decomp: demote same-width wrapper structs on scalar int-extension ops

Ghidra over-propagates a single-field struct (e.g. CRC32) onto INT_ZEXT/
INT_SEXT temps, which hard-fails Sema. Serializer demotes a same-width
record on strictly-scalar ops to a scalar surrogate; emitter also coerces
a non-arithmetic int-extension target to a same-width integer.

Author: kumarak

include/patchestry/AST/OperationBuilder.hpp

@@ -302,6 +302,14 @@ namespace patchestry::ast {
             unsigned target_bytes = 0
         );
 
+        // Coerce a non-arithmetic INT_ZEXT/INT_SEXT target (e.g. a same-width
+        // wrapper struct Ghidra mis-propagated onto a scalar temp) to a
+        // same-width unsigned integer so the extension is valid C.  Returns the
+        // type unchanged when it is already integer/pointer/enum/bool.
+        clang::QualType integer_target_for_int_ext(
+            clang::ASTContext &ctx, clang::QualType target_type, unsigned op_bytes
+        );
+
         /// Materialize a non-void call result into a temporary variable.
         /// Creates VarDecl + DeclStmt (pushed to pending for hoisting),
         /// assignment (call stays in-place), and returns the appropriate

lib/patchestry/AST/OperationStmt.cpp

@@ -484,6 +484,32 @@ namespace patchestry::ast {
         LOG_FATAL("cast_pointer_to_int: unhandled PtrToIntExtension value");
     }
 
+    // INT_ZEXT / INT_SEXT are inherently integer-producing, but Ghidra's type
+    // propagation occasionally labels the result with a same-width record (e.g.
+    // a single-field wrapper `struct CRC32`).  Casting an enum/int to that
+    // struct hard-fails Sema ("converting 'enum X' to incompatible type 'struct
+    // Y'").  When the declared target is not a usable arithmetic/pointer type,
+    // substitute a same-width unsigned integer so the extension is valid C; the
+    // write side reinterprets back into the record if the output truly needs it.
+    // (The serializer's #250 scalar-op demotion now prevents this at the source;
+    // this keeps already-captured JSON working and is defence-in-depth.)
+    clang::QualType OpBuilder::integer_target_for_int_ext(
+        clang::ASTContext &ctx, clang::QualType target_type, unsigned op_bytes
+    ) {
+        if (target_type.isNull()) {
+            return target_type;
+        }
+        if (target_type->isIntegerType() || target_type->isPointerType()
+            || target_type->isEnumeralType() || target_type->isBooleanType())
+        {
+            return target_type;
+        }
+        unsigned bits = op_bytes ? op_bytes * 8u
+                                 : static_cast< unsigned >(ctx.getTypeSize(target_type));
+        auto widened = ctx.getIntTypeForBitwidth(bits, /*Signed=*/false);
+        return widened.isNull() ? target_type : widened;
+    }
+
     clang::Expr *OpBuilder::narrow_aggregate_to_integer(
         clang::ASTContext &ctx, clang::Expr *expr, clang::SourceLocation loc,
         unsigned target_bytes
@@ -2774,6 +2800,7 @@ namespace patchestry::ast {
             return {};
         }
         auto target_type = *target_type_opt;
+        target_type = integer_target_for_int_ext(ctx, target_type, op.output ? op.output->size : 0u);
 
         if (input_expr->getType()->isPointerType()) {
             // PerformImplicitConversion asserts inside clang 22 (SemaExprCXX.cpp:4681)
@@ -2837,6 +2864,7 @@ namespace patchestry::ast {
             return {};
         }
         auto target_type = *target_type_opt;
+        target_type = integer_target_for_int_ext(ctx, target_type, op.output ? op.output->size : 0u);
 
         if (input_expr->getType()->isPointerType()) {
             // Sign-extension over a pointer requires the intptr_t intermediate;

scripts/ghidra/util/PcodeSerializer.java

@@ -856,6 +856,33 @@ static DataType demoteArrayIfMatching(
 			return surrogate != null ? surrogate : t;
 		}
 
+		// Demote a Composite (struct/union) DataType of exactly `varBytes`
+		// bytes (after peeling TypeDefs) to a same-width scalar surrogate; else
+		// return `t` as-is.  Companion to demoteArrayIfMatching (#250): a
+		// strictly-scalar p-code op (INT_ZEXT, INT_NEGATE, ...) can never yield a
+		// record value, but Ghidra's type propagation occasionally attaches a
+		// single-field wrapper struct (e.g. `struct CRC32 {uint m_state;}`) to
+		// such a varnode.  Left intact it reaches the emitter as `(struct CRC32)x`
+		// and hard-fails Sema ("used type 'struct X' where arithmetic or pointer
+		// type is required").
+		static DataType demoteRecordIfMatching(
+				DataType t, int varBytes, DataTypeManager dtm) {
+			if (t == null) {
+				return t;
+			}
+			DataType base = t;
+			for (int depth = 0;
+				depth < TYPEDEF_PEEL_MAX_DEPTH && base instanceof TypeDef;
+				++depth) {
+				base = ((TypeDef) base).getBaseDataType();
+			}
+			if (!(base instanceof Composite) || t.getLength() != varBytes) {
+				return t;
+			}
+			DataType surrogate = sizedSurrogate(varBytes, dtm);
+			return surrogate != null ? surrogate : t;
+		}
+
 		// 1-byte `undefined`/`DefaultDataType` only — char/uint8 carry user intent.
 		private static boolean isUndefinedAtom(DataType t) {
 			if (t == null) {
@@ -1718,9 +1745,9 @@ void serializeInput(PcodeOp pcodeOp, Varnode node) throws Exception {
 				// COPY output and as scalar when it's a PIECE input.
 				DataType emitted = chooseEmittedType(node, highVariable);
 				if (isScalarPcodeOp(pcodeOp.getOpcode())) {
-					emitted = demoteArrayIfMatching(
-						emitted, node.getSize(),
-						currentProgram.getDataTypeManager());
+					DataTypeManager dtm = currentProgram.getDataTypeManager();
+					emitted = demoteArrayIfMatching(emitted, node.getSize(), dtm);
+					emitted = demoteRecordIfMatching(emitted, node.getSize(), dtm);
 				}
 				writer.name("type").value(label(emitted));
 				writer.name("size").value(node.getSize());
@@ -3370,9 +3397,9 @@ void serializeOutput(PcodeOp pcodeOp) throws Exception {
 				// #250: scalar-op output must not carry an Array type.
 				DataType emitted = chooseEmittedType(output, outputHighVariable);
 				if (isScalarPcodeOp(pcodeOp.getOpcode())) {
-					emitted = demoteArrayIfMatching(
-						emitted, output.getSize(),
-						currentProgram.getDataTypeManager());
+					DataTypeManager dtm = currentProgram.getDataTypeManager();
+					emitted = demoteArrayIfMatching(emitted, output.getSize(), dtm);
+					emitted = demoteRecordIfMatching(emitted, output.getSize(), dtm);
 				}
 				writer.name("type").value(label(emitted));
 				writer.name("size").value(output.getSize());