refactor: DDDisplayWrapper vtable uses extern "fastcall" instead of inline asm

The "MFC result-return convention" (ECX=this, EDX=result_buf_ptr) is
actually __fastcall with an explicit FastcallResult parameter. This
eliminates all inline asm (call_method/call_method_1) and lets the
compiler generate correct calling code via the bind macro.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/openwa-core/src/display/dd_display.rs

@@ -294,7 +294,7 @@ pub unsafe extern "thiscall" fn get_dimensions(
     *out_h = (*gfx).base.display_height;
 }
 
-use super::display_wrapper::DDDisplayWrapper;
+use super::display_wrapper::{DDDisplayWrapper, FastcallResult};
 use crate::address::va;
 use crate::rebase::rb;
 
@@ -322,5 +322,6 @@ pub unsafe extern "thiscall" fn flush_render(this: *mut DDDisplay) {
     }
 
     // get_renderer_surface → renderer Flip
-    DDDisplayWrapper::call_method(wrapper, 13);
+    let mut buf = FastcallResult::default();
+    DDDisplayWrapper::get_renderer_surface_raw(wrapper, &mut buf);
 }

crates/openwa-core/src/display/display_wrapper.rs

@@ -4,28 +4,46 @@
 crate::define_addresses! {
     class "CWormsApp" {
         /// CWormsApp__FlipSurface — dispatches to renderer backend vtable[1]
-        fn/Thiscall CWORMSAPP_FLIP_SURFACE = 0x005A_2700;
+        fn/Fastcall CWORMSAPP_FLIP_SURFACE = 0x005A_2700;
         /// ConstructFrameBuffer — allocates software framebuffer, inits renderer
-        fn/Thiscall CONSTRUCT_FRAME_BUFFER_THISCALL = 0x005A_2430;
+        fn/Fastcall CONSTRUCT_FRAME_BUFFER_THISCALL = 0x005A_2430;
         /// CWormsApp__ReleaseFrameBuffer
-        fn/Thiscall CWORMSAPP_RELEASE_FRAME_BUFFER = 0x005A_24A0;
+        fn/Fastcall CWORMSAPP_RELEASE_FRAME_BUFFER = 0x005A_24A0;
         /// CWormsApp__FillRect — lock surface, memset rows, unlock
-        fn/Thiscall CWORMSAPP_FILL_RECT = 0x005A_25C0;
+        fn/Fastcall CWORMSAPP_FILL_RECT = 0x005A_25C0;
         /// CWormsApp__BlitToFrameBuffer — optimized blit from surface to framebuffer
-        fn/Thiscall CWORMSAPP_BLIT_TO_FRAME_BUFFER = 0x005A_2A40;
+        fn/Fastcall CWORMSAPP_BLIT_TO_FRAME_BUFFER = 0x005A_2A40;
         /// CWormsApp__DrawLandscape — blit with clipping and transparency
-        fn/Thiscall CWORMSAPP_DRAW_LANDSCAPE = 0x005A_2790;
+        fn/Fastcall CWORMSAPP_DRAW_LANDSCAPE = 0x005A_2790;
         /// ClearFrameBuffer — memset(framebuffer, 0, w*h)
         fn CWORMSAPP_CLEAR_FRAME_BUFFER = 0x005A_23F0;
     }
 }
 
+/// Result buffer for DDDisplayWrapper and CompatRenderer vtable calls.
+///
+/// These classes use `__fastcall` convention: ECX = this, EDX = result buffer pointer.
+/// The callee writes a result (typically an HRESULT or pointer) into `value` and
+/// returns `EDX` in `EAX`. Most callers allocate this on the stack and ignore the result.
+#[repr(C)]
+#[derive(Clone, Copy, Default)]
+pub struct FastcallResult {
+    pub value: u32,
+    _pad: u32,
+}
+
 /// DDDisplayWrapper vtable (0x662EC8, 25 slots).
 ///
 /// Many slots are thin thunks that forward to the renderer backend
 /// via `*(this+0x18)->vtable[N]`. Others manage the software framebuffer
 /// or perform blitting directly.
 ///
+/// ## Calling convention
+///
+/// All methods use `__fastcall`: ECX = this, EDX = `*mut FastcallResult` (caller-allocated
+/// 8-byte result buffer). Remaining parameters are on the stack, callee-cleaned.
+/// Most callers ignore the result value.
+///
 /// ## Slot categories
 ///
 /// - **Renderer thunks** (0, 2, 4, 5, 8, 10, 11): Forward to backend
@@ -37,90 +55,191 @@ crate::define_addresses! {
 pub struct DDDisplayWrapperVtable {
     /// renderer thunk -> backend vtable[0] (init/create) (0x4E3420, RET 0x8)
     #[slot(0)]
-    pub renderer_init: fn(this: *mut DDDisplayWrapper, p2: u32, p3: u32),
+    pub renderer_init: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+        p2: u32,
+        p3: u32,
+    ) -> *mut FastcallResult,
     /// flip/present — dispatches to renderer backend vtable[1] (0x5A2700)
     #[slot(1)]
-    pub flip_surface: fn(this: *mut DDDisplayWrapper),
+    pub flip_surface: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+    ) -> *mut FastcallResult,
     /// renderer thunk -> backend vtable[2] (reset state) (0x4E3440)
     #[slot(2)]
-    pub renderer_reset: fn(this: *mut DDDisplayWrapper),
+    pub renderer_reset: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+    ) -> *mut FastcallResult,
     /// get framebuffer dimensions — reads G_FRAME_BUFFER_WIDTH/HEIGHT (0x5A2660, RET 0x4)
     #[slot(3)]
-    pub get_framebuffer_dims: fn(this: *mut DDDisplayWrapper, out: *mut u32) -> u32,
+    pub get_framebuffer_dims: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+        out: *mut u32,
+    ) -> *mut FastcallResult,
     /// renderer thunk -> backend vtable[4] (enum display modes) (0x4E3460, RET 0x8)
     #[slot(4)]
-    pub renderer_enum_modes: fn(this: *mut DDDisplayWrapper, p2: u32, p3: u32),
+    pub renderer_enum_modes: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+        p2: u32,
+        p3: u32,
+    ) -> *mut FastcallResult,
     /// renderer thunk -> backend vtable[5] (tail jump) (0x4E3480)
     #[slot(5)]
-    pub renderer_slot5: fn(this: *mut DDDisplayWrapper),
+    pub renderer_slot5: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+    ) -> *mut FastcallResult,
     /// construct framebuffer — wa_malloc(w*h), init renderer (0x5A2430, RET 0x8)
     #[slot(6)]
-    pub construct_frame_buffer: fn(this: *mut DDDisplayWrapper, width: i32, height: i32) -> i32,
+    pub construct_frame_buffer: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+        width: i32,
+        height: i32,
+    ) -> *mut FastcallResult,
     /// release framebuffer — calls renderer teardown, frees buffer (0x5A24A0)
     #[slot(7)]
-    pub release_frame_buffer: fn(this: *mut DDDisplayWrapper, p2: i32),
+    pub release_frame_buffer: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+        p2: i32,
+    ) -> *mut FastcallResult,
     /// renderer thunk -> backend vtable[8] (0x5A24F0)
     #[slot(8)]
-    pub renderer_slot8: fn(this: *mut DDDisplayWrapper),
+    pub renderer_slot8: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+    ) -> *mut FastcallResult,
     /// lock framebuffer for pixel access (0x5A2530)
     ///
     /// Returns framebuffer pointer and stride for direct pixel manipulation.
     #[slot(9)]
-    pub lock_framebuffer:
-        fn(this: *mut DDDisplayWrapper, p2: u32, p3: u32, p4: u32, p5: u32) -> u32,
+    pub lock_framebuffer: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+        p2: u32,
+        p3: u32,
+        p4: u32,
+        p5: u32,
+    ) -> *mut FastcallResult,
     /// renderer thunk -> backend vtable[10] (0x5A2510)
     #[slot(10)]
-    pub renderer_restore_dims: fn(this: *mut DDDisplayWrapper),
+    pub renderer_restore_dims: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+    ) -> *mut FastcallResult,
     /// renderer thunk -> backend vtable[11] (restore surface) (0x5A25A0)
     #[slot(11)]
-    pub renderer_restore_surface: fn(this: *mut DDDisplayWrapper),
+    pub renderer_restore_surface: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+    ) -> *mut FastcallResult,
     /// allocate error/result object (0x5A2720, RET 0x4)
     #[slot(12)]
-    pub alloc_error_result: fn(this: *mut DDDisplayWrapper, p2: u32) -> u32,
+    pub alloc_error_result: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+        p2: u32,
+    ) -> *mut FastcallResult,
     /// get renderer surface pointer (0x5A26C0)
     ///
     /// Queries `renderer->vtable[12]` with G_FRAME_BUFFER_PTR.
     #[slot(13)]
-    pub get_renderer_surface: fn(this: *mut DDDisplayWrapper),
+    pub get_renderer_surface: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+    ) -> *mut FastcallResult,
     /// stub — returns 0 (CGameTask__vt18, 0x545780)
     #[slot(14)]
-    pub stub_ret_zero: fn(this: *mut DDDisplayWrapper) -> u32,
+    pub stub_ret_zero: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+    ) -> *mut FastcallResult,
     /// lock surface for reading — returns framebuffer ptr + width (0x5A2690, RET 0x8)
     #[slot(15)]
-    pub lock_surface_read: fn(this: *mut DDDisplayWrapper, p2: u32, p3: u32),
+    pub lock_surface_read: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+        p2: u32,
+        p3: u32,
+    ) -> *mut FastcallResult,
     /// unlock surface (0x5A2C10, RET 0x4)
     ///
     /// No-op for software framebuffer — just returns success code.
     #[slot(16)]
-    pub unlock_surface_read: fn(this: *mut DDDisplayWrapper, p2: u32),
+    pub unlock_surface_read: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+        p2: u32,
+    ) -> *mut FastcallResult,
     /// lock surface for writing (0x5A2690 — same fn as slot 15, RET 0x8)
     #[slot(17)]
-    pub lock_surface_write: fn(this: *mut DDDisplayWrapper, p2: u32, p3: u32),
+    pub lock_surface_write: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+        p2: u32,
+        p3: u32,
+    ) -> *mut FastcallResult,
     /// unlock surface after writing (0x5A2C10 — same fn as slot 16, RET 0x4)
     #[slot(18)]
-    pub unlock_surface_write: fn(this: *mut DDDisplayWrapper, p2: u32),
+    pub unlock_surface_write: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+        p2: u32,
+    ) -> *mut FastcallResult,
     /// fill rectangle — lock, memset rows, unlock (0x5A25C0)
     ///
     /// Params: x, y, width, height, fill_value.
     #[slot(19)]
-    pub fill_rect:
-        fn(this: *mut DDDisplayWrapper, x: i32, y: i32, width: i32, height: i32, fill_value: u32),
+    pub fill_rect: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+        x: i32,
+        y: i32,
+        width: i32,
+        height: i32,
+        fill_value: u32,
+    ) -> *mut FastcallResult,
     /// clear framebuffer — memset(ptr, 0, w*h) (0x5A23F0)
     #[slot(20)]
-    pub clear_frame_buffer: fn(this: *mut DDDisplayWrapper),
+    pub clear_frame_buffer: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+    ) -> *mut FastcallResult,
     /// trampoline to slot 20 via vtable dispatch (0x5A2420)
     #[slot(21)]
-    pub clear_frame_buffer_indirect: fn(this: *mut DDDisplayWrapper),
+    pub clear_frame_buffer_indirect: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+    ) -> *mut FastcallResult,
     /// allocate surface object — wa_malloc(0x14) (0x5A2760)
     #[slot(22)]
-    pub alloc_surface: fn(this: *mut DDDisplayWrapper) -> *mut u8,
+    pub alloc_surface: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+    ) -> *mut FastcallResult,
     /// draw landscape — blit with clipping and optional color-key transparency (0x5A2790)
     #[slot(23)]
-    pub draw_landscape:
-        fn(this: *mut DDDisplayWrapper, surface: *mut u8, y_offset: i32, flags: u32),
+    pub draw_landscape: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+        surface: *mut u8,
+        y_offset: i32,
+        flags: u32,
+    ) -> *mut FastcallResult,
     /// blit surface to framebuffer — optimized copy with stride alignment (0x5A2A40)
     #[slot(24)]
-    pub blit_to_frame_buffer: fn(this: *mut DDDisplayWrapper, surface: *mut u8, y_offset: i32),
+    pub blit_to_frame_buffer: unsafe extern "fastcall" fn(
+        this: *mut DDDisplayWrapper,
+        result: *mut FastcallResult,
+        surface: *mut u8,
+        y_offset: i32,
+    ) -> *mut FastcallResult,
 }
 
 /// DDDisplayWrapper struct — CWormsApp rendering dispatch subobject.
@@ -139,57 +258,7 @@ pub struct DDDisplayWrapper {
 
 const _: () = assert!(core::mem::size_of::<DDDisplayWrapper>() == 0x1C);
 
-// Generate calling wrappers: DDDisplayWrapper::flip_surface(), etc.
-// NOTE: The generated bind wrappers assume standard thiscall, but
-// DDDisplayWrapper methods actually use MFC result-return convention
-// (ECX=this, EDX=result_buf_ptr). Use call_wrapper_method() instead.
+// Generate calling wrappers: DDDisplayWrapper::get_renderer_surface_raw(), etc.
+// Use the `_raw` variants to avoid LLVM noalias miscompilation.
+// Callers must pass a `&mut FastcallResult` buffer (allocated on the stack).
 bind_DDDisplayWrapperVtable!(DDDisplayWrapper, vtable);
-
-impl DDDisplayWrapper {
-    /// Call a DDDisplayWrapper vtable method by slot index.
-    ///
-    /// DDDisplayWrapper methods use an MFC result-return convention:
-    /// ECX = this, EDX = pointer to caller-allocated result buffer.
-    /// The result is discarded by most callers.
-    ///
-    /// # Safety
-    /// `this` must be a valid DDDisplayWrapper pointer with an initialized vtable.
-    #[inline]
-    pub unsafe fn call_method(this: *mut DDDisplayWrapper, slot: usize) {
-        let vtable = (*this).vtable as *const u32;
-        let func: u32 = *vtable.add(slot);
-        let mut result_buf: [u32; 2] = [0; 2];
-        core::arch::asm!(
-            "call {func}",
-            func = in(reg) func,
-            in("ecx") this,
-            inout("edx") result_buf.as_mut_ptr() => _,
-            out("eax") _,
-            clobber_abi("C"),
-        );
-    }
-
-    /// Call a DDDisplayWrapper vtable method with one stack parameter.
-    ///
-    /// Same MFC convention as `call_method`, with an additional stack argument
-    /// pushed before the call (callee cleans via RET N).
-    ///
-    /// # Safety
-    /// `this` must be a valid DDDisplayWrapper pointer with an initialized vtable.
-    #[inline]
-    pub unsafe fn call_method_1(this: *mut DDDisplayWrapper, slot: usize, param: u32) {
-        let vtable = (*this).vtable as *const u32;
-        let func: u32 = *vtable.add(slot);
-        let mut result_buf: [u32; 2] = [0; 2];
-        core::arch::asm!(
-            "push {param}",
-            "call {func}",
-            param = in(reg) param,
-            func = in(reg) func,
-            in("ecx") this,
-            inout("edx") result_buf.as_mut_ptr() => _,
-            out("eax") _,
-            clobber_abi("C"),
-        );
-    }
-}

crates/openwa-core/src/display/mod.rs

@@ -15,7 +15,7 @@ pub use bitgrid::{
 };
 pub use compat_renderer::CompatRenderer;
 pub use dd_display::DDDisplay;
-pub use display_wrapper::DDDisplayWrapper;
+pub use display_wrapper::{DDDisplayWrapper, FastcallResult};
 pub use gfx::DisplayGfx;
 pub use opengl::OpenGLState;
 pub use palette::{Palette, PaletteVtable};