Ghidra 12.0.4 (#403)

Prevents rpm and deb packages from being zipped

.claude/skills/debug-test-failures/SKILL.md

@@ -0,0 +1,214 @@
+---
+name: debug-test-failures
+version: "1.0.0"
+description: >
+  This skill should be used when debugging test failures, build errors, runtime
+  crashes, or assertion failures in the Sleigh/Ghidra decompiler project. It
+  covers building with libc++ hardening assertions (ci-head-assertions preset),
+  running ctest, obtaining stack traces from SIGABRT or crash signals, narrowing
+  down which datatest triggers a failure, creating patch files for upstream Ghidra
+  source in src/patches/, and recognizing common C++ bug patterns such as
+  strict-weak ordering violations in comparators. Relevant when encountering
+  "the build is failing", "ctest fails", decompiler crashes, or libc++ assertion
+  errors.
+---
+
+# Debugging Test Failures in the Sleigh Project
+
+This project builds the Ghidra decompiler as a standalone C++ library. Ghidra source
+is fetched via CMake FetchContent and patches are applied via `git am`. The key
+challenge is that bugs live in upstream Ghidra code and fixes must be packaged as
+patch files.
+
+## Quick Reference
+
+```bash
+# Build with libc++ assertions (catches strict-weak ordering, container misuse, etc.)
+cmake --preset ci-head-assertions
+cmake --build build/ci-head-assertions
+ctest --test-dir build/ci-head-assertions --output-on-failure
+
+# Clean cached Ghidra source (needed after adding/changing patches)
+rm -rf build/ci-head-assertions/_deps/ghidrasource-*
+
+# Where the Ghidra C++ source lives after fetch
+build/ci-head-assertions/_deps/ghidrasource-src/Ghidra/Features/Decompiler/src/decompile/cpp/
+```
+
+## 0. Prerequisites
+
+### Create `CMakeUserPresets.json`
+
+The `ci-head-assertions` preset used throughout this workflow lives in
+`CMakeUserPresets.json`, which is not version-controlled and does **not** exist on
+a fresh checkout. You must create it in the repository root before any build
+commands will work.
+
+Create `/workspaces/sleigh/CMakeUserPresets.json` with this content:
+
+```json
+{
+  "version": 2,
+  "cmakeMinimumRequired": { "major": 3, "minor": 18, "patch": 0 },
+  "configurePresets": [
+    {
+      "name": "libcxx",
+      "hidden": true,
+      "cacheVariables": {
+        "CMAKE_CXX_COMPILER": "clang++",
+        "CMAKE_CXX_FLAGS": "-stdlib=libc++ -D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_DEBUG -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3 -fstrict-flex-arrays=3 -fstack-clash-protection -fstack-protector-strong",
+        "CMAKE_EXE_LINKER_FLAGS": "-stdlib=libc++ -lc++abi",
+        "CMAKE_SHARED_LINKER_FLAGS": "-stdlib=libc++ -lc++abi"
+      }
+    },
+    {
+      "name": "ci-head",
+      "hidden": true,
+      "inherits": ["ci-ubuntu"],
+      "cacheVariables": { "sleigh_RELEASE_TYPE": "HEAD" }
+    },
+    {
+      "name": "ci-head-assertions",
+      "binaryDir": "${sourceDir}/build/${presetName}",
+      "inherits": ["libcxx", "ci-head"],
+      "generator": "Ninja",
+      "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" }
+    }
+  ]
+}
+```
+
+This file inherits from `ci-ubuntu` (defined in `CMakePresets.json`), so the
+repo's version-controlled presets must also be present (they always are in a
+normal checkout).
+
+## 1. Build Presets
+
+### The assertions preset
+
+The `ci-head-assertions` preset (created in Section 0 above) links against libc++
+with `_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_DEBUG`. This enables runtime
+checks that catch undefined behavior in STL usage — most importantly, it validates
+that comparators passed to `std::sort` satisfy strict-weak ordering.
+
+### Other useful presets
+
+| Preset | Source | Purpose |
+|--------|--------|---------|
+| `ci-head-assertions` | `CMakeUserPresets.json` | HEAD build with libc++ debug assertions (primary debugging preset) |
+| `ci-head` | `CMakeUserPresets.json` | HEAD build without assertions (faster, hidden/base preset) |
+| `ci-sanitize` | `CMakePresets.json` | Stable build with ASan + UBSan (repo-controlled) |
+
+Note: `ci-head-assertions` and `ci-head` are user-local presets created in
+Section 0. `ci-sanitize` is the only sanitizer preset version-controlled in the
+repo. Add your own sanitizer presets to `CMakeUserPresets.json` as needed.
+
+## 2. Running Tests
+
+```bash
+# Run all tests
+ctest --test-dir build/ci-head-assertions --output-on-failure
+
+# Run a specific test
+ctest --test-dir build/ci-head-assertions -R decomp_datatest --output-on-failure
+```
+
+There are typically 3 tests:
+
+| Test | What it does |
+|------|--------------|
+| `sleigh_decomp_unittest` | Unit tests (fast) |
+| `sleigh_decomp_datatest` | Decompiler data tests — runs XML test files from the `datatests/` directory |
+| `sleigh_namespace_std_test` | Namespace compilation test |
+
+The datatest exercises the most code paths and is the most likely to trigger
+assertion failures from comparator bugs.
+
+### How datatest works
+
+The test binary loads XML files from the datatests directory in alphabetical order.
+Each XML file contains binary data + expected decompiler output patterns. The test
+decompiles each function and checks the output against `<stringmatch>` patterns.
+
+The exact command ctest uses (check `tests/CTestTestfile.cmake` for the authoritative version):
+```bash
+./tests/sleigh_decomp_test \
+  -sleighpath <build-dir> \
+  -path <build-dir>/_deps/ghidrasource-src/Ghidra/Features/Decompiler/src/decompile/datatests \
+  datatests
+```
+
+## 3. Getting a Stack Trace from a Crash
+
+When a test crashes (e.g., SIGABRT from an assertion), you need a stack trace to
+identify which comparator or code path is the culprit. The test binaries may not
+have full debug symbols, so multiple techniques may be needed.
+
+See `references/stack-trace-techniques.md` for the full details on each method.
+Here's the summary:
+
+1. **gdb**: Use `gdb -batch` for full demangled backtraces — the simplest method
+2. **lldb**: Use `lldb -b` with `-k` for crash-time backtrace commands
+3. **LD_PRELOAD backtrace**: Build a small shared library that catches SIGABRT and
+   prints a backtrace — works when neither debugger can attach (containers)
+4. **addr2line**: Resolve raw hex addresses from the backtrace to function names
+   and source lines
+
+## 4. Narrowing Down Which Test Triggers a Crash
+
+> **Tip**: Often the stack trace from Section 3 identifies the exact function and
+> source line, making this step unnecessary. Use this binary search technique only
+> when the stack trace is unclear or you need to isolate which specific test input
+> triggers the crash.
+
+When you know the test crashes but can't immediately identify the cause from the
+stack trace, use binary search on the test XML files.
+
+The idea: copy subsets of test files to a temporary directory and run the test
+binary against that subset. Keep halving until you isolate the triggering file.
+
+```bash
+cd build/ci-head-assertions
+
+# Copy a subset of test files to a temporary directory
+mkdir -p /tmp/test_subset
+SRC=_deps/ghidrasource-src/Ghidra/Features/Decompiler/src/decompile/datatests
+for f in $(ls $SRC/*.xml | sort | sed -n '1,20p'); do cp "$f" /tmp/test_subset/; done
+
+# Run just those tests
+./tests/sleigh_decomp_test -sleighpath . -path /tmp/test_subset datatests
+```
+
+Important: some crashes only reproduce when specific files are processed together
+(accumulated state from earlier tests), so start by splitting the full set in half
+rather than testing individual files. If an individual file doesn't crash alone, try
+combining it with files that ran before it in alphabetical order.
+
+## 5. Creating Patches for Ghidra Source
+
+Patches live in `src/patches/HEAD/` (for HEAD builds) and `src/patches/stable/`
+(for stable builds). They are applied via `git am` during the CMake FetchContent
+step. See `references/patching-workflow.md` for the full step-by-step.
+
+### Quick workflow
+
+1. **Edit the bug** in `build/<preset>/_deps/ghidrasource-src/Ghidra/Features/Decompiler/src/decompile/cpp/`
+2. **Commit**: `cd` into the ghidrasource-src dir, `git add` + `git commit`
+3. **Generate patches**: `git format-patch -o /workspaces/sleigh/src/patches/HEAD/ <base_commit>..HEAD`
+4. **Register** the new patch in `src/setup-ghidra-source.cmake`
+5. **Clean and rebuild**: `rm -rf build/<preset>/_deps/ghidrasource-*` then reconfigure
+
+The base commit for HEAD is the `ghidra_head_git_tag` value in `src/setup-ghidra-source.cmake`.
+
+## 6. Common Bug Patterns
+
+The most common bugs are **strict-weak ordering violations** in comparators used
+by `std::sort` or `std::set`. These are caught by libc++ assertions at runtime.
+Key patterns include null pointer sentinels that don't check self-comparison,
+special index early-returns without checking the other operand, and unsafe casts
+in `compareDependency` methods of TypePartial* classes.
+
+See `references/common-bug-patterns.md` for detailed before/after code examples,
+real-world instances from the codebase (e.g., `PullRecord::operator<` in
+`bitfield.cc`, `FlowBlock::compareFinalOrder` in `block.cc`), and a systematic
+audit checklist for finding new comparator bugs.

.claude/skills/debug-test-failures/references/common-bug-patterns.md

@@ -0,0 +1,72 @@
+# Common Bug Patterns in Ghidra Decompiler Source
+
+## Strict-weak ordering violations
+
+The most common class of bugs caught by libc++ assertions. A comparator for
+`std::sort` or `std::set` must satisfy:
+
+- **Irreflexivity**: `comp(a, a)` must return `false`
+- **Asymmetry**: if `comp(a, b)` is true then `comp(b, a)` must be false
+- **Transitivity**: if `comp(a, b)` and `comp(b, c)` then `comp(a, c)`
+
+The libc++ assertion message looks like:
+```
+strict_weak_ordering_check.h:50: libc++ Hardening assertion
+  !__comp(*(__first + __a), *(__first + __b)) failed:
+  Your comparator is not a valid strict-weak ordering
+```
+
+### Pattern 1: Null pointer sentinel without self-check
+
+```cpp
+// BUG: when both are null, returns true (violates irreflexivity)
+if (ptr == nullptr)
+    return true;
+
+// FIX: only return true when the other is non-null
+if (ptr == nullptr)
+    return (other.ptr != nullptr);
+```
+
+Real example: `PullRecord::operator<` in `bitfield.cc` — when both `readOp`
+pointers were null, the comparator returned `true`.
+
+### Pattern 2: Special index without self-check
+
+```cpp
+// BUG: when comparing the entry point with itself, returns true
+if (bl1->getIndex() == 0) return true;
+
+// FIX: check that the other is different
+if (bl1->getIndex() == 0) return (bl2->getIndex() != 0);
+```
+
+Real example: `FlowBlock::compareFinalOrder` in `block.cc`.
+
+### Pattern 3: Unsafe cast in compareDependency (TypePartial* classes)
+
+The `TypePartialEnum`, `TypePartialStruct`, and `TypePartialUnion` classes have
+`compareDependency` methods that cast `op` to their own type. If `op` is actually
+the parent container type (not a partial), the cast accesses invalid memory.
+
+```cpp
+// BUG: casts op to TypePartialFoo without checking if op IS the container
+TypePartialFoo *tp = (TypePartialFoo *) &op;
+
+// FIX: add a guard before the cast
+if (container == &op) return 1;  // op is our container
+TypePartialFoo *tp = (TypePartialFoo *) &op;
+```
+
+Real example: `TypePartialEnum::compareDependency` in `type.cc` (patched in 0005).
+
+## How to audit comparators systematically
+
+1. Search for all `operator<`, `::compare`, and `::compareDependency` functions
+2. Search for all `sort(`, `stable_sort(`, and `std::set` usage to find which
+   comparators are actually used in sorting contexts
+3. For each comparator, mentally trace the case where both arguments are identical
+   — does it return false?
+4. Check for early-return branches that don't verify the other operand differs
+5. For `compareDependency` methods in TypePartial* classes, check for the
+   container-guard pattern before unsafe casts

.claude/skills/debug-test-failures/references/patching-workflow.md

@@ -0,0 +1,153 @@
+# Patching Workflow for Ghidra Source
+
+## Overview
+
+Ghidra source is fetched via CMake FetchContent from GitHub. Patches are applied
+automatically during the configure step using `git am`. The patch files live in
+the Sleigh repo and are version-controlled.
+
+## Directory Structure
+
+```
+src/patches/
+├── HEAD/       # Patches for the HEAD (development) Ghidra commit
+│   ├── 0001-Fix-UBSAN-errors-in-decompiler.patch
+│   ├── 0002-Use-stroull-instead-of-stroul-to-parse-address-offse.patch
+│   └── ...
+└── stable/     # Patches for the stable Ghidra release
+    ├── 0001-Fix-UBSAN-errors-in-decompiler.patch
+    └── ...
+```
+
+## Key Configuration
+
+The base commit and patch list are defined in `src/setup-ghidra-source.cmake`:
+
+- `ghidra_head_git_tag`: The pinned HEAD commit hash
+- `ghidra_version` / `ghidra_git_tag`: The stable version tag
+- `ghidra_patches`: The ordered list of patch files to apply
+
+## Step-by-Step: Creating a New Patch
+
+### 1. Identify the build preset
+
+Determine which build you're fixing. The Ghidra source checkout location depends
+on the preset:
+
+```
+build/<preset>/_deps/ghidrasource-src/
+```
+
+For example:
+```
+build/ci-head-assertions/_deps/ghidrasource-src/
+```
+
+The C++ source files are in:
+```
+build/<preset>/_deps/ghidrasource-src/Ghidra/Features/Decompiler/src/decompile/cpp/
+```
+
+### 2. Make the fix
+
+Edit the file directly in the Ghidra source checkout. The file already has all
+existing patches applied, so you're working on top of the current patch stack.
+
+### 3. Commit in the Ghidra source checkout
+
+```bash
+cd build/<preset>/_deps/ghidrasource-src
+
+# In a fresh container, git may require identity configuration before committing:
+# git config user.name "Your Name" && git config user.email "your@email.com"
+
+git add Ghidra/Features/Decompiler/src/decompile/cpp/<file>.cc
+git commit -m "decompiler: Short description
+
+Longer explanation of the bug and fix. Mention what assertion or test
+was failing and why."
+```
+
+Commit message conventions:
+- Prefix with `decompiler:` for decompiler fixes
+- First line should be concise (under 72 chars)
+- Body explains the *why*, not just the *what*
+
+### 4. Generate patch files
+
+Use `git format-patch` to regenerate ALL patches from the base commit:
+
+```bash
+# Get the base commit from src/setup-ghidra-source.cmake
+# For HEAD: it's the ghidra_head_git_tag value
+# For stable: it's the Ghidra_X.Y.Z_build tag
+
+git format-patch -o /workspaces/sleigh/src/patches/HEAD/ <base_commit>..HEAD
+```
+
+This regenerates patches 0001 through 000N. Existing patches will be regenerated
+with updated numbering in the `[PATCH N/M]` subject line, but the content stays
+the same. The new patch gets the next number.
+
+### 5. Register in CMake
+
+Edit `src/setup-ghidra-source.cmake` and add the new patch file to the appropriate
+`ghidra_patches` list:
+
+```cmake
+"${CMAKE_CURRENT_LIST_DIR}/patches/HEAD/0006-your-new-patch-name.patch"
+```
+
+### 6. Verify from scratch
+
+Clean the cached source so FetchContent re-fetches and applies all patches fresh:
+
+```bash
+rm -rf build/<preset>/_deps/ghidrasource-*
+cmake --preset <preset>
+cmake --build build/<preset>
+ctest --test-dir build/<preset> --output-on-failure
+```
+
+Watch the configure output for:
+```
+Applying: <your commit message>
+```
+
+If a patch fails to apply, you'll see `Patch failed at NNNN ...` during configure.
+
+## HEAD vs Stable
+
+- **HEAD patches** (`src/patches/HEAD/`): Applied to the development commit. May
+  include fixes for newly added files (e.g., `bitfield.cc` is HEAD-only).
+- **Stable patches** (`src/patches/stable/`): Applied to the release tag. These
+  are typically a subset of HEAD patches that also apply to stable.
+
+Check `src/setup-ghidra-source.cmake` to see which files are HEAD-only (look for
+`if("${sleigh_RELEASE_TYPE}" STREQUAL "HEAD")` blocks).
+
+## Troubleshooting
+
+### Patch fails to apply
+
+If `git am` fails during configure, the Ghidra source checkout may be in a dirty
+state. Clean it:
+
+```bash
+rm -rf build/<preset>/_deps/ghidrasource-*
+```
+
+Then reconfigure. If the patch itself is wrong, fix it and try again.
+
+### Patches conflict with new Ghidra commit
+
+When updating the pinned Ghidra HEAD commit, existing patches may not apply cleanly.
+See the [wiki](https://github.com/lifting-bits/sleigh/wiki/Patching-and-Updating)
+for the full rebasing procedure.
+
+### Source already patched from manual edits
+
+If you edited files directly in the checkout and then try to reconfigure, CMake
+may try to apply patches on top of already-patched code. Always clean the
+`_deps/ghidrasource-*` directories before reconfiguring after generating new
+patches.

.claude/skills/debug-test-failures/references/stack-trace-techniques.md

@@ -0,0 +1,149 @@
+# Stack Trace Techniques
+
+When a test binary crashes (typically SIGABRT from a libc++ hardening assertion),
+these techniques can be used to identify the exact function and source line.
+
+## Method 1: gdb (simplest)
+
+gdb in batch mode produces full demangled backtraces and works reliably in most
+environments, including containers with default seccomp profiles.
+
+```bash
+cd build/ci-head-assertions
+
+gdb -batch \
+  -ex "run -sleighpath . -path _deps/ghidrasource-src/Ghidra/Features/Decompiler/src/decompile/datatests datatests" \
+  -ex "bt" \
+  ./tests/sleigh_decomp_test
+```
+
+gdb will run the program, and when it crashes (e.g., SIGABRT), it automatically
+stops and prints the backtrace. The output includes fully demangled C++ function
+names and source locations.
+
+If gdb is unavailable, try lldb (Method 2). If neither debugger can attach
+(restricted ptrace), fall back to Method 3.
+
+## Method 2: lldb
+
+Use lldb in batch mode with the full test arguments. The key is to handle SIGABRT
+so it stops instead of terminating.
+
+**Important**: Use `-k` (one-line-on-crash) for the backtrace command, not `-o`.
+Commands passed via `-o` run sequentially after file load, but when lldb hits a
+signal stop, it enters its event loop and won't execute subsequent `-o` commands.
+The `-k` flag queues commands to run specifically when the target crashes.
+
+```bash
+cd build/ci-head-assertions
+
+lldb -b \
+  -o "process handle SIGABRT --stop true --pass false" \
+  -o "run -sleighpath . -path _deps/ghidrasource-src/Ghidra/Features/Decompiler/src/decompile/datatests datatests" \
+  -k "thread backtrace" \
+  -k "quit" \
+  -- ./tests/sleigh_decomp_test
+```
+
+If lldb shows full symbol names (function + file + line), you're done.
+
+If lldb fails with "personality set failed: Operation not permitted", this is
+common in Docker containers where ptrace is restricted. Use Method 3 instead.
+
+## Method 3: LD_PRELOAD Backtrace Library
+
+Build a small shared library that intercepts SIGABRT and prints a backtrace:
+
+```bash
+cat > /tmp/bt_preload.c << 'BTEOF'
+#include <signal.h>
+#include <execinfo.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+void bt_handler(int sig) {
+    void *array[50];
+    int size = backtrace(array, 50);
+    fprintf(stderr, "=== BACKTRACE (signal %d) ===\n", sig);
+    backtrace_symbols_fd(array, size, STDERR_FILENO);
+    fprintf(stderr, "=== END BACKTRACE ===\n");
+    signal(sig, SIG_DFL);
+    raise(sig);
+}
+
+__attribute__((constructor))
+void install_handler(void) {
+    signal(SIGABRT, bt_handler);
+}
+BTEOF
+gcc -shared -fPIC -o /tmp/bt_preload.so /tmp/bt_preload.c -rdynamic
+```
+
+Run the test with the preloaded library:
+
+```bash
+cd build/ci-head-assertions
+
+LD_PRELOAD=/tmp/bt_preload.so ./tests/sleigh_decomp_test \
+  -sleighpath . \
+  -path _deps/ghidrasource-src/Ghidra/Features/Decompiler/src/decompile/datatests \
+  datatests
+```
+
+The output will look like:
+
+```
+=== BACKTRACE (signal 6) ===
+./tests/sleigh_decomp_test(+0xf1a64)[0x55c312f02a64]
+./tests/sleigh_decomp_test(+0xf17ea)[0x55c312f027ea]
+./tests/sleigh_decomp_test(+0xef732)[0x55c312f00732]
+...
+=== END BACKTRACE ===
+```
+
+The addresses in parentheses (like `+0xf1a64`) are the key — these are offsets
+from the binary's load address.
+
+## Method 4: addr2line
+
+Resolve the hex offsets from the backtrace to function names and source lines:
+
+```bash
+for addr in 0xf1a64 0xf17ea 0xef732 0x31fbd9 0x31d536; do
+  echo -n "$addr: "
+  addr2line -e ./tests/sleigh_decomp_test -f -C "$addr"
+  echo "---"
+done
+```
+
+Flags:
+- `-e` specifies the executable
+- `-f` prints function names
+- `-C` demangles C++ names
+
+Example output:
+```
+0xf1a64: void std::__1::__check_strict_weak_ordering_sorted<...>(...)
+/usr/lib/llvm-21/bin/../include/c++/v1/__debug_utils/strict_weak_ordering_check.h:51
+---
+0x31fbd9: ghidra::BlockGraph::orderBlocks()
+/path/to/block.hh:431
+---
+```
+
+This tells you exactly which sort call and which comparator function triggered
+the assertion.
+
+## Putting It All Together
+
+Typical debugging flow:
+
+1. Run the test: `ctest --test-dir build/ci-head-assertions -R decomp_datatest --output-on-failure`
+2. See assertion failure → need stack trace
+3. Try gdb first (Method 1) — it typically gives the best output with full demangled symbols
+4. If gdb is unavailable, try lldb (Method 2)
+5. If neither debugger can attach → build LD_PRELOAD library (Method 3)
+6. Resolve addresses with addr2line (Method 4) if the backtrace only has hex offsets
+7. Now you know which comparator function and sort call is the problem
+8. Read the comparator code and check for strict-weak ordering violations

.devcontainer/Dockerfile

@@ -0,0 +1,37 @@
+FROM mcr.microsoft.com/devcontainers/base:ubuntu-24.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+ENV LLVM_VERSION=21
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        gnupg \
+        wget \
+        software-properties-common \
+    && wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | gpg --dearmor -o /usr/share/keyrings/llvm-archive-keyring.gpg \
+    && echo "deb [signed-by=/usr/share/keyrings/llvm-archive-keyring.gpg] http://apt.llvm.org/noble/ llvm-toolchain-noble-${LLVM_VERSION} main" \
+        > /etc/apt/sources.list.d/llvm.list \
+    && apt-get update && apt-get install -y \
+        clang-${LLVM_VERSION} \
+        clangd-${LLVM_VERSION} \
+        lld-${LLVM_VERSION} \
+        llvm-${LLVM_VERSION}-dev \
+        libclang-${LLVM_VERSION}-dev \
+        libc++-${LLVM_VERSION}-dev \
+        libc++abi-${LLVM_VERSION}-dev \
+        lldb-${LLVM_VERSION} \
+        cmake \
+        ninja-build \
+        git \
+        zlib1g-dev \
+        ccache \
+        doxygen \
+        graphviz \
+    && update-alternatives --install /usr/bin/cc cc /usr/bin/clang-${LLVM_VERSION} 100 \
+    && update-alternatives --install /usr/bin/c++ c++ /usr/bin/clang++-${LLVM_VERSION} 100 \
+    && update-alternatives --install /usr/bin/clang clang /usr/bin/clang-${LLVM_VERSION} 100 \
+    && update-alternatives --install /usr/bin/clang++ clang++ /usr/bin/clang++-${LLVM_VERSION} 100 \
+    && update-alternatives --install /usr/bin/lld lld /usr/bin/lld-${LLVM_VERSION} 100 \
+    && update-alternatives --install /usr/bin/lldb lldb /usr/bin/lldb-${LLVM_VERSION} 100 \
+    && update-alternatives --install /usr/bin/clangd clangd /usr/bin/clangd-${LLVM_VERSION} 100 \
+    && apt-get clean && rm -rf /var/lib/apt/lists/*

.devcontainer/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "sleigh",
+  "build": {
+    "dockerfile": "Dockerfile"
+  },
+  "runArgs": [
+    "--cap-add=SYS_PTRACE",
+    "--security-opt=seccomp=unconfined",
+    "--privileged" 
+  ],
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "ms-vscode.cmake-tools",
+        "llvm-vs-code-extensions.vscode-clangd",
+      ]
+    }
+  }
+}

.github/workflows/main.yml

@@ -13,6 +13,9 @@ on:
     branches:
       - "*"
 
+env:
+  LLVM_VERSION: 21
+
 jobs:
   build:
     runs-on: ${{ matrix.os }}
@@ -23,6 +26,11 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
         build_type: [RelWithDebInfo, Debug]
         release: [stable, HEAD]
+        exclude:
+          - os: ubuntu-latest
+            build_type: Debug
+          - os: macos-latest
+            build_type: Debug
 
     steps:
     - uses: actions/checkout@v6
@@ -214,10 +222,11 @@ jobs:
     # DEB Package
     - name: Upload the DEB package artifact (RelWithDebInfo only)
       if: matrix.build_type == 'RelWithDebInfo' && runner.os == 'Linux'
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: ${{ env.DEB_PACKAGE_NAME }}
         path: ${{ env.DEB_PACKAGE_PATH }}
+        archive: false
 
     - name: Release DEB package artifact (RelWithDebInfo only)
       uses: softprops/action-gh-release@v2.5.0
@@ -228,10 +237,11 @@ jobs:
     # RPM Package
     - name: Upload the RPM package artifact (RelWithDebInfo only)
       if: matrix.build_type == 'RelWithDebInfo' && runner.os == 'Linux'
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: ${{ env.RPM_PACKAGE_NAME }}
         path: ${{ env.RPM_PACKAGE_PATH }}
+        archive: false
     - name: Release RPM package artifact (RelWithDebInfo only)
       uses: softprops/action-gh-release@v2.5.0
       if: matrix.build_type == 'RelWithDebInfo' && runner.os == 'Linux' && startsWith(github.ref, 'refs/tags/') && matrix.release == 'stable'
@@ -241,10 +251,11 @@ jobs:
     # TGZ Package
     - name: Upload the TGZ package artifact (RelWithDebInfo only)
       if: matrix.build_type == 'RelWithDebInfo'
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: ${{ env.TGZ_PACKAGE_NAME }}
         path: ${{ env.TGZ_PACKAGE_PATH }}
+        archive: false
 
     - name: Release TGZ package artifact (RelWithDebInfo only)
       uses: softprops/action-gh-release@v2.5.0
@@ -254,3 +265,177 @@ jobs:
 
     - name: ccache stats
       run: ccache -s
+
+  sanitizer:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    env:
+      ASAN_OPTIONS: strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1:detect_leaks=1
+      UBSAN_OPTIONS: print_stacktrace=1
+
+    strategy:
+      fail-fast: false
+      matrix:
+        release: [stable, HEAD]
+
+    steps:
+    - uses: actions/checkout@v6
+
+    - name: Setup Git User for Applying Patches
+      run: |
+        git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+        git config --global user.name "github-actions[bot]"
+
+    - name: Install LLVM
+      run: |
+        wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh
+        chmod +x /tmp/llvm.sh
+        sudo /tmp/llvm.sh $LLVM_VERSION
+        echo "CXX=clang++-$LLVM_VERSION" >> "$GITHUB_ENV"
+
+    - name: Install system dependencies
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y ccache
+
+    - name: Generate cache key
+      shell: cmake -P {0}
+      run: |
+        string(TIMESTAMP current_date "%Y-%m-%d-%H;%M;%S" UTC)
+        file(APPEND "$ENV{GITHUB_ENV}" "CACHE_KEY=sanitizer_${{ matrix.release }}\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CACHE_TIMESTAMP=${current_date}\n")
+
+    - name: Update the cache (ccache)
+      uses: actions/cache@v5
+      with:
+        path: "${{ github.workspace }}/ccache"
+        key: ${{ env.CACHE_KEY }}_ccache_${{ env.CACHE_TIMESTAMP }}
+        restore-keys: |
+          ${{ env.CACHE_KEY }}_ccache_
+
+    - name: Setup ccache
+      working-directory: "${{ github.workspace }}"
+      shell: cmake -P {0}
+      run: |
+        file(MAKE_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}/ccache")
+        file(APPEND "$ENV{GITHUB_ENV}" "CCACHE_BASEDIR=${CMAKE_CURRENT_SOURCE_DIR}\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CCACHE_DIR=${CMAKE_CURRENT_SOURCE_DIR}/ccache\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CCACHE_COMPRESS=true\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CCACHE_COMPRESSLEVEL=10\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CCACHE_MAXSIZE=400M\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CMAKE_CXX_COMPILER_LAUNCHER=ccache\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CMAKE_C_COMPILER_LAUNCHER=ccache\n")
+        execute_process(COMMAND ccache -z)
+
+    - name: Configure the project
+      run: cmake --preset=ci-sanitize
+        -Dsleigh_RELEASE_TYPE=${{ matrix.release }}
+        -Dsleigh_BUILD_DOCUMENTATION=OFF
+
+    - name: Build the project
+      run: cmake
+        --build build/sanitize
+        -j 4
+        -v
+
+    - name: Test the project
+      working-directory: build/sanitize
+      run: ctest -VV
+
+    - name: Run the example
+      run: cmake
+        --build build/sanitize
+        -j 4
+        --target sleigh_example_runner
+
+    - name: Run the install target
+      run: cmake --install build/sanitize
+        --prefix install
+
+    - name: Smoketest sleigh lift
+      run: |
+        ./install/bin/sleigh-lift --version
+        ./install/bin/sleigh-lift disassemble x86-64.sla 4881ecc00f0000
+        ./install/bin/sleigh-lift pcode x86-64.sla 4881ecc00f0000
+
+    - name: ccache stats
+      run: ccache -s
+
+  assertions:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        release: [stable, HEAD]
+
+    steps:
+    - uses: actions/checkout@v6
+
+    - name: Setup Git User for Applying Patches
+      run: |
+        git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+        git config --global user.name "github-actions[bot]"
+
+    - name: Install LLVM
+      run: |
+        wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh
+        chmod +x /tmp/llvm.sh
+        sudo /tmp/llvm.sh $LLVM_VERSION
+        echo "CXX=clang++-$LLVM_VERSION" >> "$GITHUB_ENV"
+
+    - name: Install system dependencies
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y ccache libc++-$LLVM_VERSION-dev libc++abi-$LLVM_VERSION-dev
+
+    - name: Generate cache key
+      shell: cmake -P {0}
+      run: |
+        string(TIMESTAMP current_date "%Y-%m-%d-%H;%M;%S" UTC)
+        file(APPEND "$ENV{GITHUB_ENV}" "CACHE_KEY=assertions_${{ matrix.release }}\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CACHE_TIMESTAMP=${current_date}\n")
+
+    - name: Update the cache (ccache)
+      uses: actions/cache@v5
+      with:
+        path: "${{ github.workspace }}/ccache"
+        key: ${{ env.CACHE_KEY }}_ccache_${{ env.CACHE_TIMESTAMP }}
+        restore-keys: |
+          ${{ env.CACHE_KEY }}_ccache_
+
+    - name: Setup ccache
+      working-directory: "${{ github.workspace }}"
+      shell: cmake -P {0}
+      run: |
+        file(MAKE_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}/ccache")
+        file(APPEND "$ENV{GITHUB_ENV}" "CCACHE_BASEDIR=${CMAKE_CURRENT_SOURCE_DIR}\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CCACHE_DIR=${CMAKE_CURRENT_SOURCE_DIR}/ccache\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CCACHE_COMPRESS=true\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CCACHE_COMPRESSLEVEL=10\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CCACHE_MAXSIZE=400M\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CMAKE_CXX_COMPILER_LAUNCHER=ccache\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CMAKE_C_COMPILER_LAUNCHER=ccache\n")
+        execute_process(COMMAND ccache -z)
+
+    - name: Configure the project
+      run: cmake --preset=ci-assertions
+        -Dsleigh_RELEASE_TYPE=${{ matrix.release }}
+        -Dsleigh_BUILD_DOCUMENTATION=OFF
+
+    - name: Build the project
+      run: cmake
+        --build build/assertions
+        -j 4
+        -v
+
+    - name: Test the project
+      working-directory: build/assertions
+      run: ctest -VV
+
+    - name: ccache stats
+      run: ccache -s

.github/workflows/update_head.yml

@@ -31,8 +31,8 @@ jobs:
       if: steps.head_update.outputs.did_update
       id: generate-token
       with:
-        app_id: ${{ secrets.APP_ID }}
-        private_key: ${{ secrets.APP_PRIVATE_KEY }}
+        app-id: ${{ secrets.APP_ID }}
+        private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
     - name: Commit, push, and create PR
       if: steps.head_update.outputs.did_update
@@ -70,32 +70,43 @@ jobs:
         # Push branch
         git push -u origin "$BRANCH"
 
-        # Build PR body
-        PR_BODY="Changed files:
+        # Build PR body using heredoc with single-quoted delimiter to prevent
+        # bash from interpreting backticks in the markdown content as command
+        # substitution. GitHub Actions expressions are expanded before bash
+        # processes the script, so they still get substituted.
+        BASE_BODY=$(cat <<'PRBODY'
+        Changed files:
 
         ${{ steps.head_update.outputs.changed_files }}
 
         Commit details:
 
-        ${{ steps.head_update.outputs.commit_details }}"
+        ${{ steps.head_update.outputs.commit_details }}
+        PRBODY
+        )
 
         # Add intervention warning if needed
         if [ "${{ steps.head_update.outputs.needs_manual_intervention }}" = "true" ]; then
-          PR_BODY="## :warning: Manual Intervention Required
+          INTERVENTION=$(cat <<'PRBODY'
+        ## :warning: Manual Intervention Required
 
         The following files were added or deleted and may require manual CMake configuration updates:
 
         ${{ steps.head_update.outputs.intervention_details }}
 
         ### Instructions
-        - **New C++ sources**: Add to appropriate list in \`src/setup-ghidra-source.cmake\`
-        - **Deleted C++ sources**: Remove from \`src/setup-ghidra-source.cmake\`
-        - **New spec files**: Review if \`.slaspec\` files are auto-generated; other types may need manual updates
+        - **New C++ sources**: Add to appropriate list in `src/setup-ghidra-source.cmake`
+        - **Deleted C++ sources**: Remove from `src/setup-ghidra-source.cmake`
+        - **New spec files**: Review if `.slaspec` files are auto-generated; other types may need manual updates
         - **Deleted spec files**: Verify no longer referenced
 
         ---
 
-        $PR_BODY"
+        PRBODY
+        )
+          PR_BODY="${INTERVENTION}${BASE_BODY}"
+        else
+          PR_BODY="$BASE_BODY"
         fi
 
         # Create PR

CLAUDE.md

@@ -0,0 +1,117 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+Sleigh is a CMake-based build system for Ghidra's Sleigh/decompiler C++ libraries (by Trail of Bits). It wraps NSA's Ghidra source code — fetched via CMake FetchContent during configure — so the Sleigh disassembly and decompilation engines can be built as standalone C++ libraries for reuse outside Ghidra.
+
+**The actual Ghidra C++ source is not in this repo.** It is cloned from GitHub automatically during CMake configuration.
+
+## Build Commands
+
+```sh
+# Standard build (fetches Ghidra source on first configure)
+cmake -B build -S .
+cmake --build build -j$(nproc)
+
+# CI-style build with developer mode (enables tests, docs, warnings)
+cmake --preset=ci-ubuntu
+cmake --build build -j$(nproc)
+
+# Build with HEAD (bleeding-edge) Ghidra instead of stable
+cmake -B build -S . -Dsleigh_RELEASE_TYPE=HEAD
+
+# Use a local Ghidra checkout (avoids re-cloning)
+cmake -B build -S . -Dsleigh_RELEASE_TYPE=HEAD \
+  -DFETCHCONTENT_SOURCE_DIR_GHIDRASOURCE=/path/to/ghidra
+
+# Sanitizer build
+cmake --preset=ci-sanitize
+cmake --build build/sanitize -j$(nproc)
+```
+
+## Running Tests
+
+Tests require `sleigh_DEVELOPER_MODE=ON` (enabled by all `ci-*` presets).
+
+```sh
+# Run all tests
+cd build && ctest -VV
+
+# Run specific test by name
+cd build && ctest -VV -R sleigh_decomp_unittest    # unit tests
+cd build && ctest -VV -R sleigh_decomp_datatest     # data-driven tests
+cd build && ctest -VV -R sleigh_namespace_std_test   # header hygiene check
+```
+
+Test binary: `sleigh_decomp_test` — wraps Ghidra's own test suite. Takes `-sleighpath` for compiled .sla files and a test mode (`unittests` or `datatests`).
+
+## Architecture
+
+### Library Targets
+
+| Target | Library | C++ Std | Description |
+|--------|---------|---------|-------------|
+| `sleigh::sla` | `sla` | C++11 | Core sleigh: disassembly, encoding, p-code, emulation |
+| `sleigh::decomp` | `decomp` | C++11 | Full decompiler (superset of sla) |
+| `sleigh::support` | `slaSupport` | C++17 | Trail of Bits helpers: `FindSpecFile()`, version info |
+
+Headers: `<ghidra/*.hh>` for upstream Ghidra headers, `<sleigh/*.h>` for ToB additions.
+
+### Key Directories
+
+- `src/setup-ghidra-source.cmake` — Pinned Ghidra versions, FetchContent, source file lists, patch application. **This is the central file for version bumps and source management.**
+- `src/patches/{stable,HEAD}/` — Git-format patches applied to Ghidra source during fetch
+- `src/spec_files_{stable,HEAD}.cmake` — Lists of ~148 .slaspec files to compile
+- `tools/` — Ghidra executables (sleigh compiler, decompiler, ghidra service)
+- `support/` — Trail of Bits support library (C++17)
+- `extra-tools/sleigh-lift/` — Demo tool for disassembly/p-code lifting
+- `cmake/modules/sleighCompile.cmake` — `sleigh_compile()` function exported for downstream users
+
+### How Ghidra Source Integration Works
+
+1. `src/setup-ghidra-source.cmake` pins a Ghidra git ref (tag for stable, commit hash for HEAD)
+2. CMake FetchContent clones from `github.com/NationalSecurityAgency/ghidra`
+3. Patches from `src/patches/` are applied via `git am`
+4. Source file lists reference into `Ghidra/Features/Decompiler/src/decompile/cpp/`
+5. Headers are copied into `build/include/ghidra/` for clean include paths
+
+### Two Release Tracks
+
+- **stable** (default): Pinned to a Ghidra release tag (e.g., `Ghidra_12.0.3_build`). Shallow clone.
+- **HEAD**: Pinned to a specific commit on Ghidra main. Full clone. Updated weekly by CI via `scripts/update_ghidra_head.py`.
+
+## Patch System
+
+Patches fix upstream Ghidra bugs (UB sanitizer issues, portability, strict weak ordering violations) without changing Sleigh functionality. They are standard `git format-patch` files.
+
+- `src/patches/stable/` — Patches for stable release
+- `src/patches/HEAD/` — Superset of stable patches plus HEAD-specific fixes
+- Custom patches via: `-Dsleigh_ADDITIONAL_PATCHES="path/to/patch1;path/to/patch2"`
+
+When adding patches: create with `git format-patch`, number sequentially, and add to both directories if applicable. Patches in HEAD must be a superset of stable patches.
+
+## Key Gotchas
+
+- **In-source builds are forbidden** — enforced by `cmake/prelude.cmake`
+- **First configure is slow** — Ghidra repo clone takes time (especially HEAD which can't shallow clone)
+- **Core libraries are C++11** — the support library and extra tools are C++17, but `sleigh::sla` and `sleigh::decomp` must stay C++11
+- **Source file lists are manual** — when Ghidra adds/removes .cc files, `src/setup-ghidra-source.cmake` must be updated; the `scripts/update_ghidra_head.py` script detects new files and flags them
+- **Strict weak ordering** — a recurring class of upstream bugs in Ghidra comparators; several patches fix these
+- **Spec files differ between releases** — `src/spec_files_stable.cmake` and `src/spec_files_HEAD.cmake` are separate lists and must be maintained independently
+
+## CMake Presets Reference
+
+| Preset | Use Case |
+|--------|----------|
+| `ci-ubuntu` | Linux dev build with warnings and tests |
+| `ci-macos` | macOS dev build |
+| `ci-windows` | Windows dev build (VS 2022, vcpkg) |
+| `ci-sanitize` | ASan + UBSan (builds to `build/sanitize/`) |
+| `ci-coverage` | Code coverage (builds to `build/coverage/`) |
+
+## Code Style
+
+- `.clang-format`: BasedOnStyle LLVM
+- Compiler warnings are strict in CI (see `flags-unix`/`flags-windows` presets)

CMakeLists.txt

@@ -148,10 +148,11 @@ set(public_include_header_list
   "${library_root}/constseq.hh"
   "${library_root}/expression.hh"
 )
-#if(sleigh_RELEASE_IS_HEAD)
-#  list(APPEND public_include_header_list
-#  )
-#endif()
+if(sleigh_RELEASE_IS_HEAD)
+  list(APPEND public_include_header_list
+    "${library_root}/bitfield.hh"
+  )
+endif()
 # Create custom target so that IDEs know these files are part of the sources
 add_custom_target(sleigh_all_headers SOURCES ${public_include_header_list})
 set(public_headers_dir ${CMAKE_CURRENT_BINARY_DIR}/include)

CMakePresets.json

@@ -114,6 +114,17 @@
         "CMAKE_CXX_FLAGS_SANITIZE": "-O2 -g -fsanitize=address,undefined -fno-omit-frame-pointer -fno-common"
       }
     },
+    {
+      "name": "ci-assertions",
+      "binaryDir": "${sourceDir}/build/assertions",
+      "inherits": ["ci-unix", "dev-mode"],
+      "cacheVariables": {
+        "CMAKE_BUILD_TYPE": "Assertions",
+        "CMAKE_CXX_FLAGS_ASSERTIONS": "-O0 -g -stdlib=libc++ -D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_DEBUG -fstack-protector-strong",
+        "CMAKE_EXE_LINKER_FLAGS_ASSERTIONS": "-stdlib=libc++ -lc++abi",
+        "CMAKE_SHARED_LINKER_FLAGS_ASSERTIONS": "-stdlib=libc++ -lc++abi"
+      }
+    },
     {
       "name": "ci-build",
       "binaryDir": "${sourceDir}/build",

src/patches/HEAD/0001-Fix-UBSAN-errors-in-decompiler.patch

@@ -1,7 +1,7 @@
-From 9d1e7b00e8f5dca987038a78fbac400c835a78be Mon Sep 17 00:00:00 2001
+From 98769d3cd2f417a52559bf68700e2f9f3e7a0e4f Mon Sep 17 00:00:00 2001
 From: Eric Kilmer <eric.d.kilmer@gmail.com>
 Date: Mon, 12 Aug 2024 12:02:35 -0400
-Subject: [PATCH 1/5] Fix UBSAN errors in decompiler
+Subject: [PATCH 1/7] Fix UBSAN errors in decompiler
 
 Co-authored-by: Alex Cameron <asc@tetsuo.sh>
 ---
@@ -13,10 +13,10 @@ Co-authored-by: Alex Cameron <asc@tetsuo.sh>
  5 files changed, 16 insertions(+), 10 deletions(-)
 
 diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/pcodecompile.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/pcodecompile.cc
-index ca9d71ab99..85d4dd281d 100644
+index a67a3de849..37ba4930e6 100644
 --- a/Ghidra/Features/Decompiler/src/decompile/cpp/pcodecompile.cc
 +++ b/Ghidra/Features/Decompiler/src/decompile/cpp/pcodecompile.cc
-@@ -621,8 +621,10 @@ vector<OpTpl *> *PcodeCompile::assignBitRange(VarnodeTpl *vn,uint4 bitoffset,uin
+@@ -618,8 +618,10 @@ vector<OpTpl *> *PcodeCompile::assignBitRange(VarnodeTpl *vn,uint4 bitoffset,uin
    uint4 smallsize = (numbits+7)/8; // Size of input (output of rhs)
    bool shiftneeded = (bitoffset != 0);
    bool zextneeded = true;
@@ -29,7 +29,7 @@ index ca9d71ab99..85d4dd281d 100644
  
    if (vn->getSize().getType()==ConstTpl::real) {
      // If we know the size of the bitranged varnode, we can
-@@ -726,9 +728,6 @@ ExprTree *PcodeCompile::createBitRange(SpecificSymbol *sym,uint4 bitoffset,uint4
+@@ -723,9 +725,6 @@ ExprTree *PcodeCompile::createBitRange(SpecificSymbol *sym,uint4 bitoffset,uint4
      }
    }
  
@@ -39,7 +39,7 @@ index ca9d71ab99..85d4dd281d 100644
    if (truncneeded && ((bitoffset % 8)==0)) {
      truncshift = bitoffset/8;
      bitoffset = 0;
-@@ -751,8 +750,13 @@ ExprTree *PcodeCompile::createBitRange(SpecificSymbol *sym,uint4 bitoffset,uint4
+@@ -748,8 +747,13 @@ ExprTree *PcodeCompile::createBitRange(SpecificSymbol *sym,uint4 bitoffset,uint4
      appendOp(CPUI_INT_RIGHT,res,bitoffset,4);
    if (truncneeded)
      appendOp(CPUI_SUBPIECE,res,truncshift,4);
@@ -56,7 +56,7 @@ index ca9d71ab99..85d4dd281d 100644
    return res;
  }
 diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/semantics.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/semantics.cc
-index cd9b9835b1..8a4616c3b9 100644
+index 18e2ff8ba1..3bfe29f2ef 100644
 --- a/Ghidra/Features/Decompiler/src/decompile/cpp/semantics.cc
 +++ b/Ghidra/Features/Decompiler/src/decompile/cpp/semantics.cc
 @@ -22,6 +22,7 @@ ConstTpl::ConstTpl(const_type tp)
@@ -76,7 +76,7 @@ index cd9b9835b1..8a4616c3b9 100644
  
  bool ConstTpl::isConstSpace(void) const
 diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/semantics.hh b/Ghidra/Features/Decompiler/src/decompile/cpp/semantics.hh
-index e0b069959d..9117a45c75 100644
+index b53b18797d..b2f043e32d 100644
 --- a/Ghidra/Features/Decompiler/src/decompile/cpp/semantics.hh
 +++ b/Ghidra/Features/Decompiler/src/decompile/cpp/semantics.hh
 @@ -47,7 +47,7 @@ class ConstTpl {
@@ -89,10 +89,10 @@ index e0b069959d..9117a45c75 100644
      type=op2.type; value=op2.value; value_real=op2.value_real; select=op2.select; }
    ConstTpl(const_type tp,uintb val);
 diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/slgh_compile.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/slgh_compile.cc
-index 50d85e22ba..9f3b456229 100644
+index 75bebffcb0..bf5e7ce681 100644
 --- a/Ghidra/Features/Decompiler/src/decompile/cpp/slgh_compile.cc
 +++ b/Ghidra/Features/Decompiler/src/decompile/cpp/slgh_compile.cc
-@@ -2164,8 +2164,8 @@ string SleighCompile::checkSymbols(SymbolScope *scope)
+@@ -2323,8 +2323,8 @@ string SleighCompile::checkSymbols(SymbolScope *scope)
    ostringstream msg;
    SymbolTree::const_iterator iter;
    for(iter=scope->begin();iter!=scope->end();++iter) {
@@ -116,5 +116,5 @@ index 2571f55f1a..fe40e22b1b 100644
          uintb true_result = ((uintb)(int32_t)f) & 0xffffffff;
          uintb encoding = format.getEncoding(f);
 -- 
-2.50.1
+2.51.1
 

src/patches/HEAD/0002-Use-stroull-instead-of-stroul-to-parse-address-offse.patch

@@ -1,7 +1,7 @@
-From 729f72060849dc4f29e89b1c76a980563ffd3e2a Mon Sep 17 00:00:00 2001
+From 4e6f277eae589c4f9bceb40337d43384248d272c Mon Sep 17 00:00:00 2001
 From: Alex Cameron <asc@tetsuo.sh>
 Date: Wed, 3 Aug 2022 20:01:18 +1000
-Subject: [PATCH 2/5] Use `stroull` instead of `stroul` to parse address
+Subject: [PATCH 2/7] Use `stroull` instead of `stroul` to parse address
  offsets
 
 ---
@@ -34,5 +34,5 @@ index dbaa2e775f..72927bf379 100644
      enddata = (const char *) tmpdata;
      if (enddata - s.c_str() == s.size()) { // If no size or offset override
 -- 
-2.50.1
+2.51.1
 

src/patches/HEAD/0003-Ignore-floating-point-test-due-to-compilation-differ.patch

@@ -1,7 +1,7 @@
-From 39cfff6f08dad8a85f992e09b3e26716c9173bf7 Mon Sep 17 00:00:00 2001
+From 41eb6be342d29d6ff618d06b391bf33209fe8ade Mon Sep 17 00:00:00 2001
 From: Eric Kilmer <eric.d.kilmer@gmail.com>
 Date: Tue, 29 Oct 2024 17:51:09 -0400
-Subject: [PATCH 3/5] Ignore floating point test due to compilation differences
+Subject: [PATCH 3/7] Ignore floating point test due to compilation differences
 
 This test fails on macOS and Windows. I'm unsure whether it's an OS or
 compiler issue.
@@ -24,5 +24,5 @@ index fe40e22b1b..91440e2510 100644
    ASSERT_EQUALS(ff.printDecimal(f2, false), "0.33333334");
    double f3 = doubleFromRawBits(0x3fd0000000000000);
 -- 
-2.50.1
+2.51.1
 

src/patches/HEAD/0004-Allow-positive-or-negative-NAN-in-decompiler-floatin.patch

@@ -1,7 +1,7 @@
-From 2aa4395ef8874ee9890126f4bdad0d71adf9eacc Mon Sep 17 00:00:00 2001
+From 8aa8bf7a146ab43f5b1b27386667af52269720fd Mon Sep 17 00:00:00 2001
 From: Eric Kilmer <eric.d.kilmer@gmail.com>
 Date: Wed, 30 Oct 2024 14:26:57 -0400
-Subject: [PATCH 4/5] Allow positive or negative NAN in decompiler floating
+Subject: [PATCH 4/7] Allow positive or negative NAN in decompiler floating
  point test
 
 At least on Apple Silicon, this test reports positive NAN.
@@ -33,5 +33,5 @@ index f8108d3d32..1060a3e193 100644
  <stringmatch name="Float print #14" min="1" max="1">double7 = 3.1415926535897933e-06;</stringmatch>
  </decompilertest>
 -- 
-2.50.1
+2.51.1
 

src/patches/HEAD/0005-decompiler-Fix-strict-weak-ordering-TypePartialEnum.patch

@@ -1,7 +1,7 @@
-From 2a6bd0a0ad7797160db887bba7137b77aa148ba5 Mon Sep 17 00:00:00 2001
+From d9242056b580cc994661c41344c9ad51b636b0e5 Mon Sep 17 00:00:00 2001
 From: Eric Kilmer <eric.d.kilmer@gmail.com>
 Date: Sat, 8 Feb 2025 17:59:57 -0500
-Subject: [PATCH 5/5] decompiler: Fix strict weak ordering TypePartialEnum
+Subject: [PATCH 5/7] decompiler: Fix strict weak ordering TypePartialEnum
 
 This fixes Windows Debug error encountered in testing where it was
 complaining about lack of strict weak ordering.
@@ -10,10 +10,10 @@ complaining about lack of strict weak ordering.
  1 file changed, 1 insertion(+)
 
 diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/type.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/type.cc
-index 962c525b7f..7db5024b54 100644
+index 2d48650e70..4a52633ebf 100644
 --- a/Ghidra/Features/Decompiler/src/decompile/cpp/type.cc
 +++ b/Ghidra/Features/Decompiler/src/decompile/cpp/type.cc
-@@ -2303,6 +2303,7 @@ int4 TypePartialEnum::compareDependency(const Datatype &op) const
+@@ -2703,6 +2703,7 @@ int4 TypePartialEnum::compareDependency(const Datatype &op) const
  
  {
    if (submeta != op.getSubMeta()) return (submeta < op.getSubMeta()) ? -1 : 1;
@@ -22,5 +22,5 @@ index 962c525b7f..7db5024b54 100644
    if (parent != tp->parent) return (parent < tp->parent) ? -1 : 1;	// Compare absolute pointers
    if (offset != tp->offset) return (offset < tp->offset) ? -1 : 1;
 -- 
-2.50.1
+2.51.1
 

src/patches/HEAD/0006-decompiler-Fix-strict-weak-ordering-PullRecord.patch

@@ -0,0 +1,29 @@
+From f2fdafbd981a441c35ab243bcb74872febd6bbd4 Mon Sep 17 00:00:00 2001
+From: "github-actions[bot]"
+ <41898282+github-actions[bot]@users.noreply.github.com>
+Date: Wed, 25 Feb 2026 02:29:10 +0000
+Subject: [PATCH 6/7] decompiler: Fix strict weak ordering PullRecord
+
+When both readOp pointers are null, PullRecord::operator< incorrectly
+returns true, violating strict weak ordering (irreflexivity). This is
+caught by libc++ debug mode hardening assertions at pullList.sort().
+---
+ Ghidra/Features/Decompiler/src/decompile/cpp/bitfield.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/bitfield.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/bitfield.cc
+index add61c741b..3e01d2e045 100644
+--- a/Ghidra/Features/Decompiler/src/decompile/cpp/bitfield.cc
++++ b/Ghidra/Features/Decompiler/src/decompile/cpp/bitfield.cc
+@@ -1058,7 +1058,7 @@ bool BitFieldPullTransform::PullRecord::operator<(const PullRecord &op2) const
+       return (readOp->getSeqNum() < op2.readOp->getSeqNum());
+   }
+   else if (readOp == (PcodeOp *)0)
+-    return true;
++    return (op2.readOp != (PcodeOp *)0);
+   else if (op2.readOp == (PcodeOp *)0)
+     return false;
+   return false;
+-- 
+2.51.1
+

src/patches/HEAD/0007-decompiler-Fix-strict-weak-ordering-compareFinalOrde.patch

@@ -0,0 +1,29 @@
+From a44beeb3a2569887c33d2dfd509c0d103bd6c447 Mon Sep 17 00:00:00 2001
+From: "github-actions[bot]"
+ <41898282+github-actions[bot]@users.noreply.github.com>
+Date: Wed, 25 Feb 2026 02:43:17 +0000
+Subject: [PATCH 7/7] decompiler: Fix strict weak ordering compareFinalOrder
+
+FlowBlock::compareFinalOrder returns true when both blocks have index 0,
+violating strict weak ordering (irreflexivity). This is caught by libc++
+debug mode hardening assertions during BlockGraph::orderBlocks sort.
+---
+ Ghidra/Features/Decompiler/src/decompile/cpp/block.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/block.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/block.cc
+index bf7103d916..2e495d9c3f 100644
+--- a/Ghidra/Features/Decompiler/src/decompile/cpp/block.cc
++++ b/Ghidra/Features/Decompiler/src/decompile/cpp/block.cc
+@@ -709,7 +709,7 @@ string FlowBlock::typeToName(FlowBlock::block_type bt)
+ bool FlowBlock::compareFinalOrder(const FlowBlock *bl1,const FlowBlock *bl2)
+ 
+ {
+-  if (bl1->getIndex() == 0) return true; // Make sure the entry point comes first
++  if (bl1->getIndex() == 0) return (bl2->getIndex() != 0); // Make sure the entry point comes first
+   if (bl2->getIndex() == 0) return false;
+   PcodeOp *op1 = bl1->lastOp();
+   PcodeOp *op2 = bl2->lastOp();
+-- 
+2.51.1
+

src/patches/HEAD/0008-Fix-UBSAN-signed-left-shift-errors.patch

@@ -0,0 +1,57 @@
+From 8afa7d89a368b358a5493b87804985ed9ac70a2f Mon Sep 17 00:00:00 2001
+From: "github-actions[bot]"
+ <41898282+github-actions[bot]@users.noreply.github.com>
+Date: Wed, 25 Feb 2026 20:41:10 +0000
+Subject: [PATCH] Fix UBSAN signed left shift errors
+
+Cast signed values to unsigned before left shifting to avoid undefined
+behavior when the signed value is negative or when the result cannot be
+represented in the signed type.
+
+Fixes runtime errors detected by UndefinedBehaviorSanitizer:
+- address.hh sign_extend(): left shift of negative value
+- address.hh sign_extend(): left shift cannot be represented in type 'intb'
+- slghpatexpress.cc LeftShiftExpression: left shift of negative value
+---
+ Ghidra/Features/Decompiler/src/decompile/cpp/address.hh       | 2 +-
+ .../Features/Decompiler/src/decompile/cpp/slghpatexpress.cc   | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/address.hh b/Ghidra/Features/Decompiler/src/decompile/cpp/address.hh
+index 45144daf3..0e75c68b8 100644
+--- a/Ghidra/Features/Decompiler/src/decompile/cpp/address.hh
++++ b/Ghidra/Features/Decompiler/src/decompile/cpp/address.hh
+@@ -544,7 +544,7 @@ inline intb sign_extend(intb val,int4 bit)
+
+ {
+   int4 sa = 8*sizeof(intb) - (bit+1);
+-  val = (val << sa) >> sa;
++  val = static_cast<intb>(static_cast<uintb>(val) << sa) >> sa;
+   return val;
+ }
+
+diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/slghpatexpress.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/slghpatexpress.cc
+index 941097859..93cce378a 100644
+--- a/Ghidra/Features/Decompiler/src/decompile/cpp/slghpatexpress.cc
++++ b/Ghidra/Features/Decompiler/src/decompile/cpp/slghpatexpress.cc
+@@ -969,7 +969,7 @@ intb LeftShiftExpression::getValue(ParserWalker &walker) const
+ {
+   intb leftval = getLeft()->getValue(walker);
+   intb rightval = getRight()->getValue(walker);
+-  return leftval << rightval;
++  return static_cast<intb>(static_cast<uintb>(leftval) << rightval);
+ }
+
+ intb LeftShiftExpression::getSubValue(const vector<intb> &replace,int4 &listpos) const
+@@ -977,7 +977,7 @@ intb LeftShiftExpression::getSubValue(const vector<intb> &replace,int4 &listpos)
+ {
+   intb leftval = getLeft()->getSubValue(replace,listpos); // Must be left first
+   intb rightval = getRight()->getSubValue(replace,listpos);
+-  return leftval << rightval;
++  return static_cast<intb>(static_cast<uintb>(leftval) << rightval);
+ }
+
+ void LeftShiftExpression::encode(Encoder &encoder) const
+--
+2.51.1
+

src/patches/stable/0006-decompiler-Fix-strict-weak-ordering-compareFinalOrde.patch

@@ -0,0 +1,29 @@
+From c435df4c0dbab80d8ff85e364cea9b59bf7010a1 Mon Sep 17 00:00:00 2001
+From: "github-actions[bot]"
+ <41898282+github-actions[bot]@users.noreply.github.com>
+Date: Wed, 25 Feb 2026 22:22:05 +0000
+Subject: [PATCH] decompiler: Fix strict weak ordering compareFinalOrder
+
+FlowBlock::compareFinalOrder returns true when both blocks have index 0,
+violating strict weak ordering (irreflexivity). This is caught by libc++
+debug mode hardening assertions during BlockGraph::orderBlocks sort.
+---
+ Ghidra/Features/Decompiler/src/decompile/cpp/block.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/block.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/block.cc
+index bf7103d91..2e495d9c3 100644
+--- a/Ghidra/Features/Decompiler/src/decompile/cpp/block.cc
++++ b/Ghidra/Features/Decompiler/src/decompile/cpp/block.cc
+@@ -709,7 +709,7 @@ string FlowBlock::typeToName(FlowBlock::block_type bt)
+ bool FlowBlock::compareFinalOrder(const FlowBlock *bl1,const FlowBlock *bl2)
+ 
+ {
+-  if (bl1->getIndex() == 0) return true; // Make sure the entry point comes first
++  if (bl1->getIndex() == 0) return (bl2->getIndex() != 0); // Make sure the entry point comes first
+   if (bl2->getIndex() == 0) return false;
+   PcodeOp *op1 = bl1->lastOp();
+   PcodeOp *op2 = bl2->lastOp();
+-- 
+2.51.1
+

src/patches/stable/0007-Fix-UBSAN-signed-left-shift-errors.patch

@@ -0,0 +1,57 @@
+From 8afa7d89a368b358a5493b87804985ed9ac70a2f Mon Sep 17 00:00:00 2001
+From: "github-actions[bot]"
+ <41898282+github-actions[bot]@users.noreply.github.com>
+Date: Wed, 25 Feb 2026 20:41:10 +0000
+Subject: [PATCH] Fix UBSAN signed left shift errors
+
+Cast signed values to unsigned before left shifting to avoid undefined
+behavior when the signed value is negative or when the result cannot be
+represented in the signed type.
+
+Fixes runtime errors detected by UndefinedBehaviorSanitizer:
+- address.hh sign_extend(): left shift of negative value
+- address.hh sign_extend(): left shift cannot be represented in type 'intb'
+- slghpatexpress.cc LeftShiftExpression: left shift of negative value
+---
+ Ghidra/Features/Decompiler/src/decompile/cpp/address.hh       | 2 +-
+ .../Features/Decompiler/src/decompile/cpp/slghpatexpress.cc   | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/address.hh b/Ghidra/Features/Decompiler/src/decompile/cpp/address.hh
+index 45144daf3..0e75c68b8 100644
+--- a/Ghidra/Features/Decompiler/src/decompile/cpp/address.hh
++++ b/Ghidra/Features/Decompiler/src/decompile/cpp/address.hh
+@@ -544,7 +544,7 @@ inline intb sign_extend(intb val,int4 bit)
+ 
+ {
+   int4 sa = 8*sizeof(intb) - (bit+1);
+-  val = (val << sa) >> sa;
++  val = static_cast<intb>(static_cast<uintb>(val) << sa) >> sa;
+   return val;
+ }
+ 
+diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/slghpatexpress.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/slghpatexpress.cc
+index 941097859..93cce378a 100644
+--- a/Ghidra/Features/Decompiler/src/decompile/cpp/slghpatexpress.cc
++++ b/Ghidra/Features/Decompiler/src/decompile/cpp/slghpatexpress.cc
+@@ -969,7 +969,7 @@ intb LeftShiftExpression::getValue(ParserWalker &walker) const
+ {
+   intb leftval = getLeft()->getValue(walker);
+   intb rightval = getRight()->getValue(walker);
+-  return leftval << rightval;
++  return static_cast<intb>(static_cast<uintb>(leftval) << rightval);
+ }
+ 
+ intb LeftShiftExpression::getSubValue(const vector<intb> &replace,int4 &listpos) const
+@@ -977,7 +977,7 @@ intb LeftShiftExpression::getSubValue(const vector<intb> &replace,int4 &listpos)
+ {
+   intb leftval = getLeft()->getSubValue(replace,listpos); // Must be left first
+   intb rightval = getRight()->getSubValue(replace,listpos);
+-  return leftval << rightval;
++  return static_cast<intb>(static_cast<uintb>(leftval) << rightval);
+ }
+ 
+ void LeftShiftExpression::encode(Encoder &encoder) const
+-- 
+2.51.1
+

src/setup-ghidra-source.cmake

@@ -22,7 +22,7 @@ set_property(CACHE sleigh_RELEASE_TYPE PROPERTY STRINGS "stable" "HEAD")
 find_package(Git REQUIRED)
 
 # Ghidra pinned stable version commit
-set(ghidra_version "12.0.3")
+set(ghidra_version "12.0.4")
 set(ghidra_git_tag "Ghidra_${ghidra_version}_build")
 set(ghidra_shallow TRUE)
 
@@ -43,6 +43,8 @@ set(ghidra_patches
   "${CMAKE_CURRENT_LIST_DIR}/patches/stable/0003-Ignore-floating-point-test-due-to-compilation-differ.patch"
   "${CMAKE_CURRENT_LIST_DIR}/patches/stable/0004-Allow-positive-or-negative-NAN-in-decompiler-floatin.patch"
   "${CMAKE_CURRENT_LIST_DIR}/patches/stable/0005-decompiler-Fix-strict-weak-ordering-TypePartialEnum.patch"
+  "${CMAKE_CURRENT_LIST_DIR}/patches/stable/0006-decompiler-Fix-strict-weak-ordering-compareFinalOrde.patch"
+  "${CMAKE_CURRENT_LIST_DIR}/patches/stable/0007-Fix-UBSAN-signed-left-shift-errors.patch"
 )
 
 # Ghidra pinned commits used for pinning last known working HEAD commit
@@ -51,7 +53,7 @@ if("${sleigh_RELEASE_TYPE}" STREQUAL "HEAD")
   # TODO: CMake only likes numeric characters in the version string....
   set(ghidra_head_version "12.1")
   set(ghidra_version "${ghidra_head_version}")
-  set(ghidra_head_git_tag "ccbdd4f66eb92186b695b0f143b90e5ce714bf85")
+  set(ghidra_head_git_tag "fc73f70b9cb4523329b1629b2753f87ae734521d")
   set(ghidra_git_tag "${ghidra_head_git_tag}")
   set(ghidra_shallow FALSE)
   set(ghidra_patches
@@ -63,6 +65,9 @@ if("${sleigh_RELEASE_TYPE}" STREQUAL "HEAD")
     "${CMAKE_CURRENT_LIST_DIR}/patches/HEAD/0003-Ignore-floating-point-test-due-to-compilation-differ.patch"
     "${CMAKE_CURRENT_LIST_DIR}/patches/HEAD/0004-Allow-positive-or-negative-NAN-in-decompiler-floatin.patch"
     "${CMAKE_CURRENT_LIST_DIR}/patches/HEAD/0005-decompiler-Fix-strict-weak-ordering-TypePartialEnum.patch"
+    "${CMAKE_CURRENT_LIST_DIR}/patches/HEAD/0006-decompiler-Fix-strict-weak-ordering-PullRecord.patch"
+    "${CMAKE_CURRENT_LIST_DIR}/patches/HEAD/0007-decompiler-Fix-strict-weak-ordering-compareFinalOrde.patch"
+    "${CMAKE_CURRENT_LIST_DIR}/patches/HEAD/0008-Fix-UBSAN-signed-left-shift-errors.patch"
   )
   string(SUBSTRING "${ghidra_git_tag}" 0 7 ghidra_short_commit)
 else()
@@ -174,10 +179,11 @@ set(sleigh_deccore_source_list
   "${library_root}/constseq.cc"
   "${library_root}/expression.cc"
 )
-#if("${sleigh_RELEASE_TYPE}" STREQUAL "HEAD")
-#  list(APPEND sleigh_deccore_source_list
-#  )
-#endif()
+if("${sleigh_RELEASE_TYPE}" STREQUAL "HEAD")
+  list(APPEND sleigh_deccore_source_list
+    "${library_root}/bitfield.cc"
+  )
+endif()
 
 set(sleigh_extra_source_list
   "${library_root}/callgraph.cc"