feat(ast): 将AST上下文重构为模块并添加字符串池支持

- 将scc_ast_ctx重命名为scc_ast_module以更好地反映其功能
- 添加scc_strpool_t用于统一管理AST节点名称字符串的生命周期
- 实现scc_ast_module_intern函数用于字符串驻留
- 更新所有相关的初始化、销毁和访问函数命名
- 修改内存分配宏以使用新的模块结构

refactor(parser): 更新解析器以使用AST模块和字符串池

- 将解析器中的ast_ctx字段替换为ast_module
- 在创建AST节点时使用新的ast_module参数
- 使用scc_ast_module_intern函数处理标识符和字符串字面量
- 确保所有字符串都被正确驻留到模块的字符串池中

refactor(sema): 更新语义分析器使用AST模块

- 将sema_ctx中的ast_ctx字段替换为ast_module
- 更新语义分析器初始化函数参数

refactor(ast2ir): 更新AST到IR转换器使用AST模块

- 将ast_ctx字段替换为ast_module
- 更新上下文初始化函数参数和实现

fix(cfg): 修复CFG模块中的符号查找错误

- 修正scc_cfg_module_unsafe_get_symbol函数中的边界检查条件

perf(ir): 完善各IR层模块的内存清理机制

- 为HIR模块添加函数和基本块元数据的释放逻辑
- 为MIR和LIR模块完善完整的资源清理和内存释放
- 确保所有分配的元数据结构都能被正确释放

chore(deps): 添加scc_utils依赖到AST库

- 在libs/ast/cbuild.toml中添加对scc_utils的依赖

libs/abi/cbuild.toml

@@ -1,9 +0,0 @@
-[package]
-name = "scc_abi"
-version = "0.1.0"
-authors = []
-description = ""
-
-# dependencies = []
-# features = {}
-# default_features = []

libs/ast/cbuild.toml

@@ -7,6 +7,7 @@ description = ""
 dependencies = [
     { name = "tree_dump", path = "../tree_dump" },
     { name = "scc_pos", path = "../sstream" },
+    { name = "scc_utils", path = "../../runtime/scc_utils" },
 ]
 # features = {}
 # default_features = []

libs/ast/include/scc_ast.h

@@ -2,47 +2,59 @@
 #define __SCC_AST_H__
 
 #include "scc_ast_def.h"
+#include <scc_strpool.h>
 
-typedef struct scc_ast_ctx {
+typedef struct scc_ast_module {
     scc_ast_canon_type_vec_t canonical_type_pool;
     scc_ast_canon_type_t *builtin_types[SCC_AST_BUILTIN_TYPE_COUNT];
     scc_ast_node_vec_t all_nodes;
-} scc_ast_ctx_t;
 
-void scc_ast_ctx_init(scc_ast_ctx_t *ctx);
-void scc_ast_ctx_drop(scc_ast_ctx_t *ctx);
+    /** 所有 AST 节点的 name 字符串由 name_pool 统一管理生命周期 */
+    scc_strpool_t name_pool;
+} scc_ast_module_t;
 
-scc_ast_canon_type_t *scc_ast_ctx_get_builtin_type(scc_ast_ctx_t *ctx,
-                                                   scc_ast_builtin_type_t kind);
+void scc_ast_module_init(scc_ast_module_t *module);
+void scc_ast_module_drop(scc_ast_module_t *module);
 
-scc_ast_canon_type_t *scc_ast_ctx_alloc_type(scc_ast_ctx_t *ctx);
+scc_ast_canon_type_t *
+scc_ast_module_get_builtin_type(scc_ast_module_t *module,
+                                scc_ast_builtin_type_t kind);
 
-static inline void *scc_ast_ctx_alloc_node(scc_ast_ctx_t *ctx, usize size) {
+scc_ast_canon_type_t *scc_ast_module_alloc_type(scc_ast_module_t *module);
+
+/**
+ * @brief 将字符串 intern 到 module 的 name_pool 中
+ * @return 指向 module 所拥有的持久化副本的指针
+ *         （在 module_drop 前始终有效）
+ */
+const char *scc_ast_module_intern(scc_ast_module_t *module, const char *str);
+
+static inline void *scc_ast_module_alloc_node(scc_ast_module_t *module,
+                                              usize size) {
     void *ptr = scc_malloc(size);
     if (ptr == nullptr) {
         Panic("Out of memory");
     }
     scc_memset(ptr, 0, size);
-    scc_vec_push(ctx->all_nodes, (scc_ast_node_t *)ptr);
+    scc_vec_push(module->all_nodes, (scc_ast_node_t *)ptr);
     return ptr;
 }
 
-#define SCC_AST_ALLOC(ctx, type)                                               \
-    ((type *)scc_ast_ctx_alloc_node(ctx, sizeof(type)))
-#define SCC_AST_ALLOC_QUAL_TYPE(ctx) SCC_AST_ALLOC(ctx, scc_ast_qual_type_t)
-#define SCC_AST_ALLOC_DECL(ctx) SCC_AST_ALLOC(ctx, scc_ast_decl_t)
-#define SCC_AST_ALLOC_EXPR(ctx) SCC_AST_ALLOC(ctx, scc_ast_expr_t)
-#define SCC_AST_ALLOC_STMT(ctx) SCC_AST_ALLOC(ctx, scc_ast_stmt_t)
+#define SCC_AST_ALLOC(module, type)                                            \
+    ((type *)scc_ast_module_alloc_node(module, sizeof(type)))
+#define SCC_AST_ALLOC_QUAL_TYPE(module) SCC_AST_ALLOC(module, scc_ast_qual_type_t)
+#define SCC_AST_ALLOC_DECL(module)     SCC_AST_ALLOC(module, scc_ast_decl_t)
+#define SCC_AST_ALLOC_EXPR(module)     SCC_AST_ALLOC(module, scc_ast_expr_t)
+#define SCC_AST_ALLOC_STMT(module)     SCC_AST_ALLOC(module, scc_ast_stmt_t)
 
-// have defined cannoical_type type
 static inline void
-scc_ast_type_builtin_init(scc_ast_qual_type_t *type, scc_ast_ctx_t *ctx,
+scc_ast_type_builtin_init(scc_ast_qual_type_t *type, scc_ast_module_t *module,
                           scc_ast_builtin_type_t builtin_type, scc_pos_t loc) {
     Assert(type != nullptr);
     type->base.loc = loc;
     type->base.type = SCC_AST_TYPE_BUILTIN;
-    type->type = scc_ast_ctx_get_builtin_type(ctx, builtin_type);
-    type->quals = (scc_ast_decl_specifier_t){0}; // FIXME
+    type->type = scc_ast_module_get_builtin_type(module, builtin_type);
+    type->quals = (scc_ast_decl_specifier_t){0};
 }
 
-#endif /* __SCC_AST_H__*/
+#endif /* __SCC_AST_H__ */

libs/ast/src/scc_ast.c

@@ -1,42 +1,49 @@
 #include <scc_ast.h>
 
-static scc_ast_canon_type_t *alloc_canonical_type(scc_ast_ctx_t *ctx) {
+static scc_ast_canon_type_t *alloc_canonical_type(scc_ast_module_t *module) {
     scc_ast_canon_type_t *type = scc_malloc(sizeof(scc_ast_canon_type_t));
     if (type == nullptr) {
         Panic("alloc_canonical_type: malloc failed");
     }
-    scc_vec_push(ctx->canonical_type_pool, type);
+    scc_vec_push(module->canonical_type_pool, type);
     return type;
 }
 
-void scc_ast_ctx_init(scc_ast_ctx_t *ctx) {
-    scc_vec_init(ctx->canonical_type_pool);
-    scc_vec_init(ctx->all_nodes);
+void scc_ast_module_init(scc_ast_module_t *module) {
+    scc_vec_init(module->canonical_type_pool);
+    scc_vec_init(module->all_nodes);
+    scc_strpool_init(&module->name_pool);
 
-    // 创建全部内置类型
     for (int i = 0; i < SCC_AST_BUILTIN_TYPE_COUNT; i += 1) {
-        scc_ast_canon_type_t *t = alloc_canonical_type(ctx);
-        t->builtin.type = (scc_ast_builtin_type_t)i; // 直接按顺序对应
-        ctx->builtin_types[i] = t;
+        scc_ast_canon_type_t *t = alloc_canonical_type(module);
+        t->builtin.type = (scc_ast_builtin_type_t)i;
+        module->builtin_types[i] = t;
     }
 }
 
-void scc_ast_ctx_drop(scc_ast_ctx_t *ctx) {
-    // 释放所有规范类型
-    scc_vec_foreach(ctx->canonical_type_pool, i) {
-        scc_free(ctx->canonical_type_pool.data[i]);
+void scc_ast_module_drop(scc_ast_module_t *module) {
+    scc_vec_foreach(module->canonical_type_pool, i) {
+        scc_free(module->canonical_type_pool.data[i]);
     }
-    scc_vec_foreach(ctx->all_nodes, i) { scc_free(ctx->all_nodes.data[i]); }
-    scc_vec_free(ctx->canonical_type_pool);
+    scc_vec_foreach(module->all_nodes, i) { scc_free(module->all_nodes.data[i]); }
+    scc_vec_free(module->canonical_type_pool);
+    scc_strpool_drop(&module->name_pool);
 }
 
 scc_ast_canon_type_t *
-scc_ast_ctx_get_builtin_type(scc_ast_ctx_t *ctx, scc_ast_builtin_type_t kind) {
+scc_ast_module_get_builtin_type(scc_ast_module_t *module,
+                                scc_ast_builtin_type_t kind) {
     assert(kind < SCC_AST_BUILTIN_TYPE_COUNT &&
            kind > SCC_AST_BUILTIN_TYPE_UNKNOWN);
-    return ctx->builtin_types[kind];
+    return module->builtin_types[kind];
 }
 
-scc_ast_canon_type_t *scc_ast_ctx_alloc_type(scc_ast_ctx_t *ctx) {
-    return alloc_canonical_type(ctx);
+scc_ast_canon_type_t *scc_ast_module_alloc_type(scc_ast_module_t *module) {
+    return alloc_canonical_type(module);
+}
+
+const char *scc_ast_module_intern(scc_ast_module_t *module, const char *str) {
+    if (str == nullptr)
+        return nullptr;
+    return scc_strpool_intern(&module->name_pool, str);
 }

libs/ast2ir/cbuild.toml

@@ -7,7 +7,6 @@ description = ""
 dependencies = [
     { name = "scc_ast", path = "../ast" },
     { name = "scc_hir", path = "../ir/hir" },
-    { name = "scc_abi", path = "../abi" },
 ]
 # features = {}
 # default_features = []

libs/ast2ir/include/scc_ast2ir.h

@@ -16,7 +16,7 @@ typedef struct {
     const scc_abi_type_calc_t *abi;
     cbool hint_using_value; // 转换时尽可能使用value而不是alloc
 
-    scc_ast_ctx_t *ast_ctx;
+    scc_ast_module_t *ast_module;
 } scc_ast2ir_ctx_t;
 
 static inline scc_hir_module_t *scc_ast2ir_mir_module(scc_ast2ir_ctx_t *ctx) {
@@ -24,7 +24,7 @@ static inline scc_hir_module_t *scc_ast2ir_mir_module(scc_ast2ir_ctx_t *ctx) {
 }
 
 void scc_ast2ir_ctx_init(scc_ast2ir_ctx_t *ctx, const scc_abi_type_calc_t *abi,
-                         scc_ast_ctx_t *ast_ctx, scc_hir_cprog_t *cprog);
+                         scc_ast_module_t *ast_module, scc_hir_cprog_t *cprog);
 void scc_ast2ir_ctx_drop(scc_ast2ir_ctx_t *ctx);
 
 void scc_ast2ir_run(scc_ast2ir_ctx_t *ctx,
@@ -38,6 +38,10 @@ void scc_ast2ir_stmt(scc_ast2ir_ctx_t *ctx, const scc_ast_stmt_t *stmt);
 scc_hir_type_ref_t scc_ast2ir_type(scc_ast2ir_ctx_t *ctx,
                                    const scc_ast_qual_type_t *ast_type);
 
+scc_hir_type_ref_t
+scc_ast2ir_parse_base_type(scc_ast2ir_ctx_t *ctx,
+                           const scc_ast_qual_type_t *ast_type);
+
 // ====== 类型提升（Type Promotion）接口 ======
 
 /**
@@ -47,16 +51,17 @@ scc_hir_type_ref_t scc_ast2ir_type(scc_ast2ir_ctx_t *ctx,
  * @return 提升后的类型的引用，若无需提升则返回原始类型
  */
 scc_hir_type_ref_t scc_ast2ir_integer_promotion(scc_ast2ir_ctx_t *ctx,
-                                                 scc_hir_type_ref_t type_ref);
+                                                scc_hir_type_ref_t type_ref);
 
 /**
  * @brief 寻常算术转换（C11 6.3.1.8）
  * 对二元算术操作的两个操作数类型找到公共类型
  * @return 公共类型的引用
  */
-scc_hir_type_ref_t scc_ast2ir_usual_arithmetic_conversion(
-    scc_ast2ir_ctx_t *ctx, scc_hir_type_ref_t t1_ref,
-    scc_hir_type_ref_t t2_ref);
+scc_hir_type_ref_t
+scc_ast2ir_usual_arithmetic_conversion(scc_ast2ir_ctx_t *ctx,
+                                       scc_hir_type_ref_t t1_ref,
+                                       scc_hir_type_ref_t t2_ref);
 
 /**
  * @brief 插入类型转换指令
@@ -64,7 +69,25 @@ scc_hir_type_ref_t scc_ast2ir_usual_arithmetic_conversion(
  * @return 转换后的值引用
  */
 scc_hir_value_ref_t scc_ast2ir_emit_conversion(scc_ast2ir_ctx_t *ctx,
-                                                scc_hir_value_ref_t value,
-                                                scc_hir_type_ref_t target_type);
+                                               scc_hir_value_ref_t value,
+                                               scc_hir_type_ref_t target_type);
+
+// ====== 常量表达式求值 ======
+
+/**
+ * @brief 对整数常量表达式求值（C11 6.6）
+ *
+ * 递归计算 AST 表达式，得到一个编译期可确定的整数值。
+ * 支持：整数字面量、字符字面量、枚举常量、sizeof / _Alignof、
+ *       一元运算（+ - ~ !）、二元运算（算术/位/移位/关系/逻辑）、
+ *       条件表达式（?:）、强制类型转换。
+ *
+ * @param ctx    ast2ir 上下文
+ * @param result 输出参数，存放求值结果
+ * @param expr   待求值的 AST 表达式
+ * @return 成功返回 true；若表达式不是合法的常量表达式则返回 false
+ */
+cbool scc_ast2ir_eval_constant_int(scc_ast2ir_ctx_t *ctx, scc_ap_t *result,
+                                   const scc_ast_expr_t *expr);
 
 #endif /* __SCC_AST2IR_H__ */

libs/ast2ir/src/scc_ast2ir.c

@@ -24,29 +24,6 @@ static int fixed_param_count(const scc_ast_canon_type_t *canon) {
     return n;
 }
 
-static scc_hir_type_ref_t parse_base_type(scc_ast2ir_ctx_t *ctx,
-                                          const scc_ast_qual_type_t *ast_type) {
-    scc_abi_type_layout_t layout;
-    // 映射内置类型
-    ctx->abi->compute_type_layout(ctx->abi, (void *)ast_type, &layout);
-    switch (layout.size) {
-    case 0:
-        return scc_hir_builder_type_void(&ctx->builder);
-    case 1:
-        return scc_hir_builder_type_i8(&ctx->builder);
-    case 2:
-        return scc_hir_builder_type_i16(&ctx->builder);
-    case 4:
-        return scc_hir_builder_type_i32(&ctx->builder);
-    case 8:
-        return scc_hir_builder_type_i64(&ctx->builder);
-        break;
-    default:
-        break;
-    }
-    return SCC_HIR_REF_nullptr;
-}
-
 static inline bool scc_hir_type_is_signed(scc_hir_type_tag_t tag) {
     switch (tag) {
     case SCC_HIR_TYPE_i8:
@@ -69,6 +46,7 @@ static inline bool scc_hir_type_is_signed(scc_hir_type_tag_t tag) {
 
 // 判断是否为算术类型（整数或浮点）
 static cbool is_arithmetic_type(const scc_hir_type_t *type) {
+    Assert(type != nullptr);
     switch (type->tag) {
     case SCC_HIR_TYPE_i8:
     case SCC_HIR_TYPE_i16:
@@ -235,7 +213,7 @@ scc_hir_type_ref_t scc_ast2ir_type(scc_ast2ir_ctx_t *ctx,
 
     switch (ast_type->base.type) {
     case SCC_AST_TYPE_BUILTIN: {
-        return parse_base_type(ctx, ast_type);
+        return scc_ast2ir_parse_base_type(ctx, ast_type);
     }
     case SCC_AST_TYPE_POINTER: {
         scc_hir_type_init(&ir_type, SCC_HIR_TYPE_PTR);
@@ -253,16 +231,11 @@ scc_hir_type_ref_t scc_ast2ir_type(scc_ast2ir_ctx_t *ctx,
         ir_type.data.array.base = element_type;
         ir_type.data.array.len = 0;
         if (scc_ast_canon_type(ast_type)->array.size) {
-            // TODO constant expression
-            if (scc_ast_canon_type(ast_type)->array.size->base.type !=
-                SCC_AST_EXPR_INT_LITERAL) {
-                Panic("TODO: array size expression");
-            }
             scc_ap_t value;
-            scc_ap_from_cstr(
-                &value, scc_ast_canon_type(ast_type)->array.size->literal.lexme,
-                10);
-            // FIXME hack
+            if (!scc_ast2ir_eval_constant_int(
+                    ctx, &value, scc_ast_canon_type(ast_type)->array.size)) {
+                Panic("array size is not a constant expression");
+            }
             ir_type.data.array.len = value.data.digit;
         }
     } break;
@@ -353,13 +326,13 @@ scc_hir_type_ref_t scc_ast2ir_type(scc_ast2ir_ctx_t *ctx,
         return place_ref;
     } break;
     case SCC_AST_TYPE_ENUM:
-        scc_ast_canon_type_t *int_canon_type = scc_ast_ctx_get_builtin_type(
-            ctx->ast_ctx, SCC_AST_BUILTIN_TYPE_INT);
+        scc_ast_canon_type_t *int_canon_type = scc_ast_module_get_builtin_type(
+            ctx->ast_module, SCC_AST_BUILTIN_TYPE_INT);
         scc_ast_qual_type_t int_type = {
             .base.type = SCC_AST_TYPE_BUILTIN,
             .type = int_canon_type,
         };
-        return parse_base_type(ctx, &int_type);
+        return scc_ast2ir_parse_base_type(ctx, &int_type);
     case SCC_AST_TYPE_TYPEDEF:
         // TODO maybe using cache
         return scc_ast2ir_type(
@@ -569,7 +542,8 @@ scc_hir_value_ref_t scc_ast2ir_expr(scc_ast2ir_ctx_t *ctx,
                 rhs = scc_ast2ir_emit_conversion(
                     ctx, rhs, lhs_ptr_type->data.pointer.base);
             }
-            return scc_hir_builder_store(&ctx->builder, lhs, rhs);
+            scc_hir_builder_store(&ctx->builder, lhs, rhs);
+            return rhs;
         }
 
         if (expr->binary.op == SCC_AST_OP_LOGICAL_AND ||
@@ -577,30 +551,36 @@ scc_hir_value_ref_t scc_ast2ir_expr(scc_ast2ir_ctx_t *ctx,
             // TODO 类型提升
             return scc_ast2ir_logical_expr(ctx, expr);
         }
-        rhs = scc_ast2ir_expr(ctx, expr->binary.rhs, false);
-        lhs = scc_ast2ir_expr(ctx, expr->binary.lhs, false);
+        if (expr->binary.op == SCC_AST_OP_COMMA) {
+            lhs = scc_ast2ir_expr(ctx, expr->binary.lhs, false);
+            rhs = scc_ast2ir_expr(ctx, expr->binary.rhs, false);
+        } else {
+            rhs = scc_ast2ir_expr(ctx, expr->binary.rhs, false);
+            lhs = scc_ast2ir_expr(ctx, expr->binary.lhs, false);
+        }
 
         // 类型提升：对算术类型二元操作应用寻常算术转换（C11 6.3.1.8）
         // 移位操作符不适用（仅对每个操作数单独整数提升）
         cbool is_shift = (expr->binary.op == SCC_AST_OP_LEFT_SHIFT ||
                           expr->binary.op == SCC_AST_OP_RIGHT_SHIFT);
+        scc_hir_type_ref_t common_type = 0;
         if (!is_shift && expr->binary.op != SCC_AST_OP_COMMA) {
             scc_hir_module_t *module = scc_ast2ir_mir_module(ctx);
             scc_hir_type_ref_t lhs_type_ref =
                 scc_hir_module_get_value(module, lhs)->type;
             scc_hir_type_ref_t rhs_type_ref =
                 scc_hir_module_get_value(module, rhs)->type;
+            Assert(lhs_type_ref != 0 && rhs_type_ref != 0);
             scc_hir_type_t *lhs_type =
                 scc_hir_module_get_type(module, lhs_type_ref);
             scc_hir_type_t *rhs_type =
                 scc_hir_module_get_type(module, rhs_type_ref);
             if (is_arithmetic_type(lhs_type) && is_arithmetic_type(rhs_type)) {
-                scc_hir_type_ref_t common =
-                    scc_ast2ir_usual_arithmetic_conversion(ctx, lhs_type_ref,
-                                                           rhs_type_ref);
-                if (common != 0) {
-                    lhs = scc_ast2ir_emit_conversion(ctx, lhs, common);
-                    rhs = scc_ast2ir_emit_conversion(ctx, rhs, common);
+                common_type = scc_ast2ir_usual_arithmetic_conversion(
+                    ctx, lhs_type_ref, rhs_type_ref);
+                if (common_type != 0) {
+                    lhs = scc_ast2ir_emit_conversion(ctx, lhs, common_type);
+                    rhs = scc_ast2ir_emit_conversion(ctx, rhs, common_type);
                 }
             }
         } else if (is_shift) {
@@ -628,16 +608,42 @@ scc_hir_value_ref_t scc_ast2ir_expr(scc_ast2ir_ctx_t *ctx,
         case SCC_AST_OP_BITWISE_XOR:    op = SCC_HIR_OP_XOR; break;
         case SCC_AST_OP_LEFT_SHIFT:     op = SCC_HIR_OP_SHL; break;
         case SCC_AST_OP_RIGHT_SHIFT:    {
-            op = SCC_HIR_OP_SHR;
-            // FIXME op = SCC_HIR_OP_SAR;
+            scc_hir_module_t *module = scc_ast2ir_mir_module(ctx);
+            scc_hir_type_ref_t type_ref = scc_hir_module_get_value(module, lhs)->type;
+            scc_hir_type_t *type = scc_hir_module_get_type(module, type_ref);
+            op = scc_hir_type_is_signed(type->tag) ? SCC_HIR_OP_SAR : SCC_HIR_OP_SHR;
             break;
         }
         case SCC_AST_OP_EQUAL:          op = SCC_HIR_OP_EQ;  break;
         case SCC_AST_OP_NOT_EQUAL:      op = SCC_HIR_OP_NEQ; break;
-        case SCC_AST_OP_LESS:           op = SCC_HIR_OP_LT;  break;
-        case SCC_AST_OP_LESS_EQUAL:     op = SCC_HIR_OP_LE;  break;
-        case SCC_AST_OP_GREATER:        op = SCC_HIR_OP_GT;  break;
-        case SCC_AST_OP_GREATER_EQUAL:  op = SCC_HIR_OP_GE;  break;
+        case SCC_AST_OP_LESS: {
+            scc_hir_module_t *module = scc_ast2ir_mir_module(ctx);
+            scc_hir_type_ref_t tr = common_type ? common_type : scc_hir_module_get_value(module, lhs)->type;
+            scc_hir_type_t *t = scc_hir_module_get_type(module, tr);
+            op = scc_hir_type_is_signed(t->tag) ? SCC_HIR_OP_LT : SCC_HIR_OP_ULT;
+            break;
+        }
+        case SCC_AST_OP_LESS_EQUAL: {
+            scc_hir_module_t *module = scc_ast2ir_mir_module(ctx);
+            scc_hir_type_ref_t tr = common_type ? common_type : scc_hir_module_get_value(module, lhs)->type;
+            scc_hir_type_t *t = scc_hir_module_get_type(module, tr);
+            op = scc_hir_type_is_signed(t->tag) ? SCC_HIR_OP_LE : SCC_HIR_OP_ULE;
+            break;
+        }
+        case SCC_AST_OP_GREATER: {
+            scc_hir_module_t *module = scc_ast2ir_mir_module(ctx);
+            scc_hir_type_ref_t tr = common_type ? common_type : scc_hir_module_get_value(module, lhs)->type;
+            scc_hir_type_t *t = scc_hir_module_get_type(module, tr);
+            op = scc_hir_type_is_signed(t->tag) ? SCC_HIR_OP_GT : SCC_HIR_OP_UGT;
+            break;
+        }
+        case SCC_AST_OP_GREATER_EQUAL: {
+            scc_hir_module_t *module = scc_ast2ir_mir_module(ctx);
+            scc_hir_type_ref_t tr = common_type ? common_type : scc_hir_module_get_value(module, lhs)->type;
+            scc_hir_type_t *t = scc_hir_module_get_type(module, tr);
+            op = scc_hir_type_is_signed(t->tag) ? SCC_HIR_OP_GE : SCC_HIR_OP_UGE;
+            break;
+        }
         case SCC_AST_OP_COMMA: {
             // 逗号运算符：计算左表达式，丢弃结果，返回右表达式
             return rhs;
@@ -854,28 +860,24 @@ scc_hir_value_ref_t scc_ast2ir_expr(scc_ast2ir_ctx_t *ctx,
         scc_hir_value_ref_vec_t args;
         scc_vec_init(args);
 
-        // 获取函数类型信息用于参数转换。注意：不能长期持有指向 types 向量
-        // 内部的指针（如 ft->data.function.params），因为递归的
-        // scc_ast2ir_expr 可能触发 scc_hir_module_add_type 导致 realloc。
-        // 改为通过 func_type_ref（稳定的索引）每次需要时重新获取指针。
+        // 获取函数类型信息用于参数转换。
         scc_hir_func_ref_t callee_func =
             (scc_hir_func_ref_t)(usize)scc_hashtable_get(
                 &ctx->symtab, expr->call.callee->identifier._target->name);
         scc_hir_type_ref_t func_type_ref = SCC_HIR_REF_nullptr;
         cbool is_variadic = false;
         int fixed_count = 0;
-        if (callee_func != SCC_HIR_REF_nullptr) {
-            scc_hir_func_t *hir_func = scc_hir_module_get_func(
-                scc_ast2ir_mir_module(ctx), callee_func);
-            scc_hir_func_meta_t *meta = SCC_HIR_FUNC_META(hir_func);
-            is_variadic = meta->is_variadic;
-            func_type_ref = meta->type;
-            if (func_type_ref != SCC_HIR_REF_nullptr) {
-                const scc_hir_type_t *ft = scc_hir_module_get_type(
-                    scc_ast2ir_mir_module(ctx), func_type_ref);
-                if (ft != nullptr && ft->tag == SCC_HIR_TYPE_FUNC)
-                    fixed_count = (int)ft->data.function.params.size;
-            }
+        Assert(callee_func != SCC_HIR_REF_nullptr);
+        scc_hir_func_t *hir_func =
+            scc_hir_module_get_func(scc_ast2ir_mir_module(ctx), callee_func);
+        scc_hir_func_meta_t *meta = SCC_HIR_FUNC_META(hir_func);
+        is_variadic = meta->is_variadic;
+        func_type_ref = meta->type;
+        if (func_type_ref != SCC_HIR_REF_nullptr) {
+            const scc_hir_type_t *ft = scc_hir_module_get_type(
+                scc_ast2ir_mir_module(ctx), func_type_ref);
+            if (ft != nullptr && ft->tag == SCC_HIR_TYPE_FUNC)
+                fixed_count = (int)ft->data.function.params.size;
         }
 
         scc_vec_foreach(expr->call.args, i) {
@@ -897,8 +899,11 @@ scc_hir_value_ref_t scc_ast2ir_expr(scc_ast2ir_ctx_t *ctx,
                 // 可变参数：只应用默认参数提升（C11 6.5.2.2）
                 // 整数提升：char/short → int
                 scc_hir_module_t *module = scc_ast2ir_mir_module(ctx);
-                scc_hir_type_ref_t arg_type_ref =
-                    scc_hir_module_get_value(module, arg_node)->type;
+
+                scc_hir_value_t *arg_value =
+                    scc_hir_module_get_value(module, arg_node);
+                Assert(arg_value != nullptr);
+                scc_hir_type_ref_t arg_type_ref = arg_value->type;
                 Assert(arg_type_ref != 0);
                 scc_hir_type_tag_t arg_tag =
                     scc_hir_module_get_type(module, arg_type_ref)->tag;
@@ -1136,7 +1141,7 @@ scc_hir_value_ref_t scc_ast2ir_expr(scc_ast2ir_ctx_t *ctx,
         // FIXME maybe using some array to int;
         scc_hir_type_ref_t type_ref = scc_hir_builder_type_i32(&ctx->builder);
         scc_ap_t value;
-        scc_ap_from_cstr(&value, expr->literal.lexme, 10);
+        scc_ap_from_cstr(&value, expr->literal.lexme, 0);
         return scc_hir_builder_integer(&ctx->builder, type_ref, &value);
     }
     // SCC_AST_EXPR_FLOAT_LITERAL,  // 浮点字面量
@@ -1645,8 +1650,9 @@ void scc_ast2ir_decl(scc_ast2ir_ctx_t *ctx, const scc_ast_decl_t *decl,
             .record.name = decl->name,
         };
         scc_ast_qual_type_t type = {
-            .base.type =
-                SCC_AST_DECL_STRUCT ? SCC_AST_TYPE_STRUCT : SCC_AST_TYPE_UNION,
+            .base.type = decl->base.type == SCC_AST_DECL_STRUCT
+                             ? SCC_AST_TYPE_STRUCT
+                             : SCC_AST_TYPE_UNION,
             .type = &canon_type,
         };
         scc_hir_type_ref_t type_ref = scc_ast2ir_type(ctx, &type);
@@ -1655,24 +1661,23 @@ void scc_ast2ir_decl(scc_ast2ir_ctx_t *ctx, const scc_ast_decl_t *decl,
     } break;
     case SCC_AST_DECL_ENUM: {
         scc_ap_t val;
-        int idx = 0;
-        scc_ap_set_int(&val, idx);
+        scc_ap_set_int(&val, 0);
         scc_vec_foreach(decl->record.fields, i) {
             scc_ast_decl_t *item = scc_vec_at(decl->record.fields, i);
             Assert(item->base.type == SCC_AST_DECL_VAR);
             if (item->var.init) {
-                Assert(item->var.init->base.type == SCC_AST_EXPR_INT_LITERAL);
-                scc_ap_from_cstr(&val, item->var.init->literal.lexme, 10);
+                if (!scc_ast2ir_eval_constant_int(ctx, &val, item->var.init)) {
+                    Panic("enum value is not a constant expression");
+                }
             }
             scc_hir_value_ref_t item_val_ref = scc_hir_builder_integer(
                 &ctx->builder, scc_hir_builder_type_i32(&ctx->builder), &val);
             scc_hashtable_set(&ctx->ast2ir_cache, item,
                               (void *)(usize)item_val_ref);
-            // FIXME hack ap
-            idx = val.data.digit;
-            idx += 1;
-            // scc_ap_add 1 ();
-            scc_ap_set_int(&val, idx);
+            /* next = val + 1 */
+            scc_ap_t one;
+            scc_ap_set_int(&one, 1);
+            scc_ap_add(&val, &val, &one);
         }
     } break;
     case SCC_AST_DECL_TYPEDEF:
@@ -1694,13 +1699,13 @@ void scc_ast2ir_run(scc_ast2ir_ctx_t *ctx,
 }
 
 void scc_ast2ir_ctx_init(scc_ast2ir_ctx_t *ctx, const scc_abi_type_calc_t *abi,
-                         scc_ast_ctx_t *ast_ctx, scc_hir_cprog_t *cprog) {
+                         scc_ast_module_t *ast_module, scc_hir_cprog_t *cprog) {
     Assert(ctx != nullptr);
     Assert(abi != nullptr);
-    Assert(ast_ctx != nullptr);
+    Assert(ast_module != nullptr);
     Assert(cprog != nullptr);
     ctx->abi = abi;
-    ctx->ast_ctx = ast_ctx;
+    ctx->ast_module = ast_module;
     scc_hir_builder_init(&ctx->builder, cprog);
     scc_hashtable_usize_init(&ctx->ast2ir_cache);
     scc_hashtable_usize_init(&ctx->break_cache);

libs/ast2ir/src/scc_ast2ir_const.c

@@ -0,0 +1,381 @@
+#include <scc_ast2ir.h>
+#include <scc_ast_def.h>
+#include <scc_ast_utils.h>
+
+/* ---------- internal helpers ---------- */
+
+static cbool is_builtin_signed(scc_ast_builtin_type_t t) {
+    switch (t) {
+    case SCC_AST_BUILTIN_TYPE_BOOL:
+    case SCC_AST_BUILTIN_TYPE_CHAR: /* implementation-defined, treat as signed */
+    case SCC_AST_BUILTIN_TYPE_SHORT:
+    case SCC_AST_BUILTIN_TYPE_INT:
+    case SCC_AST_BUILTIN_TYPE_LONG:
+    case SCC_AST_BUILTIN_TYPE_LONG_LONG:
+    case SCC_AST_BUILTIN_TYPE_SIGNED_CHAR:
+    case SCC_AST_BUILTIN_TYPE_SIGNED_SHORT:
+    case SCC_AST_BUILTIN_TYPE_SIGNED_INT:
+    case SCC_AST_BUILTIN_TYPE_SIGNED_LONG:
+    case SCC_AST_BUILTIN_TYPE_SIGNED_LONG_LONG:
+        return true;
+    default:
+        return false;
+    }
+}
+
+static cbool is_builtin_unsigned(scc_ast_builtin_type_t t) {
+    switch (t) {
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_CHAR:
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_SHORT:
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_INT:
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_LONG:
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_LONG_LONG:
+        return true;
+    default:
+        return false;
+    }
+}
+
+/* Check whether an AST qual-type is an integer type (not pointer/float/struct) */
+static cbool is_ast_integer_type(const scc_ast_qual_type_t *type) {
+    if (type->base.type != SCC_AST_TYPE_BUILTIN)
+        return false;
+    scc_ast_builtin_type_t bt = scc_ast_canon_type(type)->builtin.type;
+    return bt >= SCC_AST_BUILTIN_TYPE_BOOL &&
+           bt <= SCC_AST_BUILTIN_TYPE_UNSIGNED_LONG_LONG;
+}
+
+/*
+ * Truncate / sign-extend an AP value to match a target integer type width.
+ * Uses the ABI calculator to determine the type's size in bytes.
+ */
+static cbool apply_integer_truncation(scc_ast2ir_ctx_t *ctx, scc_ap_t *val,
+                                       const scc_ast_qual_type_t *target_type) {
+    if (!is_ast_integer_type(target_type))
+        return false;
+
+    scc_abi_type_layout_t layout;
+    ctx->abi->compute_type_layout(ctx->abi, (void *)target_type, &layout);
+    int bits = layout.size * 8;
+    if (bits >= (int)sizeof(scc_ap_digit) * 8)
+        return true; /* no truncation needed */
+
+    /* Extract magnitude */
+    uint64_t mag = val->data.digit;
+    uint64_t mask = ((uint64_t)1 << bits) - 1;
+    uint64_t truncated = mag & mask;
+
+    /* For signed types, sign-extend if the MSB is set */
+    scc_ast_builtin_type_t bt = scc_ast_canon_type(target_type)->builtin.type;
+    if (is_builtin_signed(bt) && (truncated >> (bits - 1)))
+        truncated |= ~mask; /* set all bits above bits-1 */
+
+    val->data.digit = truncated;
+    val->len = (val->len < 0 && truncated == 0) ? 1 : val->len;
+    return true;
+}
+
+/* ---------- unary expression ---------- */
+
+static cbool eval_unary(scc_ast2ir_ctx_t *ctx, scc_ap_t *result,
+                         const scc_ast_expr_t *expr) {
+    scc_ap_t val;
+    scc_ap_init(&val);
+
+    if (!scc_ast2ir_eval_constant_int(ctx, &val, expr->unary.operand))
+        return false;
+
+    switch (expr->unary.op) {
+    case SCC_AST_OP_UNARY_PLUS:
+        result->capacity = -1;
+        result->len = val.len;
+        result->data.digit = val.data.digit;
+        return true;
+    case SCC_AST_OP_UNARY_MINUS:
+        scc_ap_neg(result, &val);
+        return true;
+    case SCC_AST_OP_BITWISE_NOT:
+        scc_ap_not(result, &val);
+        return true;
+    case SCC_AST_OP_LOGICAL_NOT:
+        scc_ap_set_int(result, scc_ap_is_zero(&val));
+        return true;
+    default:
+        return false;
+    }
+}
+
+/* ---------- binary expression ---------- */
+
+static cbool eval_binary(scc_ast2ir_ctx_t *ctx, scc_ap_t *result,
+                          const scc_ast_expr_t *expr) {
+    scc_ap_t lhs_val, rhs_val;
+    scc_ap_init(&lhs_val);
+    scc_ap_init(&rhs_val);
+
+    if (!scc_ast2ir_eval_constant_int(ctx, &lhs_val, expr->binary.lhs))
+        return false;
+    if (!scc_ast2ir_eval_constant_int(ctx, &rhs_val, expr->binary.rhs))
+        return false;
+
+    switch (expr->binary.op) {
+    /* arithmetic */
+    case SCC_AST_OP_ADD:
+        scc_ap_add(result, &lhs_val, &rhs_val);
+        return true;
+    case SCC_AST_OP_SUB:
+        scc_ap_sub(result, &lhs_val, &rhs_val);
+        return true;
+    case SCC_AST_OP_MUL:
+        scc_ap_mul(result, &lhs_val, &rhs_val);
+        return true;
+    case SCC_AST_OP_DIV:
+        scc_ap_div(result, &lhs_val, &rhs_val);
+        return true;
+    case SCC_AST_OP_MOD:
+        scc_ap_mod(result, &lhs_val, &rhs_val);
+        return true;
+    /* bitwise */
+    case SCC_AST_OP_BITWISE_AND:
+        scc_ap_and(result, &lhs_val, &rhs_val);
+        return true;
+    case SCC_AST_OP_BITWISE_OR:
+        scc_ap_or(result, &lhs_val, &rhs_val);
+        return true;
+    case SCC_AST_OP_BITWISE_XOR:
+        scc_ap_xor(result, &lhs_val, &rhs_val);
+        return true;
+    /* shift */
+    case SCC_AST_OP_LEFT_SHIFT:
+        scc_ap_shl(result, &lhs_val, (unsigned)rhs_val.data.digit);
+        return true;
+    case SCC_AST_OP_RIGHT_SHIFT:
+        scc_ap_shr(result, &lhs_val, (unsigned)rhs_val.data.digit);
+        return true;
+    /* relational */
+    case SCC_AST_OP_EQUAL:
+        scc_ap_set_int(result, scc_ap_cmp(&lhs_val, &rhs_val) == 0);
+        return true;
+    case SCC_AST_OP_NOT_EQUAL:
+        scc_ap_set_int(result, scc_ap_cmp(&lhs_val, &rhs_val) != 0);
+        return true;
+    case SCC_AST_OP_LESS:
+        scc_ap_set_int(result, scc_ap_cmp(&lhs_val, &rhs_val) < 0);
+        return true;
+    case SCC_AST_OP_GREATER:
+        scc_ap_set_int(result, scc_ap_cmp(&lhs_val, &rhs_val) > 0);
+        return true;
+    case SCC_AST_OP_LESS_EQUAL:
+        scc_ap_set_int(result, scc_ap_cmp(&lhs_val, &rhs_val) <= 0);
+        return true;
+    case SCC_AST_OP_GREATER_EQUAL:
+        scc_ap_set_int(result, scc_ap_cmp(&lhs_val, &rhs_val) >= 0);
+        return true;
+    /* logical */
+    case SCC_AST_OP_LOGICAL_AND:
+        if (scc_ap_is_zero(&lhs_val)) {
+            scc_ap_set_int(result, 0);
+        } else {
+            scc_ap_set_int(result, !scc_ap_is_zero(&rhs_val));
+        }
+        return true;
+    case SCC_AST_OP_LOGICAL_OR:
+        if (!scc_ap_is_zero(&lhs_val)) {
+            scc_ap_set_int(result, 1);
+        } else {
+            scc_ap_set_int(result, !scc_ap_is_zero(&rhs_val));
+        }
+        return true;
+    default:
+        return false;
+    }
+}
+
+/* ---------- identifier (enum constant lookup) ---------- */
+
+static cbool eval_identifier(scc_ast2ir_ctx_t *ctx, scc_ap_t *result,
+                              const scc_ast_expr_t *expr) {
+    if (expr->identifier._target == nullptr)
+        return false;
+
+    /* Try the ast2ir_cache — enum values are stored there as HIR integer
+     * constants during scc_ast2ir_decl(SCC_AST_DECL_ENUM) */
+    scc_hir_value_ref_t cached = (scc_hir_value_ref_t)(usize)scc_hashtable_get(
+        &ctx->ast2ir_cache, expr->identifier._target);
+    if (cached != 0) {
+        scc_hir_value_t *hir_val =
+            scc_hir_module_get_value(scc_ast2ir_mir_module(ctx), cached);
+        if (hir_val != nullptr && hir_val->tag == SCC_HIR_VALUE_TAG_INTEGER) {
+            /* shallow copy — digit mode has no heap allocation */
+            result->capacity = -1;
+            result->len = hir_val->data.integer.len;
+            result->data.digit = hir_val->data.integer.data.digit;
+            return true;
+        }
+    }
+
+    /* If not cached yet, evaluate the var init recursively.
+     * This handles enum-internal forward references within a single enum decl:
+     *   enum { A = 1, B = A + 1 };  — when evaluating B, A may not be cached
+     *   yet, but we can look at A's init expression. */
+    if (expr->identifier._target->base.type == SCC_AST_DECL_VAR &&
+        expr->identifier._target->var.init != nullptr) {
+        return scc_ast2ir_eval_constant_int(ctx, result,
+                                  expr->identifier._target->var.init);
+    }
+
+    return false;
+}
+
+/* ---------- character literal evaluation ---------- */
+
+static int eval_char_literal(const scc_ast_expr_t *expr) {
+    const char *lexme = expr->literal.lexme;
+    Assert(lexme[0] == '\'');
+
+    if (lexme[1] != '\\')
+        return (unsigned char)lexme[1];
+
+    switch (lexme[2]) {
+    case 'a':
+        return '\a';
+    case 'b':
+        return '\b';
+    case 'f':
+        return '\f';
+    case 'n':
+        return '\n';
+    case 'r':
+        return '\r';
+    case 't':
+        return '\t';
+    case 'v':
+        return '\v';
+    case '\\':
+        return '\\';
+    case '\'':
+        return '\'';
+    case '"':
+        return '"';
+    case '0':
+        return '\0';
+    case 'x':
+        /* hex escape: \xNN — parse up to 2 hex digits */
+        {
+            int val = 0;
+            int j = 3;
+            while (1) {
+                char c = lexme[j];
+                unsigned d;
+                if (c >= '0' && c <= '9')
+                    d = c - '0';
+                else if (c >= 'a' && c <= 'f')
+                    d = c - 'a' + 10;
+                else if (c >= 'A' && c <= 'F')
+                    d = c - 'A' + 10;
+                else
+                    break;
+                val = val * 16 + d;
+                j++;
+            }
+            return val;
+        }
+    default:
+        /* octal: \nnn */
+        if (lexme[2] >= '0' && lexme[2] <= '7') {
+            int val = 0;
+            int j = 2;
+            while (j < 5 && lexme[j] >= '0' && lexme[j] <= '7') {
+                val = val * 8 + (lexme[j] - '0');
+                j++;
+            }
+            return val;
+        }
+        return (unsigned char)lexme[2];
+    }
+}
+
+/* ===================================================================
+ * Public API
+ * =================================================================== */
+
+cbool scc_ast2ir_eval_constant_int(scc_ast2ir_ctx_t *ctx, scc_ap_t *result,
+                                    const scc_ast_expr_t *expr) {
+    if (ctx == nullptr || result == nullptr || expr == nullptr)
+        return false;
+
+    scc_ap_init(result);
+
+    switch (expr->base.type) {
+    case SCC_AST_EXPR_INT_LITERAL:
+        scc_ap_from_cstr(result, expr->literal.lexme, 0);
+        return true;
+
+    case SCC_AST_EXPR_CHAR_LITERAL:
+        scc_ap_set_int(result, eval_char_literal(expr));
+        return true;
+
+    case SCC_AST_EXPR_BINARY:
+        return eval_binary(ctx, result, expr);
+
+    case SCC_AST_EXPR_UNARY:
+        return eval_unary(ctx, result, expr);
+
+    case SCC_AST_EXPR_COND: {
+        scc_ap_t cond_val;
+        scc_ap_init(&cond_val);
+        if (!scc_ast2ir_eval_constant_int(ctx, &cond_val, expr->cond.cond))
+            return false;
+        return scc_ast2ir_eval_constant_int(ctx, result,
+                                  scc_ap_is_zero(&cond_val)
+                                      ? expr->cond.else_expr
+                                      : expr->cond.then_expr);
+    }
+
+    case SCC_AST_EXPR_CAST: {
+        if (!scc_ast2ir_eval_constant_int(ctx, result, expr->cast.expr))
+            return false;
+        /* Truncate / sign-extend to the target type width */
+        if (!apply_integer_truncation(ctx, result, expr->cast.type))
+            return false;
+        return true;
+    }
+
+    case SCC_AST_EXPR_SIZE_OF: {
+        scc_abi_type_layout_t layout;
+        if (expr->attr_of.type) {
+            ctx->abi->compute_type_layout(ctx->abi, (void *)expr->attr_of.type,
+                                           &layout);
+        } else if (expr->attr_of.expr) {
+            /* sizeof expression: try to get the type through the ABI */
+            /* For constant expressions, sema should have annotated the type */
+            /* TODO: handle sizeof(expr) where expr is not a type */
+            return false;
+        } else {
+            return false;
+        }
+        scc_ap_set_int(result, layout.size);
+        return true;
+    }
+
+    case SCC_AST_EXPR_ALIGN_OF: {
+        scc_abi_type_layout_t layout;
+        if (expr->attr_of.type) {
+            ctx->abi->compute_type_layout(ctx->abi, (void *)expr->attr_of.type,
+                                           &layout);
+        } else if (expr->attr_of.expr) {
+            return false;
+        } else {
+            return false;
+        }
+        scc_ap_set_int(result, layout.alignment);
+        return true;
+    }
+
+    case SCC_AST_EXPR_IDENTIFIER:
+        return eval_identifier(ctx, result, expr);
+
+    default:
+        return false;
+    }
+}

libs/ast2ir/src/scc_ast2ir_promote.c

@@ -179,9 +179,10 @@ scc_hir_type_ref_t scc_ast2ir_integer_promotion(scc_ast2ir_ctx_t *ctx,
  *    d. 如果有符号类型可以表示无符号类型的所有值，无符号转换为有符号
  *    e. 否则，两个都转换为有符号类型的无符号版本
  */
-scc_hir_type_ref_t scc_ast2ir_usual_arithmetic_conversion(
-    scc_ast2ir_ctx_t *ctx, scc_hir_type_ref_t t1_ref,
-    scc_hir_type_ref_t t2_ref) {
+scc_hir_type_ref_t
+scc_ast2ir_usual_arithmetic_conversion(scc_ast2ir_ctx_t *ctx,
+                                       scc_hir_type_ref_t t1_ref,
+                                       scc_hir_type_ref_t t2_ref) {
     scc_hir_module_t *module = scc_ast2ir_mir_module(ctx);
     scc_hir_type_t *t1 = scc_hir_module_get_type(module, t1_ref);
     scc_hir_type_t *t2 = scc_hir_module_get_type(module, t2_ref);
@@ -200,13 +201,9 @@ scc_hir_type_ref_t scc_ast2ir_usual_arithmetic_conversion(
     scc_hir_type_ref_t p2_ref = scc_ast2ir_integer_promotion(ctx, t2_ref);
 
     scc_hir_type_tag_t tag1 =
-        (p1_ref != 0)
-            ? scc_hir_module_get_type(module, p1_ref)->tag
-            : t1->tag;
+        (p1_ref != 0) ? scc_hir_module_get_type(module, p1_ref)->tag : t1->tag;
     scc_hir_type_tag_t tag2 =
-        (p2_ref != 0)
-            ? scc_hir_module_get_type(module, p2_ref)->tag
-            : t2->tag;
+        (p2_ref != 0) ? scc_hir_module_get_type(module, p2_ref)->tag : t2->tag;
 
     // 如果提升后相同，直接返回
     if (tag1 == tag2)
@@ -252,6 +249,7 @@ scc_hir_type_ref_t scc_ast2ir_usual_arithmetic_conversion(
  * - 返回 -1 表示无需转换（同类型同大小）
  */
 static int determine_conv_kind(scc_hir_type_tag_t src, scc_hir_type_tag_t dst) {
+    Assert(SCC_HIR_TYPE_VALID(src) && SCC_HIR_TYPE_VALID(dst));
     if (src == dst)
         return -1;
 
@@ -302,10 +300,8 @@ scc_hir_value_ref_t scc_ast2ir_emit_conversion(scc_ast2ir_ctx_t *ctx,
                                                scc_hir_value_ref_t value,
                                                scc_hir_type_ref_t target_type) {
     scc_hir_module_t *module = scc_ast2ir_mir_module(ctx);
-    scc_hir_type_t *src_type =
-        scc_hir_module_get_type_by_value(module, value);
-    scc_hir_type_t *dst_type =
-        scc_hir_module_get_type(module, target_type);
+    scc_hir_type_t *src_type = scc_hir_module_get_type_by_value(module, value);
+    scc_hir_type_t *dst_type = scc_hir_module_get_type(module, target_type);
 
     if (src_type == nullptr || dst_type == nullptr)
         return value;

libs/ast2ir/src/scc_ast2ir_type.c

@@ -0,0 +1,76 @@
+#include <scc_ast2ir.h>
+
+scc_hir_type_ref_t
+scc_ast2ir_parse_base_type(scc_ast2ir_ctx_t *ctx,
+                           const scc_ast_qual_type_t *ast_type) {
+    scc_abi_type_layout_t layout;
+    // 映射内置类型
+    ctx->abi->compute_type_layout(ctx->abi, (void *)ast_type, &layout);
+    switch (scc_ast_canon_type(ast_type)->builtin.type) {
+        // FIXME it not a void
+    case SCC_AST_BUILTIN_TYPE_VA_LIST:
+    case SCC_AST_BUILTIN_TYPE_VOID:
+        return scc_hir_builder_type_void(&ctx->builder);
+    case SCC_AST_BUILTIN_TYPE_BOOL:
+    case SCC_AST_BUILTIN_TYPE_SIGNED_CHAR:
+    case SCC_AST_BUILTIN_TYPE_SHORT:
+    case SCC_AST_BUILTIN_TYPE_SIGNED_SHORT:
+    case SCC_AST_BUILTIN_TYPE_INT:
+    case SCC_AST_BUILTIN_TYPE_SIGNED_INT:
+    case SCC_AST_BUILTIN_TYPE_LONG:
+    case SCC_AST_BUILTIN_TYPE_SIGNED_LONG:
+    case SCC_AST_BUILTIN_TYPE_LONG_LONG:
+    case SCC_AST_BUILTIN_TYPE_SIGNED_LONG_LONG:
+        switch (layout.size) {
+        case 1:
+            return scc_hir_builder_type_i8(&ctx->builder);
+        case 2:
+            return scc_hir_builder_type_i16(&ctx->builder);
+        case 4:
+            return scc_hir_builder_type_i32(&ctx->builder);
+        case 8:
+            return scc_hir_builder_type_i64(&ctx->builder);
+            break;
+        default:
+            break;
+        }
+        break;
+    case SCC_AST_BUILTIN_TYPE_CHAR:
+        // TODO CHAR TO BE UNSIGNED CHAR
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_CHAR:
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_SHORT:
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_INT:
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_LONG:
+    case SCC_AST_BUILTIN_TYPE_UNSIGNED_LONG_LONG:
+        switch (layout.size) {
+        case 1:
+            return scc_hir_builder_type_u8(&ctx->builder);
+        case 2:
+            return scc_hir_builder_type_u16(&ctx->builder);
+        case 4:
+            return scc_hir_builder_type_u32(&ctx->builder);
+        case 8:
+            return scc_hir_builder_type_u64(&ctx->builder);
+            break;
+        default:
+            break;
+        }
+        break;
+    case SCC_AST_BUILTIN_TYPE_FLOAT:
+    case SCC_AST_BUILTIN_TYPE_DOUBLE:
+        switch (layout.size) {
+        case 4:
+            return scc_hir_builder_type_f32(&ctx->builder);
+        case 8:
+            return scc_hir_builder_type_f64(&ctx->builder);
+            break;
+        default:
+            break;
+        }
+    default:
+        Panic("Unsupported AST type: %d",
+              scc_ast_canon_type(ast_type)->builtin.type);
+        break;
+    }
+    return SCC_HIR_REF_nullptr;
+}

libs/ir/cfg/src/scc_cfg.c

@@ -75,7 +75,7 @@ scc_cfg_module_unsafe_get_symbol(const scc_cfg_module_t *module,
     if (id == SCC_CFG_ID_nullptr) {
         Panic("nullptr symbol id");
     }
-    if (id >= scc_vec_size(module->bblocks)) {
+    if (id >= scc_vec_size(module->symbols)) {
         Panic("invalid symbol id");
     }
     return &scc_vec_at(module->symbols, id);
@@ -88,17 +88,29 @@ scc_cfg_symbol_id_t scc_cfg_module_lookup_symbol(const scc_cfg_module_t *module,
 }
 
 void scc_cfg_bblock_add_pred(scc_cfg_bblock_t *bb,
-                             scc_cfg_bblock_id_t pred_id) {}
+                             scc_cfg_bblock_id_t pred_id) {
+    (void)bb;
+    (void)pred_id;
+}
 
 void scc_cfg_bblock_remove_pred(scc_cfg_bblock_t *bb,
-                                scc_cfg_bblock_id_t pred_id) {}
+                                scc_cfg_bblock_id_t pred_id) {
+    (void)bb;
+    (void)pred_id;
+}
 
-void scc_cfg_bblock_clear_pred(scc_cfg_bblock_t *bb) {}
+void scc_cfg_bblock_clear_pred(scc_cfg_bblock_t *bb) { (void)bb; }
 
 void scc_cfg_bblock_add_succ(scc_cfg_bblock_t *bb,
-                             scc_cfg_bblock_id_t succ_id) {}
+                             scc_cfg_bblock_id_t succ_id) {
+    (void)bb;
+    (void)succ_id;
+}
 
 void scc_cfg_bblock_remove_succ(scc_cfg_bblock_t *bb,
-                                scc_cfg_bblock_id_t succ_id) {}
+                                scc_cfg_bblock_id_t succ_id) {
+    (void)bb;
+    (void)succ_id;
+}
 
-void scc_cfg_bblock_clear_succs(scc_cfg_bblock_t *bb) {}
+void scc_cfg_bblock_clear_succs(scc_cfg_bblock_t *bb) { (void)bb; }

libs/ir/hir/include/scc_hir_def.h

@@ -48,7 +48,9 @@ typedef enum scc_hir_type_tag {
     SCC_HIR_TYPE_STRUCT,
     SCC_HIR_TYPE_UNION,
     SCC_HIR_TYPE_VECTOR, // TODO SIMD
+    SCC_HIR_TYPE_COUNT,
 } scc_hir_type_tag_t;
+#define SCC_HIR_TYPE_VALID(tag) ((tag) < SCC_HIR_TYPE_COUNT && (tag) >= 0)
 
 struct scc_hir_type {
     scc_hir_type_tag_t tag;
@@ -134,6 +136,14 @@ typedef enum {
     SCC_HIR_OP_SHR,
     /// Shift right arithmetic.
     SCC_HIR_OP_SAR,
+    /// Unsigned greater than.
+    SCC_HIR_OP_UGT,
+    /// Unsigned less than.
+    SCC_HIR_OP_ULT,
+    /// Unsigned greater than or equal to.
+    SCC_HIR_OP_UGE,
+    /// Unsigned less than or equal to.
+    SCC_HIR_OP_ULE,
 } scc_hir_op_type_t;
 
 typedef enum {

libs/ir/hir/src/scc_hir_dump.c

@@ -49,7 +49,9 @@ static const char *get_op_str(scc_hir_op_type_t op) {
         [SCC_HIR_OP_AND] = "&",       [SCC_HIR_OP_OR] = "|",
         [SCC_HIR_OP_XOR] = "^",       [SCC_HIR_OP_NOT] = "~",
         [SCC_HIR_OP_SHL] = "<<",      [SCC_HIR_OP_SHR] = ">>",
-        [SCC_HIR_OP_SAR] = ">>a",
+        [SCC_HIR_OP_SAR] = ">>a",     [SCC_HIR_OP_ULT] = "u<",
+        [SCC_HIR_OP_ULE] = "u<=",     [SCC_HIR_OP_UGT] = "u>",
+        [SCC_HIR_OP_UGE] = "u>=",
     };
     if (op >= 0 && (usize)op < sizeof(ops) / sizeof(ops[0]) && ops[op])
         return ops[op];

libs/ir/hir/src/scc_hir_module.c

@@ -18,6 +18,18 @@ void scc_hir_module_init(scc_hir_module_t *ctx) {
 }
 
 void scc_hir_module_drop(scc_hir_module_t *ctx) {
+    // 释放函数元数据
+    for (usize i = 0; i < ctx->funcs_meta.size; i++) {
+        scc_free(ctx->funcs_meta.data[i]);
+    }
+    scc_vec_free(ctx->funcs_meta);
+
+    // 释放基本块元数据
+    for (usize i = 0; i < ctx->bblock_meta.size; i++) {
+        scc_free(ctx->bblock_meta.data[i]);
+    }
+    scc_vec_free(ctx->bblock_meta);
+
     scc_cfg_module_drop(&ctx->cfg_module);
 
     // 释放所有实体的内部内存
@@ -36,19 +48,6 @@ void scc_hir_module_drop(scc_hir_module_t *ctx) {
         }
     }
 
-    // TODO free
-    // ctx->cfg_module.funcs;
-    // for (usize i = 1; i < ctx->bblocks.size; i++) {
-    //     scc_hir_bblock_t *bblock = &ctx->bblocks.data[i];
-    //     scc_vec_free(bblock->instrs);
-    // }
-
-    // for (usize i = 1; i < ctx->funcs.size; i++) {
-    //     scc_hir_func_t *func = &ctx->funcs.data[i];
-    //     scc_vec_free(func->params);
-    //     scc_vec_free(func->bblocks);
-    // }
-
     scc_vec_free(ctx->values);
     scc_vec_free(ctx->types);
     scc_hashtable_drop(&ctx->uid2value);

libs/ir/lir/src/scc_hir2lir.c

@@ -174,7 +174,6 @@ static scc_lir_cond_t map_cmp_cond(scc_hir_op_type_t op, cbool is_float) {
             Panic("invalid float cmp");
         }
     } else {
-        // 默认为有符号比较 (无符号需额外处理类型)
         switch (op) {
         case SCC_HIR_OP_EQ:
             return SCC_LIR_COND_EQ;
@@ -188,6 +187,14 @@ static scc_lir_cond_t map_cmp_cond(scc_hir_op_type_t op, cbool is_float) {
             return SCC_LIR_COND_SGT;
         case SCC_HIR_OP_GE:
             return SCC_LIR_COND_SGE;
+        case SCC_HIR_OP_ULT:
+            return SCC_LIR_COND_ULT;
+        case SCC_HIR_OP_ULE:
+            return SCC_LIR_COND_ULE;
+        case SCC_HIR_OP_UGT:
+            return SCC_LIR_COND_UGT;
+        case SCC_HIR_OP_UGE:
+            return SCC_LIR_COND_UGE;
         default:
             Panic("invalid int cmp");
         }
@@ -196,6 +203,54 @@ static scc_lir_cond_t map_cmp_cond(scc_hir_op_type_t op, cbool is_float) {
 }
 
 static scc_lir_op_t map_binop(scc_hir_op_type_t op, cbool is_float) {
+    switch (op) {
+    case SCC_HIR_OP_EMPTY:
+        return SCC_LIR_NOP;
+    /// Not equal to.
+    case SCC_HIR_OP_NEQ:
+    /// Equal to.
+    case SCC_HIR_OP_EQ:
+    /// Greater than.
+    case SCC_HIR_OP_GT:
+    /// Less than.
+    case SCC_HIR_OP_LT:
+    /// Greater than or equal to.
+    case SCC_HIR_OP_GE:
+    /// Less than or equal to.
+    case SCC_HIR_OP_LE:
+    /// Unsigned greater than.
+    case SCC_HIR_OP_UGT:
+    /// Unsigned less than.
+    case SCC_HIR_OP_ULT:
+    /// Unsigned greater than or equal to.
+    case SCC_HIR_OP_UGE:
+    /// Unsigned less than or equal to.
+    case SCC_HIR_OP_ULE:
+        return SCC_LIR_CMP;
+    /// Bitwise AND.
+    case SCC_HIR_OP_AND:
+        return SCC_LIR_AND;
+    /// Bitwise OR.
+    case SCC_HIR_OP_OR:
+        return SCC_LIR_OR;
+    /// Bitwise XOR.
+    case SCC_HIR_OP_XOR:
+        return SCC_LIR_XOR;
+    /// Bitwise NOT.
+    case SCC_HIR_OP_NOT:
+        return SCC_LIR_NOT;
+    /// Shift left logical.
+    case SCC_HIR_OP_SHL:
+        return SCC_LIR_SHL;
+    /// Shift right logical.
+    case SCC_HIR_OP_SHR:
+        return SCC_LIR_SHR;
+    /// Shift right arithmetic.
+    case SCC_HIR_OP_SAR:
+        return SCC_LIR_SAR;
+    default:
+        break;
+    }
     if (is_float) {
         switch (op) {
         case SCC_HIR_OP_ADD:
@@ -206,6 +261,9 @@ static scc_lir_op_t map_binop(scc_hir_op_type_t op, cbool is_float) {
             return SCC_LIR_FMUL;
         case SCC_HIR_OP_DIV:
             return SCC_LIR_FDIV;
+        case SCC_HIR_OP_MOD:
+            TODO();
+            return SCC_LIR_FNEG;
         default:
             Panic("unsupported float binop");
         }
@@ -221,20 +279,8 @@ static scc_lir_op_t map_binop(scc_hir_op_type_t op, cbool is_float) {
             return SCC_LIR_DIV_S;
         case SCC_HIR_OP_MOD:
             return SCC_LIR_REM_S;
-        case SCC_HIR_OP_AND:
-            return SCC_LIR_AND;
-        case SCC_HIR_OP_OR:
-            return SCC_LIR_OR;
-        case SCC_HIR_OP_XOR:
-            return SCC_LIR_XOR;
-        case SCC_HIR_OP_SHL:
-            return SCC_LIR_SHL;
-        case SCC_HIR_OP_SHR:
-            return SCC_LIR_SHR;
-        case SCC_HIR_OP_SAR:
-            return SCC_LIR_SAR;
         default:
-            return SCC_LIR_CMP;
+            Panic("unsupported binop");
         }
     }
     return SCC_LIR_NOP;
@@ -277,7 +323,10 @@ static void translate_hir_value(ir2lir_ctx_t *ctx, scc_hir_value_t *value,
     switch (value->tag) {
     case SCC_HIR_VALUE_TAG_OP: {
         scc_lir_val_t lhs = ir_value_to_lir_operand(ctx, value->data.op.lhs);
-        scc_lir_val_t rhs = ir_value_to_lir_operand(ctx, value->data.op.rhs);
+        scc_lir_val_t rhs = SCC_LIR_NONE();
+        if (value->data.op.rhs != SCC_HIR_REF_nullptr) {
+            rhs = ir_value_to_lir_operand(ctx, value->data.op.rhs);
+        }
         scc_lir_op_t op = map_binop(value->data.op.op, is_float);
 
         scc_lir_instr_t instr = {
@@ -308,9 +357,18 @@ static void translate_hir_value(ir2lir_ctx_t *ctx, scc_hir_value_t *value,
             ir_value_to_lir_operand(ctx, value->data.store.value);
         scc_lir_val_t addr =
             ir_value_to_lir_operand(ctx, value->data.store.target);
-        ty = scc_hir_module_get_type_by_value(ctx->hir_module,
-                                              value->data.store.value);
-        ir_type_to_lir_size_ext(ty, &size, &ext);
+        /* 修复: 使用目标指针的元素类型确定 store 宽度而非源值类型 */
+        scc_hir_type_t *ptr_type = scc_hir_module_get_type_by_value(
+            ctx->hir_module, value->data.store.target);
+        if (ptr_type && ptr_type->tag == SCC_HIR_TYPE_PTR) {
+            scc_hir_type_t *elem_type = scc_hir_module_get_type(
+                ctx->hir_module, ptr_type->data.pointer.base);
+            ir_type_to_lir_size_ext(elem_type, &size, &ext);
+        } else {
+            ty = scc_hir_module_get_type_by_value(ctx->hir_module,
+                                                  value->data.store.value);
+            ir_type_to_lir_size_ext(ty, &size, &ext);
+        }
         scc_lir_instr_t instr = {.op = SCC_LIR_STORE,
                                  .ext = ext,
                                  .size = size,
@@ -446,10 +504,9 @@ static void translate_hir_value(ir2lir_ctx_t *ctx, scc_hir_value_t *value,
         } else {
             // 计算源类型宽度
             scc_hir_type_t *src_type = scc_hir_module_get_type(
-                ctx->hir_module,
-                scc_hir_module_get_value(ctx->hir_module,
-                                         value->data.conv.operand)
-                    ->type);
+                ctx->hir_module, scc_hir_module_get_value(
+                                     ctx->hir_module, value->data.conv.operand)
+                                     ->type);
             int from_size = scc_hir_module_type_size(ctx->hir_module, src_type);
             scc_lir_instr_t instr = {.op = SCC_LIR_EXTEND,
                                      .size = size,

libs/ir/lir/src/scc_lir_module.c

@@ -1,16 +1,28 @@
 #include <scc_lir_module.h>
 
 void scc_lir_module_init(scc_lir_module_t *lir_module) {
-    // FIXME
-    // lir_module->lir_module
     scc_vec_init(lir_module->func_metas);
     scc_vec_init(lir_module->symbol_metas);
 }
 
 void scc_lir_module_drop(scc_lir_module_t *lir_module) {
-    // FIXME memory leak
+    for (usize i = 0; i < scc_vec_size(lir_module->func_metas); i++) {
+        scc_free(lir_module->func_metas.data[i]);
+    }
+    for (usize i = 0; i < scc_vec_size(lir_module->symbol_metas); i++) {
+        scc_lir_symbol_meta_t *meta = lir_module->symbol_metas.data[i];
+        usize cfg_idx = i + 1; /* cfg_module.symbols[0] is null sentinel */
+        if (cfg_idx < scc_vec_size(lir_module->cfg_module.symbols)) {
+            scc_cfg_symbol_t *sym = &lir_module->cfg_module.symbols.data[cfg_idx];
+            if (sym->kind == SCC_CFG_SYMBOL_KIND_DATA && meta->data.init_data) {
+                scc_free(meta->data.init_data);
+            }
+        }
+        scc_free(meta);
+    }
     scc_vec_free(lir_module->func_metas);
     scc_vec_free(lir_module->symbol_metas);
+    scc_cfg_module_drop(&lir_module->cfg_module);
 }
 
 scc_lir_symbol_t *

libs/ir/mir/include/arch/scc_x86_reg_alloc.h

@@ -3,6 +3,15 @@
 
 #include "../core_pass/scc_reg_alloc.h"
 
+/* 默认位掩码策略：R8/R9 被排除（ABI 参数寄存器），剩余 6 个通用寄存器 */
 void scc_reg_alloc_fill_arch_x86(scc_reg_alloc_op_t *ops);
 
+/*
+ * 顺序分配策略：光标递增，永不回收。
+ * 池中包含 R8-R15（共 8 个寄存器），每分配一个光标前进一格。
+ * release_reg 为空操作；寄存器耗尽后 acquire_reg 返回 -1，
+ * 由分配器回退为纯栈操作。
+ */
+void scc_reg_alloc_fill_seq_x86(scc_reg_alloc_op_t *ops);
+
 #endif /* __SCC_X86_REG_ALLOC_H__ */

libs/ir/mir/include/scc_mir.h

@@ -82,7 +82,9 @@ static inline int scc_mir_vreg_lookup(const scc_mir_func_t *func, int vreg,
 static inline scc_mir_stack_slot_t *
 scc_mir_unsafe_slot(const scc_mir_func_t *func, int slot) {
     Assert(slot > 0);
-    return &scc_vec_at(SCC_MIR_FUNC_META(func)->stack_slots, slot);
+    scc_mir_func_meta_t *meta = SCC_MIR_FUNC_META(func);
+    Assert((usize)slot < scc_vec_size(meta->stack_slots));
+    return &scc_vec_at(meta->stack_slots, slot);
 }
 
 #endif /* __SCC_MIR_H__ */

libs/ir/mir/src/arch/scc_x86_isel.c

@@ -148,6 +148,17 @@ static scc_x86_operand_value_t new_vreg_temp(scc_x86_64_isel_t *isel,
     return scc_x86_op_vreg(scc_mir_alloc_vreg(isel->func), size);
 }
 
+/* 确保操作数为寄存器: IMM → 加载到临时虚拟寄存器 */
+static scc_x86_operand_value_t ensure_reg(scc_x86_64_isel_t *isel,
+                                          scc_x86_operand_value_t op) {
+    if (op.kind == SCC_X86_OPR_IMM) {
+        scc_x86_operand_value_t tmp = new_vreg_temp(isel, op.size);
+        scc_x86_emit_move(isel, tmp, op);
+        return tmp;
+    }
+    return op;
+}
+
 static scc_x86_iform_t cond_to_setcc(scc_lir_cond_t cond) {
     switch (cond) {
     case SCC_LIR_COND_EQ:
@@ -343,9 +354,11 @@ static void sel_mir(scc_x86_64_isel_t *isel, const scc_lir_instr_t *instr) {
         break;
     /* ---- 一元运算 ---- */
     case SCC_LIR_NEG:
+        emit_copy_if_needed(isel, dst, src0);
         add_instr_1(isel, SCC_X86_IFORM_NEG_GPRV, dst);
         break;
     case SCC_LIR_NOT:
+        emit_copy_if_needed(isel, dst, src0);
         add_instr_1(isel, SCC_X86_IFORM_NOT_GPRV, dst);
         break;
     /* ---- 算术/逻辑二元运算 ---- */
@@ -416,11 +429,18 @@ static void sel_mir(scc_x86_64_isel_t *isel, const scc_lir_instr_t *instr) {
         scc_x86_operand_value_t rax = scc_x86_op_preg(SCC_X86_REG_RAX, size);
         scc_x86_operand_value_t rdx = scc_x86_op_preg(SCC_X86_REG_RDX, size);
 
-        scc_x86_emit_move(isel, rax, src0);
-
         if (instr->op == SCC_LIR_DIV_S || instr->op == SCC_LIR_REM_S) {
+            if (size < 8) {
+                // TODO 可能需要在lir进行size对齐
+                scc_x86_operand_value_t rax64 =
+                    scc_x86_op_preg(SCC_X86_REG_RAX, 8);
+                add_instr_2(isel, SCC_X86_IFORM_MOVSXD_GPRV_GPRZ, rax64, src0);
+            } else {
+                scc_x86_emit_move(isel, rax, src0);
+            }
             add_instr_0(isel, SCC_X86_IFORM_CQO);
         } else {
+            scc_x86_emit_move(isel, rax, src0);
             scc_x86_operand_value_t zero = scc_x86_op_imm(0, size);
             scc_x86_emit_move(isel, rdx, zero);
         }
@@ -429,7 +449,12 @@ static void sel_mir(scc_x86_64_isel_t *isel, const scc_lir_instr_t *instr) {
             (instr->op == SCC_LIR_DIV_S || instr->op == SCC_LIR_REM_S)
                 ? SCC_X86_IFORM_IDIV_GPRV
                 : SCC_X86_IFORM_DIV_GPRV;
-        add_instr_1(isel, div_if, src1);
+        scc_x86_operand_value_t divisor = src1;
+        if (src1.kind == SCC_X86_OPR_IMM) {
+            divisor = new_vreg_temp(isel, size);
+            scc_x86_emit_move(isel, divisor, src1);
+        }
+        add_instr_1(isel, div_if, divisor);
 
         if (instr->op == SCC_LIR_REM_S || instr->op == SCC_LIR_REM_U)
             scc_x86_emit_move(isel, dst, rdx);
@@ -440,6 +465,11 @@ static void sel_mir(scc_x86_64_isel_t *isel, const scc_lir_instr_t *instr) {
     /* ---- 比较指令 ---- */
     case SCC_LIR_CMP: {
         Assert(src0.size == src1.size);
+        if (src0.kind == SCC_X86_OPR_IMM) {
+            scc_x86_operand_value_t tmp_reg = new_vreg_temp(isel, src0.size);
+            scc_x86_emit_move(isel, tmp_reg, src0);
+            src0 = tmp_reg;
+        }
         if (scc_x86_op_is_vreg(&src0) && src1.kind == SCC_X86_OPR_IMM)
             // SCC_X86_IFORM_CMP_GPR8_IMMB_82R7 历史遗留指令在amd64中已不再使用
             add_instr_2(isel,
@@ -511,6 +541,7 @@ static void sel_mir(scc_x86_64_isel_t *isel, const scc_lir_instr_t *instr) {
         int from_size = instr->metadata.extend.from_size;
         scc_x86_operand_value_t ext_src =
             scc_x86_lir_val_to_mir_op(isel, &instr->arg0, from_size);
+        ext_src = ensure_reg(isel, ext_src);
 
         if (instr->ext == SCC_LIR_EXT_ZEXT) {
             if (from_size == 4) {

libs/ir/mir/src/arch/scc_x86_mir.c

@@ -42,12 +42,27 @@ scc_mir_x86_mov_mem_imm(scc_x86_operand_value_t op0,
                          : SCC_X86_IFORM_MOV_MEMV_IMMZ;
 }
 
+static inline u8 get_op_size(scc_x86_operand_value_t op, cbool get_value) {
+    if (get_value) {
+        return op.size;
+    }
+    if (op.kind == SCC_X86_OPR_MEM) {
+        return 8;
+    }
+    if (op.kind == SCC_X86_OPR_RELOC && op.reloc.kind == SCC_X86_OPR_MEM) {
+        return 8;
+    }
+    return op.size;
+}
+
 void scc_x86_emit_move_to_vec(scc_mir_x86_instr_vec_t *vec,
                               scc_x86_operand_value_t dst,
                               scc_x86_operand_value_t src) {
-    if (dst.size != src.size) {
-        LOG_WARN("Mismatched register sizes for move %d != %d", dst.size,
-                 src.size);
+    u8 dst_size = get_op_size(dst, false);
+    u8 src_size = get_op_size(src, false);
+    if (dst_size != src_size) {
+        LOG_FATAL("Mismatched register sizes for move %d != %d", dst_size,
+                  src_size);
     }
     scc_mir_x86_instr_t ins;
     if (dst.kind == SCC_X86_OPR_REG) {
@@ -60,7 +75,7 @@ void scc_x86_emit_move_to_vec(scc_mir_x86_instr_vec_t *vec,
         } else if (src.kind == SCC_X86_OPR_MEM ||
                    (src.kind == SCC_X86_OPR_RELOC &&
                     src.reloc.target == SCC_X86_RELOC_TARGET_SYMBOL)) {
-            Assert(dst.size == 8);
+            Assert(dst_size == 8);
             scc_mir_x86_instr_2(&ins, SCC_X86_IFORM_LEA_GPRV_AGEN, dst, src,
                                 scc_pos_create());
         } else {
@@ -85,8 +100,11 @@ void scc_x86_emit_move_to_vec(scc_mir_x86_instr_vec_t *vec,
 void scc_x86_emit_load_to_vec(scc_mir_x86_instr_vec_t *vec,
                               scc_x86_operand_value_t dst,
                               scc_x86_operand_value_t src_addr) {
-    if (dst.size != src_addr.size) {
-        LOG_WARN("Mismatched sizes for load %d != %d", dst.size, src_addr.size);
+    u8 dst_size = get_op_size(dst, false);
+    u8 src_addr_size = get_op_size(src_addr, true);
+    if (dst_size != src_addr_size) {
+        LOG_FATAL("Mismatched sizes for load %d != %d", dst_size,
+                  src_addr_size);
     }
     Assert(dst.kind == SCC_X86_OPR_REG);
     scc_x86_operand_value_t mem_op;
@@ -99,9 +117,9 @@ void scc_x86_emit_load_to_vec(scc_mir_x86_instr_vec_t *vec,
                     .index = SCC_X86_REG_INVALID,
                     .scale = 1,
                     .disp.displacement = 0,
-                    .disp.displacement_bits = src_addr.size * 8,
+                    .disp.displacement_bits = src_addr_size * 8,
                 },
-            .size = src_addr.size,
+            .size = src_addr_size,
         };
     } else if (src_addr.kind == SCC_X86_OPR_MEM) {
         mem_op = src_addr;
@@ -117,9 +135,11 @@ void scc_x86_emit_load_to_vec(scc_mir_x86_instr_vec_t *vec,
 void scc_x86_emit_store_to_vec(scc_mir_x86_instr_vec_t *vec,
                                scc_x86_operand_value_t dst_addr,
                                scc_x86_operand_value_t src) {
-    if (dst_addr.size != src.size) {
-        LOG_WARN("Mismatched sizes for store %d != %d", dst_addr.size,
-                 src.size);
+    u8 dst_addr_size = get_op_size(dst_addr, true);
+    u8 src_size = get_op_size(src, false);
+    if (dst_addr_size != src_size) {
+        LOG_FATAL("Mismatched sizes for store %d != %d", dst_addr_size,
+                  src_size);
     }
     scc_x86_operand_value_t mem_op;
     if (dst_addr.kind == SCC_X86_OPR_REG) {
@@ -131,9 +151,9 @@ void scc_x86_emit_store_to_vec(scc_mir_x86_instr_vec_t *vec,
                     .index = SCC_X86_REG_INVALID,
                     .scale = 1,
                     .disp.displacement = 0,
-                    .disp.displacement_bits = dst_addr.size * 8,
+                    .disp.displacement_bits = dst_addr_size * 8,
                 },
-            .size = dst_addr.size,
+            .size = dst_addr_size,
         };
     } else if (dst_addr.kind == SCC_X86_OPR_MEM) {
         mem_op = dst_addr;

libs/ir/mir/src/arch/scc_x86_reg_alloc.c

@@ -73,16 +73,25 @@ static void get_implicit_regs(void *ctx, int opcode, const int **uses,
     }
 }
 
-/* ========== 寄存器池 ========== */
+/* ========== 默认寄存器池（位掩码策略） ========== */
 
-static const int reg_pool[] = {
-    SCC_X86_REG_R8,  SCC_X86_REG_R9,  SCC_X86_REG_R10, SCC_X86_REG_R11,
-    SCC_X86_REG_R12, SCC_X86_REG_R13, SCC_X86_REG_R14, SCC_X86_REG_R15};
+/*
+ * R8/R9 被排除在通用寄存器池之外，因为它们被 Win64 ABI 用作参数传递寄存器
+ * （RCX=arg0, RDX=arg1, R8=arg2, R9=arg3）。
+ * 如果把它们放在池中，当 lower_call 发出 MOV R8, vreg 时，
+ * 分配器可能把 R8 分配给源 vreg，导致冗余的 MOV R8, R8。
+ *
+ * 可用寄存器: R10, R11, R12, R13, R14, R15
+ */
+static const int reg_pool[] = {SCC_X86_REG_R10, SCC_X86_REG_R11,
+                               SCC_X86_REG_R12, SCC_X86_REG_R13,
+                               SCC_X86_REG_R14, SCC_X86_REG_R15};
+#define REG_POOL_SIZE ((int)SCC_ARRLEN(reg_pool))
 static uint32_t reg_mask = 0;
 
 static int acquire_reg(void *ctx) {
     (void)ctx;
-    for (int i = 0; i < SCC_ARRLEN(reg_pool); i++)
+    for (int i = 0; i < REG_POOL_SIZE; i++)
         if (!(reg_mask & (1u << i))) {
             reg_mask |= (1u << i);
             return reg_pool[i];
@@ -92,7 +101,7 @@ static int acquire_reg(void *ctx) {
 
 static void release_reg(void *ctx, int preg) {
     (void)ctx;
-    for (int i = 0; i < SCC_ARRLEN(reg_pool); i++)
+    for (int i = 0; i < REG_POOL_SIZE; i++)
         if (reg_pool[i] == preg) {
             reg_mask &= ~(1u << i);
             return;
@@ -101,7 +110,7 @@ static void release_reg(void *ctx, int preg) {
 
 static void mark_reg_used(void *ctx, int preg) {
     (void)ctx;
-    for (int i = 0; i < SCC_ARRLEN(reg_pool); i++)
+    for (int i = 0; i < REG_POOL_SIZE; i++)
         if (reg_pool[i] == preg) {
             reg_mask |= (1u << i);
             return;
@@ -113,6 +122,57 @@ static void clean_mark_regs(void *ctx) {
     reg_mask = 0;
 }
 
+/* ========== 顺序分配策略（光标，永不回收） ========== */
+
+/*
+ * 顺序分配策略：按固定顺序分配寄存器（R8 → R9 → ... → R15），
+ * 一旦分配就永不回收（release_reg 为空操作）。
+ * 当所有 8 个寄存器耗尽后，acquire_reg 返回 -1，
+ * 分配器将 vreg 直接替换为栈槽（spill/reload 由内存操作数隐式完成）。
+ *
+ * 包含 R8/R9 是安全的，因为顺序分配避免了冲突：
+ * - 如果 R8 已被分配，参数 MOV R8, vreg 中的 vreg 会分配下一个可用寄存器（如
+ * R10）， 然后通过 MOV R8, R10 将值移入 R8。
+ * - 如果 R8 尚未分配，参数 MOV R8, vreg 的 vreg 会分配到 R8，
+ *   产生 MOV R8, R8（空操作），这在功能上是正确的。
+ */
+static const int seq_pool[] = {
+    SCC_X86_REG_R8,  SCC_X86_REG_R9,  SCC_X86_REG_R10, SCC_X86_REG_R11,
+    SCC_X86_REG_R12, SCC_X86_REG_R13, SCC_X86_REG_R14, SCC_X86_REG_R15};
+#define SEQ_POOL_SIZE ((int)SCC_ARRLEN(seq_pool))
+static int seq_cursor = 0;
+
+static int seq_acquire_reg(void *ctx) {
+    (void)ctx;
+    if (seq_cursor < SEQ_POOL_SIZE)
+        return seq_pool[seq_cursor++];
+    return -1; /* 寄存器耗尽 */
+}
+
+static void seq_release_reg(void *ctx, int preg) {
+    (void)ctx;
+    (void)preg;
+    /* 永不回收：释放为空操作 */
+}
+
+static void seq_mark_reg_used(void *ctx, int preg) {
+    (void)ctx;
+    for (int i = seq_cursor; i < SEQ_POOL_SIZE; i++)
+        if (seq_pool[i] == preg) {
+            /* 将光标移到该寄存器之后（燃烧） */
+            if (i + 1 > seq_cursor)
+                seq_cursor = i + 1;
+            return;
+        }
+}
+
+static void seq_clean_mark_regs(void *ctx) {
+    (void)ctx;
+    seq_cursor = 0;
+}
+
+/* ========== 指令迭代器（两种策略共享） ========== */
+
 static void x86_alloc_iter_begin(scc_reg_alloc_iter_t *iter) {
     iter->op_idx = 0;
     iter->op_sub_idx = 0;
@@ -128,8 +188,8 @@ static cbool x86_alloc_iter_next(scc_reg_alloc_iter_t *iter, int *out_vreg,
     while (iter->op_idx < num_ops) {
         const scc_x86_operand_value_t *op =
             &ins->x86_instr.operands[iter->op_idx];
-        scc_reg_op_access_t base_access = SCC_REG_ALLOC_OP_ACCESS_READWRITE;
-        // base_access = get_operand_access(opcode, iter->op_idx);
+        scc_reg_op_access_t base_access =
+            get_operand_access(opcode, iter->op_idx);
 
         *out_size = op->size;
         if (op->kind == SCC_X86_OPR_REG) {
@@ -223,6 +283,8 @@ static void x86_alloc_iter_end(scc_reg_alloc_iter_t *iter) {
     (void)iter; // 无需清理
 }
 
+/* ========== 回调表填充 ========== */
+
 void scc_reg_alloc_fill_arch_x86(scc_reg_alloc_op_t *ops) {
     ops->acquire_reg = acquire_reg;
     ops->release_reg = release_reg;
@@ -240,3 +302,21 @@ void scc_reg_alloc_fill_arch_x86(scc_reg_alloc_op_t *ops) {
     ops->emit_reload = emit_reload;
     ops->emit_copy = emit_copy;
 }
+
+void scc_reg_alloc_fill_seq_x86(scc_reg_alloc_op_t *ops) {
+    ops->acquire_reg = seq_acquire_reg;
+    ops->release_reg = seq_release_reg;
+    ops->mark_reg_used = seq_mark_reg_used;
+    ops->clean_mark_regs = seq_clean_mark_regs;
+
+    ops->alloc_iter_begin = x86_alloc_iter_begin;
+    ops->alloc_iter_next = x86_alloc_iter_next;
+    ops->alloc_iter_replace_preg = x86_alloc_iter_replace_preg;
+    ops->alloc_iter_replace_slot = x86_alloc_iter_replace_slot;
+    ops->alloc_iter_end = x86_alloc_iter_end;
+    ops->get_implicit_regs = get_implicit_regs;
+
+    ops->emit_spill = emit_spill;
+    ops->emit_reload = emit_reload;
+    ops->emit_copy = emit_copy;
+}

libs/ir/mir/src/reg_alloc/reg_alloc.c

@@ -49,16 +49,21 @@ static void alloc_instr(scc_reg_alloc_ctx_t *ctx,
         if (mapping == 0)
             slot = scc_mir_vreg_map2slot(ctx->func, vreg, size, 8);
         preg = ops->acquire_reg(ctx);
-        scc_vec_push(allocated, preg);
+        if (preg >= 0) {
+            scc_vec_push(allocated, preg);
 
-        if (access == SCC_REG_ALLOC_OP_ACCESS_READ ||
-            access == SCC_REG_ALLOC_OP_ACCESS_READWRITE)
-            ops->emit_reload(&before, preg, slot, size);
-        if (access == SCC_REG_ALLOC_OP_ACCESS_WRITE ||
-            access == SCC_REG_ALLOC_OP_ACCESS_READWRITE)
-            ops->emit_spill(&after, preg, slot, size);
+            if (access == SCC_REG_ALLOC_OP_ACCESS_READ ||
+                access == SCC_REG_ALLOC_OP_ACCESS_READWRITE)
+                ops->emit_reload(&before, preg, slot, size);
+            if (access == SCC_REG_ALLOC_OP_ACCESS_WRITE ||
+                access == SCC_REG_ALLOC_OP_ACCESS_READWRITE)
+                ops->emit_spill(&after, preg, slot, size);
 
-        ops->alloc_iter_replace_preg(&iter, preg, size);
+            ops->alloc_iter_replace_preg(&iter, preg, size);
+        } else {
+            /* 寄存器耗尽（顺序策略）：vreg 直接使用栈槽 */
+            ops->alloc_iter_replace_slot(&iter, slot, size);
+        }
     }
     ops->alloc_iter_end(&iter);
 

libs/ir/mir/src/scc_mir_module.c

@@ -8,7 +8,24 @@ void scc_mir_module_init(scc_mir_module_t *mir_module) {
 }
 
 void scc_mir_module_drop(scc_mir_module_t *mir_module) {
-    // FIXME memory leak
+    for (usize i = 0; i < scc_vec_size(mir_module->func_metas); i++) {
+        scc_mir_func_meta_t *meta = mir_module->func_metas.data[i];
+        scc_vec_free(meta->stack_slots);
+        scc_hashtable_drop(&meta->vreg2physic);
+        scc_free(meta);
+    }
+    for (usize i = 0; i < scc_vec_size(mir_module->symbol_metas); i++) {
+        scc_mir_symbol_meta_t *meta = mir_module->symbol_metas.data[i];
+        usize cfg_idx = i + 1;
+        if (cfg_idx < scc_vec_size(mir_module->cfg_module.symbols)) {
+            scc_cfg_symbol_t *sym = &mir_module->cfg_module.symbols.data[cfg_idx];
+            if (sym->kind == SCC_CFG_SYMBOL_KIND_DATA && meta->data.init_data) {
+                scc_free(meta->data.init_data);
+            }
+        }
+        scc_free(meta);
+    }
     scc_vec_free(mir_module->func_metas);
     scc_vec_free(mir_module->symbol_metas);
+    scc_cfg_module_drop(&mir_module->cfg_module);
 }

libs/ir/mir/src/target/win64_abi.c

@@ -171,6 +171,10 @@ void scc_win_pc_x64_prolog_epilog_init(scc_prolog_epilog_t *ctx) {
     ctx->need_epilog = need_epilog;
 }
 
+/*
+windows x64 calling convention
+https://learn.microsoft.com/zh-cn/cpp/build/x64-calling-convention?view=msvc-180#varargs
+*/
 static void lower_call(void *userdata, const scc_lir_instr_t *instr) {
     scc_x86_64_isel_t *isel = userdata;
 

libs/parser/include/scc_parser.h

@@ -14,7 +14,7 @@ typedef struct scc_parser {
     scc_lexer_tok_ring_t *ring;
     usize checkpoint;
 
-    scc_ast_ctx_t *ast_ctx;
+    scc_ast_module_t *ast_module;
     scc_sema_ctx_t *sema_ctx;
     int owned_sema;
     scc_ast_translation_unit_t *translation_unit;
@@ -28,7 +28,7 @@ typedef struct scc_parser {
  * @param callbacks 语义分析回调(可为 nullptr)
  */
 void scc_parser_init(scc_parser_t *parser, scc_lexer_tok_ring_t *tok_ring,
-                     scc_ast_ctx_t *ast_ctx, scc_sema_ctx_t *callbacks);
+                     scc_ast_module_t *ast_module, scc_sema_ctx_t *callbacks);
 
 /**
  * @brief 销毁解析器

libs/parser/include/scc_sema.h

@@ -29,7 +29,7 @@ struct scc_sema_ctx {
     scc_sema_callback_t on_expr;
     scc_sema_callback_t on_type;
     scc_sema_got_type_t got_type;
-    scc_ast_ctx_t *ast_ctx;
+    scc_ast_module_t *ast_module;
 
     scc_ast_stmt_vec_t break_stack;
     scc_ast_stmt_vec_t continue_stack;
@@ -37,7 +37,7 @@ struct scc_sema_ctx {
     void *context;
 };
 
-void scc_sema_init(scc_sema_ctx_t *sema_ctx, scc_ast_ctx_t *ast_ctx);
+void scc_sema_init(scc_sema_ctx_t *sema_ctx, scc_ast_module_t *ast_module);
 void scc_sema_drop(scc_sema_ctx_t *sema_ctx);
 
 #endif /* __SCC_SEMA_H__ */

libs/parser/include/sema_symtab.h

@@ -2,6 +2,7 @@
 #define __SCC_SEMA_SYMTAB_H__
 
 #include <scc_ast.h>
+#include <scc_strpool.h>
 #include <scc_utils.h>
 
 typedef struct scc_parser_scope {
@@ -12,6 +13,7 @@ typedef struct scc_parser_scope {
 typedef struct {
     scc_sema_scope_t root_scope;
     scc_sema_scope_t *current_scope;
+    scc_strpool_t name_pool; /* 拥有符号名（生成的标签名等）的生命周期 */
 } scc_sema_symtab_t;
 
 void scc_sema_symtab_init(scc_sema_symtab_t *symtab);

libs/parser/src/parse_decl.c

@@ -187,7 +187,7 @@ scc_ast_expr_t *scc_parse_initializer(scc_parser_t *parser,
     scc_pos_t pos = tok.loc;
     scc_lexer_tok_drop(&tok);
 
-    init = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+    init = SCC_AST_ALLOC_EXPR(parser->ast_module);
     Assert(init != nullptr);
     scc_ast_expr_vec_t lhs_exprs;
     scc_vec_init(lhs_exprs);
@@ -203,9 +203,9 @@ scc_ast_expr_t *scc_parse_initializer(scc_parser_t *parser,
             tok_ptr = scc_parser_peek(parser);
             if (tok_ptr && tok_ptr->type == SCC_TOK_IDENT) {
                 scc_parser_next_consume(parser, &tok);
-                lhs = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+                lhs = SCC_AST_ALLOC_EXPR(parser->ast_module);
                 Assert(lhs != nullptr);
-                scc_ast_expr_member_init(lhs, ptr, scc_str_as_cstr(&tok.lexeme),
+                scc_ast_expr_member_init(lhs, ptr, scc_ast_module_intern(parser->ast_module, scc_str_as_cstr(&tok.lexeme)),
                                          tok.loc);
                 if (!scc_parser_consume_if(parser, SCC_TOK_ASSIGN)) {
                     ptr = lhs;
@@ -231,7 +231,7 @@ scc_ast_expr_t *scc_parse_initializer(scc_parser_t *parser,
             if (!scc_parser_consume_if(parser, SCC_TOK_R_BRACKET)) {
                 SCC_ERROR(scc_parser_got_current_pos(parser), "Expected ']'");
             }
-            lhs = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+            lhs = SCC_AST_ALLOC_EXPR(parser->ast_module);
             Assert(lhs != nullptr);
             scc_ast_expr_array_subscript_init(lhs, ptr, idx, tok_ptr->loc);
             if (!scc_parser_consume_if(parser, SCC_TOK_ASSIGN)) {
@@ -285,7 +285,7 @@ CONTINUE:
     if (tok_ptr->type == SCC_TOK_ASSIGN) {
         scc_parser_next_consume(parser, nullptr);
         // TODO maybe memory leak
-        scc_ast_expr_t *lvalue = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+        scc_ast_expr_t *lvalue = SCC_AST_ALLOC_EXPR(parser->ast_module);
         scc_ast_expr_lvalue_init(lvalue, decl->var.type, decl->base.loc);
         decl->var.init = scc_parse_initializer(parser, lvalue);
     } else if (tok_ptr->type == SCC_TOK_L_BRACE) {
@@ -348,7 +348,7 @@ CONTINUE:
     } else if (tok_ptr->type == SCC_TOK_COMMA) {
         scc_parser_next_consume(parser, nullptr);
         if (decl_list == nullptr) {
-            decl_list = SCC_AST_ALLOC_DECL(parser->ast_ctx);
+            decl_list = SCC_AST_ALLOC_DECL(parser->ast_module);
             Assert(decl_list != nullptr);
             scc_vec_push(decl_list_vec, decl);
         } else {
@@ -365,7 +365,9 @@ CONTINUE:
     }
 
 RETURN:
+    scc_vec_free(decl_list_vec);
     return decl;
 ERROR:
+    scc_vec_free(decl_list_vec);
     return nullptr;
 }

libs/parser/src/parse_expr.c

@@ -371,7 +371,7 @@ static scc_ast_expr_t *parse_expression_with_precedence(scc_parser_t *parser,
             return nullptr;
         }
 
-        scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+        scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
         Assert(expr != nullptr);
         // FIXME pos
         scc_ast_expr_binary_init(expr, op, left, right, left->base.loc);
@@ -410,7 +410,7 @@ scc_ast_expr_t *scc_parse_assignment_expression(scc_parser_t *parser) {
             return nullptr;
         }
 
-        scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+        scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
         Assert(expr != nullptr);
         scc_ast_expr_binary_init(expr, op, left, right, pos);
         left = expr;
@@ -456,7 +456,7 @@ static scc_ast_expr_t *parse_conditional_expression(scc_parser_t *parser) {
             return nullptr;
         }
 
-        scc_ast_expr_t *cond = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+        scc_ast_expr_t *cond = SCC_AST_ALLOC_EXPR(parser->ast_module);
         Assert(cond != nullptr);
         scc_ast_expr_cond_init(cond, cond_expr, then_expr, else_expr, pos);
         cond_expr = cond;
@@ -481,13 +481,13 @@ static scc_ast_expr_t *parse_cast_expression(scc_parser_t *parser) {
                 scc_ast_expr_t *operand = parse_cast_expression(parser);
                 if (!operand) {
                     // FIXME postfix-expression
-                    scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+                    scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
                     // FIXME pos
                     scc_ast_expr_lvalue_init(expr, type, type->base.loc);
                     operand = scc_parse_initializer(parser, expr);
                     return operand;
                 }
-                scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+                scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
                 Assert(expr != nullptr);
                 // FIXME pos
                 scc_ast_expr_cast_init(expr, type, operand, type->base.loc);
@@ -559,7 +559,7 @@ static scc_ast_expr_t *parse_unary_expression(scc_parser_t *parser) {
             return nullptr;
         }
 
-        scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+        scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
         Assert(expr != nullptr);
         scc_ast_expr_unary_init(expr, op, operand, pos);
         return expr;
@@ -588,7 +588,7 @@ static scc_ast_expr_t *parse_sizeof_expression(scc_parser_t *parser) {
         return nullptr;
     }
 
-    scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+    scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
 
     if (next->type == SCC_TOK_L_PAREN) {
         scc_parser_store(parser);
@@ -643,7 +643,7 @@ static scc_ast_expr_t *parse_postfix_expression(scc_parser_t *parser) {
         if (!scc_parser_consume_if(parser, SCC_TOK_R_PAREN)) {
             SCC_ERROR(scc_parser_got_current_pos(parser), "Expected ')'");
         }
-        scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+        scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
         scc_ast_expr_lvalue_init(expr, type, pos);
         left = scc_parse_initializer(parser, expr);
         return left;
@@ -672,7 +672,7 @@ static scc_ast_expr_t *parse_postfix_expression(scc_parser_t *parser) {
                 parser_sync(parser);
                 return nullptr;
             }
-            scc_ast_expr_t *subscript = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+            scc_ast_expr_t *subscript = SCC_AST_ALLOC_EXPR(parser->ast_module);
             Assert(subscript != nullptr);
             scc_ast_expr_array_subscript_init(subscript, left, index, pos);
             left = subscript;
@@ -709,7 +709,7 @@ static scc_ast_expr_t *parse_postfix_expression(scc_parser_t *parser) {
                     return nullptr;
                 }
             }
-            scc_ast_expr_t *call = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+            scc_ast_expr_t *call = SCC_AST_ALLOC_EXPR(parser->ast_module);
             Assert(call != nullptr);
             scc_ast_expr_call_init(call, left, &args, pos);
             left = call;
@@ -729,9 +729,9 @@ static scc_ast_expr_t *parse_postfix_expression(scc_parser_t *parser) {
                 parser_sync(parser);
                 return nullptr;
             }
-            const char *name = scc_str_as_cstr(&ident_tok.lexeme);
+            const char *name = scc_ast_module_intern(parser->ast_module, scc_str_as_cstr(&ident_tok.lexeme));
 
-            scc_ast_expr_t *member = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+            scc_ast_expr_t *member = SCC_AST_ALLOC_EXPR(parser->ast_module);
             Assert(member != nullptr);
             if (op_tok.type == SCC_TOK_DOT) {
                 scc_ast_expr_member_init(member, left, name, ident_tok.loc);
@@ -750,7 +750,7 @@ static scc_ast_expr_t *parse_postfix_expression(scc_parser_t *parser) {
             if (!scc_parser_next_consume(parser, &op_tok))
                 return left;
             scc_ast_expr_op_t op = map_token_to_unary_op(op_tok.type, false);
-            scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+            scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
             Assert(expr != nullptr);
             scc_ast_expr_unary_init(expr, op, left, op_tok.loc);
             scc_lexer_tok_drop(&op_tok);
@@ -785,36 +785,36 @@ static scc_ast_expr_t *parse_primary_expression(scc_parser_t *parser) {
     case SCC_TOK_IDENT: {
         if (!scc_parser_next_consume(parser, &tok))
             return nullptr;
-        expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+        expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
         Assert(expr != nullptr);
-        scc_ast_expr_identifier_init(expr, scc_str_as_cstr(&tok.lexeme),
+        scc_ast_expr_identifier_init(expr, scc_ast_module_intern(parser->ast_module, scc_str_as_cstr(&tok.lexeme)),
                                      tok.loc);
         break;
     }
     case SCC_TOK_INT_LITERAL: {
         if (!scc_parser_next_consume(parser, &tok))
             return nullptr;
-        expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+        expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
         Assert(expr != nullptr);
-        scc_ast_expr_literal_int_init(expr, scc_str_as_cstr(&tok.lexeme), false,
+        scc_ast_expr_literal_int_init(expr, scc_ast_module_intern(parser->ast_module, scc_str_as_cstr(&tok.lexeme)), false,
                                       tok.loc);
         break;
     }
     case SCC_TOK_FLOAT_LITERAL: {
         if (!scc_parser_next_consume(parser, &tok))
             return nullptr;
-        expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+        expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
         Assert(expr != nullptr);
-        scc_ast_expr_literal_float_init(expr, scc_str_as_cstr(&tok.lexeme),
+        scc_ast_expr_literal_float_init(expr, scc_ast_module_intern(parser->ast_module, scc_str_as_cstr(&tok.lexeme)),
                                         false, tok.loc);
         break;
     }
     case SCC_TOK_CHAR_LITERAL: {
         if (!scc_parser_next_consume(parser, &tok))
             return nullptr;
-        expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+        expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
         Assert(expr != nullptr);
-        scc_ast_expr_literal_char_init(expr, scc_str_as_cstr(&tok.lexeme),
+        scc_ast_expr_literal_char_init(expr, scc_ast_module_intern(parser->ast_module, scc_str_as_cstr(&tok.lexeme)),
                                        false, tok.loc);
         break;
     }
@@ -835,10 +835,12 @@ static scc_ast_expr_t *parse_primary_expression(scc_parser_t *parser) {
             scc_str_append(&string, &tmp);
         }
 
-        expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+        const char *pooled_str = scc_ast_module_intern(parser->ast_module, scc_str_as_cstr(&string));
+        scc_str_drop(&string);
+        expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
         Assert(expr != nullptr);
         // FIXME loc
-        scc_ast_expr_literal_string_init(expr, scc_str_as_cstr(&string), true,
+        scc_ast_expr_literal_string_init(expr, pooled_str, false,
                                          tok.loc);
         break;
     }
@@ -880,7 +882,7 @@ scc_ast_expr_t *scc_parse_expression(scc_parser_t *parser) {
             parser_sync(parser);
             return nullptr;
         }
-        scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_ctx);
+        scc_ast_expr_t *expr = SCC_AST_ALLOC_EXPR(parser->ast_module);
         Assert(expr != nullptr);
         scc_ast_expr_binary_init(expr, SCC_AST_OP_COMMA, left, right, pos);
         left = expr;

libs/parser/src/parse_stmt.c

@@ -83,9 +83,9 @@ static scc_ast_stmt_t *parse_label_statement(scc_parser_t *parser,
         Panic("expect stmt");
     }
 
-    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_ctx);
+    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_module);
     Assert(stmt != nullptr);
-    scc_ast_stmt_label_init(stmt, scc_str_as_cstr(&tok.lexeme), statement, pos);
+    scc_ast_stmt_label_init(stmt, scc_ast_module_intern(parser->ast_module, scc_str_as_cstr(&tok.lexeme)), statement, pos);
     return stmt;
 }
 
@@ -114,7 +114,7 @@ static scc_ast_stmt_t *parse_case_statement(scc_parser_t *parser,
         Panic("expect stmt");
     }
 
-    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_ctx);
+    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_module);
     scc_ast_stmt_case_init(stmt, expr, statement, pos);
     return stmt;
 }
@@ -136,7 +136,7 @@ static scc_ast_stmt_t *parse_default_statement(scc_parser_t *parser,
         Panic("expect stmt");
     }
 
-    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_ctx);
+    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_module);
     scc_ast_stmt_default_init(stmt, statement, pos);
     return stmt;
 }
@@ -168,7 +168,7 @@ static scc_ast_stmt_t *parse_compound_statement(scc_parser_t *parser,
     }
     scc_sema_stmt(parser, scc_ast_stmt_t_END, nullptr);
 
-    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_ctx);
+    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_module);
     scc_ast_stmt_compound_init(stmt, &block_items, pos);
     return stmt;
 }
@@ -188,7 +188,7 @@ static scc_ast_stmt_t *parse_if_statement(scc_parser_t *parser, scc_pos_t pos) {
         opt_else = nullptr;
     }
 
-    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_ctx);
+    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_module);
     scc_ast_stmt_if_init(stmt, expression, statement, opt_else, pos);
     return stmt;
 }
@@ -198,7 +198,7 @@ static scc_ast_stmt_t *parse_switch_statement(scc_parser_t *parser,
     if (!scc_parser_consume_if(parser, SCC_TOK_SWITCH)) {
         return nullptr;
     }
-    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_ctx);
+    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_module);
     stmt->base.type = SCC_AST_STMT_SWITCH;
 
     scc_ast_expr_t *expression = ast_parse_paren_expression(parser);
@@ -216,7 +216,7 @@ static scc_ast_stmt_t *parse_while_statement(scc_parser_t *parser,
     if (!scc_parser_consume_if(parser, SCC_TOK_WHILE)) {
         return nullptr;
     }
-    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_ctx);
+    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_module);
     stmt->base.type = SCC_AST_STMT_WHILE;
 
     scc_ast_expr_t *expression = ast_parse_paren_expression(parser);
@@ -234,7 +234,7 @@ static scc_ast_stmt_t *parse_do_while_statement(scc_parser_t *parser,
     if (!scc_parser_consume_if(parser, SCC_TOK_DO)) {
         return nullptr;
     }
-    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_ctx);
+    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_module);
     stmt->base.type = SCC_AST_STMT_DO_WHILE;
 
     scc_sema_stmt(parser, scc_ast_stmt_t_BEGIN, stmt);
@@ -272,7 +272,7 @@ static scc_ast_stmt_t *parse_for_statement(scc_parser_t *parser,
         SCC_ERROR(scc_parser_got_current_pos(parser),
                   "Expected '(' before like `( expression )` .");
     }
-    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_ctx);
+    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_module);
     stmt->base.type = SCC_AST_STMT_FOR;
 
     scc_ast_node_t *init = nullptr;
@@ -314,12 +314,12 @@ static scc_ast_stmt_t *parse_for_statement(scc_parser_t *parser,
 
 static scc_ast_stmt_t *parse_jump_statement(scc_parser_t *parser,
                                             scc_pos_t pos) {
-    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_ctx);
+    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_module);
 
     if (scc_parser_consume_if(parser, SCC_TOK_GOTO)) {
         scc_lexer_tok_t tok = {0};
         if (scc_parser_next_consume(parser, &tok)) {
-            scc_ast_stmt_goto_init(stmt, scc_str_as_cstr(&tok.lexeme), pos);
+            scc_ast_stmt_goto_init(stmt, scc_ast_module_intern(parser->ast_module, scc_str_as_cstr(&tok.lexeme)), pos);
         } else {
             SCC_ERROR(scc_parser_got_current_pos(parser),
                       "Expected label after goto.");
@@ -345,7 +345,7 @@ static scc_ast_stmt_t *parse_expression_statement(scc_parser_t *parser,
                                                   scc_pos_t pos) {
 
     if (scc_parser_consume_if(parser, SCC_TOK_SEMICOLON)) {
-        scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_ctx);
+        scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_module);
         scc_ast_stmt_expr_init(stmt, nullptr, pos);
         return stmt;
     }
@@ -355,7 +355,7 @@ static scc_ast_stmt_t *parse_expression_statement(scc_parser_t *parser,
         return nullptr;
     }
 
-    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_ctx);
+    scc_ast_stmt_t *stmt = SCC_AST_ALLOC_STMT(parser->ast_module);
     scc_ast_stmt_expr_init(stmt, expr, pos);
 
     if (!scc_parser_consume_if(parser, SCC_TOK_SEMICOLON)) {

libs/parser/src/parse_type.c

@@ -526,9 +526,9 @@ static scc_ast_qual_type_t *build_type_from_info(scc_parser_t *parser,
         }
     }
 
-    scc_ast_ctx_get_builtin_type(parser->ast_ctx, builtin);
-    scc_ast_qual_type_t *type = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_ctx);
-    scc_ast_type_builtin_init(type, parser->ast_ctx, builtin, pos);
+    scc_ast_module_get_builtin_type(parser->ast_module, builtin);
+    scc_ast_qual_type_t *type = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_module);
+    scc_ast_type_builtin_init(type, parser->ast_module, builtin, pos);
     return type;
 }
 
@@ -551,7 +551,7 @@ static scc_ast_qual_type_t *parse_record_type(scc_parser_t *parser,
     if (tok_ptr->type == SCC_TOK_IDENT) {
         scc_parser_next_consume(parser, &tok);
         tok_ptr = scc_parser_peek(parser);
-        name = scc_str_as_cstr(&tok.lexeme);
+        name = scc_ast_module_intern(parser->ast_module, scc_str_as_cstr(&tok.lexeme));
     } else if (tok_ptr->type != SCC_TOK_L_BRACE) {
         SCC_ERROR(scc_parser_got_current_pos(parser),
                   "Expected name in struct/union/enum specifier");
@@ -581,8 +581,8 @@ static scc_ast_qual_type_t *parse_record_type(scc_parser_t *parser,
 
     type = scc_parse_got_type(parser, scc_str_as_cstr(&symbol_name));
     if (type == nullptr) {
-        scc_ast_canon_type_t *canon = scc_ast_ctx_alloc_type(parser->ast_ctx);
-        scc_ast_decl_t *decl = SCC_AST_ALLOC_DECL(parser->ast_ctx);
+        scc_ast_canon_type_t *canon = scc_ast_module_alloc_type(parser->ast_module);
+        scc_ast_decl_t *decl = SCC_AST_ALLOC_DECL(parser->ast_module);
 
         scc_ast_node_kind_t decl_kind;
         switch (type_kind) {
@@ -607,7 +607,7 @@ static scc_ast_qual_type_t *parse_record_type(scc_parser_t *parser,
         }
 
         scc_ast_qual_type_t *qual_type =
-            SCC_AST_ALLOC_QUAL_TYPE(parser->ast_ctx);
+            SCC_AST_ALLOC_QUAL_TYPE(parser->ast_module);
         _scc_ast_type_record_init(qual_type, canon, type_kind, name, decl,
                                   *pos);
         scc_parse_type_sema(parser, qual_type);
@@ -747,10 +747,10 @@ static scc_ast_qual_type_t *parse_enum_type(scc_parser_t *parser) {
             }
 
             scc_ast_decl_t *enum_item_decl =
-                SCC_AST_ALLOC_DECL(parser->ast_ctx);
+                SCC_AST_ALLOC_DECL(parser->ast_module);
             Assert(enum_item_decl != nullptr);
             scc_ast_decl_val_init(enum_item_decl, type,
-                                  scc_str_as_cstr(&tok.lexeme), enum_item_init,
+                                  scc_ast_module_intern(parser->ast_module, scc_str_as_cstr(&tok.lexeme)), enum_item_init,
                                   tok.loc);
             scc_vec_push(decl->record.fields, enum_item_decl);
 
@@ -939,14 +939,14 @@ parse_pointer(scc_parser_t *parser, scc_ast_qual_type_t *pointee,
     scc_pos_t pos = tok_ptr->loc;
     scc_parser_next_consume(parser, nullptr);
 
-    scc_ast_qual_type_t *pointer = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_ctx);
+    scc_ast_qual_type_t *pointer = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_module);
     if (pointee == nullptr) {
         Assert(delay_pointee_ptr != nullptr);
         *delay_pointee_ptr = pointer;
         pointee = pointer;
     }
 
-    scc_ast_canon_type_t *canon = scc_ast_ctx_alloc_type(parser->ast_ctx);
+    scc_ast_canon_type_t *canon = scc_ast_module_alloc_type(parser->ast_module);
     scc_ast_type_pointer_init(pointer, canon, pointee, pos);
     pointer->quals = parse_type_qualifier_list(parser, pointer->quals);
 
@@ -981,7 +981,7 @@ static void parse_parameter_type_list(scc_parser_t *parser,
         }
 
         // TODO Check validation
-        param = SCC_AST_ALLOC_DECL(parser->ast_ctx);
+        param = SCC_AST_ALLOC_DECL(parser->ast_module);
         Assert(param != nullptr);
         scc_ast_decl_param_init(param, decl->var.type, decl->name,
                                 scc_vec_size(*params), decl->base.loc);
@@ -998,11 +998,11 @@ static void parse_parameter_type_list(scc_parser_t *parser,
         scc_parser_next_consume(parser, nullptr);
         tok_ptr = scc_parser_peek(parser);
         if (tok_ptr->type == SCC_TOK_ELLIPSIS) {
-            param = SCC_AST_ALLOC_DECL(parser->ast_ctx);
+            param = SCC_AST_ALLOC_DECL(parser->ast_module);
             Assert(param != nullptr);
             // FIXME
-            type = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_ctx);
-            scc_ast_type_builtin_init(type, parser->ast_ctx,
+            type = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_module);
+            scc_ast_type_builtin_init(type, parser->ast_module,
                                       SCC_AST_BUILTIN_TYPE_VA_LIST,
                                       tok_ptr->loc);
             scc_ast_decl_param_init(param, type, nullptr, scc_vec_size(*params),
@@ -1112,7 +1112,7 @@ parse_direct_declarator(scc_parser_t *parser, scc_ast_qual_type_t *base,
                         scc_lexer_tok_t *tok_ident) {
     const scc_lexer_tok_t *tok_ptr = nullptr;
     scc_ast_qual_type_t *ret = nullptr;
-    scc_ast_canon_type_t *canon = scc_ast_ctx_alloc_type(parser->ast_ctx);
+    scc_ast_canon_type_t *canon = scc_ast_module_alloc_type(parser->ast_module);
     // direct-abstract-declarator
     tok_ptr = scc_parser_peek(parser);
     if (tok_ptr == nullptr) {
@@ -1137,7 +1137,7 @@ parse_direct_declarator(scc_parser_t *parser, scc_ast_qual_type_t *base,
         if (parse_function_parameters_start(parser)) {
             scc_ast_decl_vec_t params;
             parse_function_parameters(parser, &params);
-            ret = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_ctx);
+            ret = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_module);
             // FIXME
             scc_ast_type_function_init(ret, canon, base, &params,
                                        base->base.loc);
@@ -1162,7 +1162,7 @@ parse_direct_declarator(scc_parser_t *parser, scc_ast_qual_type_t *base,
     } else if (tok_ptr->type == SCC_TOK_L_BRACKET) {
         // [] SCC_TOK_L_BRACKET
         scc_ast_expr_t *size = parse_array_size_type(parser);
-        scc_ast_qual_type_t *ret = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_ctx);
+        scc_ast_qual_type_t *ret = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_module);
         base =
             parse_direct_declarator(parser, base, delay_pointee_ptr, tok_ident);
         // FIXME
@@ -1202,7 +1202,7 @@ parse_direct_abstract_declarator(scc_parser_t *parser,
                                  scc_ast_qual_type_t **delay_pointee_ptr) {
     const scc_lexer_tok_t *tok_ptr = nullptr;
     scc_ast_qual_type_t *ret = nullptr;
-    scc_ast_canon_type_t *canon = scc_ast_ctx_alloc_type(parser->ast_ctx);
+    scc_ast_canon_type_t *canon = scc_ast_module_alloc_type(parser->ast_module);
     // direct-abstract-declarator
     tok_ptr = scc_parser_peek(parser);
     if (tok_ptr == nullptr) {
@@ -1216,7 +1216,7 @@ parse_direct_abstract_declarator(scc_parser_t *parser,
         if (parse_function_parameters_start(parser)) {
             scc_ast_decl_vec_t params;
             parse_function_parameters(parser, &params);
-            ret = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_ctx);
+            ret = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_module);
             // FIXME
             scc_ast_type_function_init(ret, canon, base, &params,
                                        base->base.loc);
@@ -1237,7 +1237,7 @@ parse_direct_abstract_declarator(scc_parser_t *parser,
     } else if (tok_ptr->type == SCC_TOK_L_BRACKET) {
         // [] SCC_TOK_L_BRACKET
         scc_ast_expr_t *size = parse_array_size_type(parser);
-        scc_ast_qual_type_t *ret = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_ctx);
+        scc_ast_qual_type_t *ret = SCC_AST_ALLOC_QUAL_TYPE(parser->ast_module);
         base =
             parse_direct_abstract_declarator(parser, base, delay_pointee_ptr);
         // FIXME
@@ -1254,14 +1254,14 @@ scc_ast_decl_t *scc_parse_declarator(scc_parser_t *parser,
     scc_ast_qual_type_t *decl_type =
         parse_declarator(parser, type, nullptr, &decl_name_tok);
     scc_ast_decl_t *decl = nullptr;
-    decl = SCC_AST_ALLOC_DECL(parser->ast_ctx);
+    decl = SCC_AST_ALLOC_DECL(parser->ast_module);
     Assert(decl != nullptr);
     Assert(decl_name_tok.type == SCC_TOK_IDENT ||
            decl_name_tok.type == SCC_TOK_UNKNOWN);
 
     // FIXME memory leak
     const char *name = decl_name_tok.type == SCC_TOK_IDENT
-                           ? scc_str_as_cstr(&decl_name_tok.lexeme)
+                           ? scc_ast_module_intern(parser->ast_module, scc_str_as_cstr(&decl_name_tok.lexeme))
                            : nullptr;
 
     if (decl_type->base.type == SCC_AST_TYPE_FUNCTION) {
@@ -1288,7 +1288,7 @@ scc_ast_decl_t *scc_parse_declarator(scc_parser_t *parser,
     //         decl = scc_ast_canon_type(decl_type)->record.decl;
     //     } else {
     //         // TODO();
-    //         // decl = SCC_AST_ALLOC_DECL(parser->ast_ctx);
+    //         // decl = SCC_AST_ALLOC_DECL(parser->ast_module);
     //         // scc_ast_decl_unsafe_val_init(decl, type, nullptr, nullptr,
     //         //                              decl_type->base.loc);
     //     }

libs/parser/src/scc_parser.c

@@ -20,10 +20,10 @@ static scc_ast_qual_type_t *dummy_got_type_callback(scc_sema_ctx_t *context,
     assigned_val = value ? value : default
 
 void scc_parser_init(scc_parser_t *parser, scc_lexer_tok_ring_t *tok_ring,
-                     scc_ast_ctx_t *ast_ctx, scc_sema_ctx_t *sema_ctx) {
+                     scc_ast_module_t *ast_module, scc_sema_ctx_t *sema_ctx) {
     Assert(parser != nullptr && tok_ring != nullptr);
-    Assert(ast_ctx != nullptr);
-    parser->ast_ctx = ast_ctx;
+    Assert(ast_module != nullptr);
+    parser->ast_module = ast_module;
 
     parser->ring = tok_ring;
     parser->errcode = 0;

libs/parser/src/scc_sema.c

@@ -31,14 +31,15 @@ static void symtab_add_symbol(scc_sema_symtab_t *sema_symtab,
 
     if (decl->name == nullptr)
         return;
-    // FIXME memory leak
     scc_str_t name = scc_str_empty();
     gen_symbol_name(decl, &name);
     if (scc_str_is_empty(&name)) {
         scc_sema_symtab_add_symbol(sema_symtab, decl->name, ast_node_ref);
     } else {
-        scc_sema_symtab_add_symbol(sema_symtab, scc_str_as_cstr(&name),
-                                   ast_node_ref);
+        const char *pooled = scc_strpool_intern(&sema_symtab->name_pool,
+                                                scc_str_as_cstr(&name));
+        scc_sema_symtab_add_symbol(sema_symtab, pooled, ast_node_ref);
+        scc_str_drop(&name);
     }
 }
 
@@ -291,8 +292,8 @@ static scc_ast_qual_type_t *got_type_callback(scc_sema_ctx_t *sema_ctx,
     return nullptr;
 }
 
-void scc_sema_init(scc_sema_ctx_t *sema_ctx, scc_ast_ctx_t *ast_ctx) {
-    sema_ctx->ast_ctx = ast_ctx;
+void scc_sema_init(scc_sema_ctx_t *sema_ctx, scc_ast_module_t *ast_module) {
+    sema_ctx->ast_module = ast_module;
     scc_sema_symtab_t *sema_symtab = scc_malloc(sizeof(scc_sema_symtab_t));
     if (sema_symtab == nullptr) {
         LOG_FATAL("out of memory");
@@ -311,25 +312,23 @@ void scc_sema_init(scc_sema_ctx_t *sema_ctx, scc_ast_ctx_t *ast_ctx) {
     scc_vec_init(sema_ctx->break_stack);
     scc_vec_init(sema_ctx->continue_stack);
 
-    // FIXME memory leak
-
-    scc_ast_qual_type_t *type = SCC_AST_ALLOC_QUAL_TYPE(sema_ctx->ast_ctx);
-    scc_ast_type_builtin_init(type, sema_ctx->ast_ctx,
+    scc_ast_qual_type_t *type = SCC_AST_ALLOC_QUAL_TYPE(sema_ctx->ast_module);
+    scc_ast_type_builtin_init(type, sema_ctx->ast_module,
                               SCC_AST_BUILTIN_TYPE_VA_LIST, scc_pos_create());
     scc_sema_symtab_add_symbol(sema_symtab, "__scc_builtin_va_list",
                                &type->base);
 
-    scc_ast_decl_t *decl = SCC_AST_ALLOC_DECL(sema_ctx->ast_ctx);
+    scc_ast_decl_t *decl = SCC_AST_ALLOC_DECL(sema_ctx->ast_module);
     scc_ast_decl_val_init(decl, type, "__scc_builtin__", nullptr,
                           scc_pos_create());
     scc_sema_symtab_add_symbol(sema_symtab, "__func__", &decl->base);
 
     scc_ast_qual_type_t *built_func_type =
-        SCC_AST_ALLOC_QUAL_TYPE(sema_ctx->ast_ctx);
+        SCC_AST_ALLOC_QUAL_TYPE(sema_ctx->ast_module);
     // FIXME hack
     built_func_type->base.type = SCC_AST_TYPE_FUNCTION;
 
-    scc_ast_decl_t *builin_func = SCC_AST_ALLOC_DECL(sema_ctx->ast_ctx);
+    scc_ast_decl_t *builin_func = SCC_AST_ALLOC_DECL(sema_ctx->ast_module);
     scc_ast_decl_func_init(builin_func, built_func_type, "__scc_builtin_func",
                            nullptr, scc_pos_create());
     scc_sema_symtab_add_symbol(sema_symtab, "__scc_builtin_va_start",
@@ -348,8 +347,9 @@ void scc_sema_drop(scc_sema_ctx_t *sema_ctx) {
     scc_vec_free(sema_ctx->break_stack);
     scc_vec_free(sema_ctx->continue_stack);
 
-    // FIXME drop obj
     if (sema_ctx->context) {
         scc_sema_symtab_drop(sema_ctx->context);
+        scc_free(sema_ctx->context);
+        sema_ctx->context = nullptr;
     }
 }

libs/parser/src/sema_symtab.c

@@ -5,13 +5,19 @@ void scc_sema_symtab_init(scc_sema_symtab_t *symtab) {
 
     scc_hashtable_cstr_init(&symtab->root_scope.symbols);
     symtab->current_scope = &symtab->root_scope;
+    scc_strpool_init(&symtab->name_pool);
 }
 
 void scc_sema_symtab_drop(scc_sema_symtab_t *symtab) {
     while (symtab->current_scope != nullptr) {
         scc_hashtable_drop(&symtab->current_scope->symbols);
+        scc_sema_scope_t *scope = symtab->current_scope;
         symtab->current_scope = symtab->current_scope->parent;
+        if (scope != &symtab->root_scope) {
+            scc_free(scope);
+        }
     }
+    scc_strpool_drop(&symtab->name_pool);
 }
 
 void scc_sema_symtab_enter_scope(scc_sema_symtab_t *symtab) {
@@ -30,8 +36,10 @@ void scc_sema_symtab_leave_scope(scc_sema_symtab_t *symtab) {
         LOG_ERROR("out of scope");
         return;
     }
-    scc_hashtable_drop(&symtab->current_scope->symbols);
+    scc_sema_scope_t *scope = symtab->current_scope;
+    scc_hashtable_drop(&scope->symbols);
     symtab->current_scope = symtab->current_scope->parent;
+    scc_free(scope);
 }
 
 scc_ast_node_t *scc_sema_symtab_add_symbol(scc_sema_symtab_t *symtab,

libs/pproc/src/pproc_include.c

@@ -1,5 +1,6 @@
 #include <pproc_expand.h>
 #include <scc_core_ring.h>
+#include <scc_path.h>
 #include <scc_pproc.h>
 
 static int switch_file_stack(scc_pproc_t *pp, scc_str_t *fname, scc_pos_t *pos,
@@ -100,6 +101,19 @@ void scc_pproc_parse_include(scc_pproc_t *pp, scc_lexer_tok_t *include_tok,
         scc_str_append_ch(&fname, includename[i]);
     }
     int is_system = includename[0] == '<';
+
+    /* 安全检查：拒绝绝对路径和路径穿越 */
+    const char *fname_cstr = scc_str_as_cstr(&fname);
+    if (scc_path_check_include_safe(fname_cstr) != 0) {
+        SCC_ERROR(pos,
+                  "unsafe include filename: '%s' (absolute path and '..' "
+                  "are not allowed)",
+                  fname_cstr);
+        scc_str_drop(&line);
+        scc_str_drop(&fname);
+        return;
+    }
+
     if (switch_file_stack(pp, &fname, &pos, is_system)) {
         // LOG_ERROR()
     }

libs/target/sccf2target/src/sccf2pe.c

@@ -6,6 +6,7 @@
 typedef struct {
     scc_hashtable_t str2libsym;
     scc_pe_idata_lib_vec_t idata_libs;
+    scc_strpool_t pool; /* owns all interned symbol names and library names */
     const char *find_path;
 } pe_idata_lib_ctx_t;
 
@@ -24,11 +25,18 @@ static void load_from_def(pe_idata_lib_ctx_t *ctx, const char *file_path,
     const char *fname = scc_str_as_cstr(&fpath);
     scc_file_t fp = scc_fopen(fname, SCC_FILE_READ);
     if (fp == nullptr) {
+        scc_str_drop(&fpath);
         return;
     }
     LOG_TRACE("load_from_def file read sucessful: %s", fname);
 
     usize fsize = scc_fsize(fp);
+    if (fsize == 0) {
+        scc_fclose(fp);
+        scc_str_drop(&fpath);
+        return;
+    }
+
     char *buffer = scc_malloc(fsize);
     Assert(buffer != nullptr);
 
@@ -36,10 +44,9 @@ static void load_from_def(pe_idata_lib_ctx_t *ctx, const char *file_path,
     Assert(read_size == fsize);
     scc_fclose(fp);
 
-    // scc_pe_name_vec_t symbol_names;
     usize line = 0;
-    // FIXME
     buffer[fsize - 1] = '\0';
+    const char *dll_pooled = scc_strpool_intern(&ctx->pool, dll_name);
     for (usize i = 0; i < fsize; i += 1) {
         if (buffer[i] == '\n') {
             line += 1;
@@ -56,15 +63,18 @@ static void load_from_def(pe_idata_lib_ctx_t *ctx, const char *file_path,
                 break;
             }
         }
-        // FIXME memory leak
-        scc_hashtable_set(&ctx->str2libsym, buffer + i, (void *)dll_name);
+        const char *sym_pooled = scc_strpool_intern(&ctx->pool, buffer + i);
+        scc_hashtable_set(&ctx->str2libsym, sym_pooled, (void *)dll_pooled);
     }
+    scc_free(buffer);
+    scc_str_drop(&fpath);
 }
 
 static void pe_idata_lib_init(pe_idata_lib_ctx_t *ctx, const char *find_path) {
     // Got .dll.def
 
     scc_hashtable_cstr_init(&ctx->str2libsym);
+    scc_strpool_init(&ctx->pool);
     scc_vec_init(ctx->idata_libs);
     ctx->find_path = find_path;
     load_from_def(ctx, ctx->find_path, "msvcrt.dll");
@@ -249,4 +259,12 @@ void sccf2pe(scc_pe_builder_t *builder, const sccf_t *sccf) {
     scc_pe_write_section(builder, &idata_range,
                          scc_vec_unsafe_get_data(idata_buffer),
                          scc_vec_size(idata_buffer));
+
+    // Cleanup
+    scc_vec_foreach(idata_lib_ctx.idata_libs, i) {
+        scc_vec_free(scc_vec_at(idata_lib_ctx.idata_libs, i).symbol_names);
+    }
+    scc_vec_free(idata_lib_ctx.idata_libs);
+    scc_hashtable_drop(&idata_lib_ctx.str2libsym);
+    scc_strpool_drop(&idata_lib_ctx.pool);
 }

runtime/ap/cbuild.toml

@@ -1,9 +1,9 @@
 [package]
-name = "ap"
-version = "0.1.0"
-authors = []
+name        = "ap"
+version     = "0.1.0"
+authors     = []
 description = ""
 
-# dependencies = []
+dependencies = [{ name = "core", path = "../scc_core" }]
 # features = {}
 # default_features = []

runtime/ap/include/ap.h

@@ -4,7 +4,7 @@
  * @brief Arbitrary Precision Library
  *
  */
-#ifdef __SCC__
+#ifndef __NO_SCC_RUNTIME__
 #include <scc_core.h>
 #define SCC_AP_DIGIT u64
 #define SCC_AP_PANIC Panic
@@ -49,21 +49,21 @@ typedef struct {
 } scc_ap_t;
 
 static inline void scc_ap_init(scc_ap_t *ap) {
-    ap->len = 0;
     ap->capacity = -1;
     ap->len = 1;
     ap->data.digit = 0;
 }
 
 static inline void scc_ap_set_int(scc_ap_t *ap, int val) {
+    ap->capacity = -1;
+    SCC_AP_ASSERT(sizeof(scc_ap_digit) >= sizeof(int));
     if (val < 0) {
         ap->len = -1;
+        ap->data.digit = (scc_ap_digit)(-(int64_t)val);
     } else {
         ap->len = 1;
+        ap->data.digit = (scc_ap_digit)val;
     }
-    SCC_AP_ASSERT(sizeof(scc_ap_digit) >= sizeof(int));
-    ap->capacity = -1;
-    ap->data.digit = val;
 }
 
 void scc_ap_drop(scc_ap_t *ap);
@@ -77,13 +77,20 @@ void scc_ap_mul(scc_ap_t *to, const scc_ap_t *from_a, const scc_ap_t *from_b);
 void scc_ap_div(scc_ap_t *to, const scc_ap_t *from_a, const scc_ap_t *from_b);
 void scc_ap_mod(scc_ap_t *to, const scc_ap_t *from_a, const scc_ap_t *from_b);
 
-/**
- * @brief equal
- *
- * @param a
- * @param b
- * @return int
- */
+void scc_ap_shl(scc_ap_t *to, const scc_ap_t *from, unsigned shift);
+void scc_ap_shr(scc_ap_t *to, const scc_ap_t *from, unsigned shift);
+void scc_ap_lshr(scc_ap_t *to, const scc_ap_t *from, unsigned shift);
+
+void scc_ap_and(scc_ap_t *to, const scc_ap_t *a, const scc_ap_t *b);
+void scc_ap_or(scc_ap_t *to, const scc_ap_t *a, const scc_ap_t *b);
+void scc_ap_xor(scc_ap_t *to, const scc_ap_t *a, const scc_ap_t *b);
+void scc_ap_not(scc_ap_t *to, const scc_ap_t *from);
+
+void scc_ap_neg(scc_ap_t *to, const scc_ap_t *from);
+
+int scc_ap_cmp(const scc_ap_t *a, const scc_ap_t *b);
+int scc_ap_is_zero(const scc_ap_t *ap);
+
 int scc_ap_eql(const scc_ap_t *a, const scc_ap_t *b);
 
 typedef void (*ap_dump_fn)(const char ch, void *user_data);

runtime/ap/src/ap.c

@@ -1,48 +1,394 @@
 #include <ap.h>
 
-static void *scc_ap_alloc(size_t size) {
-    void *p = SCC_AP_MALLOC(size);
-    SCC_AP_ASSERT(p != NULL);
-    return p;
+/*
+ * Fast-path (hack) implementation: all values stored in single-digit mode.
+ * data.digit holds the absolute magnitude as u64, len sign indicates sign.
+ * Arithmetic is done via isize with explicit overflow checks — anything
+ * out of isize range triggers SCC_AP_PANIC.
+ */
+
+/* ---------- internal helpers ---------- */
+
+/* Convert from sign-magnitude (digit mode) to isize */
+static isize ap_to_isize(const scc_ap_t *ap) {
+    SCC_AP_ASSERT(ap != nullptr);
+    SCC_AP_ASSERT(ap->capacity == -1);
+    uint64_t mag = ap->data.digit;
+    if (ap->len < 0) {
+        if (mag == 0)
+            return 0;
+        if (mag == (uint64_t)INTPTR_MAX + 1)
+            return INTPTR_MIN;
+        SCC_AP_ASSERT(mag <= (uint64_t)INTPTR_MAX);
+        return -(isize)(int64_t)mag;
+    }
+    SCC_AP_ASSERT(mag <= (uint64_t)INTPTR_MAX);
+    return (isize)(int64_t)mag;
 }
 
-/* 重新分配内存 */
-static void *scc_ap_realloc_data(void *old, size_t new_size) {
-    void *p = SCC_AP_REALLOC(old, new_size);
-    SCC_AP_ASSERT(p != NULL);
-    return p;
+/* Store isize value into sign-magnitude (digit mode) */
+static void ap_from_isize(scc_ap_t *ap, isize val) {
+    ap->capacity = -1;
+    if (val < 0) {
+        ap->len = -1;
+        ap->data.digit = (scc_ap_digit)(-(uint64_t)(int64_t)val);
+    } else {
+        ap->len = 1;
+        ap->data.digit = (scc_ap_digit)val;
+    }
 }
 
+/* Checked addition */
+static isize ap_add_isize(isize a, isize b) {
+    if (b > 0 && a > INTPTR_MAX - b)
+        SCC_AP_PANIC("scc_ap_add: positive overflow");
+    if (b < 0 && a < INTPTR_MIN - b)
+        SCC_AP_PANIC("scc_ap_add: negative overflow");
+    return a + b;
+}
+
+/* Checked subtraction: a - b */
+static isize ap_sub_isize(isize a, isize b) {
+    /* a - b = a + (-b); -INTPTR_MIN overflows, handle specially */
+    if (b == INTPTR_MIN) {
+        if (a < 0)
+            SCC_AP_PANIC("scc_ap_sub: overflow (a - INTPTR_MIN, a < 0)");
+        SCC_AP_PANIC("scc_ap_sub: overflow (a - INTPTR_MIN, a >= 0)");
+    }
+    return ap_add_isize(a, -b);
+}
+
+/* Checked multiplication */
+static isize ap_mul_isize(isize a, isize b) {
+    if (a == 0 || b == 0)
+        return 0;
+    if (a == 1)
+        return b;
+    if (b == 1)
+        return a;
+
+    /* Determine sign of result */
+    int sign = ((a < 0) == (b < 0)) ? 1 : -1;
+
+    /* Absolute values as uint64 */
+    uint64_t ua = (a == INTPTR_MIN)
+                      ? (uint64_t)INTPTR_MAX + 1
+                      : (uint64_t)(a < 0 ? -(int64_t)a : (int64_t)a);
+    uint64_t ub = (b == INTPTR_MIN)
+                      ? (uint64_t)INTPTR_MAX + 1
+                      : (uint64_t)(b < 0 ? -(int64_t)b : (int64_t)b);
+
+    /* Overflow threshold */
+    uint64_t limit =
+        (sign > 0) ? (uint64_t)INTPTR_MAX : (uint64_t)INTPTR_MAX + 1;
+
+    if (ua != 0 && ub > limit / ua)
+        SCC_AP_PANIC("scc_ap_mul: overflow");
+
+    isize result = (isize)(ua * ub);
+    return (sign > 0) ? result : -result;
+}
+
+/* Checked division */
+static isize ap_div_isize(isize a, isize b) {
+    if (b == 0)
+        SCC_AP_PANIC("scc_ap_div: division by zero");
+    if (a == INTPTR_MIN && b == -1)
+        SCC_AP_PANIC("scc_ap_div: overflow (INTPTR_MIN / -1)");
+    return a / b;
+}
+
+/* Checked modulo */
+static isize ap_mod_isize(isize a, isize b) {
+    if (b == 0)
+        SCC_AP_PANIC("scc_ap_mod: modulo by zero");
+    if (a == INTPTR_MIN && b == -1)
+        SCC_AP_PANIC("scc_ap_mod: overflow (INTPTR_MIN %% -1)");
+    return a % b;
+}
+
+/* ---------- public API ---------- */
+
 void scc_ap_drop(scc_ap_t *ap) {
-    SCC_AP_ASSERT(ap);
-    // SCC_AP_FREE(ap->data);
+    SCC_AP_ASSERT(ap != nullptr);
+    /* In digit mode (capacity == -1), there's no heap allocation to free */
     scc_ap_init(ap);
 }
 
-void scc_ap_with_bits(scc_ap_t *ap, int bits) {}
-
-void scc_ap_from_string(scc_ap_t *ap, const char *str, int len, int base) {
-    SCC_AP_ASSERT(base == 10);
-    SCC_AP_ASSERT(ap && str);
-    if (len == 0) {
-        scc_ap_set_int(ap, 0);
-    }
-    // FIXME
-    int int_lit = 0;
-    for (int i = 0; i < len; i += 1) {
-        int_lit = int_lit * 10 + (str[i] - '0');
-    }
-    scc_ap_set_int(ap, int_lit);
+void scc_ap_with_bits(scc_ap_t *ap, int bits) {
+    SCC_AP_ASSERT(ap != nullptr);
+    if (bits > (int)(sizeof(scc_ap_digit) * 8))
+        SCC_AP_PANIC(
+            "scc_ap_with_bits: request %d bits but digit only has %zu bits",
+            bits, sizeof(scc_ap_digit) * 8);
+    (void)ap;
+    /* Fast path: always stays in digit mode */
 }
 
-void scc_ap_set_digit(scc_ap_t *ap, scc_ap_digit digit) {}
+void scc_ap_from_string(scc_ap_t *ap, const char *str, int len, int base) {
+    SCC_AP_ASSERT(ap != nullptr && str != nullptr);
 
-void scc_ap_add_impl(scc_ap_t *to, const scc_ap_t *from_a,
-                     const scc_ap_t *from_b) {}
+    /* len < 0 means null-terminated */
+    if (len < 0) {
+        len = 0;
+        while (str[len] != '\0')
+            len++;
+    }
+    if (len == 0) {
+        ap_from_isize(ap, 0);
+        return;
+    }
 
-void scc_ap_add(scc_ap_t *to, const scc_ap_t *from_a, const scc_ap_t *from_b) {}
+    int i = 0;
+    int sign = 1;
 
-void scc_ap_sub(scc_ap_t *to, const scc_ap_t *from_a, const scc_ap_t *from_b) {}
+    /* Optional leading sign */
+    if (str[i] == '-') {
+        sign = -1;
+        i++;
+    } else if (str[i] == '+') {
+        i++;
+    }
 
-typedef void (*ap_dump_fn)(const char ch, void *user_data);
-int scc_ap_dump(scc_ap_t *ap, ap_dump_fn dump_fn, void *user_data) { return 0; }
+    if (i >= len) {
+        ap_from_isize(ap, 0);
+        return;
+    }
+
+    /* ---------- base auto-detection ---------- */
+    /* hex: 0x / 0X */
+    if ((base == 0 || base == 16) &&
+        (i + 2 < len && str[i] == '0' &&
+         (str[i + 1] == 'x' || str[i + 1] == 'X'))) {
+        base = 16;
+        i += 2;
+    }
+    /* binary: 0b / 0B */
+    if ((base == 0 || base == 2) &&
+        (i + 2 < len && str[i] == '0' &&
+         (str[i + 1] == 'b' || str[i + 1] == 'B'))) {
+        base = 2;
+        i += 2;
+    }
+    if (base == 0) {
+        if (i < len && str[i] == '0') {
+            base = 8;
+            i++;
+        } else {
+            base = 10;
+        }
+    }
+
+    /* ---------- parse digits ---------- */
+    uint64_t val = 0;
+    for (; i < len; i++) {
+        char ch = str[i];
+        unsigned d;
+        if (ch >= '0' && ch <= '9')
+            d = (unsigned)(ch - '0');
+        else if (ch >= 'a' && ch <= 'f')
+            d = (unsigned)(ch - 'a' + 10);
+        else if (ch >= 'A' && ch <= 'F')
+            d = (unsigned)(ch - 'A' + 10);
+        else
+            break;
+        if ((int)d >= base)
+            break;
+
+        /* overflow check: val * base + d <= UINT64_MAX */
+        if (val > (UINT64_MAX - d) / (unsigned)base)
+            SCC_AP_PANIC("scc_ap_from_string: overflow");
+        val = val * (unsigned)base + d;
+    }
+
+    ap->capacity = -1;
+    ap->data.digit = val;
+    ap->len = (sign < 0 && val > 0) ? -1 : 1;
+}
+
+void scc_ap_set_digit(scc_ap_t *ap, scc_ap_digit digit) {
+    SCC_AP_ASSERT(ap != nullptr);
+    if (digit > (scc_ap_digit)INTPTR_MAX)
+        SCC_AP_PANIC("scc_ap_set_digit: value %llu exceeds isize range",
+                     (unsigned long long)digit);
+    ap->capacity = -1;
+    ap->data.digit = digit;
+    ap->len = 1;
+}
+
+void scc_ap_add(scc_ap_t *to, const scc_ap_t *from_a, const scc_ap_t *from_b) {
+    SCC_AP_ASSERT(to != nullptr && from_a != nullptr && from_b != nullptr);
+    isize a = ap_to_isize(from_a);
+    isize b = ap_to_isize(from_b);
+    ap_from_isize(to, ap_add_isize(a, b));
+}
+
+void scc_ap_sub(scc_ap_t *to, const scc_ap_t *from_a, const scc_ap_t *from_b) {
+    SCC_AP_ASSERT(to != nullptr && from_a != nullptr && from_b != nullptr);
+    isize a = ap_to_isize(from_a);
+    isize b = ap_to_isize(from_b);
+    ap_from_isize(to, ap_sub_isize(a, b));
+}
+
+void scc_ap_mul(scc_ap_t *to, const scc_ap_t *from_a, const scc_ap_t *from_b) {
+    SCC_AP_ASSERT(to != nullptr && from_a != nullptr && from_b != nullptr);
+    isize a = ap_to_isize(from_a);
+    isize b = ap_to_isize(from_b);
+    ap_from_isize(to, ap_mul_isize(a, b));
+}
+
+void scc_ap_div(scc_ap_t *to, const scc_ap_t *from_a, const scc_ap_t *from_b) {
+    SCC_AP_ASSERT(to != nullptr && from_a != nullptr && from_b != nullptr);
+    isize a = ap_to_isize(from_a);
+    isize b = ap_to_isize(from_b);
+    ap_from_isize(to, ap_div_isize(a, b));
+}
+
+void scc_ap_mod(scc_ap_t *to, const scc_ap_t *from_a, const scc_ap_t *from_b) {
+    SCC_AP_ASSERT(to != nullptr && from_a != nullptr && from_b != nullptr);
+    isize a = ap_to_isize(from_a);
+    isize b = ap_to_isize(from_b);
+    ap_from_isize(to, ap_mod_isize(a, b));
+}
+
+void scc_ap_shl(scc_ap_t *to, const scc_ap_t *from, unsigned shift) {
+    SCC_AP_ASSERT(to != nullptr && from != nullptr);
+    SCC_AP_ASSERT(from->capacity == -1);
+    if (shift >= sizeof(scc_ap_digit) * 8)
+        SCC_AP_PANIC("scc_ap_shl: shift %u exceeds digit width (%zu bits)",
+                     shift, sizeof(scc_ap_digit) * 8);
+    /* left shift = multiply by 2^shift */
+    isize val = ap_to_isize(from);
+    isize result = ap_mul_isize(val, (isize)1 << shift);
+    ap_from_isize(to, result);
+}
+
+void scc_ap_shr(scc_ap_t *to, const scc_ap_t *from, unsigned shift) {
+    SCC_AP_ASSERT(to != nullptr && from != nullptr);
+    SCC_AP_ASSERT(from->capacity == -1);
+    if (shift >= sizeof(scc_ap_digit) * 8)
+        SCC_AP_PANIC("scc_ap_shr: shift %u exceeds digit width (%zu bits)",
+                     shift, sizeof(scc_ap_digit) * 8);
+    /* arithmetic right shift — uses >> on isize (arithmetic on GCC/MSVC/Clang) */
+    isize val = ap_to_isize(from);
+    ap_from_isize(to, val >> shift);
+}
+
+void scc_ap_lshr(scc_ap_t *to, const scc_ap_t *from, unsigned shift) {
+    SCC_AP_ASSERT(to != nullptr && from != nullptr);
+    SCC_AP_ASSERT(from->capacity == -1);
+    if (shift >= sizeof(scc_ap_digit) * 8)
+        SCC_AP_PANIC("scc_ap_lshr: shift %u exceeds digit width (%zu bits)",
+                     shift, sizeof(scc_ap_digit) * 8);
+    /*
+     * logical right shift: reinterpret the signed value as uint64 bit pattern,
+     * shift right, store as non-negative magnitude.
+     */
+    uint64_t bits;
+    if (from->len < 0) {
+        /* negative → two's complement bit pattern */
+        bits = -(uint64_t)(int64_t)from->data.digit;
+    } else {
+        bits = from->data.digit;
+    }
+    to->capacity = -1;
+    to->data.digit = bits >> shift;
+    to->len = 1;
+}
+
+/* ---------- bitwise ---------- */
+
+void scc_ap_and(scc_ap_t *to, const scc_ap_t *a, const scc_ap_t *b) {
+    SCC_AP_ASSERT(to != nullptr && a != nullptr && b != nullptr);
+    ap_from_isize(to, ap_to_isize(a) & ap_to_isize(b));
+}
+
+void scc_ap_or(scc_ap_t *to, const scc_ap_t *a, const scc_ap_t *b) {
+    SCC_AP_ASSERT(to != nullptr && a != nullptr && b != nullptr);
+    ap_from_isize(to, ap_to_isize(a) | ap_to_isize(b));
+}
+
+void scc_ap_xor(scc_ap_t *to, const scc_ap_t *a, const scc_ap_t *b) {
+    SCC_AP_ASSERT(to != nullptr && a != nullptr && b != nullptr);
+    ap_from_isize(to, ap_to_isize(a) ^ ap_to_isize(b));
+}
+
+void scc_ap_not(scc_ap_t *to, const scc_ap_t *from) {
+    SCC_AP_ASSERT(to != nullptr && from != nullptr);
+    ap_from_isize(to, ~ap_to_isize(from));
+}
+
+/* ---------- unary arithmetic ---------- */
+
+void scc_ap_neg(scc_ap_t *to, const scc_ap_t *from) {
+    SCC_AP_ASSERT(to != nullptr && from != nullptr);
+    isize val = ap_to_isize(from);
+    if (val == INTPTR_MIN)
+        SCC_AP_PANIC("scc_ap_neg: overflow (INTPTR_MIN)");
+    ap_from_isize(to, -val);
+}
+
+/* ---------- comparison ---------- */
+
+int scc_ap_cmp(const scc_ap_t *a, const scc_ap_t *b) {
+    SCC_AP_ASSERT(a != nullptr && b != nullptr);
+    isize va = ap_to_isize(a);
+    isize vb = ap_to_isize(b);
+    if (va < vb) return -1;
+    if (va > vb) return 1;
+    return 0;
+}
+
+int scc_ap_is_zero(const scc_ap_t *ap) {
+    SCC_AP_ASSERT(ap != nullptr);
+    return ap->data.digit == 0;
+}
+
+int scc_ap_eql(const scc_ap_t *a, const scc_ap_t *b) {
+    SCC_AP_ASSERT(a != nullptr && b != nullptr);
+    SCC_AP_ASSERT(a->capacity == -1 && b->capacity == -1);
+    if (a->len != b->len) {
+        /* -0 == +0 */
+        if (a->data.digit == 0 && b->data.digit == 0)
+            return 1;
+        return 0;
+    }
+    return a->data.digit == b->data.digit;
+}
+
+int scc_ap_dump(scc_ap_t *ap, ap_dump_fn dump_fn, void *user_data) {
+    SCC_AP_ASSERT(ap != nullptr && dump_fn != nullptr);
+    SCC_AP_ASSERT(ap->capacity == -1);
+
+    isize val = ap_to_isize(ap);
+
+    if (val == 0) {
+        dump_fn('0', user_data);
+        return 0;
+    }
+
+    /* Buffer large enough for INT64_MIN "-9223372036854775808" */
+    char buf[24];
+    int pos = sizeof(buf);
+
+    if (val < 0) {
+        dump_fn('-', user_data);
+        /* Work with positive magnitude to avoid overflow when printing */
+        uint64_t mag = ap->data.digit;
+        while (mag > 0) {
+            buf[--pos] = (char)('0' + (mag % 10));
+            mag /= 10;
+        }
+    } else {
+        uint64_t mag = (uint64_t)val;
+        while (mag > 0) {
+            buf[--pos] = (char)('0' + (mag % 10));
+            mag /= 10;
+        }
+    }
+
+    for (int i = pos; i < (int)sizeof(buf); i++)
+        dump_fn(buf[i], user_data);
+
+    return 0;
+}

runtime/ap/tests/test_ap_panic.c

@@ -0,0 +1,184 @@
+#include <ap.h>
+#include <stdio.h>
+#include <string.h>
+#include <utest/acutest.h>
+
+/*
+ * Panic / overflow tests — each test calls SCC_AP_PANIC which aborts the
+ * process. Run this file separately from the normal tests.
+ */
+
+/* ---------- helper: attempt an operation and report result ---------- */
+
+#define TRY_PANIC(call, label)                                                    \
+    do {                                                                          \
+        fprintf(stderr, "  " label " ... ");                                      \
+        call;                                                                     \
+        fprintf(stderr, "FAIL (no panic)\n");                                     \
+        TEST_CHECK(0 && "expected panic");                                        \
+    } while (0)
+
+void test_add_overflow_positive(void) {
+    scc_ap_t a, b, r;
+    scc_ap_init(&a);
+    scc_ap_init(&b);
+    scc_ap_init(&r);
+    scc_ap_from_string(&a, "9223372036854775807", -1, 10);
+    scc_ap_set_int(&b, 1);
+    TRY_PANIC(scc_ap_add(&r, &a, &b), "INTPTR_MAX + 1");
+}
+
+void test_add_overflow_negative(void) {
+    scc_ap_t a, b, r;
+    scc_ap_init(&a);
+    scc_ap_init(&b);
+    scc_ap_init(&r);
+    scc_ap_from_string(&a, "-9223372036854775808", -1, 10);
+    scc_ap_set_int(&b, -1);
+    TRY_PANIC(scc_ap_add(&r, &a, &b), "INTPTR_MIN + (-1)");
+}
+
+void test_mul_overflow(void) {
+    scc_ap_t a, b, r;
+    scc_ap_init(&a);
+    scc_ap_init(&b);
+    scc_ap_init(&r);
+    scc_ap_from_string(&a, "4611686018427387904", -1, 10); /* INT64_MAX/2 + 1 */
+    scc_ap_set_int(&b, 2);
+    TRY_PANIC(scc_ap_mul(&r, &a, &b), "(INT64_MAX/2+1) * 2");
+}
+
+void test_div_by_zero(void) {
+    scc_ap_t a, b, r;
+    scc_ap_init(&a);
+    scc_ap_init(&b);
+    scc_ap_init(&r);
+    scc_ap_set_int(&a, 1);
+    scc_ap_set_int(&b, 0);
+    TRY_PANIC(scc_ap_div(&r, &a, &b), "1 / 0");
+}
+
+void test_mod_by_zero(void) {
+    scc_ap_t a, b, r;
+    scc_ap_init(&a);
+    scc_ap_init(&b);
+    scc_ap_init(&r);
+    scc_ap_set_int(&a, 1);
+    scc_ap_set_int(&b, 0);
+    TRY_PANIC(scc_ap_mod(&r, &a, &b), "1 % 0");
+}
+
+void test_from_string_overflow(void) {
+    scc_ap_t ap;
+    scc_ap_init(&ap);
+    TRY_PANIC(scc_ap_from_string(&ap, "18446744073709551615", -1, 10),
+              "UINT64_MAX as string");
+}
+
+void test_set_digit_overflow(void) {
+    scc_ap_t ap;
+    scc_ap_init(&ap);
+    TRY_PANIC(scc_ap_set_digit(&ap, (scc_ap_digit)18446744073709551615ULL),
+              "set_digit(UINT64_MAX)");
+}
+
+void test_sub_underflow(void) {
+    scc_ap_t a, b, r;
+    scc_ap_init(&a);
+    scc_ap_init(&b);
+    scc_ap_init(&r);
+    scc_ap_from_string(&a, "-9223372036854775808", -1, 10);
+    scc_ap_set_int(&b, 1);
+    TRY_PANIC(scc_ap_sub(&r, &a, &b), "INTPTR_MIN - 1");
+}
+
+void test_div_overflow(void) {
+    scc_ap_t a, b, r;
+    scc_ap_init(&a);
+    scc_ap_init(&b);
+    scc_ap_init(&r);
+    scc_ap_from_string(&a, "-9223372036854775808", -1, 10);
+    scc_ap_set_int(&b, -1);
+    TRY_PANIC(scc_ap_div(&r, &a, &b), "INTPTR_MIN / -1");
+}
+
+void test_mod_overflow(void) {
+    scc_ap_t a, b, r;
+    scc_ap_init(&a);
+    scc_ap_init(&b);
+    scc_ap_init(&r);
+    scc_ap_from_string(&a, "-9223372036854775808", -1, 10);
+    scc_ap_set_int(&b, -1);
+    TRY_PANIC(scc_ap_mod(&r, &a, &b), "INTPTR_MIN % -1");
+}
+
+void test_mul_overflow_neg_limit(void) {
+    scc_ap_t a, b, r;
+    scc_ap_init(&a);
+    scc_ap_init(&b);
+    scc_ap_init(&r);
+    scc_ap_from_string(&a, "-9223372036854775808", -1, 10);
+    scc_ap_set_int(&b, 2);
+    TRY_PANIC(scc_ap_mul(&r, &a, &b), "INTPTR_MIN * 2");
+}
+
+void test_with_bits_overflow(void) {
+    scc_ap_t ap;
+    scc_ap_init(&ap);
+    TRY_PANIC(scc_ap_with_bits(&ap, 65), "with_bits(65)");
+}
+
+/* ---------- shift overflow tests ---------- */
+
+void test_shl_overflow(void) {
+    scc_ap_t a, r;
+    scc_ap_init(&a);
+    scc_ap_init(&r);
+    scc_ap_from_string(&a, "4611686018427387904", -1, 10); /* INT64_MAX/2+1 */
+    TRY_PANIC(scc_ap_shl(&r, &a, 1), "(INT64_MAX/2+1) << 1");
+}
+
+void test_shl_shift_ge_64(void) {
+    scc_ap_t a, r;
+    scc_ap_init(&a);
+    scc_ap_init(&r);
+    scc_ap_set_int(&a, 1);
+    TRY_PANIC(scc_ap_shl(&r, &a, 64), "1 << 64");
+}
+
+void test_shr_shift_ge_64(void) {
+    scc_ap_t a, r;
+    scc_ap_init(&a);
+    scc_ap_init(&r);
+    scc_ap_set_int(&a, 1);
+    TRY_PANIC(scc_ap_shr(&r, &a, 64), "1 >> 64");
+}
+
+void test_lshr_shift_ge_64(void) {
+    scc_ap_t a, r;
+    scc_ap_init(&a);
+    scc_ap_init(&r);
+    scc_ap_set_int(&a, 1);
+    TRY_PANIC(scc_ap_lshr(&r, &a, 64), "1 lshr 64");
+}
+
+TEST_LIST = {
+    {"test_add_overflow_positive", test_add_overflow_positive},
+    {"test_add_overflow_negative", test_add_overflow_negative},
+    {"test_mul_overflow", test_mul_overflow},
+    {"test_mul_overflow_neg_limit", test_mul_overflow_neg_limit},
+    {"test_div_by_zero", test_div_by_zero},
+    {"test_div_overflow", test_div_overflow},
+    {"test_mod_by_zero", test_mod_by_zero},
+    {"test_mod_overflow", test_mod_overflow},
+    {"test_sub_underflow", test_sub_underflow},
+    {"test_from_string_overflow", test_from_string_overflow},
+    {"test_set_digit_overflow", test_set_digit_overflow},
+    {"test_with_bits_overflow", test_with_bits_overflow},
+    /* shift overflow */
+    {"test_shl_overflow", test_shl_overflow},
+    {"test_shl_shift_ge_64", test_shl_shift_ge_64},
+    {"test_shr_shift_ge_64", test_shr_shift_ge_64},
+    {"test_lshr_shift_ge_64", test_lshr_shift_ge_64},
+    {nullptr, nullptr},
+};

runtime/scc_core/include/scc_core_str.h

@@ -240,7 +240,14 @@ static inline char *scc_str_move_cstr(scc_str_t *str) {
 }
 
 static inline scc_str_t scc_str_move(scc_str_t *str) {
-    return scc_str_from_cstr(scc_str_move_cstr(str));
+    if (str == nullptr || str->data == nullptr) {
+        return scc_str_empty();
+    }
+    scc_str_t result = *str;
+    str->data = nullptr;
+    str->cap = 0;
+    str->size = 0;
+    return result;
 }
 
 #endif /* __SCC_CORE_STR_H__ */

runtime/scc_core/include/scc_core_vec.h

@@ -106,7 +106,7 @@ typedef size_t usize;
 #define scc_vec_push(vec, value)                                               \
     do {                                                                       \
         if ((vec).size >= (vec).cap) {                                         \
-            int cap = (vec).cap ? (vec).cap * 2 : 4;                           \
+            usize cap = (vec).cap ? (vec).cap * 2 : 4;                           \
             scc_vec_realloc(vec, cap);                                         \
         }                                                                      \
         Assert((vec).data != nullptr);                                         \

runtime/scc_core/src/core_impl.c

@@ -42,12 +42,13 @@ usize scc_fread(scc_file_t file, void *buffer, usize size) {
 usize scc_fwrite(scc_file_t file, const void *buf, usize size) {
     if (file == scc_stdout) {
         scc_pal_write(buf, size);
+        return size;
     } else if (file == scc_stderr) {
         scc_pal_ewrite(buf, size);
+        return size;
     } else {
         return scc_pal_fwrite(file, buf, size);
     }
-    return 0;
 }
 
 cbool scc_fexists(const char *path) {

runtime/scc_utils/include/scc_path.h

@@ -0,0 +1,30 @@
+#ifndef __SCC_PATH_H__
+#define __SCC_PATH_H__
+
+/**
+ * @brief 检查路径是否为绝对路径
+ * @param path 要检查的路径
+ * @return 1 是绝对路径, 0 不是
+ */
+int scc_path_is_absolute(const char *path);
+
+/**
+ * @brief 检查路径是否包含 .. 路径穿越组件
+ * @param path 要检查的路径
+ * @return 1 包含 .., 0 不包含
+ */
+int scc_path_has_dotdot(const char *path);
+
+/**
+ * @brief 检查路径是否安全用作 #include 文件名
+ *
+ * 拒绝条件：
+ *  - 绝对路径（以 / \ 开头，或 Windows 驱动符如 C:\）
+ *  - 包含 .. 路径穿越组件
+ *
+ * @param path 要检查的路径
+ * @return 0 安全, -1 不安全
+ */
+int scc_path_check_include_safe(const char *path);
+
+#endif /* __SCC_PATH_H__ */

runtime/scc_utils/include/scc_utils.h

@@ -4,6 +4,7 @@
 // #include "kllist.h"
 #include "scc_hashtable.h"
 #include "scc_strpool.h"
+#include "scc_path.h"
 #include <scc_core.h>
 
 #endif /* __SMCC_UTILS_H__ */

runtime/scc_utils/src/hashtable.c

@@ -44,13 +44,15 @@ void scc_hashtable_usize_init(scc_hashtable_t *ht) {
     scc_hashtable_init(ht, ht_usizehash, ht_usizecmp, nullptr);
 }
 
-static int next_power_of_two(int n) {
+static usize next_power_of_two(usize n) {
+    if (n == 0) return 32;
     n--;
     n |= n >> 1;
     n |= n >> 2;
     n |= n >> 4;
     n |= n >> 8;
     n |= n >> 16;
+    n |= n >> 32;
     return n + 1;
 }
 
@@ -119,14 +121,18 @@ static void adjust_capacity(scc_hashtable_t *ht, usize new_cap) {
 
 void *scc_hashtable_set(scc_hashtable_t *ht, const void *key, void *value) {
     if (ht->count + ht->tombstone_count >= ht->entries.cap * 0.75) {
-        int new_cap = ht->entries.cap < SCC_INIT_HASHMAP_SIZE
-                          ? SCC_INIT_HASHMAP_SIZE
-                          : ht->entries.cap * 2;
+        usize new_cap = ht->entries.cap < SCC_INIT_HASHMAP_SIZE
+                            ? SCC_INIT_HASHMAP_SIZE
+                            : ht->entries.cap * 2;
         adjust_capacity(ht, new_cap);
     }
 
     u32 hash = ht->hash_func(key, ht->userdata);
     scc_hashtable_entry_t *entry = find_entry(ht, key, hash);
+    if (entry == nullptr) {
+        LOG_FATAL("scc_hashtable_set: hash table is full");
+        return nullptr;
+    }
 
     void *old_value = nullptr;
     if (entry->state == ENTRY_ACTIVE) {

runtime/scc_utils/src/scc_path.c

@@ -0,0 +1,67 @@
+#include <scc_core.h>
+#include <scc_path.h>
+
+#ifdef _WIN32
+#define SCC_PATH_SEP_A '\\'
+#define SCC_PATH_SEP_B '/'
+#define SCC_IS_DRIVE_LETTER(c)                                                 \
+    (((c) >= 'a' && (c) <= 'z') || ((c) >= 'A' && (c) <= 'Z'))
+#else
+#define SCC_PATH_SEP_A '/'
+#define SCC_PATH_SEP_B '/' /* no alternative separator on non-Windows */
+#endif
+
+int scc_path_is_absolute(const char *path) {
+    if (path == nullptr || path[0] == '\0')
+        return 0;
+
+    /* Unix absolute: /path */
+    if (path[0] == '/')
+        return 1;
+
+#ifdef _WIN32
+    /* Windows absolute: C:\path or \path */
+    if (path[0] == '\\')
+        return 1;
+    if (SCC_IS_DRIVE_LETTER(path[0]) && path[1] == ':')
+        return 1;
+#endif
+
+    return 0;
+}
+
+int scc_path_has_dotdot(const char *path) {
+    if (path == nullptr)
+        return 0;
+
+    const char *p = path;
+    while (*p) {
+        /* Look for '.' followed by '.' */
+        if (p[0] == '.' && p[1] == '.') {
+            char next = p[2];
+            /* ".." at end of string or followed by a separator */
+            if (next == '\0' || next == SCC_PATH_SEP_A || next == SCC_PATH_SEP_B) {
+                /* Must also check that this ".." is at start or preceded by a separator */
+                if (p == path ||
+                    p[-1] == SCC_PATH_SEP_A || p[-1] == SCC_PATH_SEP_B) {
+                    return 1;
+                }
+            }
+        }
+        p++;
+    }
+    return 0;
+}
+
+int scc_path_check_include_safe(const char *path) {
+    if (path == nullptr || path[0] == '\0')
+        return -1;
+
+    if (scc_path_is_absolute(path))
+        return -1;
+
+    if (scc_path_has_dotdot(path))
+        return -1;
+
+    return 0;
+}

runtime/scc_utils/src/strpool.c

@@ -22,7 +22,16 @@ const char *scc_strpool_intern(scc_strpool_t *pool, const char *str) {
     return new_str;
 }
 
-void scc_strpool_drop(scc_strpool_t *pool) { scc_hashtable_drop(&pool->ht); }
+void scc_strpool_drop(scc_strpool_t *pool) {
+    // Free all interned string allocations before dropping the hash table
+    for (usize i = 0; i < pool->ht.entries.cap; i++) {
+        scc_hashtable_entry_t *entry = &scc_vec_at(pool->ht.entries, i);
+        if (entry->state == ENTRY_ACTIVE) {
+            scc_free((void *)entry->key);
+        }
+    }
+    scc_hashtable_drop(&pool->ht);
+}
 
 void scc_strpool_foreach(scc_strpool_t *pool, scc_strpool_iter_fn iter_func,
                          void *context) {

src/bin/sccfdump.c

@@ -12,6 +12,9 @@ typedef struct {
     cbool dump_relocs;
     cbool dump_hex;
     cbool dump_all;
+    const char *get_section_name;
+    int get_section_idx;
+    cbool has_get_section_idx;
     int verbose;
 } sccfdump_config_t;
 
@@ -188,6 +191,8 @@ int main(int argc, const char **argv, const char **envp) {
         HINT_HEX,
         HINT_VERBOSE,
         HINT_ALL,
+        HINT_GET_SECTION,
+        HINT_GET_SECTION_IDX,
     };
     static const char *hints_en[] = {
         [HINT_PROG_NAME] = "sccfdump",
@@ -201,6 +206,8 @@ int main(int argc, const char **argv, const char **envp) {
         [HINT_HEX] = "Dump section hex content",
         [HINT_VERBOSE] = "Verbose output (use with -x)",
         [HINT_ALL] = "Dump header, sections, symbols and relocs",
+        [HINT_GET_SECTION] = "Extract raw section data by name (e.g. .text)",
+        [HINT_GET_SECTION_IDX] = "Extract raw section data by index",
     };
     static const char *hints_zh[] = {
         [HINT_PROG_NAME] = "sccfdump",
@@ -214,6 +221,8 @@ int main(int argc, const char **argv, const char **envp) {
         [HINT_HEX] = "转存段的十六进制内容",
         [HINT_VERBOSE] = "详细输出(与-x配合使用)",
         [HINT_ALL] = "转存文件头、段、符号和重定位",
+        [HINT_GET_SECTION] = "按名称提取段原始数据(如 .text)",
+        [HINT_GET_SECTION_IDX] = "按索引提取段原始数据",
     };
 
     scc_argparse_lang_t lang = SCC_ARGPARSE_LANG_EN;
@@ -228,6 +237,7 @@ int main(int argc, const char **argv, const char **envp) {
     sccfdump_config_t config;
     scc_memset(&config, 0, sizeof(config));
     config.dump_all = true;
+    config.get_section_idx = -1;
 
     scc_argparse_t argparse;
     scc_argparse_init(&argparse, hints[HINT_PROG_NAME], hints[HINT_DESCRIPTION]);
@@ -275,6 +285,16 @@ int main(int argc, const char **argv, const char **envp) {
     scc_argparse_spec_setup_count(&opt_verbose.spec, &config.verbose);
     scc_argparse_cmd_add_opt(root, &opt_verbose);
 
+    scc_argparse_opt_t opt_get_section;
+    scc_argparse_opt_init(&opt_get_section, 0, "get-section", hints[HINT_GET_SECTION]);
+    scc_argparse_spec_setup_string(&opt_get_section.spec, &config.get_section_name);
+    scc_argparse_cmd_add_opt(root, &opt_get_section);
+
+    scc_argparse_opt_t opt_get_section_idx;
+    scc_argparse_opt_init(&opt_get_section_idx, 0, "get-section-idx", hints[HINT_GET_SECTION_IDX]);
+    scc_argparse_spec_setup_int(&opt_get_section_idx.spec, &config.get_section_idx);
+    scc_argparse_cmd_add_opt(root, &opt_get_section_idx);
+
     scc_argparse_arg_t arg_file;
     scc_argparse_arg_init(&arg_file, "file", hints[HINT_FILE]);
     scc_argparse_spec_setup_string(&arg_file.spec, &config.filepath);
@@ -318,6 +338,60 @@ int main(int argc, const char **argv, const char **envp) {
     sccf_parse(&sccf, &buf, 0);
     u8 *base = scc_vec_unsafe_get_data(buf);
 
+    /* --get-section / --get-section-idx: extract raw data to a file/stdout */
+    if (config.get_section_name || config.get_section_idx >= 0) {
+        usize idx = (usize)-1;
+        if (config.get_section_idx >= 0) {
+            idx = (usize)config.get_section_idx;
+        } else {
+            const sccf_header_t *hdr = (const sccf_header_t *)base;
+            for (usize i = 0; i < (usize)hdr->sect_header_num; i++) {
+                const sccf_sect_header_t *sh = sccf_sect_header(base, i);
+                if (sh && scc_memcmp(sh->name,
+                                     config.get_section_name, 8) == 0) {
+                    idx = i;
+                    break;
+                }
+            }
+            if (idx == (usize)-1) {
+                LOG_ERROR("section not found: %s", config.get_section_name);
+                scc_vec_free(buf);
+                return 1;
+            }
+        }
+
+        const sccf_sect_header_t *sh = sccf_sect_header(base, idx);
+        if (!sh) {
+            LOG_ERROR("invalid section index: %d", config.get_section_idx);
+            scc_vec_free(buf);
+            return 1;
+        }
+        u8 *sdata = sccf_sect_data(base, idx);
+        if (!sdata || sh->size == 0) {
+            scc_vec_free(buf);
+            return 0;
+        }
+
+        if (config.output && scc_strcmp(config.output, "-") == 0) {
+            scc_fwrite(scc_stdout, sdata, sh->size);
+        } else if (config.output) {
+            scc_file_t ofp = scc_fopen(config.output, SCC_FILE_WRITE);
+            if (!ofp) {
+                LOG_ERROR("cannot open output: %s", config.output);
+                scc_vec_free(buf);
+                return 1;
+            }
+            scc_fwrite(ofp, sdata, sh->size);
+            scc_fclose(ofp);
+        } else {
+            scc_fwrite(scc_stdout, sdata, sh->size);
+        }
+
+        scc_vec_free(buf);
+        return 0;
+    }
+
+    /* --hex without -o: also go to stdout */
     if (config.dump_all) {
         dump_header(&sccf.header);
         dump_sections(base);

src/main.c

@@ -203,11 +203,11 @@ int main(int argc, const char **argv, const char **envp) {
     scc_lexer_tok_ring_t *tok_ring =
         scc_pproc_to_ring(&pproc, 1024, false, false);
     scc_parser_t parser;
-    scc_ast_ctx_t ast_ctx;
-    scc_ast_ctx_init(&ast_ctx);
+    scc_ast_module_t ast_module;
+    scc_ast_module_init(&ast_module);
     scc_sema_ctx_t sema_ctx;
-    scc_sema_init(&sema_ctx, &ast_ctx);
-    scc_parser_init(&parser, tok_ring, &ast_ctx, &sema_ctx);
+    scc_sema_init(&sema_ctx, &ast_module);
+    scc_parser_init(&parser, tok_ring, &ast_module, &sema_ctx);
     scc_ast_translation_unit_t *translation_unit =
         scc_parse_translation_unit(&parser);
     if (parser.errcode != 0) {
@@ -243,7 +243,7 @@ sstream_drop:
 #include <target/scc_abi_win_x64_pc.h>
     scc_hir_cprog_t cprog;
     scc_hir_cprog_init(&cprog);
-    scc_ast2ir_ctx_init(&ast2ir_ctx, &scc_ast_abi_impl, &ast_ctx, &cprog);
+    scc_ast2ir_ctx_init(&ast2ir_ctx, &scc_ast_abi_impl, &ast_module, &cprog);
     scc_ast2ir_run(&ast2ir_ctx, translation_unit);
     scc_ast2ir_ctx_drop(&ast2ir_ctx);
 

tests/simple/test.py

@@ -7,6 +7,7 @@ executes the resulting binary, and validates the process return code or stdout.
 from __future__ import annotations
 
 import argparse
+import difflib
 import logging
 import os
 import subprocess
@@ -23,7 +24,8 @@ from typing import Sequence
 # Configuration
 # ---------------------------------------------------------------------------
 WORKSPACE = Path(__file__).resolve().parent
-CC_PATH = WORKSPACE / "../../build/dev/scc"
+CC_ROOT = WORKSPACE / "../.."
+CC_PATH = CC_ROOT / "build/dev/scc"
 CONFIG_PATH = WORKSPACE / "expect.toml"
 DEFAULT_TIMEOUT = 1  # seconds
 
@@ -99,8 +101,15 @@ class Runner:
                 text=True,
                 timeout=self.timeout,
             )
-        except subprocess.TimeoutExpired:
-            return False, "Compilation timed out"
+        except subprocess.TimeoutExpired as e:
+            # e.stdout, e.stderr 为已捕获的部分输出（字符串）
+            captured_stderr = e.stderr.strip() if e.stderr else ""
+            captured_stdout = e.stdout.strip() if e.stdout else ""
+            err_msg = f"""Compilation timed out.
+            stderr: {captured_stderr or '(no output)'}
+            stdout: {captured_stdout or '(no output)'}
+            cmd: {" ".join(cmd)}"""
+            return False, err_msg
         except OSError as exc:
             return False, f"Failed to invoke compiler: {exc}"
 
@@ -127,6 +136,26 @@ class Runner:
 
         return proc.returncode, proc.stdout, proc.stderr.strip()
 
+    def _print_diff(self, expected: str, actual: str) -> None:
+        """Print unified diff between expected and actual stdout."""
+        expected_lines = expected.splitlines()
+        actual_lines = actual.splitlines()
+        diff = difflib.unified_diff(
+            expected_lines, actual_lines,
+            fromfile='expected', tofile='actual',
+            lineterm=''
+        )
+        # diff = difflib.ndiff(
+        #     expected_lines, actual_lines,
+        # )
+        diff_lines = list(diff)
+        if not diff_lines:
+            logger.error("  Strings differ but no diff generated?")
+            return
+        logger.error("  Diff (expected vs actual):")
+        for line in diff_lines:
+            logger.error("    %s", line)
+
     def run_one(self, test: TestCase) -> bool:
         """Run a single test case. Returns True if passed."""
         logger.info("Testing %s", test.source)
@@ -157,9 +186,14 @@ class Runner:
         if passed:
             logger.info("  PASSED")
         else:
-            logger.error(
-                "  FAILED: expected %r, got %r", test.expected, actual
-            )
+            if test.test_type == "stdout":
+                logger.error("  FAILED: stdout mismatch")
+                self._print_diff(test.expected, actual)
+            else:
+                logger.error(
+                    "  FAILED: expected return code %r, got %r",
+                    test.expected, actual
+                )
 
         # 4. Cleanup
         self._remove(exe_path)
@@ -326,12 +360,12 @@ def main() -> None:
 
     runner = Runner(
         cc=args.cc,
-        workspace=WORKSPACE,
+        workspace=CC_ROOT,
         timeout=args.timeout,
         keep_temps=args.keep_temps,
     )
 
-    global_timeout = DEFAULT_TIMEOUT * 3
+    global_timeout = args.timeout * 3
     passed, total = runner.run_all(selected, global_timeout)
     logger.info("=" * 40)
     if global_timeout and total < len(selected):