");
+}
+
+void test_mod_by_zero(void) {
+    scc_ap_t a, b, r;
+    scc_ap_init(&a);
+    scc_ap_init(&b);
+    scc_ap_init(&r);
+    scc_ap_set_int(&a, 1);
+    scc_ap_set_int(&b, 0);
+    TRY_PANIC(scc_ap_mod(&r, &a, &b), "1 % 0");
+}
+
+void test_from_string_overflow(void) {
+    scc_ap_t ap;
+    scc_ap_init(&ap);
+    TRY_PANIC(scc_ap_from_string(&ap, "18446744073709551615", -1, 10),
+              "UINT64_MAX as string");
+}
+
+void test_set_digit_overflow(void) {
+    scc_ap_t ap;
+    scc_ap_init(&ap);
+    TRY_PANIC(scc_ap_set_digit(&ap, (scc_ap_digit)18446744073709551615ULL),
+              "set_digit(UINT64_MAX)");
+}
+
+void test_sub_underflow(void) {
+    scc_ap_t a, b, r;
+    scc_ap_init(&a);
+    scc_ap_init(&b);
+    scc_ap_init(&r);
+    scc_ap_from_string(&a, "-9223372036854775808", -1, 10);
+    scc_ap_set_int(&b, 1);
+    TRY_PANIC(scc_ap_sub(&r, &a, &b), "INTPTR_MIN - 1");
+}
+
+void test_div_overflow(void) {
+    scc_ap_t a, b, r;
+    scc_ap_init(&a);
+    scc_ap_init(&b);
+    scc_ap_init(&r);
+    scc_ap_from_string(&a, "-9223372036854775808", -1, 10);
+    scc_ap_set_int(&b, -1);
+    TRY_PANIC(scc_ap_div(&r, &a, &b), "INTPTR_MIN / -1");
+}
+
+void test_mod_overflow(void) {
+    scc_ap_t a, b, r;
+    scc_ap_init(&a);
+    scc_ap_init(&b);
+    scc_ap_init(&r);
+    scc_ap_from_string(&a, "-9223372036854775808", -1, 10);
+    scc_ap_set_int(&b, -1);
+    TRY_PANIC(scc_ap_mod(&r, &a, &b), "INTPTR_MIN % -1");
+}
+
+void test_mul_overflow_neg_limit(void) {
+    scc_ap_t a, b, r;
+    scc_ap_init(&a);
+    scc_ap_init(&b);
+    scc_ap_init(&r);
+    scc_ap_from_string(&a, "-9223372036854775808", -1, 10);
+    scc_ap_set_int(&b, 2);
+    TRY_PANIC(scc_ap_mul(&r, &a, &b), "INTPTR_MIN * 2");
+}
+
+void test_with_bits_overflow(void) {
+    scc_ap_t ap;
+    scc_ap_init(&ap);
+    TRY_PANIC(scc_ap_with_bits(&ap, 65), "with_bits(65)");
+}
+
+/* ---------- shift overflow tests ---------- */
+
+void test_shl_overflow(void) {
+    scc_ap_t a, r;
+    scc_ap_init(&a);
+    scc_ap_init(&r);
+    scc_ap_from_string(&a, "4611686018427387904", -1, 10); /* INT64_MAX/2+1 */
+    TRY_PANIC(scc_ap_shl(&r, &a, 1), "(INT64_MAX/2+1) << 1");
+}
+
+void test_shl_shift_ge_64(void) {
+    scc_ap_t a, r;
+    scc_ap_init(&a);
+    scc_ap_init(&r);
+    scc_ap_set_int(&a, 1);
+    TRY_PANIC(scc_ap_shl(&r, &a, 64), "1 << 64");
+}
+
+void test_shr_shift_ge_64(void) {
+    scc_ap_t a, r;
+    scc_ap_init(&a);
+    scc_ap_init(&r);
+    scc_ap_set_int(&a, 1);
+    TRY_PANIC(scc_ap_shr(&r, &a, 64), "1 >> 64");
+}
+
+void test_lshr_shift_ge_64(void) {
+    scc_ap_t a, r;
+    scc_ap_init(&a);
+    scc_ap_init(&r);
+    scc_ap_set_int(&a, 1);
+    TRY_PANIC(scc_ap_lshr(&r, &a, 64), "1 lshr 64");
+}
+
+TEST_LIST = {
+    {"test_add_overflow_positive", test_add_overflow_positive},
+    {"test_add_overflow_negative", test_add_overflow_negative},
+    {"test_mul_overflow", test_mul_overflow},
+    {"test_mul_overflow_neg_limit", test_mul_overflow_neg_limit},
+    {"test_div_by_zero", test_div_by_zero},
+    {"test_div_overflow", test_div_overflow},
+    {"test_mod_by_zero", test_mod_by_zero},
+    {"test_mod_overflow", test_mod_overflow},
+    {"test_sub_underflow", test_sub_underflow},
+    {"test_from_string_overflow", test_from_string_overflow},
+    {"test_set_digit_overflow", test_set_digit_overflow},
+    {"test_with_bits_overflow", test_with_bits_overflow},
+    /* shift overflow */
+    {"test_shl_overflow", test_shl_overflow},
+    {"test_shl_shift_ge_64", test_shl_shift_ge_64},
+    {"test_shr_shift_ge_64", test_shr_shift_ge_64},
+    {"test_lshr_shift_ge_64", test_lshr_shift_ge_64},
+    {nullptr, nullptr},
+};

runtime/scc_core/include/scc_core_impl.h

@@ -4,9 +4,12 @@
 #include "scc_core_pal.h"
 #include "scc_core_type.h"
 
-#define scc_malloc scc_pal_malloc
-#define scc_calloc scc_pal_calloc
-#define scc_realloc scc_pal_realloc
+void *__scc_malloc(size_t size);
+void *__scc_calloc(size_t count, size_t size);
+void *__scc_realloc(void *ptr, size_t new_size);
+#define scc_malloc __scc_malloc
+#define scc_calloc __scc_calloc
+#define scc_realloc __scc_realloc
 #define scc_free scc_pal_free
 #define scc_exit scc_pal_exit
 #define scc_abort scc_pal_abort

runtime/scc_core/include/scc_core_str.h

@@ -240,7 +240,14 @@ static inline char *scc_str_move_cstr(scc_str_t *str) {
 }
 
 static inline scc_str_t scc_str_move(scc_str_t *str) {
-    return scc_str_from_cstr(scc_str_move_cstr(str));
+    if (str == nullptr || str->data == nullptr) {
+        return scc_str_empty();
+    }
+    scc_str_t result = *str;
+    str->data = nullptr;
+    str->cap = 0;
+    str->size = 0;
+    return result;
 }
 
 #endif /* __SCC_CORE_STR_H__ */

runtime/scc_core/include/scc_core_vec.h

@@ -106,7 +106,7 @@ typedef size_t usize;
 #define scc_vec_push(vec, value)                                               \
     do {                                                                       \
         if ((vec).size >= (vec).cap) {                                         \
-            int cap = (vec).cap ? (vec).cap * 2 : 4;                           \
+            usize cap = (vec).cap ? (vec).cap * 2 : 4;                           \
             scc_vec_realloc(vec, cap);                                         \
         }                                                                      \
         Assert((vec).data != nullptr);                                         \

runtime/scc_core/src/core_impl.c

@@ -5,6 +5,30 @@
 #define __SCC_LOG_IMPL_IMPORT_SRC__
 #include <scc_core_log.h>
 
+void *__scc_malloc(size_t size) {
+    void *p = scc_pal_malloc(size);
+    if (!p) {
+        LOG_FATAL("__scc_malloc: allocation failed (%zu bytes)", size);
+    }
+    return p;
+}
+
+void *__scc_calloc(size_t count, size_t size) {
+    void *p = scc_pal_calloc(count, size);
+    if (!p) {
+        LOG_FATAL("__scc_calloc: allocation failed (%zu x %zu)", count, size);
+    }
+    return p;
+}
+
+void *__scc_realloc(void *ptr, size_t new_size) {
+    void *p = scc_pal_realloc(ptr, new_size);
+    if (!p) {
+        LOG_FATAL("__scc_realloc: allocation failed (%zu bytes)", new_size);
+    }
+    return p;
+}
+
 void putchar_(char ch) {
     (void)ch;
     LOG_FATAL("you can't use printf.c directly");
@@ -42,12 +66,13 @@ usize scc_fread(scc_file_t file, void *buffer, usize size) {
 usize scc_fwrite(scc_file_t file, const void *buf, usize size) {
     if (file == scc_stdout) {
         scc_pal_write(buf, size);
+        return size;
     } else if (file == scc_stderr) {
         scc_pal_ewrite(buf, size);
+        return size;
     } else {
         return scc_pal_fwrite(file, buf, size);
     }
-    return 0;
 }
 
 cbool scc_fexists(const char *path) {

runtime/scc_utils/include/scc_path.h

@@ -0,0 +1,30 @@
+#ifndef __SCC_PATH_H__
+#define __SCC_PATH_H__
+
+/**
+ * @brief 检查路径是否为绝对路径
+ * @param path 要检查的路径
+ * @return 1 是绝对路径, 0 不是
+ */
+int scc_path_is_absolute(const char *path);
+
+/**
+ * @brief 检查路径是否包含 .. 路径穿越组件
+ * @param path 要检查的路径
+ * @return 1 包含 .., 0 不包含
+ */
+int scc_path_has_dotdot(const char *path);
+
+/**
+ * @brief 检查路径是否安全用作 #include 文件名
+ *
+ * 拒绝条件：
+ *  - 绝对路径（以 / \ 开头，或 Windows 驱动符如 C:\）
+ *  - 包含 .. 路径穿越组件
+ *
+ * @param path 要检查的路径
+ * @return 0 安全, -1 不安全
+ */
+int scc_path_check_include_safe(const char *path);
+
+#endif /* __SCC_PATH_H__ */

runtime/scc_utils/include/scc_utils.h

@@ -4,6 +4,7 @@
 // #include "kllist.h"
 #include "scc_hashtable.h"
 #include "scc_strpool.h"
+#include "scc_path.h"
 #include <scc_core.h>
 
 #endif /* __SMCC_UTILS_H__ */

runtime/scc_utils/src/hashtable.c

@@ -44,13 +44,15 @@ void scc_hashtable_usize_init(scc_hashtable_t *ht) {
     scc_hashtable_init(ht, ht_usizehash, ht_usizecmp, nullptr);
 }
 
-static int next_power_of_two(int n) {
+static usize next_power_of_two(usize n) {
+    if (n == 0) return 32;
     n--;
     n |= n >> 1;
     n |= n >> 2;
     n |= n >> 4;
     n |= n >> 8;
     n |= n >> 16;
+    n |= n >> 32;
     return n + 1;
 }
 
@@ -119,7 +121,7 @@ static void adjust_capacity(scc_hashtable_t *ht, usize new_cap) {
 
 void *scc_hashtable_set(scc_hashtable_t *ht, const void *key, void *value) {
     if (ht->count + ht->tombstone_count >= ht->entries.cap * 0.75) {
-        int new_cap = ht->entries.cap < SCC_INIT_HASHMAP_SIZE
+        usize new_cap = ht->entries.cap < SCC_INIT_HASHMAP_SIZE
                             ? SCC_INIT_HASHMAP_SIZE
                             : ht->entries.cap * 2;
         adjust_capacity(ht, new_cap);
@@ -127,6 +129,10 @@ void *scc_hashtable_set(scc_hashtable_t *ht, const void *key, void *value) {
 
     u32 hash = ht->hash_func(key, ht->userdata);
     scc_hashtable_entry_t *entry = find_entry(ht, key, hash);
+    if (entry == nullptr) {
+        LOG_FATAL("scc_hashtable_set: hash table is full");
+        return nullptr;
+    }
 
     void *old_value = nullptr;
     if (entry->state == ENTRY_ACTIVE) {

runtime/scc_utils/src/scc_path.c

@@ -0,0 +1,67 @@
+#include <scc_core.h>
+#include <scc_path.h>
+
+#ifdef _WIN32
+#define SCC_PATH_SEP_A '\\'
+#define SCC_PATH_SEP_B '/'
+#define SCC_IS_DRIVE_LETTER(c)                                                 \
+    (((c) >= 'a' && (c) <= 'z') || ((c) >= 'A' && (c) <= 'Z'))
+#else
+#define SCC_PATH_SEP_A '/'
+#define SCC_PATH_SEP_B '/' /* no alternative separator on non-Windows */
+#endif
+
+int scc_path_is_absolute(const char *path) {
+    if (path == nullptr || path[0] == '\0')
+        return 0;
+
+    /* Unix absolute: /path */
+    if (path[0] == '/')
+        return 1;
+
+#ifdef _WIN32
+    /* Windows absolute: C:\path or \path */
+    if (path[0] == '\\')
+        return 1;
+    if (SCC_IS_DRIVE_LETTER(path[0]) && path[1] == ':')
+        return 1;
+#endif
+
+    return 0;
+}
+
+int scc_path_has_dotdot(const char *path) {
+    if (path == nullptr)
+        return 0;
+
+    const char *p = path;
+    while (*p) {
+        /* Look for '.' followed by '.' */
+        if (p[0] == '.' && p[1] == '.') {
+            char next = p[2];
+            /* ".." at end of string or followed by a separator */
+            if (next == '\0' || next == SCC_PATH_SEP_A || next == SCC_PATH_SEP_B) {
+                /* Must also check that this ".." is at start or preceded by a separator */
+                if (p == path ||
+                    p[-1] == SCC_PATH_SEP_A || p[-1] == SCC_PATH_SEP_B) {
+                    return 1;
+                }
+            }
+        }
+        p++;
+    }
+    return 0;
+}
+
+int scc_path_check_include_safe(const char *path) {
+    if (path == nullptr || path[0] == '\0')
+        return -1;
+
+    if (scc_path_is_absolute(path))
+        return -1;
+
+    if (scc_path_has_dotdot(path))
+        return -1;
+
+    return 0;
+}

runtime/scc_utils/src/strpool.c

@@ -22,7 +22,16 @@ const char *scc_strpool_intern(scc_strpool_t *pool, const char *str) {
     return new_str;
 }
 
-void scc_strpool_drop(scc_strpool_t *pool) { scc_hashtable_drop(&pool->ht); }
+void scc_strpool_drop(scc_strpool_t *pool) {
+    // Free all interned string allocations before dropping the hash table
+    for (usize i = 0; i < pool->ht.entries.cap; i++) {
+        scc_hashtable_entry_t *entry = &scc_vec_at(pool->ht.entries, i);
+        if (entry->state == ENTRY_ACTIVE) {
+            scc_free((void *)entry->key);
+        }
+    }
+    scc_hashtable_drop(&pool->ht);
+}
 
 void scc_strpool_foreach(scc_strpool_t *pool, scc_strpool_iter_fn iter_func,
                          void *context) {

src/bin/sccfdump.c

@@ -12,6 +12,9 @@ typedef struct {
     cbool dump_relocs;
     cbool dump_hex;
     cbool dump_all;
+    const char *get_section_name;
+    int get_section_idx;
+    cbool has_get_section_idx;
     int verbose;
 } sccfdump_config_t;
 
@@ -188,6 +191,8 @@ int main(int argc, const char **argv, const char **envp) {
         HINT_HEX,
         HINT_VERBOSE,
         HINT_ALL,
+        HINT_GET_SECTION,
+        HINT_GET_SECTION_IDX,
     };
     static const char *hints_en[] = {
         [HINT_PROG_NAME] = "sccfdump",
@@ -201,6 +206,8 @@ int main(int argc, const char **argv, const char **envp) {
         [HINT_HEX] = "Dump section hex content",
         [HINT_VERBOSE] = "Verbose output (use with -x)",
         [HINT_ALL] = "Dump header, sections, symbols and relocs",
+        [HINT_GET_SECTION] = "Extract raw section data by name (e.g. .text)",
+        [HINT_GET_SECTION_IDX] = "Extract raw section data by index",
     };
     static const char *hints_zh[] = {
         [HINT_PROG_NAME] = "sccfdump",
@@ -214,6 +221,8 @@ int main(int argc, const char **argv, const char **envp) {
         [HINT_HEX] = "转存段的十六进制内容",
         [HINT_VERBOSE] = "详细输出(与-x配合使用)",
         [HINT_ALL] = "转存文件头、段、符号和重定位",
+        [HINT_GET_SECTION] = "按名称提取段原始数据(如 .text)",
+        [HINT_GET_SECTION_IDX] = "按索引提取段原始数据",
     };
 
     scc_argparse_lang_t lang = SCC_ARGPARSE_LANG_EN;
@@ -228,6 +237,7 @@ int main(int argc, const char **argv, const char **envp) {
     sccfdump_config_t config;
     scc_memset(&config, 0, sizeof(config));
     config.dump_all = true;
+    config.get_section_idx = -1;
 
     scc_argparse_t argparse;
     scc_argparse_init(&argparse, hints[HINT_PROG_NAME], hints[HINT_DESCRIPTION]);
@@ -275,6 +285,16 @@ int main(int argc, const char **argv, const char **envp) {
     scc_argparse_spec_setup_count(&opt_verbose.spec, &config.verbose);
     scc_argparse_cmd_add_opt(root, &opt_verbose);
 
+    scc_argparse_opt_t opt_get_section;
+    scc_argparse_opt_init(&opt_get_section, 0, "get-section", hints[HINT_GET_SECTION]);
+    scc_argparse_spec_setup_string(&opt_get_section.spec, &config.get_section_name);
+    scc_argparse_cmd_add_opt(root, &opt_get_section);
+
+    scc_argparse_opt_t opt_get_section_idx;
+    scc_argparse_opt_init(&opt_get_section_idx, 0, "get-section-idx", hints[HINT_GET_SECTION_IDX]);
+    scc_argparse_spec_setup_int(&opt_get_section_idx.spec, &config.get_section_idx);
+    scc_argparse_cmd_add_opt(root, &opt_get_section_idx);
+
     scc_argparse_arg_t arg_file;
     scc_argparse_arg_init(&arg_file, "file", hints[HINT_FILE]);
     scc_argparse_spec_setup_string(&arg_file.spec, &config.filepath);
@@ -318,6 +338,60 @@ int main(int argc, const char **argv, const char **envp) {
     sccf_parse(&sccf, &buf, 0);
     u8 *base = scc_vec_unsafe_get_data(buf);
 
+    /* --get-section / --get-section-idx: extract raw data to a file/stdout */
+    if (config.get_section_name || config.get_section_idx >= 0) {
+        usize idx = (usize)-1;
+        if (config.get_section_idx >= 0) {
+            idx = (usize)config.get_section_idx;
+        } else {
+            const sccf_header_t *hdr = (const sccf_header_t *)base;
+            for (usize i = 0; i < (usize)hdr->sect_header_num; i++) {
+                const sccf_sect_header_t *sh = sccf_sect_header(base, i);
+                if (sh && scc_memcmp(sh->name,
+                                     config.get_section_name, 8) == 0) {
+                    idx = i;
+                    break;
+                }
+            }
+            if (idx == (usize)-1) {
+                LOG_ERROR("section not found: %s", config.get_section_name);
+                scc_vec_free(buf);
+                return 1;
+            }
+        }
+
+        const sccf_sect_header_t *sh = sccf_sect_header(base, idx);
+        if (!sh) {
+            LOG_ERROR("invalid section index: %d", config.get_section_idx);
+            scc_vec_free(buf);
+            return 1;
+        }
+        u8 *sdata = sccf_sect_data(base, idx);
+        if (!sdata || sh->size == 0) {
+            scc_vec_free(buf);
+            return 0;
+        }
+
+        if (config.output && scc_strcmp(config.output, "-") == 0) {
+            scc_fwrite(scc_stdout, sdata, sh->size);
+        } else if (config.output) {
+            scc_file_t ofp = scc_fopen(config.output, SCC_FILE_WRITE);
+            if (!ofp) {
+                LOG_ERROR("cannot open output: %s", config.output);
+                scc_vec_free(buf);
+                return 1;
+            }
+            scc_fwrite(ofp, sdata, sh->size);
+            scc_fclose(ofp);
+        } else {
+            scc_fwrite(scc_stdout, sdata, sh->size);
+        }
+
+        scc_vec_free(buf);
+        return 0;
+    }
+
+    /* --hex without -o: also go to stdout */
     if (config.dump_all) {
         dump_header(&sccf.header);
         dump_sections(base);

src/main.c

@@ -17,6 +17,9 @@
 #include <scc_ir2sccf.h>
 #include <sccf2pe.h>
 
+#define __SCC_TYPE_ABI_WIN_X64_IMPL__
+#include <scc_type_abi_win_x64.h>
+
 #include "config.h"
 void init_platform(void);
 #define GET_VALID_FP(fp) (fp == nullptr ? scc_stdout : fp)
@@ -203,11 +206,11 @@ int main(int argc, const char **argv, const char **envp) {
     scc_lexer_tok_ring_t *tok_ring =
         scc_pproc_to_ring(&pproc, 1024, false, false);
     scc_parser_t parser;
-    scc_ast_ctx_t ast_ctx;
-    scc_ast_ctx_init(&ast_ctx);
+    scc_ast_module_t ast_module;
+    scc_ast_module_init(&ast_module);
     scc_sema_ctx_t sema_ctx;
-    scc_sema_init(&sema_ctx, &ast_ctx);
-    scc_parser_init(&parser, tok_ring, &ast_ctx, &sema_ctx);
+    scc_sema_init(&sema_ctx, &ast_module);
+    scc_parser_init(&parser, tok_ring, &ast_module, &sema_ctx);
     scc_ast_translation_unit_t *translation_unit =
         scc_parse_translation_unit(&parser);
     if (parser.errcode != 0) {
@@ -240,10 +243,10 @@ sstream_drop:
     }
 
     scc_ast2ir_ctx_t ast2ir_ctx;
-#include <target/scc_abi_win_x64_pc.h>
     scc_hir_cprog_t cprog;
-    scc_hir_cprog_init(&cprog);
-    scc_ast2ir_ctx_init(&ast2ir_ctx, &scc_ast_abi_impl, &ast_ctx, &cprog);
+    scc_hir_cprog_init(&cprog, &SCC_TYPE_ABI_WIN_X64);
+    scc_ast2ir_ctx_init(&ast2ir_ctx, &SCC_TYPE_ABI_WIN_X64, &ast_module,
+                        &cprog);
     scc_ast2ir_run(&ast2ir_ctx, translation_unit);
     scc_ast2ir_ctx_drop(&ast2ir_ctx);
 

tests/simple/test.py

@@ -7,6 +7,7 @@ executes the resulting binary, and validates the process return code or stdout.
 from __future__ import annotations
 
 import argparse
+import difflib
 import logging
 import os
 import subprocess
@@ -23,7 +24,8 @@ from typing import Sequence
 # Configuration
 # ---------------------------------------------------------------------------
 WORKSPACE = Path(__file__).resolve().parent
-CC_PATH = WORKSPACE / "../../build/dev/scc"
+CC_ROOT = WORKSPACE / "../.."
+CC_PATH = CC_ROOT / "build/dev/scc"
 CONFIG_PATH = WORKSPACE / "expect.toml"
 DEFAULT_TIMEOUT = 1  # seconds
 
@@ -99,8 +101,15 @@ class Runner:
                 text=True,
                 timeout=self.timeout,
             )
-        except subprocess.TimeoutExpired:
-            return False, "Compilation timed out"
+        except subprocess.TimeoutExpired as e:
+            # e.stdout, e.stderr 为已捕获的部分输出（字符串）
+            captured_stderr = e.stderr.strip() if e.stderr else ""
+            captured_stdout = e.stdout.strip() if e.stdout else ""
+            err_msg = f"""Compilation timed out.
+            stderr: {captured_stderr or '(no output)'}
+            stdout: {captured_stdout or '(no output)'}
+            cmd: {" ".join(cmd)}"""
+            return False, err_msg
         except OSError as exc:
             return False, f"Failed to invoke compiler: {exc}"
 
@@ -127,6 +136,26 @@ class Runner:
 
         return proc.returncode, proc.stdout, proc.stderr.strip()
 
+    def _print_diff(self, expected: str, actual: str) -> None:
+        """Print unified diff between expected and actual stdout."""
+        expected_lines = expected.splitlines()
+        actual_lines = actual.splitlines()
+        diff = difflib.unified_diff(
+            expected_lines, actual_lines,
+            fromfile='expected', tofile='actual',
+            lineterm=''
+        )
+        # diff = difflib.ndiff(
+        #     expected_lines, actual_lines,
+        # )
+        diff_lines = list(diff)
+        if not diff_lines:
+            logger.error("  Strings differ but no diff generated?")
+            return
+        logger.error("  Diff (expected vs actual):")
+        for line in diff_lines:
+            logger.error("    %s", line)
+
     def run_one(self, test: TestCase) -> bool:
         """Run a single test case. Returns True if passed."""
         logger.info("Testing %s", test.source)
@@ -156,9 +185,14 @@ class Runner:
         passed = actual == test.expected
         if passed:
             logger.info("  PASSED")
+        else:
+            if test.test_type == "stdout":
+                logger.error("  FAILED: stdout mismatch")
+                self._print_diff(test.expected, actual)
             else:
                 logger.error(
-                "  FAILED: expected %r, got %r", test.expected, actual
+                    "  FAILED: expected return code %r, got %r",
+                    test.expected, actual
                 )
 
         # 4. Cleanup
@@ -326,12 +360,12 @@ def main() -> None:
 
     runner = Runner(
         cc=args.cc,
-        workspace=WORKSPACE,
+        workspace=CC_ROOT,
         timeout=args.timeout,
         keep_temps=args.keep_temps,
     )
 
-    global_timeout = DEFAULT_TIMEOUT * 3
+    global_timeout = args.timeout * 3
     passed, total = runner.run_all(selected, global_timeout)
     logger.info("=" * 40)
     if global_timeout and total < len(selected):