[cc] fixes

(not included: comment and other minor fix descriptions)

Fixed a bug in the C compiler's declarator parser (cc/parse/parser.rs) where outer pointer modifiers in grouped declarators were applied in the wrong order.

  The Bug

  For declarations like struct node *(*fp)(int) (function pointer returning a pointer) and int *(*p)[3] (pointer to array of pointers), the type chain was being built incorrectly:

  Before (wrong):
  - struct node *(*fp)(int) → Pointer → Pointer → Function → struct node
  - int *(*p)[3] → Pointer → Pointer → Array → int

  After (correct):
  - struct node *(*fp)(int) → Pointer → Function(returns Pointer → struct node)
  - int *(*p)[3] → Pointer → Array(of Pointer → int)

  The Fix

  In parse_declarator(), moved the application of outer pointer modifiers before applying function parameters and array dimensions (lines 4040-4055). This ensures the outer * becomes part of the function's return type or array element type, not an extra wrapper around the whole construct.

  Files Modified

  1. cc/parse/parser.rs - Fixed type chain building order in grouped declarators
  2. Added two regression tests:
    - test_function_pointer_returning_struct_pointer
    - test_pointer_to_array_of_pointers

Author: jgarzik

cc/arch/x86_64/expression.rs

@@ -29,8 +29,7 @@ impl X86_64CodeGen {
             None => return,
         };
         let dst_loc = self.get_location(target);
-        // Use R10 as scratch register when dst is on stack, to avoid clobbering
-        // live values in caller-saved registers (Rax may hold phi values)
+        // Use R10 (reserved scratch register, never allocated) when dst is on stack
         let work_reg = match &dst_loc {
             Loc::Reg(r) => *r,
             _ => Reg::R10,

cc/ir/linearize.rs

@@ -1287,7 +1287,7 @@ impl<'a> Linearizer<'a> {
             }
 
             // Create a symbol pseudo for this local variable (its address)
-            // Use unique name (name#id) to distinguish shadowed variables for SSA
+            // Use unique name (name.id) to distinguish shadowed variables
             let sym_id = self.alloc_pseudo();
             let unique_name = format!("{}.{}", declarator.name, sym_id.0);
             let sym = Pseudo::sym(sym_id, unique_name.clone());

cc/parse/parser.rs

@@ -4011,19 +4011,38 @@ impl Parser<'_> {
         let mut result_type_id = base_type_id;
 
         if let Some(inner_tid) = inner_type_id {
-            // Grouped declarator: int (*p)[3] or void (*fp)(int)
-            // Arrays/functions in suffix apply to the base type first
-            // Then we substitute into the inner declarator
+            // Grouped declarator: int (*p)[3] or void (*fp)(int) or int *(*q)[3]
+            // Outer pointers (before parens) apply to the base type first
+            // Then arrays/functions in suffix are applied
+            // Finally we substitute into the inner declarator
+
+            // Apply any outer pointers (before the parens) to base type FIRST
+            // For struct node *(*fp)(int): base is struct node, outer * -> Pointer(struct node)
+            // For int *(*q)[3]: base is int, outer * -> Pointer(int)
+            for modifiers in pointer_modifiers.into_iter().rev() {
+                let ptr_type = Type {
+                    kind: TypeKind::Pointer,
+                    modifiers,
+                    base: Some(result_type_id),
+                    array_size: None,
+                    params: None,
+                    variadic: false,
+                    noreturn: false,
+                    composite: None,
+                };
+                result_type_id = self.types.intern(ptr_type);
+            }
 
-            // Apply function parameters to base type first (if present)
-            // For void (*fp)(int): base is void, suffix (int) -> Function(void, [int])
+            // Apply function parameters to (possibly pointer-modified) base type
+            // For struct node *(*fp)(int): result is Pointer(struct node)
+            //   -> Function(Pointer(struct node), [int])
             if let Some((param_type_ids, variadic)) = func_params {
                 let func_type = Type::function(result_type_id, param_type_ids, variadic);
                 result_type_id = self.types.intern(func_type);
             }
 
-            // Apply array dimensions to base type
-            // For int (*p)[3]: base is int, suffix [3] -> Array(3, int)
+            // Apply array dimensions to result type
+            // For int *(*q)[3]: result is Pointer(int) -> Array(3, Pointer(int))
             for size in dimensions.into_iter().rev() {
                 let arr_type = Type {
                     kind: TypeKind::Array,
@@ -4038,26 +4057,12 @@ impl Parser<'_> {
                 result_type_id = self.types.intern(arr_type);
             }
 
-            // Apply any outer pointers (before the parens)
-            for modifiers in pointer_modifiers.into_iter().rev() {
-                let ptr_type = Type {
-                    kind: TypeKind::Pointer,
-                    modifiers,
-                    base: Some(result_type_id),
-                    array_size: None,
-                    params: None,
-                    variadic: false,
-                    noreturn: false,
-                    composite: None,
-                };
-                result_type_id = self.types.intern(ptr_type);
-            }
-
             // Substitute into inner declarator
             // For int (*p)[3]: inner_decl is Pointer(Void), result_type is Array(3, int)
             // -> Pointer(Array(3, int))
-            // For void (*fp)(int): inner_decl is Pointer(Void), result_type is Function(void, [int])
-            // -> Pointer(Function(void, [int]))
+            // For struct node *(*fp)(int): inner_decl is Pointer(Void),
+            //   result_type is Function(Pointer(struct node), [int])
+            // -> Pointer(Function(Pointer(struct node), [int]))
             result_type_id = self.substitute_base_type(inner_tid, result_type_id);
         } else {
             // Simple declarator: char *arr[3]
@@ -7753,6 +7758,96 @@ mod tests {
         }
     }
 
+    #[test]
+    fn test_function_pointer_returning_struct_pointer() {
+        // Function pointer returning a struct pointer: struct node *(*fp)(int)
+        // This declares fp as a pointer to a function (int) -> struct node*
+        // Regression test for issue where outer pointers in grouped declarators
+        // were applied after the function type instead of before (to the return type)
+        let (tu, types, _strings) =
+            parse_tu("struct node { int value; }; struct node *(*fp)(int);").unwrap();
+        assert_eq!(tu.items.len(), 2);
+        match &tu.items[1] {
+            ExternalDecl::Declaration(decl) => {
+                assert_eq!(decl.declarators.len(), 1);
+                // fp should be Pointer -> Function -> Pointer -> struct node
+                assert_eq!(types.kind(decl.declarators[0].typ), TypeKind::Pointer);
+
+                // Base type of fp should be Function (not Pointer!)
+                let func_id = types.base_type(decl.declarators[0].typ).unwrap();
+                assert_eq!(
+                    types.kind(func_id),
+                    TypeKind::Function,
+                    "Function pointer base type should be Function, not Pointer"
+                );
+
+                // Function return type should be Pointer
+                let ret_id = types.base_type(func_id).unwrap();
+                assert_eq!(
+                    types.kind(ret_id),
+                    TypeKind::Pointer,
+                    "Function return type should be Pointer"
+                );
+
+                // Pointer base type should be Struct
+                let struct_id = types.base_type(ret_id).unwrap();
+                assert_eq!(
+                    types.kind(struct_id),
+                    TypeKind::Struct,
+                    "Pointer base type should be Struct"
+                );
+
+                // Function should take one int parameter
+                if let Some(params) = types.params(func_id) {
+                    assert_eq!(params.len(), 1);
+                    assert_eq!(types.kind(params[0]), TypeKind::Int);
+                }
+            }
+            _ => panic!("Expected Declaration"),
+        }
+    }
+
+    #[test]
+    fn test_pointer_to_array_of_pointers() {
+        // Pointer to array of pointers: int *(*p)[3]
+        // This declares p as a pointer to an array of 3 int pointers
+        // Regression test for issue where type chain was incorrectly built
+        let (tu, types, _strings) = parse_tu("int *(*p)[3];").unwrap();
+        assert_eq!(tu.items.len(), 1);
+        match &tu.items[0] {
+            ExternalDecl::Declaration(decl) => {
+                assert_eq!(decl.declarators.len(), 1);
+                // p should be Pointer -> Array -> Pointer -> int
+                assert_eq!(types.kind(decl.declarators[0].typ), TypeKind::Pointer);
+
+                // Base type of p should be Array
+                let array_id = types.base_type(decl.declarators[0].typ).unwrap();
+                assert_eq!(
+                    types.kind(array_id),
+                    TypeKind::Array,
+                    "Pointer base type should be Array"
+                );
+
+                // Array element type should be Pointer
+                let elem_id = types.base_type(array_id).unwrap();
+                assert_eq!(
+                    types.kind(elem_id),
+                    TypeKind::Pointer,
+                    "Array element type should be Pointer"
+                );
+
+                // Pointer base type should be Int
+                let int_id = types.base_type(elem_id).unwrap();
+                assert_eq!(
+                    types.kind(int_id),
+                    TypeKind::Int,
+                    "Pointer base type should be Int"
+                );
+            }
+            _ => panic!("Expected Declaration"),
+        }
+    }
+
     // ========================================================================
     // Bitfield tests
     // ========================================================================

cc/scripts/pcc_debug.sh

@@ -14,7 +14,7 @@
 #   -L <dir> : Library directory
 # Extra args after file are passed to compiler (e.g., libz.a)
 
-PCC=/Users/jgarzik/repo/posixutils-rs/target/release/pcc
+PCC="${PCC:-pcc}"
 WORKDIR=/tmp/pcc_debug_$$
 mkdir -p $WORKDIR
 

cc/tests/features/many_args.rs

@@ -0,0 +1,43 @@
+//
+// Copyright (c) 2025-2026 Jeff Garzik
+//
+// This file is part of the posixutils-rs project covered under
+// the MIT License.  For the full license text, please see the LICENSE
+// file in the root directory of this project.
+// SPDX-License-Identifier: MIT
+//
+// Tests for functions with many mixed int/FP arguments exceeding register counts
+// Verifies correct stack offset calculations in regalloc.rs
+//
+
+use crate::common::compile_and_run;
+
+#[test]
+fn test_many_mixed_args() {
+    let code = r#"
+// Function with 18 interleaved args: 9 ints + 9 doubles
+// x86_64 SysV ABI: 6 int regs (RDI-R9) + 8 FP regs (XMM0-7)
+// Stack args: m,o,q (ints at idx 6,7,8) + r (double at idx 8)
+double many_args(int a, double b, int c, double d, int e, double f,
+                 int g, double h, int i, double j, int k, double l,
+                 int m, double n, int o, double p, int q, double r) {
+    double sum = (double)a + b + (double)c + d + (double)e + f +
+                 (double)g + h + (double)i + j + (double)k + l +
+                 (double)m + n + (double)o + p + (double)q + r;
+    return sum;
+}
+
+int main(void) {
+    // ints: 1+2+3+4+5+6+7+8+9 = 45
+    // doubles: 0.5+1.5+2.5+3.5+4.5+5.5+6.5+7.5+8.5 = 40.5
+    // total: 85.5
+    double result = many_args(1, 0.5, 2, 1.5, 3, 2.5,
+                              4, 3.5, 5, 4.5, 6, 5.5,
+                              7, 6.5, 8, 7.5, 9, 8.5);
+
+    if (result < 85.4 || result > 85.6) return 1;
+    return 0;
+}
+"#;
+    assert_eq!(compile_and_run("many_mixed_args", code), 0);
+}

cc/tests/features/mod.rs

@@ -21,7 +21,9 @@ mod has_feature;
 mod inline;
 mod inline_asm;
 mod macros;
+mod many_args;
 mod noreturn;
+mod ops_struct;
 mod optimization;
 mod popcount;
 mod setjmp;