fix(cashc): lower integer * and / to OP_MUL/OP_DIV, not OP_2MUL/OP_2DIV

The numeric branch of compileBinaryOp() mapped the binary `*` and `/`
operators to the UNARY OP_2MUL / OP_2DIV (multiply / divide by 2). Since
visitBinaryOp pushes both operands and models the op as binary (pop 2,
push 1), `a * b` compiled to `a b OP_2MUL` — which doubles `b`, leaves `a`
dangling, and silently computes the wrong value. OP_2MUL/OP_2DIV are
enabled in Radiant consensus, so this produced valid-but-wrong scripts
rather than failing loudly. It breaks any contract doing real arithmetic
(e.g. a constant-product AMM); no shipped example multiplied variables, so
it went unnoticed.

Map MUL->OP_MUL and DIV->OP_DIV (both re-enabled in Radiant). Add a
generation regression test and correct the SplitSize fixture, whose baked
ASM (and comment) had encoded the buggy OP_2DIV for `b.length / 2`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: TheArtofSatoshi

packages/cashc/src/generation/utils.ts

@@ -101,8 +101,12 @@ export function compileBinaryOp(op: BinaryOperator, numeric: boolean = false): S
 
   if (numeric) {
     mapping[BinaryOperator.PLUS] = [Op.OP_ADD];
-    mapping[BinaryOperator.MUL] = [Op.OP_2MUL];
-    mapping[BinaryOperator.DIV] = [Op.OP_2DIV];
+    // OP_MUL / OP_DIV are full binary multiply/divide (re-enabled in Radiant
+    // consensus). OP_2MUL / OP_2DIV are UNARY multiply/divide-by-2 and must NOT
+    // be used for the binary `*` / `/` operators — doing so silently computes
+    // `x * 2` / `x / 2` and (being unary) corrupts the compiler's stack model.
+    mapping[BinaryOperator.MUL] = [Op.OP_MUL];
+    mapping[BinaryOperator.DIV] = [Op.OP_DIV];
     mapping[BinaryOperator.EQ] = [Op.OP_NUMEQUAL];
     mapping[BinaryOperator.NE] = [Op.OP_NUMNOTEQUAL];
   }

packages/cashc/test/generation/arithmetic.test.ts

@@ -0,0 +1,43 @@
+/*   arithmetic.test.ts
+ *
+ * Regression test: the binary `*` and `/` operators on integers must lower to
+ * the full binary OP_MUL / OP_DIV opcodes, NOT the unary OP_2MUL / OP_2DIV
+ * (multiply / divide by 2). See generation/utils.ts compileBinaryOp().
+ */
+
+import { compileString } from '../../src/index.js';
+
+const contract = `
+pragma radiantscript ^1.1.0;
+contract Arith() {
+  return {
+    f(int a, int b) {
+      require(a * b == b * a);
+      require(a / b >= 0);
+      require(a % b >= 0);
+    }
+  };
+}
+`;
+
+describe('Integer arithmetic lowering', () => {
+  const artifact = compileString(contract);
+  const asm: string = (artifact as { asm: string }).asm;
+
+  it('lowers `*` to OP_MUL', () => {
+    expect(asm).toContain('OP_MUL');
+  });
+
+  it('lowers `/` to OP_DIV', () => {
+    expect(asm).toContain('OP_DIV');
+  });
+
+  it('lowers `%` to OP_MOD', () => {
+    expect(asm).toContain('OP_MOD');
+  });
+
+  it('never emits the unary OP_2MUL / OP_2DIV for binary operators', () => {
+    expect(asm).not.toContain('OP_2MUL');
+    expect(asm).not.toContain('OP_2DIV');
+  });
+});

packages/cashc/test/generation/fixtures.ts

@@ -153,9 +153,10 @@ export const fixtures: Fixture[] = [
       asm:
         '$_b '
         // bytes x = b.split(b.length / 2)[1]
-        // Post V2-fork: the compiler emits OP_2DIV instead of OP_DIV-by-2 as
-        // an optimisation, matching the new opcode added in commit ac69ad2.
-        + 'OP_DUP OP_DUP OP_SIZE OP_NIP OP_2 OP_2DIV OP_SPLIT OP_NIP '
+        // `b.length / 2` is binary division and must lower to OP_DIV. (The unary
+        // OP_2DIV would halve the pushed literal 2, not the length — see the
+        // OP_MUL/OP_DIV fix in generation/utils.ts compileBinaryOp.)
+        + 'OP_DUP OP_DUP OP_SIZE OP_NIP OP_2 OP_DIV OP_SPLIT OP_NIP '
         // require(x != b)
         + 'OP_2DUP OP_EQUAL OP_NOT OP_VERIFY '
         // bytes x = b.split(b.length / 2)[1]