Fix cppia JIT "Bad move target" converting an int subtraction to a string - #1369

Remake of #1366

The problem

With the JIT on, a cppia module containing an ordinary integer expression fails to load:

Error : Bad move target

The failure is at module boot, because JIT compilation runs over the whole module there, so one
expression takes the entire module down. cppia with jit off runs the same code correctly.

Why

OpSub::genCode hands convert a bare sJitTemp1, where OpMult::genCode right above it passes
sJitTemp1.as(jtInt):

compiler->sub(sJitTemp1.as(jtInt), lval, sJitTemp0, false);
compiler->convert(sJitTemp1, etInt, inDest, destType);

Inside convert, the etInt to etString case moves that untyped source into an untyped
sJitArg0:

if (inSrc.uses(SLJIT_R1))
{
   move(sJitArg0, inSrc);
   ...

Neither side has a width. getCommonType(jtAny, jtAny) returns jtAny, which move() rejects with
setError("Bad move target"). That is thrown, caught in CppiaModule, and re-raised as the load
error above.

Only a String destination trips it. etFloat goes through SLJIT_CONV_F64_FROM_S32 and etObject
through intToObj, and neither of those calls move. "" + (a * b) does not trip it either, since
OpMult types its source.

The fix

One token in src/hx/cppia/Cppia.cpp, so OpSub matches OpMult:

compiler->convert(sJitTemp1.as(jtInt), etInt, inDest, destType);

That alone fixes the crash with CppiaCompiler.cpp untouched. Three other things ride along:

• The 2-byte ArrayBuiltin read has the same omission against its byte-sized sibling. Nothing
  instantiates ArrayBuiltin with a 2-byte element, so that block never compiles. Consistency only.
• CppiaCompiler.cpp still gets the three widths, as hardening rather than as the fix. convert is
  handed inSrcType and every other move in it already types both sides from that, so these three
  were the ones that had been missed.
• The etObject to etFloat branch guarded on inSrc==sJitTemp1, but JitVal::operator== compares
  type, so only a bare untyped sJitTemp1 ever matched. A typed R1 source fell through to a path
  where makeAddress stomps R1 before objToFloat reads it. It guards on inSrc.uses(SLJIT_R1)
  now, like the etObject to etString branch above it. Nothing produces that shape today either,
  so this is correctness on an unreachable path.

Test

test/cppia covers it. ClientJitConvert in Client.hx holds the cases and cases/TestCommon.hx
checks the answers: the crash itself, both of the other OpSub destinations, and the three convert
paths touched here.

cd test/cppia
haxe compile-host.hxml
haxe compile-client.hxml
cd bin && ./CppiaHost.exe client.cppia -jit

The -jit matters, and RunTests.hx already runs the suite both ways. 27/27 either way.

Without the fix the -jit run fails at setupClass failed: Bad move target and exits 1, since the
module never loads. The same build without -jit reports ALL TESTS OK.

Worth saying plainly: the tests cannot isolate the hardening from the OpSub fix. With either one in
place nothing hands convert an untyped register, so no Haxe code can tell them apart. Reverting
CppiaCompiler.cpp completely with OpSub fixed still passes everything. To check the new cases are
not vacuous I dropped a line from the branch I rewrote, and exactly one test failed.

Since this is all in the JIT, I also checked it moves no generated code. Master and this branch were
built as two hosts and run against the same client.cppia, dumping the sljit LIR through
sljit_compiler_verbose: 2601 lines each, zero differences once the pointer immediates that shift
under ASLR are normalised. That follows from getData never reading type and getTarget reading it
only to choose between maxFTempCount and maxTempCount, where jtAny, jtInt and jtPointer all
take the same branch.

Reproducing by hand

class Script {
   public static function run():String {
      var a:Int = 2;

      return "" + (a - 1);
   }

   public static function main():Void {}
}

Built with haxe -m Script --cppia script.cppia and loaded from a host built with
-D scriptable --dce no, calling cpp.cppia.Host.enableJit(true) before
cpp.cppia.Module.fromData(bytes).boot().

Error : Bad move target

if (inSrc.uses(SLJIT_R1))
{
   move(sJitArg0, inSrc);
   ...

move(sJitArg0.as(jtInt), inSrc.as(jtInt));          // the etString case, from etInt
move(sJitArg0.as(jtPointer), inSrc.as(jtPointer));  // the two etObject cases

cd test/cppia
haxe compile-host.hxml
haxe compile-client.hxml
cd bin && ./CppiaHost.exe client.cppia -jit

class Script {
   public static function run():String {
      var a:Int = 2;
      var ints:Array<Int> = [7,8,9];

      return "" + (ints[a - 1] - ints[0]);
   }

   public static function main():Void {}
}