Ghidra 12.0.4 (#403 )

ci: Don't archive when using upload-artifact GHA (#402 )
Prevents rpm and deb packages from being zipped
2026-06-21 13:56:12 +00:00 · 2026-03-04 10:51:47 -05:00 · 2026-03-02 09:21:54 -05:00 · 2026-03-02 09:00:48 -05:00 · 2026-03-02 08:01:02 -05:00 · 2026-02-25 23:05:06 +00:00
37 changed files with 2168 additions and 719 deletions
@@ -0,0 +1,214 @@
+---
+name: debug-test-failures
+version: "1.0.0"
+description: >
+  This skill should be used when debugging test failures, build errors, runtime
+  crashes, or assertion failures in the Sleigh/Ghidra decompiler project. It
+  covers building with libc++ hardening assertions (ci-head-assertions preset),
+  running ctest, obtaining stack traces from SIGABRT or crash signals, narrowing
+  down which datatest triggers a failure, creating patch files for upstream Ghidra
+  source in src/patches/, and recognizing common C++ bug patterns such as
+  strict-weak ordering violations in comparators. Relevant when encountering
+  "the build is failing", "ctest fails", decompiler crashes, or libc++ assertion
+  errors.
+---
+
+# Debugging Test Failures in the Sleigh Project
+
+This project builds the Ghidra decompiler as a standalone C++ library. Ghidra source
+is fetched via CMake FetchContent and patches are applied via `git am`. The key
+challenge is that bugs live in upstream Ghidra code and fixes must be packaged as
+patch files.
+
+## Quick Reference
+
+```bash
+# Build with libc++ assertions (catches strict-weak ordering, container misuse, etc.)
+cmake --preset ci-head-assertions
+cmake --build build/ci-head-assertions
+ctest --test-dir build/ci-head-assertions --output-on-failure
+
+# Clean cached Ghidra source (needed after adding/changing patches)
+rm -rf build/ci-head-assertions/_deps/ghidrasource-*
+
+# Where the Ghidra C++ source lives after fetch
+build/ci-head-assertions/_deps/ghidrasource-src/Ghidra/Features/Decompiler/src/decompile/cpp/
+```
+
+## 0. Prerequisites
+
+### Create `CMakeUserPresets.json`
+
+The `ci-head-assertions` preset used throughout this workflow lives in
+`CMakeUserPresets.json`, which is not version-controlled and does **not** exist on
+a fresh checkout. You must create it in the repository root before any build
+commands will work.
+
+Create `/workspaces/sleigh/CMakeUserPresets.json` with this content:
+
+```json
+{
+  "version": 2,
+  "cmakeMinimumRequired": { "major": 3, "minor": 18, "patch": 0 },
+  "configurePresets": [
+    {
+      "name": "libcxx",
+      "hidden": true,
+      "cacheVariables": {
+        "CMAKE_CXX_COMPILER": "clang++",
+        "CMAKE_CXX_FLAGS": "-stdlib=libc++ -D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_DEBUG -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3 -fstrict-flex-arrays=3 -fstack-clash-protection -fstack-protector-strong",
+        "CMAKE_EXE_LINKER_FLAGS": "-stdlib=libc++ -lc++abi",
+        "CMAKE_SHARED_LINKER_FLAGS": "-stdlib=libc++ -lc++abi"
+      }
+    },
+    {
+      "name": "ci-head",
+      "hidden": true,
+      "inherits": ["ci-ubuntu"],
+      "cacheVariables": { "sleigh_RELEASE_TYPE": "HEAD" }
+    },
+    {
+      "name": "ci-head-assertions",
+      "binaryDir": "${sourceDir}/build/${presetName}",
+      "inherits": ["libcxx", "ci-head"],
+      "generator": "Ninja",
+      "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" }
+    }
+  ]
+}
+```
+
+This file inherits from `ci-ubuntu` (defined in `CMakePresets.json`), so the
+repo's version-controlled presets must also be present (they always are in a
+normal checkout).
+
+## 1. Build Presets
+
+### The assertions preset
+
+The `ci-head-assertions` preset (created in Section 0 above) links against libc++
+with `_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_DEBUG`. This enables runtime
+checks that catch undefined behavior in STL usage — most importantly, it validates
+that comparators passed to `std::sort` satisfy strict-weak ordering.
+
+### Other useful presets
+
+| Preset | Source | Purpose |
+|--------|--------|---------|
+| `ci-head-assertions` | `CMakeUserPresets.json` | HEAD build with libc++ debug assertions (primary debugging preset) |
+| `ci-head` | `CMakeUserPresets.json` | HEAD build without assertions (faster, hidden/base preset) |
+| `ci-sanitize` | `CMakePresets.json` | Stable build with ASan + UBSan (repo-controlled) |
+
+Note: `ci-head-assertions` and `ci-head` are user-local presets created in
+Section 0. `ci-sanitize` is the only sanitizer preset version-controlled in the
+repo. Add your own sanitizer presets to `CMakeUserPresets.json` as needed.
+
+## 2. Running Tests
+
+```bash
+# Run all tests
+ctest --test-dir build/ci-head-assertions --output-on-failure
+
+# Run a specific test
+ctest --test-dir build/ci-head-assertions -R decomp_datatest --output-on-failure
+```
+
+There are typically 3 tests:
+
+| Test | What it does |
+|------|--------------|
+| `sleigh_decomp_unittest` | Unit tests (fast) |
+| `sleigh_decomp_datatest` | Decompiler data tests — runs XML test files from the `datatests/` directory |
+| `sleigh_namespace_std_test` | Namespace compilation test |
+
+The datatest exercises the most code paths and is the most likely to trigger
+assertion failures from comparator bugs.
+
+### How datatest works
+
+The test binary loads XML files from the datatests directory in alphabetical order.
+Each XML file contains binary data + expected decompiler output patterns. The test
+decompiles each function and checks the output against `<stringmatch>` patterns.
+
+The exact command ctest uses (check `tests/CTestTestfile.cmake` for the authoritative version):
+```bash
+./tests/sleigh_decomp_test \
+  -sleighpath <build-dir> \
+  -path <build-dir>/_deps/ghidrasource-src/Ghidra/Features/Decompiler/src/decompile/datatests \
+  datatests
+```
+
+## 3. Getting a Stack Trace from a Crash
+
+When a test crashes (e.g., SIGABRT from an assertion), you need a stack trace to
+identify which comparator or code path is the culprit. The test binaries may not
+have full debug symbols, so multiple techniques may be needed.
+
+See `references/stack-trace-techniques.md` for the full details on each method.
+Here's the summary:
+
+1. **gdb**: Use `gdb -batch` for full demangled backtraces — the simplest method
+2. **lldb**: Use `lldb -b` with `-k` for crash-time backtrace commands
+3. **LD_PRELOAD backtrace**: Build a small shared library that catches SIGABRT and
+   prints a backtrace — works when neither debugger can attach (containers)
+4. **addr2line**: Resolve raw hex addresses from the backtrace to function names
+   and source lines
+
+## 4. Narrowing Down Which Test Triggers a Crash
+
+> **Tip**: Often the stack trace from Section 3 identifies the exact function and
+> source line, making this step unnecessary. Use this binary search technique only
+> when the stack trace is unclear or you need to isolate which specific test input
+> triggers the crash.
+
+When you know the test crashes but can't immediately identify the cause from the
+stack trace, use binary search on the test XML files.
+
+The idea: copy subsets of test files to a temporary directory and run the test
+binary against that subset. Keep halving until you isolate the triggering file.
+
+```bash
+cd build/ci-head-assertions
+
+# Copy a subset of test files to a temporary directory
+mkdir -p /tmp/test_subset
+SRC=_deps/ghidrasource-src/Ghidra/Features/Decompiler/src/decompile/datatests
+for f in $(ls $SRC/*.xml | sort | sed -n '1,20p'); do cp "$f" /tmp/test_subset/; done
+
+# Run just those tests
+./tests/sleigh_decomp_test -sleighpath . -path /tmp/test_subset datatests
+```
+
+Important: some crashes only reproduce when specific files are processed together
+(accumulated state from earlier tests), so start by splitting the full set in half
+rather than testing individual files. If an individual file doesn't crash alone, try
+combining it with files that ran before it in alphabetical order.
+
+## 5. Creating Patches for Ghidra Source
+
+Patches live in `src/patches/HEAD/` (for HEAD builds) and `src/patches/stable/`
+(for stable builds). They are applied via `git am` during the CMake FetchContent
+step. See `references/patching-workflow.md` for the full step-by-step.
+
+### Quick workflow
+
+1. **Edit the bug** in `build/<preset>/_deps/ghidrasource-src/Ghidra/Features/Decompiler/src/decompile/cpp/`
+2. **Commit**: `cd` into the ghidrasource-src dir, `git add` + `git commit`
+3. **Generate patches**: `git format-patch -o /workspaces/sleigh/src/patches/HEAD/ <base_commit>..HEAD`
+4. **Register** the new patch in `src/setup-ghidra-source.cmake`
+5. **Clean and rebuild**: `rm -rf build/<preset>/_deps/ghidrasource-*` then reconfigure
+
+The base commit for HEAD is the `ghidra_head_git_tag` value in `src/setup-ghidra-source.cmake`.
+
+## 6. Common Bug Patterns
+
+The most common bugs are **strict-weak ordering violations** in comparators used
+by `std::sort` or `std::set`. These are caught by libc++ assertions at runtime.
+Key patterns include null pointer sentinels that don't check self-comparison,
+special index early-returns without checking the other operand, and unsafe casts
+in `compareDependency` methods of TypePartial* classes.
+
+See `references/common-bug-patterns.md` for detailed before/after code examples,
+real-world instances from the codebase (e.g., `PullRecord::operator<` in
+`bitfield.cc`, `FlowBlock::compareFinalOrder` in `block.cc`), and a systematic
+audit checklist for finding new comparator bugs.
@@ -0,0 +1,72 @@
+# Common Bug Patterns in Ghidra Decompiler Source
+
+## Strict-weak ordering violations
+
+The most common class of bugs caught by libc++ assertions. A comparator for
+`std::sort` or `std::set` must satisfy:
+
+- **Irreflexivity**: `comp(a, a)` must return `false`
+- **Asymmetry**: if `comp(a, b)` is true then `comp(b, a)` must be false
+- **Transitivity**: if `comp(a, b)` and `comp(b, c)` then `comp(a, c)`
+
+The libc++ assertion message looks like:
+```
+strict_weak_ordering_check.h:50: libc++ Hardening assertion
+  !__comp(*(__first + __a), *(__first + __b)) failed:
+  Your comparator is not a valid strict-weak ordering
+```
+
+### Pattern 1: Null pointer sentinel without self-check
+
+```cpp
+// BUG: when both are null, returns true (violates irreflexivity)
+if (ptr == nullptr)
+    return true;
+
+// FIX: only return true when the other is non-null
+if (ptr == nullptr)
+    return (other.ptr != nullptr);
+```
+
+Real example: `PullRecord::operator<` in `bitfield.cc` — when both `readOp`
+pointers were null, the comparator returned `true`.
+
+### Pattern 2: Special index without self-check
+
+```cpp
+// BUG: when comparing the entry point with itself, returns true
+if (bl1->getIndex() == 0) return true;
+
+// FIX: check that the other is different
+if (bl1->getIndex() == 0) return (bl2->getIndex() != 0);
+```
+
+Real example: `FlowBlock::compareFinalOrder` in `block.cc`.
+
+### Pattern 3: Unsafe cast in compareDependency (TypePartial* classes)
+
+The `TypePartialEnum`, `TypePartialStruct`, and `TypePartialUnion` classes have
+`compareDependency` methods that cast `op` to their own type. If `op` is actually
+the parent container type (not a partial), the cast accesses invalid memory.
+
+```cpp
+// BUG: casts op to TypePartialFoo without checking if op IS the container
+TypePartialFoo *tp = (TypePartialFoo *) &op;
+
+// FIX: add a guard before the cast
+if (container == &op) return 1;  // op is our container
+TypePartialFoo *tp = (TypePartialFoo *) &op;
+```
+
+Real example: `TypePartialEnum::compareDependency` in `type.cc` (patched in 0005).
+
+## How to audit comparators systematically
+
+1. Search for all `operator<`, `::compare`, and `::compareDependency` functions
+2. Search for all `sort(`, `stable_sort(`, and `std::set` usage to find which
+   comparators are actually used in sorting contexts
+3. For each comparator, mentally trace the case where both arguments are identical
+   — does it return false?
+4. Check for early-return branches that don't verify the other operand differs
+5. For `compareDependency` methods in TypePartial* classes, check for the
+   container-guard pattern before unsafe casts
@@ -0,0 +1,153 @@
+# Patching Workflow for Ghidra Source
+
+## Overview
+
+Ghidra source is fetched via CMake FetchContent from GitHub. Patches are applied
+automatically during the configure step using `git am`. The patch files live in
+the Sleigh repo and are version-controlled.
+
+## Directory Structure
+
+```
+src/patches/
+├── HEAD/       # Patches for the HEAD (development) Ghidra commit
+│   ├── 0001-Fix-UBSAN-errors-in-decompiler.patch
+│   ├── 0002-Use-stroull-instead-of-stroul-to-parse-address-offse.patch
+│   └── ...
+└── stable/     # Patches for the stable Ghidra release
+    ├── 0001-Fix-UBSAN-errors-in-decompiler.patch
+    └── ...
+```
+
+## Key Configuration
+
+The base commit and patch list are defined in `src/setup-ghidra-source.cmake`:
+
+- `ghidra_head_git_tag`: The pinned HEAD commit hash
+- `ghidra_version` / `ghidra_git_tag`: The stable version tag
+- `ghidra_patches`: The ordered list of patch files to apply
+
+## Step-by-Step: Creating a New Patch
+
+### 1. Identify the build preset
+
+Determine which build you're fixing. The Ghidra source checkout location depends
+on the preset:
+
+```
+build/<preset>/_deps/ghidrasource-src/
+```
+
+For example:
+```
+build/ci-head-assertions/_deps/ghidrasource-src/
+```
+
+The C++ source files are in:
+```
+build/<preset>/_deps/ghidrasource-src/Ghidra/Features/Decompiler/src/decompile/cpp/
+```
+
+### 2. Make the fix
+
+Edit the file directly in the Ghidra source checkout. The file already has all
+existing patches applied, so you're working on top of the current patch stack.
+
+### 3. Commit in the Ghidra source checkout
+
+```bash
+cd build/<preset>/_deps/ghidrasource-src
+
+# In a fresh container, git may require identity configuration before committing:
+# git config user.name "Your Name" && git config user.email "your@email.com"
+
+git add Ghidra/Features/Decompiler/src/decompile/cpp/<file>.cc
+git commit -m "decompiler: Short description
+
+Longer explanation of the bug and fix. Mention what assertion or test
+was failing and why."
+```
+
+Commit message conventions:
+- Prefix with `decompiler:` for decompiler fixes
+- First line should be concise (under 72 chars)
+- Body explains the *why*, not just the *what*
+
+### 4. Generate patch files
+
+Use `git format-patch` to regenerate ALL patches from the base commit:
+
+```bash
+# Get the base commit from src/setup-ghidra-source.cmake
+# For HEAD: it's the ghidra_head_git_tag value
+# For stable: it's the Ghidra_X.Y.Z_build tag
+
+git format-patch -o /workspaces/sleigh/src/patches/HEAD/ <base_commit>..HEAD
+```
+
+This regenerates patches 0001 through 000N. Existing patches will be regenerated
+with updated numbering in the `[PATCH N/M]` subject line, but the content stays
+the same. The new patch gets the next number.
+
+### 5. Register in CMake
+
+Edit `src/setup-ghidra-source.cmake` and add the new patch file to the appropriate
+`ghidra_patches` list:
+
+```cmake
+"${CMAKE_CURRENT_LIST_DIR}/patches/HEAD/0006-your-new-patch-name.patch"
+```
+
+### 6. Verify from scratch
+
+Clean the cached source so FetchContent re-fetches and applies all patches fresh:
+
+```bash
+rm -rf build/<preset>/_deps/ghidrasource-*
+cmake --preset <preset>
+cmake --build build/<preset>
+ctest --test-dir build/<preset> --output-on-failure
+```
+
+Watch the configure output for:
+```
+Applying: <your commit message>
+```
+
+If a patch fails to apply, you'll see `Patch failed at NNNN ...` during configure.
+
+## HEAD vs Stable
+
+- **HEAD patches** (`src/patches/HEAD/`): Applied to the development commit. May
+  include fixes for newly added files (e.g., `bitfield.cc` is HEAD-only).
+- **Stable patches** (`src/patches/stable/`): Applied to the release tag. These
+  are typically a subset of HEAD patches that also apply to stable.
+
+Check `src/setup-ghidra-source.cmake` to see which files are HEAD-only (look for
+`if("${sleigh_RELEASE_TYPE}" STREQUAL "HEAD")` blocks).
+
+## Troubleshooting
+
+### Patch fails to apply
+
+If `git am` fails during configure, the Ghidra source checkout may be in a dirty
+state. Clean it:
+
+```bash
+rm -rf build/<preset>/_deps/ghidrasource-*
+```
+
+Then reconfigure. If the patch itself is wrong, fix it and try again.
+
+### Patches conflict with new Ghidra commit
+
+When updating the pinned Ghidra HEAD commit, existing patches may not apply cleanly.
+See the [wiki](https://github.com/lifting-bits/sleigh/wiki/Patching-and-Updating)
+for the full rebasing procedure.
+
+### Source already patched from manual edits
+
+If you edited files directly in the checkout and then try to reconfigure, CMake
+may try to apply patches on top of already-patched code. Always clean the
+`_deps/ghidrasource-*` directories before reconfiguring after generating new
+patches.
@@ -0,0 +1,149 @@
+# Stack Trace Techniques
+
+When a test binary crashes (typically SIGABRT from a libc++ hardening assertion),
+these techniques can be used to identify the exact function and source line.
+
+## Method 1: gdb (simplest)
+
+gdb in batch mode produces full demangled backtraces and works reliably in most
+environments, including containers with default seccomp profiles.
+
+```bash
+cd build/ci-head-assertions
+
+gdb -batch \
+  -ex "run -sleighpath . -path _deps/ghidrasource-src/Ghidra/Features/Decompiler/src/decompile/datatests datatests" \
+  -ex "bt" \
+  ./tests/sleigh_decomp_test
+```
+
+gdb will run the program, and when it crashes (e.g., SIGABRT), it automatically
+stops and prints the backtrace. The output includes fully demangled C++ function
+names and source locations.
+
+If gdb is unavailable, try lldb (Method 2). If neither debugger can attach
+(restricted ptrace), fall back to Method 3.
+
+## Method 2: lldb
+
+Use lldb in batch mode with the full test arguments. The key is to handle SIGABRT
+so it stops instead of terminating.
+
+**Important**: Use `-k` (one-line-on-crash) for the backtrace command, not `-o`.
+Commands passed via `-o` run sequentially after file load, but when lldb hits a
+signal stop, it enters its event loop and won't execute subsequent `-o` commands.
+The `-k` flag queues commands to run specifically when the target crashes.
+
+```bash
+cd build/ci-head-assertions
+
+lldb -b \
+  -o "process handle SIGABRT --stop true --pass false" \
+  -o "run -sleighpath . -path _deps/ghidrasource-src/Ghidra/Features/Decompiler/src/decompile/datatests datatests" \
+  -k "thread backtrace" \
+  -k "quit" \
+  -- ./tests/sleigh_decomp_test
+```
+
+If lldb shows full symbol names (function + file + line), you're done.
+
+If lldb fails with "personality set failed: Operation not permitted", this is
+common in Docker containers where ptrace is restricted. Use Method 3 instead.
+
+## Method 3: LD_PRELOAD Backtrace Library
+
+Build a small shared library that intercepts SIGABRT and prints a backtrace:
+
+```bash
+cat > /tmp/bt_preload.c << 'BTEOF'
+#include <signal.h>
+#include <execinfo.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+void bt_handler(int sig) {
+    void *array[50];
+    int size = backtrace(array, 50);
+    fprintf(stderr, "=== BACKTRACE (signal %d) ===\n", sig);
+    backtrace_symbols_fd(array, size, STDERR_FILENO);
+    fprintf(stderr, "=== END BACKTRACE ===\n");
+    signal(sig, SIG_DFL);
+    raise(sig);
+}
+
+__attribute__((constructor))
+void install_handler(void) {
+    signal(SIGABRT, bt_handler);
+}
+BTEOF
+gcc -shared -fPIC -o /tmp/bt_preload.so /tmp/bt_preload.c -rdynamic
+```
+
+Run the test with the preloaded library:
+
+```bash
+cd build/ci-head-assertions
+
+LD_PRELOAD=/tmp/bt_preload.so ./tests/sleigh_decomp_test \
+  -sleighpath . \
+  -path _deps/ghidrasource-src/Ghidra/Features/Decompiler/src/decompile/datatests \
+  datatests
+```
+
+The output will look like:
+
+```
+=== BACKTRACE (signal 6) ===
+./tests/sleigh_decomp_test(+0xf1a64)[0x55c312f02a64]
+./tests/sleigh_decomp_test(+0xf17ea)[0x55c312f027ea]
+./tests/sleigh_decomp_test(+0xef732)[0x55c312f00732]
+...
+=== END BACKTRACE ===
+```
+
+The addresses in parentheses (like `+0xf1a64`) are the key — these are offsets
+from the binary's load address.
+
+## Method 4: addr2line
+
+Resolve the hex offsets from the backtrace to function names and source lines:
+
+```bash
+for addr in 0xf1a64 0xf17ea 0xef732 0x31fbd9 0x31d536; do
+  echo -n "$addr: "
+  addr2line -e ./tests/sleigh_decomp_test -f -C "$addr"
+  echo "---"
+done
+```
+
+Flags:
+- `-e` specifies the executable
+- `-f` prints function names
+- `-C` demangles C++ names
+
+Example output:
+```
+0xf1a64: void std::__1::__check_strict_weak_ordering_sorted<...>(...)
+/usr/lib/llvm-21/bin/../include/c++/v1/__debug_utils/strict_weak_ordering_check.h:51
+---
+0x31fbd9: ghidra::BlockGraph::orderBlocks()
+/path/to/block.hh:431
+---
+```
+
+This tells you exactly which sort call and which comparator function triggered
+the assertion.
+
+## Putting It All Together
+
+Typical debugging flow:
+
+1. Run the test: `ctest --test-dir build/ci-head-assertions -R decomp_datatest --output-on-failure`
+2. See assertion failure → need stack trace
+3. Try gdb first (Method 1) — it typically gives the best output with full demangled symbols
+4. If gdb is unavailable, try lldb (Method 2)
+5. If neither debugger can attach → build LD_PRELOAD library (Method 3)
+6. Resolve addresses with addr2line (Method 4) if the backtrace only has hex offsets
+7. Now you know which comparator function and sort call is the problem
+8. Read the comparator code and check for strict-weak ordering violations
@@ -0,0 +1,37 @@
+FROM mcr.microsoft.com/devcontainers/base:ubuntu-24.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+ENV LLVM_VERSION=21
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        gnupg \
+        wget \
+        software-properties-common \
+    && wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | gpg --dearmor -o /usr/share/keyrings/llvm-archive-keyring.gpg \
+    && echo "deb [signed-by=/usr/share/keyrings/llvm-archive-keyring.gpg] http://apt.llvm.org/noble/ llvm-toolchain-noble-${LLVM_VERSION} main" \
+        > /etc/apt/sources.list.d/llvm.list \
+    && apt-get update && apt-get install -y \
+        clang-${LLVM_VERSION} \
+        clangd-${LLVM_VERSION} \
+        lld-${LLVM_VERSION} \
+        llvm-${LLVM_VERSION}-dev \
+        libclang-${LLVM_VERSION}-dev \
+        libc++-${LLVM_VERSION}-dev \
+        libc++abi-${LLVM_VERSION}-dev \
+        lldb-${LLVM_VERSION} \
+        cmake \
+        ninja-build \
+        git \
+        zlib1g-dev \
+        ccache \
+        doxygen \
+        graphviz \
+    && update-alternatives --install /usr/bin/cc cc /usr/bin/clang-${LLVM_VERSION} 100 \
+    && update-alternatives --install /usr/bin/c++ c++ /usr/bin/clang++-${LLVM_VERSION} 100 \
+    && update-alternatives --install /usr/bin/clang clang /usr/bin/clang-${LLVM_VERSION} 100 \
+    && update-alternatives --install /usr/bin/clang++ clang++ /usr/bin/clang++-${LLVM_VERSION} 100 \
+    && update-alternatives --install /usr/bin/lld lld /usr/bin/lld-${LLVM_VERSION} 100 \
+    && update-alternatives --install /usr/bin/lldb lldb /usr/bin/lldb-${LLVM_VERSION} 100 \
+    && update-alternatives --install /usr/bin/clangd clangd /usr/bin/clangd-${LLVM_VERSION} 100 \
+    && apt-get clean && rm -rf /var/lib/apt/lists/*
@@ -0,0 +1,19 @@
+{
+  "name": "sleigh",
+  "build": {
+    "dockerfile": "Dockerfile"
+  },
+  "runArgs": [
+    "--cap-add=SYS_PTRACE",
+    "--security-opt=seccomp=unconfined",
+    "--privileged" 
+  ],
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "ms-vscode.cmake-tools",
+        "llvm-vs-code-extensions.vscode-clangd",
+      ]
+    }
+  }
+}
@@ -0,0 +1,161 @@
+name: Documentation
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:  # manual trigger
+
+# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
+# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+
+    steps:
+    - uses: actions/checkout@v6
+
+    - name: Setup Git User for Applying Patches
+      # See this thread for more details https://github.community/t/github-actions-bot-email-address/17204/5
+      run: |
+        git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+        git config --global user.name "github-actions[bot]"
+
+    - name: Install dependencies
+      run: sudo apt-get update && sudo apt-get install -y doxygen graphviz
+
+    # Build stable documentation
+    - name: Configure (stable)
+      run: cmake --preset=ci-ubuntu -Dsleigh_RELEASE_TYPE=stable
+
+    - name: Build documentation (stable)
+      run: cmake --build build --target docs
+
+    - name: Copy stable docs
+      run: |
+        mkdir -p docs-site/stable
+        cp -r build/docs/html/* docs-site/stable/
+
+    # Clean and build HEAD documentation
+    - name: Clean build directory
+      run: rm -rf build
+
+    - name: Configure (HEAD)
+      run: cmake --preset=ci-ubuntu -Dsleigh_RELEASE_TYPE=HEAD
+
+    - name: Build documentation (HEAD)
+      run: cmake --build build --target docs
+
+    - name: Copy HEAD docs
+      run: |
+        mkdir -p docs-site/HEAD
+        cp -r build/docs/html/* docs-site/HEAD/
+
+    # Create landing page
+    - name: Create landing page
+      run: |
+        cat > docs-site/index.html << 'EOF'
+        <!DOCTYPE html>
+        <html lang="en">
+        <head>
+            <meta charset="UTF-8">
+            <meta name="viewport" content="width=device-width, initial-scale=1.0">
+            <title>Sleigh Documentation</title>
+            <style>
+                :root {
+                    --bg-color: #f5f5f5;
+                    --text-color: #333;
+                    --text-muted: #666;
+                    --card-bg: white;
+                    --card-shadow: rgba(0,0,0,0.1);
+                    --card-shadow-hover: rgba(0,0,0,0.15);
+                    --link-color: #0066cc;
+                }
+                @media (prefers-color-scheme: dark) {
+                    :root {
+                        --bg-color: #1a1a1a;
+                        --text-color: #e0e0e0;
+                        --text-muted: #a0a0a0;
+                        --card-bg: #2d2d2d;
+                        --card-shadow: rgba(0,0,0,0.3);
+                        --card-shadow-hover: rgba(0,0,0,0.4);
+                        --link-color: #4da6ff;
+                    }
+                }
+                body {
+                    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+                    max-width: 800px;
+                    margin: 0 auto;
+                    padding: 2rem;
+                    background: var(--bg-color);
+                    color: var(--text-color);
+                }
+                h1 {
+                    color: var(--text-color);
+                }
+                .cards {
+                    display: flex;
+                    gap: 1rem;
+                    margin-top: 2rem;
+                }
+                .card {
+                    flex: 1;
+                    background: var(--card-bg);
+                    border-radius: 8px;
+                    padding: 1.5rem;
+                    text-decoration: none;
+                    color: inherit;
+                    box-shadow: 0 2px 4px var(--card-shadow);
+                    transition: box-shadow 0.2s;
+                }
+                .card:hover {
+                    box-shadow: 0 4px 8px var(--card-shadow-hover);
+                }
+                .card h2 {
+                    margin-top: 0;
+                    color: var(--link-color);
+                }
+                .card p {
+                    color: var(--text-muted);
+                    margin-bottom: 0;
+                }
+            </style>
+        </head>
+        <body>
+            <h1>Sleigh Documentation</h1>
+            <p>Select a documentation version:</p>
+            <div class="cards">
+                <a href="stable/" class="card">
+                    <h2>Stable</h2>
+                    <p>Documentation for the latest stable release.</p>
+                </a>
+                <a href="HEAD/" class="card">
+                    <h2>HEAD</h2>
+                    <p>Documentation for the latest Ghidra HEAD development version.</p>
+                </a>
+            </div>
+        </body>
+        </html>
+        EOF
+
+    - name: Upload Pages artifact
+      uses: actions/upload-pages-artifact@v4
+      with:
+        path: docs-site
+
+    - name: Deploy to GitHub Pages
+      id: deployment
+      uses: actions/deploy-pages@v4
@@ -13,6 +13,9 @@ on:
    branches:
      - "*"

+env:
+  LLVM_VERSION: 21
+
 jobs:
  build:
    runs-on: ${{ matrix.os }}
@@ -23,9 +26,14 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
        build_type: [RelWithDebInfo, Debug]
        release: [stable, HEAD]
+        exclude:
+          - os: ubuntu-latest
+            build_type: Debug
+          - os: macos-latest
+            build_type: Debug

    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6

    - name: Setup Git User for Applying Patches
      # See this thread for more details https://github.community/t/github-actions-bot-email-address/17204/5
@@ -56,6 +64,7 @@ jobs:
        max_attempts: 3
        command: |
          choco install ccache doxygen.install graphviz
+          Add-Content -Path $env:GITHUB_ENV -Value "CCACHE_EXE=$(Resolve-Path C:\ProgramData\chocolatey\lib\ccache\tools\*\ccache.exe)" 
          vcpkg install zlib:x64-windows-static

    - name: Generate cache key
@@ -66,7 +75,7 @@ jobs:
        file(APPEND "$ENV{GITHUB_ENV}" "CACHE_TIMESTAMP=${current_date}\n")

    - name: Update the cache (ccache)
-      uses: actions/cache@v4
+      uses: actions/cache@v5
      with:
        path: "${{ github.workspace }}/ccache"
        key: ${{ env.CACHE_KEY }}_ccache_${{ env.CACHE_TIMESTAMP }}
@@ -100,17 +109,19 @@ jobs:
      run: cmake "--preset=ci-$("${{ matrix.os }}".split("-")[0])"
        -DCMAKE_BUILD_TYPE=${{ matrix.build_type }}
        -Dsleigh_RELEASE_TYPE=${{ matrix.release }}
+        "-DCMAKE_PROJECT_INCLUDE:FILEPATH=${{ github.workspace }}/cmake/ccache-msvc.cmake"
+        -DCMAKE_MSVC_DEBUG_INFORMATION_FORMAT=Embedded

    - name: Build the project
      run: cmake
        --build build
        --config ${{ matrix.build_type }}
-        -j 2
+        -j 4
        -v

    - name: Test the project
      working-directory: build
-      run: ctest -VV -C ${{ matrix.build_type }} ${{ matrix.release == 'HEAD' && '|| true' || '' }}
+      run: ctest -VV -C ${{ matrix.build_type }}

    - name: Build the docs
      run: cmake
@@ -122,7 +133,7 @@ jobs:
    - name: Run the example
      run: cmake
        --build build
-        -j 2
+        -j 4
        --config ${{ matrix.build_type }}
        --target sleigh_example_runner

@@ -142,7 +153,7 @@ jobs:
      working-directory: tests/find_package
      run: |
        cmake -B build -S . "-Dsleigh_DIR=${{ github.workspace }}/install/lib/cmake/sleigh" -DCMAKE_BUILD_TYPE=${{ matrix.build_type }}
-        cmake --build build -j 2 --config ${{ matrix.build_type }}
+        cmake --build build -j 4 --config ${{ matrix.build_type }}
        cd build
        ctest -V -C ${{ matrix.build_type }}
    - name: Test install directory Windows
@@ -150,7 +161,7 @@ jobs:
      working-directory: tests/find_package
      run: |
        cmake -B build -S . "-Dsleigh_DIR=${{ github.workspace }}/install/lib/cmake/sleigh" -DCMAKE_BUILD_TYPE=${{ matrix.build_type }} "-DCMAKE_TOOLCHAIN_FILE=$env:VCPKG_INSTALLATION_ROOT/scripts/buildsystems/vcpkg.cmake" -DVCPKG_TARGET_TRIPLET=x64-windows-static
-        cmake --build build -j 2 --config ${{ matrix.build_type }}
+        cmake --build build -j 4 --config ${{ matrix.build_type }}
        cd build
        ctest -V -C ${{ matrix.build_type }}

@@ -159,7 +170,7 @@ jobs:
      working-directory: extra-tools/sleigh-lift
      run: |
        cmake -B build -S . "-Dsleigh_DIR=${{ github.workspace }}/install/lib/cmake/sleigh" -DCMAKE_BUILD_TYPE=${{ matrix.build_type }}
-        cmake --build build -j 2 --config ${{ matrix.build_type }}
+        cmake --build build -j 4 --config ${{ matrix.build_type }}
        cmake --install build --config ${{ matrix.build_type }} --prefix install
        ./install/bin/sleigh-lift --version
        ./install/bin/sleigh-lift disassemble x86-64.sla 4881ecc00f0000
@@ -169,7 +180,7 @@ jobs:
      working-directory: extra-tools/sleigh-lift
      run: |
        cmake -B build -S . "-Dsleigh_DIR=${{ github.workspace }}/install/lib/cmake/sleigh" -DCMAKE_BUILD_TYPE=${{ matrix.build_type }} "-DCMAKE_TOOLCHAIN_FILE=$env:VCPKG_INSTALLATION_ROOT/scripts/buildsystems/vcpkg.cmake" -DVCPKG_TARGET_TRIPLET=x64-windows-static
-        cmake --build build -j 2 --config ${{ matrix.build_type }}
+        cmake --build build -j 4 --config ${{ matrix.build_type }}
        cmake --install build --config ${{ matrix.build_type }} --prefix install
        ./install/bin/sleigh-lift --version
        ./install/bin/sleigh-lift disassemble x86-64.sla 4881ecc00f0000
@@ -178,7 +189,7 @@ jobs:
    - name: Create the packages
      run: cmake
          --build build
-          -j 2
+          -j 4
          --config ${{ matrix.build_type }}
          --target package

@@ -188,7 +199,7 @@ jobs:
        sudo dpkg -i build/*.deb

        cmake -S tests/find_package -B find_package_build -DCMAKE_BUILD_TYPE=${{ matrix.build_type }}
-        cmake --build find_package_build -j 2 --config ${{ matrix.build_type }} --verbose
+        cmake --build find_package_build -j 4 --config ${{ matrix.build_type }} --verbose

    - name: Locate the packages (RelWithDebInfo only)
      if: matrix.build_type == 'RelWithDebInfo'
@@ -211,13 +222,14 @@ jobs:
    # DEB Package
    - name: Upload the DEB package artifact (RelWithDebInfo only)
      if: matrix.build_type == 'RelWithDebInfo' && runner.os == 'Linux'
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
      with:
        name: ${{ env.DEB_PACKAGE_NAME }}
        path: ${{ env.DEB_PACKAGE_PATH }}
+        archive: false

    - name: Release DEB package artifact (RelWithDebInfo only)
-      uses: softprops/action-gh-release@v2.2.1
+      uses: softprops/action-gh-release@v2.5.0
      if: matrix.build_type == 'RelWithDebInfo' && runner.os == 'Linux' && startsWith(github.ref, 'refs/tags/') && matrix.release == 'stable'
      with:
        files: ${{ env.DEB_PACKAGE_PATH }}
@@ -225,12 +237,13 @@ jobs:
    # RPM Package
    - name: Upload the RPM package artifact (RelWithDebInfo only)
      if: matrix.build_type == 'RelWithDebInfo' && runner.os == 'Linux'
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
      with:
        name: ${{ env.RPM_PACKAGE_NAME }}
        path: ${{ env.RPM_PACKAGE_PATH }}
+        archive: false
    - name: Release RPM package artifact (RelWithDebInfo only)
-      uses: softprops/action-gh-release@v2.2.1
+      uses: softprops/action-gh-release@v2.5.0
      if: matrix.build_type == 'RelWithDebInfo' && runner.os == 'Linux' && startsWith(github.ref, 'refs/tags/') && matrix.release == 'stable'
      with:
        files: ${{ env.RPM_PACKAGE_PATH }}
@@ -238,16 +251,191 @@ jobs:
    # TGZ Package
    - name: Upload the TGZ package artifact (RelWithDebInfo only)
      if: matrix.build_type == 'RelWithDebInfo'
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
      with:
        name: ${{ env.TGZ_PACKAGE_NAME }}
        path: ${{ env.TGZ_PACKAGE_PATH }}
+        archive: false

    - name: Release TGZ package artifact (RelWithDebInfo only)
-      uses: softprops/action-gh-release@v2.2.1
+      uses: softprops/action-gh-release@v2.5.0
      if: matrix.build_type == 'RelWithDebInfo' && startsWith(github.ref, 'refs/tags/') && matrix.release == 'stable'
      with:
        files: ${{ env.TGZ_PACKAGE_PATH }}

    - name: ccache stats
      run: ccache -s
+
+  sanitizer:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    env:
+      ASAN_OPTIONS: strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1:detect_leaks=1
+      UBSAN_OPTIONS: print_stacktrace=1
+
+    strategy:
+      fail-fast: false
+      matrix:
+        release: [stable, HEAD]
+
+    steps:
+    - uses: actions/checkout@v6
+
+    - name: Setup Git User for Applying Patches
+      run: |
+        git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+        git config --global user.name "github-actions[bot]"
+
+    - name: Install LLVM
+      run: |
+        wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh
+        chmod +x /tmp/llvm.sh
+        sudo /tmp/llvm.sh $LLVM_VERSION
+        echo "CXX=clang++-$LLVM_VERSION" >> "$GITHUB_ENV"
+
+    - name: Install system dependencies
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y ccache
+
+    - name: Generate cache key
+      shell: cmake -P {0}
+      run: |
+        string(TIMESTAMP current_date "%Y-%m-%d-%H;%M;%S" UTC)
+        file(APPEND "$ENV{GITHUB_ENV}" "CACHE_KEY=sanitizer_${{ matrix.release }}\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CACHE_TIMESTAMP=${current_date}\n")
+
+    - name: Update the cache (ccache)
+      uses: actions/cache@v5
+      with:
+        path: "${{ github.workspace }}/ccache"
+        key: ${{ env.CACHE_KEY }}_ccache_${{ env.CACHE_TIMESTAMP }}
+        restore-keys: |
+          ${{ env.CACHE_KEY }}_ccache_
+
+    - name: Setup ccache
+      working-directory: "${{ github.workspace }}"
+      shell: cmake -P {0}
+      run: |
+        file(MAKE_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}/ccache")
+        file(APPEND "$ENV{GITHUB_ENV}" "CCACHE_BASEDIR=${CMAKE_CURRENT_SOURCE_DIR}\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CCACHE_DIR=${CMAKE_CURRENT_SOURCE_DIR}/ccache\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CCACHE_COMPRESS=true\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CCACHE_COMPRESSLEVEL=10\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CCACHE_MAXSIZE=400M\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CMAKE_CXX_COMPILER_LAUNCHER=ccache\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CMAKE_C_COMPILER_LAUNCHER=ccache\n")
+        execute_process(COMMAND ccache -z)
+
+    - name: Configure the project
+      run: cmake --preset=ci-sanitize
+        -Dsleigh_RELEASE_TYPE=${{ matrix.release }}
+        -Dsleigh_BUILD_DOCUMENTATION=OFF
+
+    - name: Build the project
+      run: cmake
+        --build build/sanitize
+        -j 4
+        -v
+
+    - name: Test the project
+      working-directory: build/sanitize
+      run: ctest -VV
+
+    - name: Run the example
+      run: cmake
+        --build build/sanitize
+        -j 4
+        --target sleigh_example_runner
+
+    - name: Run the install target
+      run: cmake --install build/sanitize
+        --prefix install
+
+    - name: Smoketest sleigh lift
+      run: |
+        ./install/bin/sleigh-lift --version
+        ./install/bin/sleigh-lift disassemble x86-64.sla 4881ecc00f0000
+        ./install/bin/sleigh-lift pcode x86-64.sla 4881ecc00f0000
+
+    - name: ccache stats
+      run: ccache -s
+
+  assertions:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        release: [stable, HEAD]
+
+    steps:
+    - uses: actions/checkout@v6
+
+    - name: Setup Git User for Applying Patches
+      run: |
+        git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+        git config --global user.name "github-actions[bot]"
+
+    - name: Install LLVM
+      run: |
+        wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh
+        chmod +x /tmp/llvm.sh
+        sudo /tmp/llvm.sh $LLVM_VERSION
+        echo "CXX=clang++-$LLVM_VERSION" >> "$GITHUB_ENV"
+
+    - name: Install system dependencies
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y ccache libc++-$LLVM_VERSION-dev libc++abi-$LLVM_VERSION-dev
+
+    - name: Generate cache key
+      shell: cmake -P {0}
+      run: |
+        string(TIMESTAMP current_date "%Y-%m-%d-%H;%M;%S" UTC)
+        file(APPEND "$ENV{GITHUB_ENV}" "CACHE_KEY=assertions_${{ matrix.release }}\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CACHE_TIMESTAMP=${current_date}\n")
+
+    - name: Update the cache (ccache)
+      uses: actions/cache@v5
+      with:
+        path: "${{ github.workspace }}/ccache"
+        key: ${{ env.CACHE_KEY }}_ccache_${{ env.CACHE_TIMESTAMP }}
+        restore-keys: |
+          ${{ env.CACHE_KEY }}_ccache_
+
+    - name: Setup ccache
+      working-directory: "${{ github.workspace }}"
+      shell: cmake -P {0}
+      run: |
+        file(MAKE_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}/ccache")
+        file(APPEND "$ENV{GITHUB_ENV}" "CCACHE_BASEDIR=${CMAKE_CURRENT_SOURCE_DIR}\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CCACHE_DIR=${CMAKE_CURRENT_SOURCE_DIR}/ccache\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CCACHE_COMPRESS=true\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CCACHE_COMPRESSLEVEL=10\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CCACHE_MAXSIZE=400M\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CMAKE_CXX_COMPILER_LAUNCHER=ccache\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CMAKE_C_COMPILER_LAUNCHER=ccache\n")
+        execute_process(COMMAND ccache -z)
+
+    - name: Configure the project
+      run: cmake --preset=ci-assertions
+        -Dsleigh_RELEASE_TYPE=${{ matrix.release }}
+        -Dsleigh_BUILD_DOCUMENTATION=OFF
+
+    - name: Build the project
+      run: cmake
+        --build build/assertions
+        -j 4
+        -v
+
+    - name: Test the project
+      working-directory: build/assertions
+      run: ctest -VV
+
+    - name: ccache stats
+      run: ccache -s
@@ -12,9 +12,9 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6

-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@v6
      with:
        # Use oldest supported version for maximum script compatibility
        python-version: '3.10'
@@ -26,33 +26,90 @@ jobs:
        python3 scripts/update_ghidra_head.py --ci

    # Need this to run further Actions on the newly created PR
-    # See here for more details https://github.com/peter-evans/create-pull-request/blob/28fa4848947e0faa7fa50647691d01477589d5e9/docs/concepts-guidelines.md#authenticating-with-github-app-generated-tokens
-    - uses: tibdex/github-app-token@v2
+    # See here for more details https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#authenticating-with-github-app-generated-tokens
+    - uses: actions/create-github-app-token@v2
      if: steps.head_update.outputs.did_update
      id: generate-token
      with:
-        app_id: ${{ secrets.APP_ID }}
-        private_key: ${{ secrets.APP_PRIVATE_KEY }}
+        app-id: ${{ secrets.APP_ID }}
+        private-key: ${{ secrets.APP_PRIVATE_KEY }}

-    - name: Create PR
+    - name: Commit, push, and create PR
      if: steps.head_update.outputs.did_update
-      uses: peter-evans/create-pull-request@v7
-      with:
-        title: Update Ghidra HEAD to commit ${{ steps.head_update.outputs.short_sha }}
-        commit-message: |
-          Bump Ghidra HEAD commit ${{ steps.head_update.outputs.short_sha }}
+      env:
+        GH_TOKEN: ${{ steps.generate-token.outputs.token }}
+      run: |
+        BRANCH="cron/update-ghidra-${{ steps.head_update.outputs.short_sha }}"

-          Changed files:
+        # Check if PR already exists for this branch
+        if gh pr list --head "$BRANCH" --json number --jq '.[0].number' | grep -q .; then
+          echo "PR already exists for branch $BRANCH, skipping"
+          exit 0
+        fi

-          ${{ steps.head_update.outputs.changed_files }}
-        body: |
-          Changed files:
+        # Configure git
+        git config user.name "github-actions[bot]"
+        git config user.email "github-actions[bot]@users.noreply.github.com"

-          ${{ steps.head_update.outputs.changed_files }}
+        # Create branch and commit
+        git checkout -b "$BRANCH"
+        git add -A
+        git commit -m "$(cat <<'EOF'
+        Bump Ghidra HEAD commit ${{ steps.head_update.outputs.short_sha }}

-          Commit details:
+        Changed files:

-          ${{ steps.head_update.outputs.commit_details }}
-        branch: cron/update-ghidra-${{ steps.head_update.outputs.short_sha }}
-        delete-branch: true
-        token: ${{ steps.generate-token.outputs.token }}
+        ${{ steps.head_update.outputs.changed_files }}
+
+        Commit details:
+
+        ${{ steps.head_update.outputs.commit_details }}
+        EOF
+        )"
+
+        # Push branch
+        git push -u origin "$BRANCH"
+
+        # Build PR body using heredoc with single-quoted delimiter to prevent
+        # bash from interpreting backticks in the markdown content as command
+        # substitution. GitHub Actions expressions are expanded before bash
+        # processes the script, so they still get substituted.
+        BASE_BODY=$(cat <<'PRBODY'
+        Changed files:
+
+        ${{ steps.head_update.outputs.changed_files }}
+
+        Commit details:
+
+        ${{ steps.head_update.outputs.commit_details }}
+        PRBODY
+        )
+
+        # Add intervention warning if needed
+        if [ "${{ steps.head_update.outputs.needs_manual_intervention }}" = "true" ]; then
+          INTERVENTION=$(cat <<'PRBODY'
+        ## :warning: Manual Intervention Required
+
+        The following files were added or deleted and may require manual CMake configuration updates:
+
+        ${{ steps.head_update.outputs.intervention_details }}
+
+        ### Instructions
+        - **New C++ sources**: Add to appropriate list in `src/setup-ghidra-source.cmake`
+        - **Deleted C++ sources**: Remove from `src/setup-ghidra-source.cmake`
+        - **New spec files**: Review if `.slaspec` files are auto-generated; other types may need manual updates
+        - **Deleted spec files**: Verify no longer referenced
+
+        ---
+
+        PRBODY
+        )
+          PR_BODY="${INTERVENTION}${BASE_BODY}"
+        else
+          PR_BODY="$BASE_BODY"
+        fi
+
+        # Create PR
+        gh pr create \
+          --title "Update Ghidra HEAD to commit ${{ steps.head_update.outputs.short_sha }}" \
+          --body "$PR_BODY"
@@ -0,0 +1,117 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+Sleigh is a CMake-based build system for Ghidra's Sleigh/decompiler C++ libraries (by Trail of Bits). It wraps NSA's Ghidra source code — fetched via CMake FetchContent during configure — so the Sleigh disassembly and decompilation engines can be built as standalone C++ libraries for reuse outside Ghidra.
+
+**The actual Ghidra C++ source is not in this repo.** It is cloned from GitHub automatically during CMake configuration.
+
+## Build Commands
+
+```sh
+# Standard build (fetches Ghidra source on first configure)
+cmake -B build -S .
+cmake --build build -j$(nproc)
+
+# CI-style build with developer mode (enables tests, docs, warnings)
+cmake --preset=ci-ubuntu
+cmake --build build -j$(nproc)
+
+# Build with HEAD (bleeding-edge) Ghidra instead of stable
+cmake -B build -S . -Dsleigh_RELEASE_TYPE=HEAD
+
+# Use a local Ghidra checkout (avoids re-cloning)
+cmake -B build -S . -Dsleigh_RELEASE_TYPE=HEAD \
+  -DFETCHCONTENT_SOURCE_DIR_GHIDRASOURCE=/path/to/ghidra
+
+# Sanitizer build
+cmake --preset=ci-sanitize
+cmake --build build/sanitize -j$(nproc)
+```
+
+## Running Tests
+
+Tests require `sleigh_DEVELOPER_MODE=ON` (enabled by all `ci-*` presets).
+
+```sh
+# Run all tests
+cd build && ctest -VV
+
+# Run specific test by name
+cd build && ctest -VV -R sleigh_decomp_unittest    # unit tests
+cd build && ctest -VV -R sleigh_decomp_datatest     # data-driven tests
+cd build && ctest -VV -R sleigh_namespace_std_test   # header hygiene check
+```
+
+Test binary: `sleigh_decomp_test` — wraps Ghidra's own test suite. Takes `-sleighpath` for compiled .sla files and a test mode (`unittests` or `datatests`).
+
+## Architecture
+
+### Library Targets
+
+| Target | Library | C++ Std | Description |
+|--------|---------|---------|-------------|
+| `sleigh::sla` | `sla` | C++11 | Core sleigh: disassembly, encoding, p-code, emulation |
+| `sleigh::decomp` | `decomp` | C++11 | Full decompiler (superset of sla) |
+| `sleigh::support` | `slaSupport` | C++17 | Trail of Bits helpers: `FindSpecFile()`, version info |
+
+Headers: `<ghidra/*.hh>` for upstream Ghidra headers, `<sleigh/*.h>` for ToB additions.
+
+### Key Directories
+
+- `src/setup-ghidra-source.cmake` — Pinned Ghidra versions, FetchContent, source file lists, patch application. **This is the central file for version bumps and source management.**
+- `src/patches/{stable,HEAD}/` — Git-format patches applied to Ghidra source during fetch
+- `src/spec_files_{stable,HEAD}.cmake` — Lists of ~148 .slaspec files to compile
+- `tools/` — Ghidra executables (sleigh compiler, decompiler, ghidra service)
+- `support/` — Trail of Bits support library (C++17)
+- `extra-tools/sleigh-lift/` — Demo tool for disassembly/p-code lifting
+- `cmake/modules/sleighCompile.cmake` — `sleigh_compile()` function exported for downstream users
+
+### How Ghidra Source Integration Works
+
+1. `src/setup-ghidra-source.cmake` pins a Ghidra git ref (tag for stable, commit hash for HEAD)
+2. CMake FetchContent clones from `github.com/NationalSecurityAgency/ghidra`
+3. Patches from `src/patches/` are applied via `git am`
+4. Source file lists reference into `Ghidra/Features/Decompiler/src/decompile/cpp/`
+5. Headers are copied into `build/include/ghidra/` for clean include paths
+
+### Two Release Tracks
+
+- **stable** (default): Pinned to a Ghidra release tag (e.g., `Ghidra_12.0.3_build`). Shallow clone.
+- **HEAD**: Pinned to a specific commit on Ghidra main. Full clone. Updated weekly by CI via `scripts/update_ghidra_head.py`.
+
+## Patch System
+
+Patches fix upstream Ghidra bugs (UB sanitizer issues, portability, strict weak ordering violations) without changing Sleigh functionality. They are standard `git format-patch` files.
+
+- `src/patches/stable/` — Patches for stable release
+- `src/patches/HEAD/` — Superset of stable patches plus HEAD-specific fixes
+- Custom patches via: `-Dsleigh_ADDITIONAL_PATCHES="path/to/patch1;path/to/patch2"`
+
+When adding patches: create with `git format-patch`, number sequentially, and add to both directories if applicable. Patches in HEAD must be a superset of stable patches.
+
+## Key Gotchas
+
+- **In-source builds are forbidden** — enforced by `cmake/prelude.cmake`
+- **First configure is slow** — Ghidra repo clone takes time (especially HEAD which can't shallow clone)
+- **Core libraries are C++11** — the support library and extra tools are C++17, but `sleigh::sla` and `sleigh::decomp` must stay C++11
+- **Source file lists are manual** — when Ghidra adds/removes .cc files, `src/setup-ghidra-source.cmake` must be updated; the `scripts/update_ghidra_head.py` script detects new files and flags them
+- **Strict weak ordering** — a recurring class of upstream bugs in Ghidra comparators; several patches fix these
+- **Spec files differ between releases** — `src/spec_files_stable.cmake` and `src/spec_files_HEAD.cmake` are separate lists and must be maintained independently
+
+## CMake Presets Reference
+
+| Preset | Use Case |
+|--------|----------|
+| `ci-ubuntu` | Linux dev build with warnings and tests |
+| `ci-macos` | macOS dev build |
+| `ci-windows` | Windows dev build (VS 2022, vcpkg) |
+| `ci-sanitize` | ASan + UBSan (builds to `build/sanitize/`) |
+| `ci-coverage` | Code coverage (builds to `build/coverage/`) |
+
+## Code Style
+
+- `.clang-format`: BasedOnStyle LLVM
+- Compiler warnings are strict in CI (see `flags-unix`/`flags-windows` presets)
@@ -8,6 +8,9 @@

 cmake_minimum_required(VERSION 3.18)

+# For MSVC ccache to use /Z7 with CMAKE_MSVC_DEBUG_INFORMATION_FORMAT=Embedded
+cmake_policy(SET CMP0141 NEW)
+
 include(cmake/prelude.cmake)

 # Sets "library_root" variable for decompiler cpp root directory
@@ -143,11 +146,13 @@ set(public_include_header_list
  "${library_root}/multiprecision.hh"
  "${library_root}/slaformat.hh"
  "${library_root}/constseq.hh"
+  "${library_root}/expression.hh"
 )
-#if(sleigh_RELEASE_IS_HEAD)
-#  list(APPEND public_include_header_list
-#  )
-#endif()
+if(sleigh_RELEASE_IS_HEAD)
+  list(APPEND public_include_header_list
+    "${library_root}/bitfield.hh"
+  )
+endif()
 # Create custom target so that IDEs know these files are part of the sources
 add_custom_target(sleigh_all_headers SOURCES ${public_include_header_list})
 set(public_headers_dir ${CMAKE_CURRENT_BINARY_DIR}/include)
@@ -114,6 +114,17 @@
        "CMAKE_CXX_FLAGS_SANITIZE": "-O2 -g -fsanitize=address,undefined -fno-omit-frame-pointer -fno-common"
      }
    },
+    {
+      "name": "ci-assertions",
+      "binaryDir": "${sourceDir}/build/assertions",
+      "inherits": ["ci-unix", "dev-mode"],
+      "cacheVariables": {
+        "CMAKE_BUILD_TYPE": "Assertions",
+        "CMAKE_CXX_FLAGS_ASSERTIONS": "-O0 -g -stdlib=libc++ -D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_DEBUG -fstack-protector-strong",
+        "CMAKE_EXE_LINKER_FLAGS_ASSERTIONS": "-stdlib=libc++ -lc++abi",
+        "CMAKE_SHARED_LINKER_FLAGS_ASSERTIONS": "-stdlib=libc++ -lc++abi"
+      }
+    },
    {
      "name": "ci-build",
      "binaryDir": "${sourceDir}/build",
@@ -1,6 +1,6 @@
 # Sleigh Library

-[Sleigh](https://ghidra.re/courses/languages/html/sleigh.html) is a language used to describe the semantics of instruction sets of general-purpose microprocessors, with enough detail to facilitate the reverse engineering of software compiled for these architectures. It is part of the [Ghidra reverse engineering platform](https://github.com/NationalSecurityAgency/ghidra) and underpins two of its major components: its disassembly and decompilation engines.
+[Sleigh](https://ghidra.re/ghidra_docs/languages/html/sleigh.html) is a language used to describe the semantics of instruction sets of general-purpose microprocessors, with enough detail to facilitate the reverse engineering of software compiled for these architectures. It is part of the [Ghidra reverse engineering platform](https://github.com/NationalSecurityAgency/ghidra) and underpins two of its major components: its disassembly and decompilation engines.

 This repository provides a CMake-based build project for Sleigh so that it can be built and packaged as a standalone library and be reused in projects other than Ghidra.

@@ -0,0 +1,34 @@
+# This module configures ccache to work with MSVC
+# Based on: https://github.com/ccache/ccache/wiki/MS-Visual-Studio
+
+# Only do this for Windows MSVC builds
+if(NOT WIN32 OR NOT CMAKE_CXX_COMPILER_ID MATCHES "MSVC")
+  return()
+endif()
+
+# Assume the parent environment has this set
+# Chocolatey creates a shim which doesn't work when renamed
+set(CCACHE_EXE "$ENV{CCACHE_EXE}")
+if(NOT CCACHE_EXE)
+  message(STATUS "ccache not found - MSVC ccache support disabled")
+  return()
+endif()
+message(STATUS "Found ccache - ${CCACHE_EXE}")
+
+message(STATUS "Configuring ccache for MSVC")
+
+file(COPY_FILE
+    "${CCACHE_EXE}" "${CMAKE_BINARY_DIR}/cl.exe"
+    ONLY_IF_DIFFERENT)
+
+# By default Visual Studio generators will use /Zi which is not compatible
+# with ccache, so tell Visual Studio to use /Z7 instead.
+message(STATUS "Setting MSVC debug information format to 'Embedded'")
+set(CMAKE_MSVC_DEBUG_INFORMATION_FORMAT "$<$<CONFIG:Debug,RelWithDebInfo>:Embedded>")
+
+set(CMAKE_VS_GLOBALS
+    "CLToolExe=cl.exe"
+    "CLToolPath=${CMAKE_BINARY_DIR}"
+    "UseMultiToolTask=true"
+    "DebugInformationFormat=OldStyle"
+    )
@@ -123,8 +123,18 @@ static void PrintAssembly(ghidra::Sleigh &engine, uint64_t addr, size_t len) {
  ghidra::Address cur_addr(engine.getDefaultCodeSpace(), addr),
      last_addr(engine.getDefaultCodeSpace(), addr + len);
  while (cur_addr < last_addr) {
-    int32_t instr_len = engine.printAssembly(asm_emit, cur_addr);
-    cur_addr = cur_addr + instr_len;
+    try {
+      int32_t instr_len = engine.printAssembly(asm_emit, cur_addr);
+      cur_addr = cur_addr + instr_len;
+    }
+    catch(ghidra::UnimplError &err) {
+      std::cerr << "UnimplError @ " << cur_addr << " (addr 0x" << addr << ", len 0x" << len << "): " << err.explain << "\n";
+      break;
+    }
+    catch (ghidra::BadDataError &err) {
+      std::cerr << "BadDataError @ " << cur_addr << " (addr 0x" << addr << ", len 0x" << len << "): " << err.explain << "\n";
+      break;
+    }
  }
 }

@@ -157,8 +167,18 @@ static void PrintPcode(ghidra::Sleigh &engine, uint64_t addr, size_t len) {
  ghidra::Address cur_addr(engine.getDefaultCodeSpace(), addr),
      last_addr(engine.getDefaultCodeSpace(), addr + len);
  while (cur_addr < last_addr) {
-    int32_t instr_len = engine.oneInstruction(pcode_emit, cur_addr);
-    cur_addr = cur_addr + instr_len;
+    try {
+      int32_t instr_len = engine.oneInstruction(pcode_emit, cur_addr);
+      cur_addr = cur_addr + instr_len;
+    }
+    catch(ghidra::UnimplError &err) {
+      std::cerr << "UnimplError @ " << cur_addr << " (addr 0x" << addr << ", len 0x" << len << "): " << err.explain << "\n";
+      break;
+    }
+    catch(ghidra::BadDataError &err) {
+      std::cerr << "BadDataError @ " << cur_addr << " (addr 0x" << addr << ", len 0x" << len << "): " << err.explain << "\n";
+      break;
+    }
  }
 }

@@ -1,82 +1,22 @@
-From 7c6e51dd1234387b98e1ad61d3f88a0565364b28 Mon Sep 17 00:00:00 2001
+From 98769d3cd2f417a52559bf68700e2f9f3e7a0e4f Mon Sep 17 00:00:00 2001
 From: Eric Kilmer <eric.d.kilmer@gmail.com>
 Date: Mon, 12 Aug 2024 12:02:35 -0400
-Subject: [PATCH 1/6] Fix UBSAN errors in decompiler
+Subject: [PATCH 1/7] Fix UBSAN errors in decompiler

 Co-authored-by: Alex Cameron <asc@tetsuo.sh>
 ---
- .../Decompiler/src/decompile/cpp/fspec.cc      |  8 ++++++--
- .../Decompiler/src/decompile/cpp/op.cc         |  6 +++++-
- .../Decompiler/src/decompile/cpp/opbehavior.cc |  8 +++++++-
 .../src/decompile/cpp/pcodecompile.cc          | 18 +++++++++++-------
- .../Decompiler/src/decompile/cpp/ruleaction.cc | 12 +++++++++---
 .../Decompiler/src/decompile/cpp/semantics.cc  |  2 ++
 .../Decompiler/src/decompile/cpp/semantics.hh  |  2 +-
 .../src/decompile/cpp/slgh_compile.cc          |  2 +-
- .../Decompiler/src/decompile/cpp/type.cc       |  2 +-
 .../src/decompile/unittests/testfloatemu.cc    |  2 +-
- 10 files changed, 44 insertions(+), 18 deletions(-)
+ 5 files changed, 16 insertions(+), 10 deletions(-)

-diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/fspec.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/fspec.cc
-index d78b78731c..caf4b24d15 100644
--- a/Ghidra/Features/Decompiler/src/decompile/cpp/fspec.cc
-+++ b/Ghidra/Features/Decompiler/src/decompile/cpp/fspec.cc
-@@ -2868,8 +2868,12 @@ void ProtoModelMerged::decode(Decoder &decoder)
-     modellist.push_back(mymodel);
-   }
-   decoder.closeElement(elemId);
-  ((ParamListMerged *)input)->finalize();
-  ((ParamListMerged *)output)->finalize();
-+  if (input->getType() == ParamList::p_merged) {
-+    ((ParamListMerged *)input)->finalize();
-+  }
-+  if (output->getType() == ParamList::p_merged) {
-+    ((ParamListMerged *)output)->finalize();
-+  }
- }
- 
- void ParameterBasic::setTypeLock(bool val)
-diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/op.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/op.cc
-index d51460be84..45bf394862 100644
--- a/Ghidra/Features/Decompiler/src/decompile/cpp/op.cc
-+++ b/Ghidra/Features/Decompiler/src/decompile/cpp/op.cc
-@@ -666,7 +666,11 @@ uintb PcodeOp::getNZMaskLocal(bool cliploop) const
-     break;
-   case CPUI_PIECE:
-     resmask = getIn(0)->getNZMask();
-    resmask <<= 8*getIn(1)->getSize();
-+    if (8*getIn(1)->getSize() < sizeof(resmask)) {
-+      resmask <<= 8*getIn(1)->getSize();
-+    } else {
-+      resmask = 0;
-+    }
-     resmask |= getIn(1)->getNZMask();
-     break;
-   case CPUI_INT_MULT:
-diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/opbehavior.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/opbehavior.cc
-index aebcfd9103..6c47e6eb15 100644
--- a/Ghidra/Features/Decompiler/src/decompile/cpp/opbehavior.cc
-+++ b/Ghidra/Features/Decompiler/src/decompile/cpp/opbehavior.cc
-@@ -746,7 +746,13 @@ uintb OpBehaviorPiece::evaluateBinary(int4 sizeout,int4 sizein,uintb in1,uintb i
- uintb OpBehaviorSubpiece::evaluateBinary(int4 sizeout,int4 sizein,uintb in1,uintb in2) const
- 
- {
-  uintb res = (in1>>(in2*8)) & calc_mask(sizeout);
-+  uintb res = in1;
-+  if (in2 < sizeof(in1)) {
-+    res >>= (in2*8);
-+  } else {
-+    res = 0;
-+  }
-+  res &= calc_mask(sizeout);
-   return res;
- }
- 
 diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/pcodecompile.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/pcodecompile.cc
-index ca9d71ab99..85d4dd281d 100644
+index a67a3de849..37ba4930e6 100644
 --- a/Ghidra/Features/Decompiler/src/decompile/cpp/pcodecompile.cc
 +++ b/Ghidra/Features/Decompiler/src/decompile/cpp/pcodecompile.cc
-@@ -621,8 +621,10 @@ vector<OpTpl *> *PcodeCompile::assignBitRange(VarnodeTpl *vn,uint4 bitoffset,uin
+@@ -618,8 +618,10 @@ vector<OpTpl *> *PcodeCompile::assignBitRange(VarnodeTpl *vn,uint4 bitoffset,uin
   uint4 smallsize = (numbits+7)/8; // Size of input (output of rhs)
   bool shiftneeded = (bitoffset != 0);
   bool zextneeded = true;
@@ -89,7 +29,7 @@ index ca9d71ab99..85d4dd281d 100644
 
   if (vn->getSize().getType()==ConstTpl::real) {
     // If we know the size of the bitranged varnode, we can
-@@ -726,9 +728,6 @@ ExprTree *PcodeCompile::createBitRange(SpecificSymbol *sym,uint4 bitoffset,uint4
+@@ -723,9 +725,6 @@ ExprTree *PcodeCompile::createBitRange(SpecificSymbol *sym,uint4 bitoffset,uint4
     }
   }
 
@@ -99,7 +39,7 @@ index ca9d71ab99..85d4dd281d 100644
   if (truncneeded && ((bitoffset % 8)==0)) {
     truncshift = bitoffset/8;
     bitoffset = 0;
-@@ -751,8 +750,13 @@ ExprTree *PcodeCompile::createBitRange(SpecificSymbol *sym,uint4 bitoffset,uint4
+@@ -748,8 +747,13 @@ ExprTree *PcodeCompile::createBitRange(SpecificSymbol *sym,uint4 bitoffset,uint4
     appendOp(CPUI_INT_RIGHT,res,bitoffset,4);
   if (truncneeded)
     appendOp(CPUI_SUBPIECE,res,truncshift,4);
@@ -115,38 +55,8 @@ index ca9d71ab99..85d4dd281d 100644
   force_size(res->outvn,ConstTpl(ConstTpl::real,finalsize),*res->ops);
   return res;
 }
-diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/ruleaction.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/ruleaction.cc
-index 009570af71..72b2a10503 100644
--- a/Ghidra/Features/Decompiler/src/decompile/cpp/ruleaction.cc
-+++ b/Ghidra/Features/Decompiler/src/decompile/cpp/ruleaction.cc
-@@ -976,7 +976,12 @@ int4 RulePullsubIndirect::applyOp(PcodeOp *op,Funcdata &data)
-   Varnode *outvn = op->getOut();
-   if (outvn->isPrecisLo()||outvn->isPrecisHi()) return 0; // Don't pull apart double precision object
- 
-  uintb consume = calc_mask(newSize) << 8 * minByte;
-+  uintb consume = calc_mask(newSize);
-+  if (8 * minByte < sizeof(consume)) {
-+    consume <<= 8 * minByte;
-+  } else {
-+    consume = 0;
-+  }
-   consume = ~consume;
-   if ((consume & indir->getIn(0)->getConsume())!=0) return 0;
- 
-@@ -7031,8 +7036,9 @@ int4 RulePtrsubCharConstant::applyOp(PcodeOp *op,Funcdata &data)
-   Varnode *sb = op->getIn(0);
-   Datatype *sbType = sb->getTypeReadFacing(op);
-   if (sbType->getMetatype() != TYPE_PTR) return 0;
-  TypeSpacebase *sbtype = (TypeSpacebase *)((TypePointer *)sbType)->getPtrTo();
-  if (sbtype->getMetatype() != TYPE_SPACEBASE) return 0;
-+  Datatype *sbTypePtr = ((TypePointer *)sbType)->getPtrTo();
-+  if (sbTypePtr->getMetatype() != TYPE_SPACEBASE) return 0;
-+  TypeSpacebase *sbtype = (TypeSpacebase *)sbTypePtr;
-   Varnode *vn1 = op->getIn(1);
-   if (!vn1->isConstant()) return 0;
-   Varnode *outvn = op->getOut();
 diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/semantics.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/semantics.cc
-index cd9b9835b1..8a4616c3b9 100644
+index 18e2ff8ba1..3bfe29f2ef 100644
 --- a/Ghidra/Features/Decompiler/src/decompile/cpp/semantics.cc
 +++ b/Ghidra/Features/Decompiler/src/decompile/cpp/semantics.cc
@@ -22,6 +22,7 @@ ConstTpl::ConstTpl(const_type tp)
@@ -166,7 +76,7 @@ index cd9b9835b1..8a4616c3b9 100644
 
 bool ConstTpl::isConstSpace(void) const
 diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/semantics.hh b/Ghidra/Features/Decompiler/src/decompile/cpp/semantics.hh
-index e0b069959d..9117a45c75 100644
+index b53b18797d..b2f043e32d 100644
 --- a/Ghidra/Features/Decompiler/src/decompile/cpp/semantics.hh
 +++ b/Ghidra/Features/Decompiler/src/decompile/cpp/semantics.hh
@@ -47,7 +47,7 @@ class ConstTpl {
@@ -179,10 +89,10 @@ index e0b069959d..9117a45c75 100644
     type=op2.type; value=op2.value; value_real=op2.value_real; select=op2.select; }
   ConstTpl(const_type tp,uintb val);
 diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/slgh_compile.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/slgh_compile.cc
-index 50d85e22ba..9f3b456229 100644
+index 75bebffcb0..bf5e7ce681 100644
 --- a/Ghidra/Features/Decompiler/src/decompile/cpp/slgh_compile.cc
 +++ b/Ghidra/Features/Decompiler/src/decompile/cpp/slgh_compile.cc
-@@ -2164,8 +2164,8 @@ string SleighCompile::checkSymbols(SymbolScope *scope)
+@@ -2323,8 +2323,8 @@ string SleighCompile::checkSymbols(SymbolScope *scope)
   ostringstream msg;
   SymbolTree::const_iterator iter;
   for(iter=scope->begin();iter!=scope->end();++iter) {
@@ -192,20 +102,6 @@ index 50d85e22ba..9f3b456229 100644
     if (sym->getRefCount() == 0)
       msg << "   Label <" << sym->getName() << "> was placed but not used" << endl;
     else if (!sym->isPlaced())
-diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/type.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/type.cc
-index fd0ab26fb4..7f654c220b 100644
--- a/Ghidra/Features/Decompiler/src/decompile/cpp/type.cc
-+++ b/Ghidra/Features/Decompiler/src/decompile/cpp/type.cc
-@@ -3728,8 +3728,8 @@ void TypeFactory::recalcPointerSubmeta(Datatype *base,sub_metatype sub)
-   top.submeta = sub;			// Search on the incorrect submeta
-   iter = tree.lower_bound(&top);
-   while(iter != tree.end()) {
-+    if ((*iter)->getMetatype() != TYPE_PTR) break;
-     TypePointer *ptr = (TypePointer *)*iter;
-    if (ptr->getMetatype() != TYPE_PTR) break;
-     if (ptr->ptrto != base) break;
-     ++iter;
-     if (ptr->submeta == sub) {
 diff --git a/Ghidra/Features/Decompiler/src/decompile/unittests/testfloatemu.cc b/Ghidra/Features/Decompiler/src/decompile/unittests/testfloatemu.cc
 index 2571f55f1a..fe40e22b1b 100644
 --- a/Ghidra/Features/Decompiler/src/decompile/unittests/testfloatemu.cc
@@ -220,5 +116,5 @@ index 2571f55f1a..fe40e22b1b 100644
         uintb true_result = ((uintb)(int32_t)f) & 0xffffffff;
         uintb encoding = format.getEncoding(f);
 -- 
-2.48.1
+2.51.1

@@ -1,7 +1,7 @@
-From 5e37c51ebc8a3ae0f32a3cb0049aaebafec48d7d Mon Sep 17 00:00:00 2001
+From 4e6f277eae589c4f9bceb40337d43384248d272c Mon Sep 17 00:00:00 2001
 From: Alex Cameron <asc@tetsuo.sh>
 Date: Wed, 3 Aug 2022 20:01:18 +1000
-Subject: [PATCH 2/6] Use `stroull` instead of `stroul` to parse address
+Subject: [PATCH 2/7] Use `stroull` instead of `stroul` to parse address
 offsets

 ---
@@ -34,5 +34,5 @@ index dbaa2e775f..72927bf379 100644
     enddata = (const char *) tmpdata;
     if (enddata - s.c_str() == s.size()) { // If no size or offset override
 -- 
-2.48.1
+2.51.1

@@ -1,7 +1,7 @@
-From a898b0df5865d8aafab60bdaae04c8fc373cd476 Mon Sep 17 00:00:00 2001
+From 41eb6be342d29d6ff618d06b391bf33209fe8ade Mon Sep 17 00:00:00 2001
 From: Eric Kilmer <eric.d.kilmer@gmail.com>
 Date: Tue, 29 Oct 2024 17:51:09 -0400
-Subject: [PATCH 4/6] Ignore floating point test due to compilation differences
+Subject: [PATCH 3/7] Ignore floating point test due to compilation differences

 This test fails on macOS and Windows. I'm unsure whether it's an OS or
 compiler issue.
@@ -24,5 +24,5 @@ index fe40e22b1b..91440e2510 100644
   ASSERT_EQUALS(ff.printDecimal(f2, false), "0.33333334");
   double f3 = doubleFromRawBits(0x3fd0000000000000);
 -- 
-2.48.1
+2.51.1

@@ -1,36 +0,0 @@
-From 0feb881ef1cbc9aa4639e16914b7d9ed863baadf Mon Sep 17 00:00:00 2001
-From: Eric Kilmer <eric.d.kilmer@gmail.com>
-Date: Tue, 29 Oct 2024 15:30:57 -0400
-Subject: [PATCH 3/6] Use string resize instead of reserve
-
-assign will fix up the size to hold all of what's copied
---
- Ghidra/Features/Decompiler/src/decompile/cpp/stringmanage.cc | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/stringmanage.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/stringmanage.cc
-index 5f5fa0c7b3..4cd77156f2 100644
--- a/Ghidra/Features/Decompiler/src/decompile/cpp/stringmanage.cc
-+++ b/Ghidra/Features/Decompiler/src/decompile/cpp/stringmanage.cc
-@@ -67,7 +67,6 @@ void StringManager::assignStringData(StringData &data,const uint1 *buf,int4 size
- 
- {
-   if (charsize == 1 && numChars < maximumChars) {
-    data.byteData.reserve(size);
-     data.byteData.assign(buf,buf+size);
-   }
-   else {
-@@ -77,9 +76,9 @@ void StringManager::assignStringData(StringData &data,const uint1 *buf,int4 size
-       return;
-     string resString = s.str();
-     int4 newSize = resString.size();
-    data.byteData.reserve(newSize + 1);
-     const uint1 *ptr = (const uint1 *)resString.c_str();
-     data.byteData.assign(ptr,ptr+newSize);
-+    data.byteData.resize(newSize + 1, 0);
-     data.byteData[newSize] = 0;		// Make sure there is a null terminator
-   }
-   data.isTruncated = (numChars >= maximumChars);
-- 
-2.48.1
-
@@ -1,7 +1,7 @@
-From 27d5d7afc21a3620362df245682748fdbaec570a Mon Sep 17 00:00:00 2001
+From 8aa8bf7a146ab43f5b1b27386667af52269720fd Mon Sep 17 00:00:00 2001
 From: Eric Kilmer <eric.d.kilmer@gmail.com>
 Date: Wed, 30 Oct 2024 14:26:57 -0400
-Subject: [PATCH 5/6] Allow positive or negative NAN in decompiler floating
+Subject: [PATCH 4/7] Allow positive or negative NAN in decompiler floating
 point test

 At least on Apple Silicon, this test reports positive NAN.
@@ -33,5 +33,5 @@ index f8108d3d32..1060a3e193 100644
 <stringmatch name="Float print #14" min="1" max="1">double7 = 3.1415926535897933e-06;</stringmatch>
 </decompilertest>
 -- 
-2.48.1
+2.51.1

@@ -1,7 +1,7 @@
-From 78b88541c36957407e9b8786f9b73c25fe6b85dd Mon Sep 17 00:00:00 2001
+From d9242056b580cc994661c41344c9ad51b636b0e5 Mon Sep 17 00:00:00 2001
 From: Eric Kilmer <eric.d.kilmer@gmail.com>
 Date: Sat, 8 Feb 2025 17:59:57 -0500
-Subject: [PATCH 6/6] decompiler: Fix strict weak ordering TypePartialEnum
+Subject: [PATCH 5/7] decompiler: Fix strict weak ordering TypePartialEnum

 This fixes Windows Debug error encountered in testing where it was
 complaining about lack of strict weak ordering.
@@ -10,10 +10,10 @@ complaining about lack of strict weak ordering.
 1 file changed, 1 insertion(+)

 diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/type.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/type.cc
-index f25b019a4f..2f1337a740 100644
+index 2d48650e70..4a52633ebf 100644
 --- a/Ghidra/Features/Decompiler/src/decompile/cpp/type.cc
 +++ b/Ghidra/Features/Decompiler/src/decompile/cpp/type.cc
-@@ -2300,6 +2300,7 @@ int4 TypePartialEnum::compareDependency(const Datatype &op) const
+@@ -2703,6 +2703,7 @@ int4 TypePartialEnum::compareDependency(const Datatype &op) const
 
 {
   if (submeta != op.getSubMeta()) return (submeta < op.getSubMeta()) ? -1 : 1;
@@ -22,5 +22,5 @@ index f25b019a4f..2f1337a740 100644
   if (parent != tp->parent) return (parent < tp->parent) ? -1 : 1;	// Compare absolute pointers
   if (offset != tp->offset) return (offset < tp->offset) ? -1 : 1;
 -- 
-2.48.1
+2.51.1

@@ -0,0 +1,29 @@
+From f2fdafbd981a441c35ab243bcb74872febd6bbd4 Mon Sep 17 00:00:00 2001
+From: "github-actions[bot]"
+ <41898282+github-actions[bot]@users.noreply.github.com>
+Date: Wed, 25 Feb 2026 02:29:10 +0000
+Subject: [PATCH 6/7] decompiler: Fix strict weak ordering PullRecord
+
+When both readOp pointers are null, PullRecord::operator< incorrectly
+returns true, violating strict weak ordering (irreflexivity). This is
+caught by libc++ debug mode hardening assertions at pullList.sort().
+---
+ Ghidra/Features/Decompiler/src/decompile/cpp/bitfield.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/bitfield.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/bitfield.cc
+index add61c741b..3e01d2e045 100644
+--- a/Ghidra/Features/Decompiler/src/decompile/cpp/bitfield.cc
+++ b/Ghidra/Features/Decompiler/src/decompile/cpp/bitfield.cc
+@@ -1058,7 +1058,7 @@ bool BitFieldPullTransform::PullRecord::operator<(const PullRecord &op2) const
+       return (readOp->getSeqNum() < op2.readOp->getSeqNum());
+   }
+   else if (readOp == (PcodeOp *)0)
+-    return true;
+    return (op2.readOp != (PcodeOp *)0);
+   else if (op2.readOp == (PcodeOp *)0)
+     return false;
+   return false;
+-- 
+2.51.1
+
@@ -0,0 +1,29 @@
+From a44beeb3a2569887c33d2dfd509c0d103bd6c447 Mon Sep 17 00:00:00 2001
+From: "github-actions[bot]"
+ <41898282+github-actions[bot]@users.noreply.github.com>
+Date: Wed, 25 Feb 2026 02:43:17 +0000
+Subject: [PATCH 7/7] decompiler: Fix strict weak ordering compareFinalOrder
+
+FlowBlock::compareFinalOrder returns true when both blocks have index 0,
+violating strict weak ordering (irreflexivity). This is caught by libc++
+debug mode hardening assertions during BlockGraph::orderBlocks sort.
+---
+ Ghidra/Features/Decompiler/src/decompile/cpp/block.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/block.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/block.cc
+index bf7103d916..2e495d9c3f 100644
+--- a/Ghidra/Features/Decompiler/src/decompile/cpp/block.cc
+++ b/Ghidra/Features/Decompiler/src/decompile/cpp/block.cc
+@@ -709,7 +709,7 @@ string FlowBlock::typeToName(FlowBlock::block_type bt)
+ bool FlowBlock::compareFinalOrder(const FlowBlock *bl1,const FlowBlock *bl2)
+ 
+ {
+-  if (bl1->getIndex() == 0) return true; // Make sure the entry point comes first
+  if (bl1->getIndex() == 0) return (bl2->getIndex() != 0); // Make sure the entry point comes first
+   if (bl2->getIndex() == 0) return false;
+   PcodeOp *op1 = bl1->lastOp();
+   PcodeOp *op2 = bl2->lastOp();
+-- 
+2.51.1
+
@@ -0,0 +1,57 @@
+From 8afa7d89a368b358a5493b87804985ed9ac70a2f Mon Sep 17 00:00:00 2001
+From: "github-actions[bot]"
+ <41898282+github-actions[bot]@users.noreply.github.com>
+Date: Wed, 25 Feb 2026 20:41:10 +0000
+Subject: [PATCH] Fix UBSAN signed left shift errors
+
+Cast signed values to unsigned before left shifting to avoid undefined
+behavior when the signed value is negative or when the result cannot be
+represented in the signed type.
+
+Fixes runtime errors detected by UndefinedBehaviorSanitizer:
+- address.hh sign_extend(): left shift of negative value
+- address.hh sign_extend(): left shift cannot be represented in type 'intb'
+- slghpatexpress.cc LeftShiftExpression: left shift of negative value
+---
+ Ghidra/Features/Decompiler/src/decompile/cpp/address.hh       | 2 +-
+ .../Features/Decompiler/src/decompile/cpp/slghpatexpress.cc   | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/address.hh b/Ghidra/Features/Decompiler/src/decompile/cpp/address.hh
+index 45144daf3..0e75c68b8 100644
+--- a/Ghidra/Features/Decompiler/src/decompile/cpp/address.hh
+++ b/Ghidra/Features/Decompiler/src/decompile/cpp/address.hh
+@@ -544,7 +544,7 @@ inline intb sign_extend(intb val,int4 bit)
+
+ {
+   int4 sa = 8*sizeof(intb) - (bit+1);
+-  val = (val << sa) >> sa;
+  val = static_cast<intb>(static_cast<uintb>(val) << sa) >> sa;
+   return val;
+ }
+
+diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/slghpatexpress.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/slghpatexpress.cc
+index 941097859..93cce378a 100644
+--- a/Ghidra/Features/Decompiler/src/decompile/cpp/slghpatexpress.cc
+++ b/Ghidra/Features/Decompiler/src/decompile/cpp/slghpatexpress.cc
+@@ -969,7 +969,7 @@ intb LeftShiftExpression::getValue(ParserWalker &walker) const
+ {
+   intb leftval = getLeft()->getValue(walker);
+   intb rightval = getRight()->getValue(walker);
+-  return leftval << rightval;
+  return static_cast<intb>(static_cast<uintb>(leftval) << rightval);
+ }
+
+ intb LeftShiftExpression::getSubValue(const vector<intb> &replace,int4 &listpos) const
+@@ -977,7 +977,7 @@ intb LeftShiftExpression::getSubValue(const vector<intb> &replace,int4 &listpos)
+ {
+   intb leftval = getLeft()->getSubValue(replace,listpos); // Must be left first
+   intb rightval = getRight()->getSubValue(replace,listpos);
+-  return leftval << rightval;
+  return static_cast<intb>(static_cast<uintb>(leftval) << rightval);
+ }
+
+ void LeftShiftExpression::encode(Encoder &encoder) const
+--
+2.51.1
+
@@ -1,77 +1,17 @@
-From 87732ad7cb2b5ed01e47b3c0a19af14acbb382e9 Mon Sep 17 00:00:00 2001
+From 9d1e7b00e8f5dca987038a78fbac400c835a78be Mon Sep 17 00:00:00 2001
 From: Eric Kilmer <eric.d.kilmer@gmail.com>
 Date: Mon, 12 Aug 2024 12:02:35 -0400
-Subject: [PATCH 1/6] Fix UBSAN errors in decompiler
+Subject: [PATCH 1/5] Fix UBSAN errors in decompiler

 Co-authored-by: Alex Cameron <asc@tetsuo.sh>
 ---
- .../Decompiler/src/decompile/cpp/fspec.cc      |  8 ++++++--
- .../Decompiler/src/decompile/cpp/op.cc         |  6 +++++-
- .../Decompiler/src/decompile/cpp/opbehavior.cc |  8 +++++++-
 .../src/decompile/cpp/pcodecompile.cc          | 18 +++++++++++-------
- .../Decompiler/src/decompile/cpp/ruleaction.cc | 12 +++++++++---
 .../Decompiler/src/decompile/cpp/semantics.cc  |  2 ++
 .../Decompiler/src/decompile/cpp/semantics.hh  |  2 +-
 .../src/decompile/cpp/slgh_compile.cc          |  2 +-
- .../Decompiler/src/decompile/cpp/type.cc       |  2 +-
 .../src/decompile/unittests/testfloatemu.cc    |  2 +-
- 10 files changed, 44 insertions(+), 18 deletions(-)
+ 5 files changed, 16 insertions(+), 10 deletions(-)

-diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/fspec.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/fspec.cc
-index 3e9f310446..c903810382 100644
--- a/Ghidra/Features/Decompiler/src/decompile/cpp/fspec.cc
-+++ b/Ghidra/Features/Decompiler/src/decompile/cpp/fspec.cc
-@@ -2868,8 +2868,12 @@ void ProtoModelMerged::decode(Decoder &decoder)
-     modellist.push_back(mymodel);
-   }
-   decoder.closeElement(elemId);
-  ((ParamListMerged *)input)->finalize();
-  ((ParamListMerged *)output)->finalize();
-+  if (input->getType() == ParamList::p_merged) {
-+    ((ParamListMerged *)input)->finalize();
-+  }
-+  if (output->getType() == ParamList::p_merged) {
-+    ((ParamListMerged *)output)->finalize();
-+  }
- }
- 
- void ParameterBasic::setTypeLock(bool val)
-diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/op.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/op.cc
-index e165951fe6..00169e22e5 100644
--- a/Ghidra/Features/Decompiler/src/decompile/cpp/op.cc
-+++ b/Ghidra/Features/Decompiler/src/decompile/cpp/op.cc
-@@ -666,7 +666,11 @@ uintb PcodeOp::getNZMaskLocal(bool cliploop) const
-     break;
-   case CPUI_PIECE:
-     resmask = getIn(0)->getNZMask();
-    resmask <<= 8*getIn(1)->getSize();
-+    if (8*getIn(1)->getSize() < sizeof(resmask)) {
-+      resmask <<= 8*getIn(1)->getSize();
-+    } else {
-+      resmask = 0;
-+    }
-     resmask |= getIn(1)->getNZMask();
-     break;
-   case CPUI_INT_MULT:
-diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/opbehavior.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/opbehavior.cc
-index aebcfd9103..6c47e6eb15 100644
--- a/Ghidra/Features/Decompiler/src/decompile/cpp/opbehavior.cc
-+++ b/Ghidra/Features/Decompiler/src/decompile/cpp/opbehavior.cc
-@@ -746,7 +746,13 @@ uintb OpBehaviorPiece::evaluateBinary(int4 sizeout,int4 sizein,uintb in1,uintb i
- uintb OpBehaviorSubpiece::evaluateBinary(int4 sizeout,int4 sizein,uintb in1,uintb in2) const
- 
- {
-  uintb res = (in1>>(in2*8)) & calc_mask(sizeout);
-+  uintb res = in1;
-+  if (in2 < sizeof(in1)) {
-+    res >>= (in2*8);
-+  } else {
-+    res = 0;
-+  }
-+  res &= calc_mask(sizeout);
-   return res;
- }
- 
 diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/pcodecompile.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/pcodecompile.cc
 index ca9d71ab99..85d4dd281d 100644
 --- a/Ghidra/Features/Decompiler/src/decompile/cpp/pcodecompile.cc
@@ -115,36 +55,6 @@ index ca9d71ab99..85d4dd281d 100644
   force_size(res->outvn,ConstTpl(ConstTpl::real,finalsize),*res->ops);
   return res;
 }
-diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/ruleaction.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/ruleaction.cc
-index b7fda34cc9..a3d164aa2d 100644
--- a/Ghidra/Features/Decompiler/src/decompile/cpp/ruleaction.cc
-+++ b/Ghidra/Features/Decompiler/src/decompile/cpp/ruleaction.cc
-@@ -976,7 +976,12 @@ int4 RulePullsubIndirect::applyOp(PcodeOp *op,Funcdata &data)
-   Varnode *outvn = op->getOut();
-   if (outvn->isPrecisLo()||outvn->isPrecisHi()) return 0; // Don't pull apart double precision object
- 
-  uintb consume = calc_mask(newSize) << 8 * minByte;
-+  uintb consume = calc_mask(newSize);
-+  if (8 * minByte < sizeof(consume)) {
-+    consume <<= 8 * minByte;
-+  } else {
-+    consume = 0;
-+  }
-   consume = ~consume;
-   if ((consume & indir->getIn(0)->getConsume())!=0) return 0;
- 
-@@ -7288,8 +7293,9 @@ int4 RulePtrsubCharConstant::applyOp(PcodeOp *op,Funcdata &data)
-   Varnode *sb = op->getIn(0);
-   Datatype *sbType = sb->getTypeReadFacing(op);
-   if (sbType->getMetatype() != TYPE_PTR) return 0;
-  TypeSpacebase *sbtype = (TypeSpacebase *)((TypePointer *)sbType)->getPtrTo();
-  if (sbtype->getMetatype() != TYPE_SPACEBASE) return 0;
-+  Datatype *sbTypePtr = ((TypePointer *)sbType)->getPtrTo();
-+  if (sbTypePtr->getMetatype() != TYPE_SPACEBASE) return 0;
-+  TypeSpacebase *sbtype = (TypeSpacebase *)sbTypePtr;
-   Varnode *vn1 = op->getIn(1);
-   if (!vn1->isConstant()) return 0;
-   Varnode *outvn = op->getOut();
 diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/semantics.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/semantics.cc
 index cd9b9835b1..8a4616c3b9 100644
 --- a/Ghidra/Features/Decompiler/src/decompile/cpp/semantics.cc
@@ -192,20 +102,6 @@ index 50d85e22ba..9f3b456229 100644
     if (sym->getRefCount() == 0)
       msg << "   Label <" << sym->getName() << "> was placed but not used" << endl;
     else if (!sym->isPlaced())
-diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/type.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/type.cc
-index 88ca8e36c8..f25b019a4f 100644
--- a/Ghidra/Features/Decompiler/src/decompile/cpp/type.cc
-+++ b/Ghidra/Features/Decompiler/src/decompile/cpp/type.cc
-@@ -3728,8 +3728,8 @@ void TypeFactory::recalcPointerSubmeta(Datatype *base,sub_metatype sub)
-   top.submeta = sub;			// Search on the incorrect submeta
-   iter = tree.lower_bound(&top);
-   while(iter != tree.end()) {
-+    if ((*iter)->getMetatype() != TYPE_PTR) break;
-     TypePointer *ptr = (TypePointer *)*iter;
-    if (ptr->getMetatype() != TYPE_PTR) break;
-     if (ptr->ptrto != base) break;
-     ++iter;
-     if (ptr->submeta == sub) {
 diff --git a/Ghidra/Features/Decompiler/src/decompile/unittests/testfloatemu.cc b/Ghidra/Features/Decompiler/src/decompile/unittests/testfloatemu.cc
 index 2571f55f1a..fe40e22b1b 100644
 --- a/Ghidra/Features/Decompiler/src/decompile/unittests/testfloatemu.cc
@@ -220,5 +116,5 @@ index 2571f55f1a..fe40e22b1b 100644
         uintb true_result = ((uintb)(int32_t)f) & 0xffffffff;
         uintb encoding = format.getEncoding(f);
 -- 
-2.48.1
+2.50.1

@@ -1,7 +1,7 @@
-From 1a7a46df85bcb1bd8ccdf581efbeadbb0d95a7d4 Mon Sep 17 00:00:00 2001
+From 729f72060849dc4f29e89b1c76a980563ffd3e2a Mon Sep 17 00:00:00 2001
 From: Alex Cameron <asc@tetsuo.sh>
 Date: Wed, 3 Aug 2022 20:01:18 +1000
-Subject: [PATCH 2/6] Use `stroull` instead of `stroul` to parse address
+Subject: [PATCH 2/5] Use `stroull` instead of `stroul` to parse address
 offsets

 ---
@@ -34,5 +34,5 @@ index dbaa2e775f..72927bf379 100644
     enddata = (const char *) tmpdata;
     if (enddata - s.c_str() == s.size()) { // If no size or offset override
 -- 
-2.48.1
+2.50.1

@@ -1,7 +1,7 @@
-From 2a8f30f31c24ecc7bd499648b97bb8b0c2705b78 Mon Sep 17 00:00:00 2001
+From 39cfff6f08dad8a85f992e09b3e26716c9173bf7 Mon Sep 17 00:00:00 2001
 From: Eric Kilmer <eric.d.kilmer@gmail.com>
 Date: Tue, 29 Oct 2024 17:51:09 -0400
-Subject: [PATCH 4/6] Ignore floating point test due to compilation differences
+Subject: [PATCH 3/5] Ignore floating point test due to compilation differences

 This test fails on macOS and Windows. I'm unsure whether it's an OS or
 compiler issue.
@@ -24,5 +24,5 @@ index fe40e22b1b..91440e2510 100644
   ASSERT_EQUALS(ff.printDecimal(f2, false), "0.33333334");
   double f3 = doubleFromRawBits(0x3fd0000000000000);
 -- 
-2.48.1
+2.50.1

@@ -1,36 +0,0 @@
-From 53863004fc50edcfc0e42ca0c2c95aff86d4c3d0 Mon Sep 17 00:00:00 2001
-From: Eric Kilmer <eric.d.kilmer@gmail.com>
-Date: Tue, 29 Oct 2024 15:30:57 -0400
-Subject: [PATCH 3/6] Use string resize instead of reserve
-
-assign will fix up the size to hold all of what's copied
---
- Ghidra/Features/Decompiler/src/decompile/cpp/stringmanage.cc | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/stringmanage.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/stringmanage.cc
-index 5f5fa0c7b3..4cd77156f2 100644
--- a/Ghidra/Features/Decompiler/src/decompile/cpp/stringmanage.cc
-+++ b/Ghidra/Features/Decompiler/src/decompile/cpp/stringmanage.cc
-@@ -67,7 +67,6 @@ void StringManager::assignStringData(StringData &data,const uint1 *buf,int4 size
- 
- {
-   if (charsize == 1 && numChars < maximumChars) {
-    data.byteData.reserve(size);
-     data.byteData.assign(buf,buf+size);
-   }
-   else {
-@@ -77,9 +76,9 @@ void StringManager::assignStringData(StringData &data,const uint1 *buf,int4 size
-       return;
-     string resString = s.str();
-     int4 newSize = resString.size();
-    data.byteData.reserve(newSize + 1);
-     const uint1 *ptr = (const uint1 *)resString.c_str();
-     data.byteData.assign(ptr,ptr+newSize);
-+    data.byteData.resize(newSize + 1, 0);
-     data.byteData[newSize] = 0;		// Make sure there is a null terminator
-   }
-   data.isTruncated = (numChars >= maximumChars);
-- 
-2.48.1
-
@@ -1,7 +1,7 @@
-From 04cca72897d9088713a6e2dadb2774ad20ae7703 Mon Sep 17 00:00:00 2001
+From 2aa4395ef8874ee9890126f4bdad0d71adf9eacc Mon Sep 17 00:00:00 2001
 From: Eric Kilmer <eric.d.kilmer@gmail.com>
 Date: Wed, 30 Oct 2024 14:26:57 -0400
-Subject: [PATCH 5/6] Allow positive or negative NAN in decompiler floating
+Subject: [PATCH 4/5] Allow positive or negative NAN in decompiler floating
 point test

 At least on Apple Silicon, this test reports positive NAN.
@@ -33,5 +33,5 @@ index f8108d3d32..1060a3e193 100644
 <stringmatch name="Float print #14" min="1" max="1">double7 = 3.1415926535897933e-06;</stringmatch>
 </decompilertest>
 -- 
-2.48.1
+2.50.1

@@ -1,7 +1,7 @@
-From a7dee0fbb1838e4e22a1c970718b84976ffb2932 Mon Sep 17 00:00:00 2001
+From 2a6bd0a0ad7797160db887bba7137b77aa148ba5 Mon Sep 17 00:00:00 2001
 From: Eric Kilmer <eric.d.kilmer@gmail.com>
 Date: Sat, 8 Feb 2025 17:59:57 -0500
-Subject: [PATCH 6/6] decompiler: Fix strict weak ordering TypePartialEnum
+Subject: [PATCH 5/5] decompiler: Fix strict weak ordering TypePartialEnum

 This fixes Windows Debug error encountered in testing where it was
 complaining about lack of strict weak ordering.
@@ -10,10 +10,10 @@ complaining about lack of strict weak ordering.
 1 file changed, 1 insertion(+)

 diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/type.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/type.cc
-index 7f654c220b..3f10c78c2f 100644
+index 962c525b7f..7db5024b54 100644
 --- a/Ghidra/Features/Decompiler/src/decompile/cpp/type.cc
 +++ b/Ghidra/Features/Decompiler/src/decompile/cpp/type.cc
-@@ -2300,6 +2300,7 @@ int4 TypePartialEnum::compareDependency(const Datatype &op) const
+@@ -2303,6 +2303,7 @@ int4 TypePartialEnum::compareDependency(const Datatype &op) const
 
 {
   if (submeta != op.getSubMeta()) return (submeta < op.getSubMeta()) ? -1 : 1;
@@ -22,5 +22,5 @@ index 7f654c220b..3f10c78c2f 100644
   if (parent != tp->parent) return (parent < tp->parent) ? -1 : 1;	// Compare absolute pointers
   if (offset != tp->offset) return (offset < tp->offset) ? -1 : 1;
 -- 
-2.48.1
+2.50.1

@@ -0,0 +1,29 @@
+From c435df4c0dbab80d8ff85e364cea9b59bf7010a1 Mon Sep 17 00:00:00 2001
+From: "github-actions[bot]"
+ <41898282+github-actions[bot]@users.noreply.github.com>
+Date: Wed, 25 Feb 2026 22:22:05 +0000
+Subject: [PATCH] decompiler: Fix strict weak ordering compareFinalOrder
+
+FlowBlock::compareFinalOrder returns true when both blocks have index 0,
+violating strict weak ordering (irreflexivity). This is caught by libc++
+debug mode hardening assertions during BlockGraph::orderBlocks sort.
+---
+ Ghidra/Features/Decompiler/src/decompile/cpp/block.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/block.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/block.cc
+index bf7103d91..2e495d9c3 100644
+--- a/Ghidra/Features/Decompiler/src/decompile/cpp/block.cc
+++ b/Ghidra/Features/Decompiler/src/decompile/cpp/block.cc
+@@ -709,7 +709,7 @@ string FlowBlock::typeToName(FlowBlock::block_type bt)
+ bool FlowBlock::compareFinalOrder(const FlowBlock *bl1,const FlowBlock *bl2)
+ 
+ {
+-  if (bl1->getIndex() == 0) return true; // Make sure the entry point comes first
+  if (bl1->getIndex() == 0) return (bl2->getIndex() != 0); // Make sure the entry point comes first
+   if (bl2->getIndex() == 0) return false;
+   PcodeOp *op1 = bl1->lastOp();
+   PcodeOp *op2 = bl2->lastOp();
+-- 
+2.51.1
+
@@ -0,0 +1,57 @@
+From 8afa7d89a368b358a5493b87804985ed9ac70a2f Mon Sep 17 00:00:00 2001
+From: "github-actions[bot]"
+ <41898282+github-actions[bot]@users.noreply.github.com>
+Date: Wed, 25 Feb 2026 20:41:10 +0000
+Subject: [PATCH] Fix UBSAN signed left shift errors
+
+Cast signed values to unsigned before left shifting to avoid undefined
+behavior when the signed value is negative or when the result cannot be
+represented in the signed type.
+
+Fixes runtime errors detected by UndefinedBehaviorSanitizer:
+- address.hh sign_extend(): left shift of negative value
+- address.hh sign_extend(): left shift cannot be represented in type 'intb'
+- slghpatexpress.cc LeftShiftExpression: left shift of negative value
+---
+ Ghidra/Features/Decompiler/src/decompile/cpp/address.hh       | 2 +-
+ .../Features/Decompiler/src/decompile/cpp/slghpatexpress.cc   | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/address.hh b/Ghidra/Features/Decompiler/src/decompile/cpp/address.hh
+index 45144daf3..0e75c68b8 100644
+--- a/Ghidra/Features/Decompiler/src/decompile/cpp/address.hh
+++ b/Ghidra/Features/Decompiler/src/decompile/cpp/address.hh
+@@ -544,7 +544,7 @@ inline intb sign_extend(intb val,int4 bit)
+ 
+ {
+   int4 sa = 8*sizeof(intb) - (bit+1);
+-  val = (val << sa) >> sa;
+  val = static_cast<intb>(static_cast<uintb>(val) << sa) >> sa;
+   return val;
+ }
+ 
+diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/slghpatexpress.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/slghpatexpress.cc
+index 941097859..93cce378a 100644
+--- a/Ghidra/Features/Decompiler/src/decompile/cpp/slghpatexpress.cc
+++ b/Ghidra/Features/Decompiler/src/decompile/cpp/slghpatexpress.cc
+@@ -969,7 +969,7 @@ intb LeftShiftExpression::getValue(ParserWalker &walker) const
+ {
+   intb leftval = getLeft()->getValue(walker);
+   intb rightval = getRight()->getValue(walker);
+-  return leftval << rightval;
+  return static_cast<intb>(static_cast<uintb>(leftval) << rightval);
+ }
+ 
+ intb LeftShiftExpression::getSubValue(const vector<intb> &replace,int4 &listpos) const
+@@ -977,7 +977,7 @@ intb LeftShiftExpression::getSubValue(const vector<intb> &replace,int4 &listpos)
+ {
+   intb leftval = getLeft()->getSubValue(replace,listpos); // Must be left first
+   intb rightval = getRight()->getSubValue(replace,listpos);
+-  return leftval << rightval;
+  return static_cast<intb>(static_cast<uintb>(leftval) << rightval);
+ }
+ 
+ void LeftShiftExpression::encode(Encoder &encoder) const
+-- 
+2.51.1
+
@@ -22,7 +22,7 @@ set_property(CACHE sleigh_RELEASE_TYPE PROPERTY STRINGS "stable" "HEAD")
 find_package(Git REQUIRED)

 # Ghidra pinned stable version commit
-set(ghidra_version "11.3.1")
+set(ghidra_version "12.0.4")
 set(ghidra_git_tag "Ghidra_${ghidra_version}_build")
 set(ghidra_shallow TRUE)

@@ -40,19 +40,20 @@ set(ghidra_patches
  "${GIT_EXECUTABLE}" am --ignore-space-change --ignore-whitespace --no-gpg-sign
  "${CMAKE_CURRENT_LIST_DIR}/patches/stable/0001-Fix-UBSAN-errors-in-decompiler.patch"
  "${CMAKE_CURRENT_LIST_DIR}/patches/stable/0002-Use-stroull-instead-of-stroul-to-parse-address-offse.patch"
-  "${CMAKE_CURRENT_LIST_DIR}/patches/stable/0003-Use-string-resize-instead-of-reserve.patch"
-  "${CMAKE_CURRENT_LIST_DIR}/patches/stable/0004-Ignore-floating-point-test-due-to-compilation-differ.patch"
-  "${CMAKE_CURRENT_LIST_DIR}/patches/stable/0005-Allow-positive-or-negative-NAN-in-decompiler-floatin.patch"
-  "${CMAKE_CURRENT_LIST_DIR}/patches/stable/0006-decompiler-Fix-strict-weak-ordering-TypePartialEnum.patch"
+  "${CMAKE_CURRENT_LIST_DIR}/patches/stable/0003-Ignore-floating-point-test-due-to-compilation-differ.patch"
+  "${CMAKE_CURRENT_LIST_DIR}/patches/stable/0004-Allow-positive-or-negative-NAN-in-decompiler-floatin.patch"
+  "${CMAKE_CURRENT_LIST_DIR}/patches/stable/0005-decompiler-Fix-strict-weak-ordering-TypePartialEnum.patch"
+  "${CMAKE_CURRENT_LIST_DIR}/patches/stable/0006-decompiler-Fix-strict-weak-ordering-compareFinalOrde.patch"
+  "${CMAKE_CURRENT_LIST_DIR}/patches/stable/0007-Fix-UBSAN-signed-left-shift-errors.patch"
 )

 # Ghidra pinned commits used for pinning last known working HEAD commit
 if("${sleigh_RELEASE_TYPE}" STREQUAL "HEAD")
  # TODO: Try to remember to look at Ghidra/application.properties
  # TODO: CMake only likes numeric characters in the version string....
-  set(ghidra_head_version "11.4")
+  set(ghidra_head_version "12.1")
  set(ghidra_version "${ghidra_head_version}")
-  set(ghidra_head_git_tag "aaf910bd82d1fd91387e002502590430be2ea658")
+  set(ghidra_head_git_tag "fc73f70b9cb4523329b1629b2753f87ae734521d")
  set(ghidra_git_tag "${ghidra_head_git_tag}")
  set(ghidra_shallow FALSE)
  set(ghidra_patches
@@ -61,10 +62,12 @@ if("${sleigh_RELEASE_TYPE}" STREQUAL "HEAD")
    "${GIT_EXECUTABLE}" am --ignore-space-change --ignore-whitespace --no-gpg-sign
    "${CMAKE_CURRENT_LIST_DIR}/patches/HEAD/0001-Fix-UBSAN-errors-in-decompiler.patch"
    "${CMAKE_CURRENT_LIST_DIR}/patches/HEAD/0002-Use-stroull-instead-of-stroul-to-parse-address-offse.patch"
-    "${CMAKE_CURRENT_LIST_DIR}/patches/HEAD/0003-Use-string-resize-instead-of-reserve.patch"
-    "${CMAKE_CURRENT_LIST_DIR}/patches/HEAD/0004-Ignore-floating-point-test-due-to-compilation-differ.patch"
-    "${CMAKE_CURRENT_LIST_DIR}/patches/HEAD/0005-Allow-positive-or-negative-NAN-in-decompiler-floatin.patch"
-    "${CMAKE_CURRENT_LIST_DIR}/patches/HEAD/0006-decompiler-Fix-strict-weak-ordering-TypePartialEnum.patch"
+    "${CMAKE_CURRENT_LIST_DIR}/patches/HEAD/0003-Ignore-floating-point-test-due-to-compilation-differ.patch"
+    "${CMAKE_CURRENT_LIST_DIR}/patches/HEAD/0004-Allow-positive-or-negative-NAN-in-decompiler-floatin.patch"
+    "${CMAKE_CURRENT_LIST_DIR}/patches/HEAD/0005-decompiler-Fix-strict-weak-ordering-TypePartialEnum.patch"
+    "${CMAKE_CURRENT_LIST_DIR}/patches/HEAD/0006-decompiler-Fix-strict-weak-ordering-PullRecord.patch"
+    "${CMAKE_CURRENT_LIST_DIR}/patches/HEAD/0007-decompiler-Fix-strict-weak-ordering-compareFinalOrde.patch"
+    "${CMAKE_CURRENT_LIST_DIR}/patches/HEAD/0008-Fix-UBSAN-signed-left-shift-errors.patch"
  )
  string(SUBSTRING "${ghidra_git_tag}" 0 7 ghidra_short_commit)
 else()
@@ -174,11 +177,13 @@ set(sleigh_deccore_source_list
  "${library_root}/signature.cc"
  "${library_root}/multiprecision.cc"
  "${library_root}/constseq.cc"
+  "${library_root}/expression.cc"
 )
-#if("${sleigh_RELEASE_TYPE}" STREQUAL "HEAD")
-#  list(APPEND sleigh_deccore_source_list
-#  )
-#endif()
+if("${sleigh_RELEASE_TYPE}" STREQUAL "HEAD")
+  list(APPEND sleigh_deccore_source_list
+    "${library_root}/bitfield.cc"
+  )
+endif()

 set(sleigh_extra_source_list
  "${library_root}/callgraph.cc"
@@ -76,6 +76,8 @@ set(spec_file_list
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/MIPS/data/languages/mips32le.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/MIPS/data/languages/mips64be.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/MIPS/data/languages/mips64le.slaspec"
+  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/NDS32/data/languages/nds32be.slaspec"
+  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/NDS32/data/languages/nds32le.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/PA-RISC/data/languages/pa-risc32be.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/PIC/data/languages/PIC24E.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/PIC/data/languages/PIC24F.slaspec"
@@ -108,6 +110,7 @@ set(spec_file_list
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/PowerPC/data/languages/ppc_64_isa_le.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/PowerPC/data/languages/ppc_64_isa_vle_be.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/PowerPC/data/languages/ppc_64_le.slaspec"
+  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/RISCV/data/languages/andestar_v5.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/RISCV/data/languages/riscv.ilp32d.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/RISCV/data/languages/riscv.lp64d.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/Sparc/data/languages/SparcV9_32.slaspec"
@@ -121,6 +124,7 @@ set(spec_file_list
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/TI_MSP430/data/languages/TI_MSP430X.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/Toy/data/languages/toy64_be.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/Toy/data/languages/toy64_be_harvard.slaspec"
+  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/Toy/data/languages/toy64_be_harvard_rev.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/Toy/data/languages/toy64_le.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/Toy/data/languages/toy_be.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/Toy/data/languages/toy_be_posStack.slaspec"
@@ -136,6 +140,7 @@ set(spec_file_list
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/Xtensa/data/languages/xtensa_le.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/Z80/data/languages/z180.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/Z80/data/languages/z80.slaspec"
+  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/eBPF/data/languages/eBPF_be.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/eBPF/data/languages/eBPF_le.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/tricore/data/languages/tricore.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/x86/data/languages/x86-64.slaspec"
@@ -76,6 +76,8 @@ set(spec_file_list
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/MIPS/data/languages/mips32le.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/MIPS/data/languages/mips64be.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/MIPS/data/languages/mips64le.slaspec"
+  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/NDS32/data/languages/nds32be.slaspec"
+  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/NDS32/data/languages/nds32le.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/PA-RISC/data/languages/pa-risc32be.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/PIC/data/languages/PIC24E.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/PIC/data/languages/PIC24F.slaspec"
@@ -108,6 +110,7 @@ set(spec_file_list
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/PowerPC/data/languages/ppc_64_isa_le.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/PowerPC/data/languages/ppc_64_isa_vle_be.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/PowerPC/data/languages/ppc_64_le.slaspec"
+  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/RISCV/data/languages/andestar_v5.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/RISCV/data/languages/riscv.ilp32d.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/RISCV/data/languages/riscv.lp64d.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/Sparc/data/languages/SparcV9_32.slaspec"
@@ -121,6 +124,7 @@ set(spec_file_list
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/TI_MSP430/data/languages/TI_MSP430X.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/Toy/data/languages/toy64_be.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/Toy/data/languages/toy64_be_harvard.slaspec"
+  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/Toy/data/languages/toy64_be_harvard_rev.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/Toy/data/languages/toy64_le.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/Toy/data/languages/toy_be.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/Toy/data/languages/toy_be_posStack.slaspec"
@@ -136,6 +140,7 @@ set(spec_file_list
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/Xtensa/data/languages/xtensa_le.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/Z80/data/languages/z180.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/Z80/data/languages/z80.slaspec"
+  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/eBPF/data/languages/eBPF_be.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/eBPF/data/languages/eBPF_le.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/tricore/data/languages/tricore.slaspec"
  "${ghidrasource_SOURCE_DIR}/Ghidra/Processors/x86/data/languages/x86-64.slaspec"
@@ -10,7 +10,7 @@
 # Tests from ghidra repo
 #

-add_executable(sleigh_ghidra_test
+add_executable(sleigh_decomp_test
  ${sleigh_core_source_list}
  ${sleigh_deccore_source_list}
  ${sleigh_source_list}
@@ -27,31 +27,31 @@ add_executable(sleigh_ghidra_test
 )

 # if(sleigh_RELEASE_IS_HEAD)
-#   target_sources(sleigh_ghidra_test PRIVATE
+#   target_sources(sleigh_decomp_test PRIVATE
 #   )
 # endif()

-target_compile_features(sleigh_ghidra_test PRIVATE cxx_std_11)
-target_include_directories(sleigh_ghidra_test PRIVATE "${library_root}")
+target_compile_features(sleigh_decomp_test PRIVATE cxx_std_11)
+target_include_directories(sleigh_decomp_test PRIVATE "${library_root}")
 include(CheckIncludeFileCXX)
 check_include_file_cxx(termios.h HAVE_TERMIOS_H)
 if(HAVE_TERMIOS_H)
-  target_compile_definitions(sleigh_ghidra_test PRIVATE
+  target_compile_definitions(sleigh_decomp_test PRIVATE
    __TERMINAL__
  )
 endif()
-sleigh_add_optional_defines(sleigh_ghidra_test PRIVATE)
+sleigh_add_optional_defines(sleigh_decomp_test PRIVATE)

-target_link_libraries(sleigh_ghidra_test PRIVATE ZLIB::ZLIB)
+target_link_libraries(sleigh_decomp_test PRIVATE ZLIB::ZLIB)

 add_test(
-  NAME sleigh_ghidra_unittest
-  COMMAND sleigh_ghidra_test -sleighpath "${PROJECT_BINARY_DIR}" unittests
+  NAME sleigh_decomp_unittest
+  COMMAND sleigh_decomp_test -sleighpath "${PROJECT_BINARY_DIR}" unittests
 )

 add_test(
-  NAME sleigh_ghidra_datatest
-  COMMAND sleigh_ghidra_test -sleighpath "${PROJECT_BINARY_DIR}"
+  NAME sleigh_decomp_datatest
+  COMMAND sleigh_decomp_test -sleighpath "${PROJECT_BINARY_DIR}"
    -path "${library_root}/../datatests"
    datatests
 )