@scriptc/compiler 0.2.2 → 0.2.4

package/dist/backend/llvm/emitter.js

@@ -22,16 +22,26 @@ import { deflateRawSync } from "node:zlib";
 import { endsWithJump, matchStringSelfConcat, streamTypedRefEligible } from "../../ir/analysis.js";
 import { emitLibraryIdentityLines } from "../library-identity-markers.js";
 import { CAUGHT, ffiCallbackType, isDynTypedRefType, isFfiContextParam, isRefCounted, isUnitType, moduleRuntimeFeatures, moduleEmbedsBuiltin, moduleEmbedsCompressedNpm, NPM_COMPRESS_MIN, POINTER_KINDS, RUNTIME_EMITTER_CLASS, RUNTIME_ERROR_CLASSES, RUNTIME_STREAM_CLASSES, typeKey, VOID } from "../../ir/ir.js";
-import { matchIntegerBytesForLoop } from "../../ir/integer-loops.js";
+import { matchIntegerArrayForLoop, matchIntegerBytesForLoop, matchIntegerCountedForLoop } from "../../ir/integer-loops.js";
+import { emitCountedLoopLimit } from "./counted-loops.js";
+import { findBytesBounds } from "./bytes-bounds.js";
 import { scalarizeNumericRecords } from "../../ir/scalar-records.js";
 import { everyStmtList } from "../../ir/traverse.js";
 import { analyzeIntegerRanges } from "../../ir/integer-ranges.js";
+import { findIntegerViews } from "./integer-views.js";
 import { findConstantNumericTables } from "../../ir/constant-tables.js";
 import { allocateFfiCallbackAdapters, hasForeignFfiCallback, hasRetainedFfiCallback } from "../ffi-callbacks.js";
 import { RUNTIME_ABI_MARKER } from "../runtime-abi.js";
 import { computeMayThrow } from "../may-throw.js";
-import { mangleArgPack, mangleAsyncSpawn, mangleClassObj, mangleClassStruct, mangleFnClosure, mangleFunction, mangleGenDrop, mangleGenSpawn, mangleGlobal, mangleLocal, mangleRecordStruct, mangleTrampoline, mangleWrapper, mangleVtInstance } from "../mangle.js";
+import { mangleArgPack, mangleAsyncSpawn, mangleBorrowedFunction, mangleClassObj, mangleClassStruct, mangleFnClosure, mangleFunction, mangleGenDrop, mangleGenSpawn, mangleGlobal, mangleLocal, mangleRecordStruct, mangleTrampoline, mangleWrapper, mangleVtInstance } from "../mangle.js";
+import { analyzeCallLifetimes } from "./call-lifetimes.js";
+import { emitStackUnion, findLocalStackUnions } from "./stack-unions.js";
 import { BlockBuilder } from "./blocks.js";
+import { emitLocalArrayRead, findLocalArrayReads, findCallArrayReads, OptionalArrayReads } from "./local-array-reads.js";
+import { emitStackMapRead, findMapReadLifetimes } from "./map-read-lifetimes.js";
+import { emitBorrowedFieldSequence } from "./borrowed-receivers.js";
+import { emitBorrowedInput } from "./borrowed-inputs.js";
+import { ReferenceEffects } from "./reference-effects.js";
 import { LlvmDebugInfo } from "./debug-info.js";
 import { f64Lit, ffiNativeTypeLl, ffiNativeParamLl, ffiNativeReturnLl, llvmCommentText } from "./common.js";
 import { ffiExtendsNarrowIntegers } from "../targets.js";
@@ -101,6 +111,41 @@ function llStrBytes(text) {
 }
 export class LlEmitter {
     mod;
+    localArrayReads = new Map();
+    localStackUnions = new Map();
+    integerArrayBindings = new Set();
+    fieldAliasTags = new Map();
+    fieldPointerTags = new Map();
+    /** Native class fields with different property names cannot occupy the
+     * same slot of one object. Inherited views of the same property share a
+     * tag. Array storage has its own disjoint categories; untagged runtime
+     * operations and record views conservatively alias all of them. */
+    markFieldPointer(ptr, field) {
+        this.markMemoryPointer(ptr, `field:${field}`);
+    }
+    markMemoryPointer(ptr, field) {
+        if (this.debug !== null)
+            return;
+        let tag = this.fieldAliasTags.get(field);
+        if (tag === undefined) {
+            tag = 2 + this.fieldAliasTags.size * 2;
+            this.fieldAliasTags.set(field, tag);
+        }
+        this.fieldPointerTags.set(ptr, tag);
+    }
+    fieldAliasAttachment(ptr) {
+        const tag = this.fieldPointerTags.get(ptr);
+        return tag === undefined ? "" : `, !tbaa !${tag}`;
+    }
+    fieldAliasMetadata() {
+        if (this.fieldAliasTags.size === 0)
+            return [];
+        const lines = ['!0 = !{!"scriptc native fields"}'];
+        for (const tag of this.fieldAliasTags.values()) {
+            lines.push(`!${tag - 1} = !{!"field.${tag}", !0, i64 0}`, `!${tag} = !{!${tag - 1}, !${tag - 1}, i64 0}`);
+        }
+        return lines;
+    }
     debug;
     debugScope = null;
     sizeType;
@@ -116,6 +161,7 @@ export class LlEmitter {
      * immortal (rc == SIZE_MAX) static per (union, unit tag).
      * RC entry points and the collector skip immortals. */
     unitInstances = new Map();
+    immortalValues = new Set();
     /** Regex literal templates: "<flags>/<pattern>" → { symbol, interned
      * source/flags literal refs } — one immortal ScrRegex template per distinct
      * (pattern, flags) pair; the bytecode slot starts null and the runtime
@@ -149,6 +195,13 @@ export class LlEmitter {
     needsBadKey = false;
     needsRetainBox = false;
     fnByName = new Map();
+    referenceEffects;
+    optionalArrayReads;
+    callArrayReads = new Map();
+    mapReadLifetimes = { locals: new Map(), arguments: new Map() };
+    callLifetimes;
+    borrowedParameters = new Set();
+    stableCallBindings = new Set();
     /** Manifest-bound native imports, used by ffiCall emission. */
     ffiByName = new Map();
     /** C-ABI callback trampolines and (for raw/no-userdata callbacks) their
@@ -230,9 +283,12 @@ export class LlEmitter {
     jumpTargets = [];
     currentLocals = new Map();
     captureIds = new Set();
-    /** Active canonical byte-loop induction bindings: local id → size_t slot. */
+    /** Active induction bindings retain their width independently of size_t. */
     integerLoopBindings = new Map();
+    countedLoopsEnabled = false;
     integerRanges = new Map();
+    bytesBounds = new Set();
+    integerViews = new Map();
     /** Enclosing try-with-FINALLY regions, innermost last: a `return`
      * inside one runs every crossed finally (innermost first) before the
      * actual ret — the runtime ABI’s pending-return path, with the finally
@@ -298,6 +354,9 @@ export class LlEmitter {
         }
         for (const u of mod.unions ?? [])
             this.unionsById.set(u.id, u);
+        this.optionalArrayReads = new OptionalArrayReads(this.fnByName, this.unionsById);
+        this.referenceEffects = new ReferenceEffects(this.fnByName, (call) => this.optionalArrayReads.get(call) !== null);
+        this.callLifetimes = analyzeCallLifetimes(this.fnByName);
         for (const r of mod.records ?? [])
             this.recordsById.set(r.id, r);
         const traced = computeTraced(mod);
@@ -849,6 +908,7 @@ export class LlEmitter {
             this.declare(`declare void @scr_net_island_install()`);
         if (usesIsland) {
             this.declare(`declare void @scr_island_modules(ptr, ${this.sizeType}, ptr, ${this.sizeType})`);
+            this.declare(`declare void @scr_island_entry_module(ptr)`);
             this.declare(`declare i32 @scr_island_exit_code()`);
             if (moduleEmbedsCompressedNpm(this.mod)) {
                 this.declare(`declare void @scr_island_set_inflate(ptr)`);
@@ -1116,6 +1176,7 @@ export class LlEmitter {
         }
         if (this.templateStringsInstances.size > 0)
             out.push(``);
+        const islandEntryPath = usesIsland ? this.cstr(this.mod.sourceFile) : null;
         for (const [text, c] of this.cstrs) {
             // NUL-terminated byte-array constants for scr_jb_puts and indentation.
             out.push(`@${c.sym} = internal constant [${c.len + 1} x i8] c"${llStrBytes(text)}"`);
@@ -1247,6 +1308,7 @@ export class LlEmitter {
             if (hasNoInlineRecordClone)
                 out.push(`attributes #2 = { noinline sanitize_address }`);
             out.push(``);
+            out.push(...this.fieldAliasMetadata());
             if (this.debug !== null)
                 out.push(this.debug.render());
             return out;
@@ -1260,6 +1322,7 @@ export class LlEmitter {
         // scr_watch.c links only when this line is emitted.
         ...(usesFsWatch ? [`  call void @scr_watch_install()`] : []), ...(this.ffiHasForeignCallback ? [`  call void @scr_ffi_install()`] : []), ...(snapshotsTlsCa ? [`  call void @scr_tls_ca_install()`] : []), ...(usesFetch ? [`  call void @scr_fetch_install()`] : []), ...(embedsZlib ? [`  call void @scr_zlib_island_install()`] : []), ...(embedsNet ? [`  call void @scr_net_island_install()`] : []), ...(usesNet ? [`  call void @scr_net_install()`, `  call void @scr_net_dyn_install()`] : []), ...(usesHttp ? [`  call void @scr_http_dyn_install()`] : []), ...(usesDgram ? [`  call void @scr_dgram_install()`] : []), ...(usesHttp2 ? [`  call void @scr_http2_dyn_install()`] : []), ...(usesStream ? [`  call void @scr_stream_install()`] : []), `  call void @scr_lib_init(i32 %argc, ptr %argv)`, ...(usesIsland
             ? [
+                `  call void @scr_island_entry_module(ptr ${islandEntryPath})`,
                 ...(moduleEmbedsCompressedNpm(this.mod)
                     ? [`  call void @scr_island_set_inflate(ptr @scr_zlib_inflate_exact)`]
                     : []),
@@ -1359,6 +1422,7 @@ export class LlEmitter {
         // lane's -fsanitize=address link activates instrumentation over the
         // emitted functions too (the runtime TUs get theirs from clang).
         `attributes #0 = { sanitize_address }`, ...(this.wasi ? [`attributes #1 = { sanitize_address presplitcoroutine }`] : []), ...(hasNoInlineRecordClone ? [`attributes #2 = { noinline sanitize_address }`] : []), ``);
+        out.push(...this.fieldAliasMetadata());
         if (this.debug !== null)
             out.push(this.debug.render());
         return out;
@@ -1941,7 +2005,9 @@ export class LlEmitter {
             lit = { sym: `sc_lit_${this.literals.size}`, len: Buffer.byteLength(text, "utf8") };
             this.literals.set(text, lit);
         }
-        return `@${lit.sym}`;
+        const name = `@${lit.sym}`;
+        this.immortalValues.add(name);
+        return name;
     }
     /** Interned NUL-terminated C-string constant (the scr_jb_puts /
      * stringify-indent currency) — `@`-ref, first-use order. */
@@ -1971,7 +2037,9 @@ export class LlEmitter {
             sym = `sc_unit_${this.unitInstances.size}`;
             this.unitInstances.set(key, sym);
         }
-        return `@${sym}`;
+        const name = `@${sym}`;
+        this.immortalValues.add(name);
+        return name;
     }
     declare(decl) {
         this.decls.add(decl);
@@ -1987,7 +2055,7 @@ export class LlEmitter {
     }
     /** Registers an owned refcounted value on the current statement frame. */
     own(v) {
-        if (isRefCounted(v.type))
+        if (isRefCounted(v.type) && !this.immortalValues.has(v.name))
             this.currentFrame().push(v);
         return v;
     }
@@ -1999,7 +2067,7 @@ export class LlEmitter {
     }
     /** Strike a refcounted temp from its frame: ownership is being moved. */
     moveTemp(v) {
-        if (!isRefCounted(v.type))
+        if (!isRefCounted(v.type) || this.immortalValues.has(v.name))
             return;
         for (let i = this.frames.length - 1; i >= 0; i--) {
             const idx = this.frames[i].findIndex((e) => e.name === v.name);
@@ -2013,6 +2081,8 @@ export class LlEmitter {
     /** The retained (+1) read of a refcounted value — type-directed through
      * the `_v` table (immortals skip, exactly the C retain calls). */
     retainValue(name, type) {
+        if (this.immortalValues.has(name))
+            return name;
         const t = this.B.tmp();
         this.B.line(`${t} = call ptr ${retainSym(this.shapeHost, type)}(ptr ${name})`);
         return t;
@@ -2020,6 +2090,8 @@ export class LlEmitter {
     /** The release call for one owned refcounted value — type-directed like
      * releaseCallC (all runtime releases are NULL-tolerant). */
     releaseValue(name, type) {
+        if (this.immortalValues.has(name))
+            return;
         this.B.line(`call void ${releaseSym(this.shapeHost, type)}(ptr ${name})`);
     }
     releaseFrame(frame) {
@@ -2418,7 +2490,7 @@ export class LlEmitter {
      * a retained peek. */
     unionExtract(uName, arm) {
         const B = this.B;
-        if (arm.kind === "f64") {
+        if (arm.kind === "f64" || arm.kind === "procStream") {
             const t = B.tmp();
             this.declare(`declare double @scr_union_get_f64(ptr)`);
             B.line(`${t} = call double @scr_union_get_f64(ptr ${uName})`);
@@ -2438,7 +2510,7 @@ export class LlEmitter {
     unionNewOwned(tag, v) {
         const B = this.B;
         const t = B.tmp();
-        if (v.type.kind === "f64") {
+        if (v.type.kind === "f64" || v.type.kind === "procStream") {
             this.declare(`declare ptr @scr_union_new_f64(i32, double)`);
             B.line(`${t} = call ptr @scr_union_new_f64(i32 ${tag}, double ${v.name})`);
             return t;
@@ -2469,6 +2541,7 @@ export class LlEmitter {
         const { index, type } = classFieldIndex(meta, field);
         const p = this.B.tmp();
         this.B.line(`${p} = getelementptr inbounds %${classStructSym(className)}, ptr ${objName}, i64 0, i32 ${index}`);
+        this.markFieldPointer(p, field);
         return { ptr: p, type };
     }
     /** `o->vt->pre` — the dynamic class's preorder number (borrowed object;
@@ -2559,7 +2632,7 @@ export class LlEmitter {
         const B = this.B;
         const fieldTy = llFieldType(t);
         const raw = B.tmp();
-        B.line(`${raw} = load ${fieldTy}, ptr ${ptr}`);
+        B.line(`${raw} = load ${fieldTy}, ptr ${ptr}${this.fieldAliasAttachment(ptr)}`);
         if (fieldTy !== "i8")
             return raw;
         const b = B.tmp();
@@ -2571,12 +2644,12 @@ export class LlEmitter {
         const B = this.B;
         const fieldTy = llFieldType(t);
         if (fieldTy !== "i8") {
-            B.line(`store ${fieldTy} ${value}, ptr ${ptr}`);
+            B.line(`store ${fieldTy} ${value}, ptr ${ptr}${this.fieldAliasAttachment(ptr)}`);
             return;
         }
         const z = B.tmp();
         B.line(`${z} = zext i1 ${value} to i8`);
-        B.line(`store i8 ${z}, ptr ${ptr}`);
+        B.line(`store i8 ${z}, ptr ${ptr}${this.fieldAliasAttachment(ptr)}`);
     }
     // ── bindings ────────────────────────────────────────────────────────────
     /** A binding's storage: a module global, a plain local slot, or a boxed
@@ -2856,9 +2929,25 @@ export class LlEmitter {
         this.unwindCleanups.clear();
         this.jumpTargets = [];
         this.currentLocals = new Map(fn.locals.map((l) => [l.id, l]));
+        this.borrowedParameters.clear();
+        this.stableCallBindings = this.callLifetimes.bindings.get(fn.name) ?? new Set();
+        const borrowedParameterIndexes = this.callLifetimes.borrowed.get(fn.name);
+        if (borrowedParameterIndexes) {
+            for (const index of borrowedParameterIndexes)
+                this.borrowedParameters.add(fn.params[index].localId);
+        }
         this.captureIds = new Set([...(fn.captures ?? []), ...(fn.classCaptures ?? [])].map((c) => c.localId));
         this.integerLoopBindings.clear();
+        this.countedLoopsEnabled = this.debug === null && !fn.async && !fn.generator;
+        this.integerViews.clear();
+        this.fieldPointerTags.clear();
+        this.integerArrayBindings.clear();
+        this.localArrayReads = findLocalArrayReads(fn, this.fnByName, this.unionsById, this.referenceEffects.functions, this.callLifetimes, this.optionalArrayReads);
+        this.callArrayReads = findCallArrayReads(fn, this.optionalArrayReads, this.referenceEffects.functions, this.callLifetimes);
+        this.mapReadLifetimes = findMapReadLifetimes(fn, this.unionsById, this.callLifetimes);
+        this.localStackUnions = findLocalStackUnions(fn, this.callLifetimes, this.unionsById);
         this.integerRanges = analyzeIntegerRanges(fn);
+        this.bytesBounds = findBytesBounds(fn, this.integerRanges);
         this.chainSlots.clear();
         this.finallyStack = [];
         this.tryStack = [];
@@ -2900,6 +2989,13 @@ export class LlEmitter {
             };
         }
         const paramIds = new Set(fn.params.map((p) => p.localId));
+        if (this.debug === null) {
+            for (const id of findIntegerViews(fn)) {
+                const slot = B.slot();
+                B.entryAllocas.push(`${slot} = alloca i32 ; integer view ${this.currentLocals.get(id).name}`);
+                this.integerViews.set(id, slot);
+            }
+        }
         for (const local of fn.locals) {
             // Boxed locals' slots hold their capture BOX (a ptr); captured
             // (env-borrowed) locals bind the incoming box below. A caught-typed
@@ -2949,7 +3045,8 @@ export class LlEmitter {
         // params (callees own their params — callers passed +1). Boxed params
         // allocate the shared binding and move the raw value in.
         const fnScope = [];
-        for (const p of fn.params) {
+        const borrowed = this.callLifetimes.borrowed.get(fn.name);
+        for (const [index, p] of fn.params.entries()) {
             const local = this.currentLocals.get(p.localId);
             const slot = `%${mangleLocal(p.localId)}`;
             if (local.boxed) {
@@ -2961,7 +3058,8 @@ export class LlEmitter {
                 continue;
             }
             B.line(`store ${this.llType(p.type)} %p_${mangleLocal(p.localId)}, ptr ${slot}`);
-            if (isRefCounted(p.type))
+            this.storeIntegerView(p.localId, { name: `%p_${mangleLocal(p.localId)}`, type: p.type });
+            if (isRefCounted(p.type) && !borrowed?.has(index))
                 fnScope.push({ slot, type: p.type });
         }
         this.scopes.push(fnScope);
@@ -3043,7 +3141,38 @@ export class LlEmitter {
         const ret = this.llType(fn.returnType);
         const attrs = coro !== null ? "#1" : FN_ATTRS;
         const debug = this.debugScope === null ? "" : ` !dbg ${this.debugScope}`;
-        return `define internal ${ret} @${mangleFunction(fn.name)}(${params.join(", ")}) ${attrs}${debug} { ; ${fn.name}\n${B.render()}\n}`;
+        const symbol = borrowed ? mangleBorrowedFunction(fn.name) : mangleFunction(fn.name);
+        const body = `define internal ${ret} @${symbol}(${params.join(", ")}) ${attrs}${debug} { ; ${fn.name}\n${B.render()}\n}`;
+        return borrowed ? body + "\n" + this.emitOwnedCallAdapter(fn, borrowed) : body;
+    }
+    /** Keep the ordinary owned ABI for closures, virtual dispatch, generated
+     * runtime adapters and library exports. Only direct IR calls select the
+     * borrowing body. Ownership of other parameters moves into that body;
+     * borrowed parameters are released here on normal and exceptional exits.
+     * The pending exception remains for the adapter's caller to handle. */
+    emitOwnedCallAdapter(fn, borrowed) {
+        const B = new BlockBuilder();
+        this.B = B;
+        const params = fn.params.map((param, index) => `${this.llType(param.type)} %p${index}`);
+        const ret = this.llType(fn.returnType);
+        const call = `call ${ret} @${mangleBorrowedFunction(fn.name)}(${params.join(", ")})`;
+        B.line(ret === "void" ? call : `%result = ${call}`);
+        for (const index of borrowed)
+            this.releaseValue(`%p${index}`, fn.params[index].type);
+        B.terminate(ret === "void" ? "ret void" : `ret ${ret} %result`);
+        return `define internal ${ret} @${mangleFunction(fn.name)}(${params.join(", ")}) ${FN_ATTRS} {\n${B.render()}\n}`;
+    }
+    /** A local stable binding keeps its value alive while later arguments
+     * and the callee execute. Global, captured, TDZ and mutable bindings need
+     * an owned snapshot, even when the callee only inspects the value. */
+    canBorrowCallArgument(value) {
+        if (value.kind === "strLit")
+            return true;
+        if (value.kind !== "varRef")
+            return false;
+        const binding = this.binding(value.localId);
+        return binding.kind === "local" && binding.local !== undefined &&
+            (!binding.local.mutable || this.stableCallBindings.has(value.localId) || this.borrowedParameters.has(value.localId)) && !binding.local.boxed && !binding.local.tdz;
     }
     // ── statements ──────────────────────────────────────────────────────────
     emitStmts(stmts) {
@@ -3087,6 +3216,31 @@ export class LlEmitter {
         switch (s.kind) {
             case "varDecl": {
                 const b = this.binding(s.localId);
+                const localUnion = this.localStackUnions.get(s.localId);
+                if (localUnion) {
+                    const union = emitStackUnion(this, localUnion);
+                    B.line(`store ptr ${union.value.name}, ptr ${b.slot}`);
+                    if (union.payload) {
+                        this.moveTemp(union.payload);
+                        this.scopes[this.scopes.length - 1].push({ slot: union.payloadSlot, type: union.payload.type });
+                    }
+                    break;
+                }
+                const localRead = this.localArrayReads.get(s.localId);
+                if (localRead) {
+                    const owner = emitLocalArrayRead(this, localRead, b.slot);
+                    if (owner)
+                        this.scopes[this.scopes.length - 1].push(owner);
+                    break;
+                }
+                const mapRead = this.mapReadLifetimes.locals.get(s.localId);
+                if (mapRead) {
+                    const result = emitStackMapRead(this, mapRead);
+                    B.line(`store ptr ${result.value.name}, ptr ${b.slot}`);
+                    if (result.owner)
+                        this.scopes[this.scopes.length - 1].push(result.owner);
+                    break;
+                }
                 if (b.kind === "boxed") {
                     // Box FIRST, then evaluate the initializer: a named function
                     // expression's closure captures this box during init evaluation.
@@ -3124,9 +3278,20 @@ export class LlEmitter {
                     }
                     break;
                 }
+                // A lexical const alias cannot outlive its unchanged local owner.
+                // Whole-value uses still retain their own copies, so returning or
+                // storing the alias preserves the ordinary heap representation.
+                // Boxed captures, reassigned sources and projections need ownership.
+                if (b.kind === "local" && b.local && !b.local.mutable && isRefCounted(b.type) &&
+                    this.stableCallBindings.has(s.localId) && this.canBorrowCallArgument(s.init)) {
+                    const v = this.emitReadReceiver(s.init);
+                    B.line(`store ptr ${v.name}, ptr ${b.slot}`);
+                    break;
+                }
                 const v = this.emitExpr(s.init);
                 this.moveTemp(v);
                 B.line(`store ${this.llType(b.type)} ${v.name}, ptr ${b.slot}`);
+                this.storeIntegerView(s.localId, v, s.init);
                 if (isRefCounted(b.type)) {
                     this.scopes[this.scopes.length - 1].push({ slot: b.slot, type: b.type });
                 }
@@ -3157,6 +3322,7 @@ export class LlEmitter {
                     this.releaseValue(old, b.type);
                 }
                 B.line(`store ${this.llType(b.type)} ${v.name}, ptr ${b.slot}`);
+                this.storeIntegerView(s.localId, v, s.value);
                 break;
             }
             case "exprStmt":
@@ -3166,7 +3332,7 @@ export class LlEmitter {
                 // Evaluation order matches JS: array, index, then value. Ownership
                 // of a refcounted value moves into the array (the runtime releases
                 // the replaced element itself).
-                const arr = this.emitExpr(s.arr);
+                const arr = emitBorrowedInput(this, s.arr);
                 const idx = this.emitExpr(s.index);
                 const v = this.emitExpr(s.value);
                 if (s.arr.type.kind !== "array")
@@ -3180,7 +3346,7 @@ export class LlEmitter {
                 break;
             }
             case "arraySetLength": {
-                const arr = this.emitExpr(s.arr);
+                const arr = emitBorrowedInput(this, s.arr);
                 const length = this.emitExpr(s.length);
                 if (s.arr.type.kind !== "array")
                     throw new InternalCompilerError("llvm emitter bug: arraySetLength on non-array");
@@ -3191,7 +3357,7 @@ export class LlEmitter {
             }
             case "arraySetUndefined":
             case "arrayDelete": {
-                const arr = this.emitExpr(s.arr);
+                const arr = emitBorrowedInput(this, s.arr);
                 const idx = this.emitExpr(s.index);
                 if (s.arr.type.kind !== "array")
                     throw new InternalCompilerError(`llvm emitter bug: ${s.kind} on non-array`);
@@ -3210,12 +3376,11 @@ export class LlEmitter {
                 // IrBytesElem is static, so never rediscover it through the
                 // generic runtime switch in a hot loop.
                 const arr = this.emitStableReceiver(s.arr, [s.index, s.value]);
-                const integerIndex = this.emitIntegerLoopIndex(s.index);
-                const idx = integerIndex ?? this.emitExpr(s.index).name;
+                const idx = this.emitExpr(s.index);
                 const v = this.emitExpr(s.value);
                 if (s.arr.type.kind !== "bytes")
                     throw new InternalCompilerError("llvm emitter bug: bytesSet on non-bytes");
-                this.emitBytesSet(s.arr.type.elem, arr.name, idx, v.name, integerIndex !== null);
+                this.emitBytesSet(s.arr.type.elem, arr.name, idx, v, s.index, s.value, this.bytesBounds.has(s));
                 break;
             }
             case "fieldSet":
@@ -3225,7 +3390,7 @@ export class LlEmitter {
                 // release — a release can trigger a cycle collection, which must
                 // never see a heap edge whose count was already given up).
                 // Classes and records share the struct layout, so one emission.
-                const obj = this.emitExpr(s.obj);
+                const obj = isRefCounted(s.value.type) ? this.emitExpr(s.obj) : this.emitStableReceiver(s.obj, [s.value]);
                 const v = this.emitExpr(s.value);
                 const { ptr, type } = s.kind === "fieldSet"
                     ? this.classFieldPtr(obj.name, s.className, s.field)
@@ -3486,14 +3651,51 @@ export class LlEmitter {
             case "for": {
                 // The init's scope wraps the whole loop (break/continue must NOT
                 // release it — scopeDepth captured after the push, C parity).
-                const integerLoop = this.debug === null ? matchIntegerBytesForLoop(s, this.currentLocals) : null;
+                const integerArrayLoop = this.debug === null ? matchIntegerArrayForLoop(s, this.currentLocals, this.integerArrayBindings) : null;
+                const integerLoop = integerArrayLoop ?? (this.debug === null ? matchIntegerBytesForLoop(s, this.currentLocals) : null);
+                const countedLoop = !integerLoop && this.countedLoopsEnabled ? matchIntegerCountedForLoop(s, this.currentLocals, this.integerRanges) : null;
+                let countedJoin = null;
+                if (countedLoop?.guarded) {
+                    const bound = this.emitExpr(countedLoop.limit);
+                    const safe = B.tmp();
+                    const fast = B.newLabel("counted.fast");
+                    const slow = B.newLabel("counted.slow");
+                    countedJoin = B.newLabel("counted.done");
+                    B.line(`${safe} = fcmp ${countedLoop.step > 0 ? "ole" : "oge"} double ${bound.name}, ${f64Lit(countedLoop.guardLimit)}`);
+                    B.condBr(safe, fast, slow);
+                    B.startBlock(slow);
+                    this.countedLoopsEnabled = false;
+                    this.emitStmt(s);
+                    this.countedLoopsEnabled = true;
+                    B.br(countedJoin);
+                    B.startBlock(fast);
+                }
                 this.scopes.push([]);
                 let integerSlot = null;
+                let countedLimit = null;
                 if (integerLoop) {
                     integerSlot = B.slot();
                     B.entryAllocas.push(`${integerSlot} = alloca ${this.sizeType} ; integer induction ${this.currentLocals.get(integerLoop.localId).name}`);
-                    B.line(`store ${this.sizeType} 0, ptr ${integerSlot}`);
-                    this.integerLoopBindings.set(integerLoop.localId, integerSlot);
+                    let start = "0";
+                    if (integerArrayLoop && s.init?.kind === "varDecl" && s.init.init) {
+                        const value = this.emitExpr(s.init.init);
+                        start = B.tmp();
+                        B.line(`${start} = fptoui double ${value.name} to ${this.sizeType}`);
+                        this.integerArrayBindings.add(integerLoop.localId);
+                    }
+                    B.line(`store ${this.sizeType} ${start}, ptr ${integerSlot}`);
+                    this.integerLoopBindings.set(integerLoop.localId, { slot: integerSlot, type: this.sizeType,
+                        range: { min: 0, max: integerArrayLoop ? 4294967294 : Number.MAX_SAFE_INTEGER - 1 } });
+                }
+                else if (countedLoop) {
+                    integerSlot = B.slot();
+                    B.entryAllocas.push(`${integerSlot} = alloca i64 ; integer induction ${this.currentLocals.get(countedLoop.localId).name}`);
+                    const startNumber = this.emitExpr(countedLoop.start);
+                    const start = B.tmp();
+                    B.line(`${start} = fptosi double ${startNumber.name} to i64`);
+                    B.line(`store i64 ${start}, ptr ${integerSlot}`);
+                    this.integerLoopBindings.set(countedLoop.localId, { slot: integerSlot, type: "i64", signed: true, range: countedLoop.range });
+                    countedLimit = emitCountedLoopLimit(this, countedLoop);
                 }
                 else if (s.init) {
                     // A multi-declarator head shares the loop's scope. Emitting its
@@ -3540,12 +3742,21 @@ export class LlEmitter {
                     const len = B.tmp();
                     const index = B.tmp();
                     const inBounds = B.tmp();
-                    B.line(`${lenPtr} = getelementptr inbounds %ScrBytes, ptr ${receiver.name}, i64 0, i32 1`);
-                    B.line(`${len} = load ${this.sizeType}, ptr ${lenPtr}`);
+                    B.line(`${lenPtr} = getelementptr inbounds %${integerArrayLoop ? "ScrArr" : "ScrBytes"}, ptr ${receiver.name}, i64 0, i32 1`);
+                    if (integerArrayLoop)
+                        this.markMemoryPointer(lenPtr, "array:header");
+                    B.line(`${len} = load ${this.sizeType}, ptr ${lenPtr}${this.fieldAliasAttachment(lenPtr)}`);
                     B.line(`${index} = load ${this.sizeType}, ptr ${integerSlot}`);
                     B.line(`${inBounds} = icmp ult ${this.sizeType} ${index}, ${len}`);
                     B.condBr(inBounds, lb, le);
                 }
+                else if (countedLoop && integerSlot && countedLimit) {
+                    const index = B.tmp();
+                    const inBounds = B.tmp();
+                    B.line(`${index} = load i64, ptr ${integerSlot}`);
+                    B.line(`${inBounds} = icmp ${countedLoop.step > 0 ? "slt" : "sgt"} i64 ${index}, ${countedLimit}`);
+                    B.condBr(inBounds, lb, le);
+                }
                 else if (s.cond)
                     B.condBr(this.emitCondition(s.cond), lb, le);
                 else
@@ -3573,6 +3784,13 @@ export class LlEmitter {
                         B.line(`${next} = add nuw ${this.sizeType} ${old}, 1`);
                         B.line(`store ${this.sizeType} ${next}, ptr ${integerSlot}`);
                     }
+                    else if (countedLoop && integerSlot) {
+                        const old = B.tmp();
+                        const next = B.tmp();
+                        B.line(`${old} = load i64, ptr ${integerSlot}`);
+                        B.line(`${next} = add nsw i64 ${old}, ${countedLoop.step}`);
+                        B.line(`store i64 ${next}, ptr ${integerSlot}`);
+                    }
                     else if (s.update)
                         this.emitStmt(s.update);
                     B.br(lc);
@@ -3581,6 +3799,14 @@ export class LlEmitter {
                 this.releaseScope(this.scopes.pop());
                 if (integerLoop)
                     this.integerLoopBindings.delete(integerLoop.localId);
+                if (countedLoop)
+                    this.integerLoopBindings.delete(countedLoop.localId);
+                if (integerArrayLoop)
+                    this.integerArrayBindings.delete(integerArrayLoop.localId);
+                if (countedJoin) {
+                    B.br(countedJoin);
+                    B.startBlock(countedJoin);
+                }
                 break;
             }
             case "forOf": {
@@ -4066,12 +4292,15 @@ export class LlEmitter {
      * branch and moves the result into `slot`: the chosen value's ownership
      * transfers, every other temp the arm allocated releases inside the
      * branch. The shared core of ternary/logical. */
-    emitBranchInto(slot, expr) {
+    emitBranchInto(slot, expr, integerSlot) {
         this.frames.push([]);
         const v = this.emitExpr(expr);
         this.moveTemp(v);
         this.B.line(`store ${this.llType(expr.type)} ${v.name}, ptr ${slot}`);
+        if (integerSlot !== undefined && v.uint32 !== undefined)
+            this.B.line(`store i32 ${v.uint32}, ptr ${integerSlot}`);
         this.releaseFrame(this.frames.pop());
+        return v.uint32 !== undefined;
     }
     // ── expressions ─────────────────────────────────────────────────────────
     emitLiteralExpr(e) {
@@ -4083,7 +4312,7 @@ export class LlEmitter {
             // to this expression's frame so they survive those reads and still
             // die on the path that created them, including inside lazy branches.
             this.scopes.push([]);
-            const result = emitOperatorExpr(this, e);
+            const result = emitBorrowedFieldSequence(this, e) ?? emitOperatorExpr(this, e);
             for (const local of this.scopes.pop()) {
                 this.currentFrame().push({ name: local.slot, type: local.type, slot: true, ...(local.boxed ? { boxed: true } : {}) });
             }
@@ -4170,6 +4399,8 @@ export class LlEmitter {
     emitReadReceiver(e) {
         if (!isRefCounted(e.type))
             return this.emitExpr(e);
+        if (e.kind === "strLit")
+            return { name: this.internLiteral(e.value), type: e.type };
         if (e.kind === "varRef") {
             const binding = this.binding(e.localId);
             // Capture boxes can carry TDZ and caught-value conversion semantics.
@@ -4192,8 +4423,43 @@ export class LlEmitter {
                 : this.classFieldPtr(receiver.name, e.className, e.field);
             return { name: this.loadField(ptr, type), type: e.type };
         }
+        if (e.kind === "ternary" && this.canBorrowReceiver(e.then) && this.canBorrowReceiver(e.else_)) {
+            // Checked projections lower to a ternary with an always-throwing
+            // arm. Keep that check at the use, but borrow the successful arm.
+            const B = this.B;
+            const cond = this.emitExpr(e.cond);
+            const slot = B.slot();
+            B.entryAllocas.push(`${slot} = alloca ptr`);
+            const yes = B.newLabel("read.then"), no = B.newLabel("read.else"), join = B.newLabel("read.join");
+            B.condBr(cond.name, yes, no);
+            for (const [label, value] of [[yes, e.then], [no, e.else_]]) {
+                B.startBlock(label);
+                this.frames.push([]);
+                const result = this.emitReadReceiver(value);
+                B.line(`store ptr ${result.name}, ptr ${slot}`);
+                this.releaseFrame(this.frames.pop());
+                B.br(join);
+            }
+            B.startBlock(join);
+            const value = B.tmp();
+            B.line(`${value} = load ptr, ptr ${slot}`);
+            return { name: value, type: e.type };
+        }
         return this.emitExpr(e);
     }
+    canBorrowReceiver(e) {
+        switch (e.kind) {
+            case "varRef": return this.binding(e.localId).kind !== "boxed";
+            case "unionNarrow": return this.canBorrowReceiver(e.value);
+            case "fieldGet":
+            case "recordGet": return this.canBorrowReceiver(e.obj);
+            case "ternary": return this.canBorrowReceiver(e.then) && this.canBorrowReceiver(e.else_);
+            // The runtime always sets a pending exception; its unreachable
+            // typed dummy is null and owns no receiver.
+            case "libCall": return e.fn === "error.nodeThrow";
+            default: return false;
+        }
+    }
     emitExpr(e) {
         return emitExpr(this, e);
     }
@@ -4311,8 +4577,8 @@ export class LlEmitter {
     emitIntegerLoopIndex(expr) {
         return emitIntegerLoopIndex(this, expr);
     }
-    emitBytesIndex(receiver, index, integerIndex = false) {
-        return emitBytesIndex(this, receiver, index, integerIndex);
+    emitBytesIndex(receiver, index, expr, inBounds = false) {
+        return emitBytesIndex(this, receiver, index, expr, undefined, inBounds);
     }
     emitBytesData(receiver) {
         return emitBytesData(this, receiver);
@@ -4320,14 +4586,21 @@ export class LlEmitter {
     emitBytesLength(elem, receiver, bytes) {
         return emitBytesLength(this, elem, receiver, bytes);
     }
-    emitBytesGet(elem, receiver, index, integerIndex = false) {
-        return emitBytesGet(this, elem, receiver, index, integerIndex);
+    emitBytesGet(elem, receiver, index, expr, inBounds = false) {
+        return emitBytesGet(this, elem, receiver, index, expr, inBounds);
     }
-    emitToUint32(value, expr) {
-        return emitToUint32(this, value, expr);
+    emitToUint32(value, expr, uint32) {
+        return emitToUint32(this, value, expr, uint32);
+    }
+    storeIntegerView(localId, value, expr) {
+        const slot = this.integerViews.get(localId);
+        if (slot === undefined)
+            return;
+        const integer = this.emitToUint32(value.name, expr, value.uint32);
+        this.B.line(`store i32 ${integer}, ptr ${slot}`);
     }
-    emitBytesSet(elem, receiver, index, value, integerIndex = false) {
-        return emitBytesSet(this, elem, receiver, index, value, integerIndex);
+    emitBytesSet(elem, receiver, index, value, indexExpr, expr, inBounds = false) {
+        return emitBytesSet(this, elem, receiver, index, value, indexExpr, expr, inBounds);
     }
     emitBytesIntrinsic(e) {
         return emitBytesIntrinsic(this, e);