@scriptc/compiler 0.2.9 → 0.3.0

package/dist/backend/llvm/reference-writes.js

@@ -0,0 +1,1090 @@
+import { isRefCounted, } from "../../ir/ir.js";
+import { everyExprChild, everyStmtChild } from "../../ir/traverse.js";
+import { borrowsMapMutationReceiver, borrowsMapReadInputs } from "./map-read-lifetimes.js";
+import { preservesRegexInputs, VirtualTargets } from "./reference-effects.js";
+import { borrowsStringInputs } from "./string-lifetimes.js";
+import { preservesDynTest } from "./checked-value-lifetimes.js";
+import { isStableReceiverOperand } from "../../ir/analysis.js";
+/** Every heap location (key 0). */
+const HEAP_KEY = "*";
+/** Array element slots of every reference array share one location: arrays
+ * are covariant, so element types do not separate them. */
+const ARRAY_KEY = "a";
+/** Entries of typed maps and sets. */
+const MAP_KEY = "m";
+/** Captured-binding boxes. */
+const BOX_KEY = "bx";
+/** Record fields written through a computed key. */
+const ANY_RECORD_KEY = "r:*";
+/** The pseudo-function standing for every indirect call target. */
+const ANY_FUNCTION = "%anyFunctionValue";
+/** Value-producing kinds that only move an existing function value. */
+const FUNCTION_MOVES = new Set([
+    "closure",
+    "selfRef",
+    "varRef",
+    "fieldGet",
+    "recordGet",
+    "arrayGet",
+    "call",
+    "virtualCall",
+    "callValue",
+    "ternary",
+    "logical",
+    "nullish",
+    "orDefault",
+    "unionNarrow",
+    "seqExpr",
+    "assignExpr",
+    "optChain",
+    "chainRecv",
+    "upcast",
+    "downcast",
+    "mapIntrinsic",
+    "setIntrinsic",
+    "arrIntrinsic",
+    "recordKeyGet",
+    "unionKeyGet",
+]);
+/** Runtime library families that run no user code and never write a
+ * program reference (scalars, strings, byte buffers, files, clocks). */
+const INERT_LIB_PREFIXES = [
+    "math.",
+    "num.",
+    "number.",
+    "string.",
+    "str.",
+    "bigint.",
+    "buffer.",
+    "arrayBuffer.",
+    "sharedArrayBuffer.",
+    "atomics.",
+    "perf.",
+    "date.",
+    "text.",
+    "path.",
+    "fs.",
+    "stats.",
+    "spawnRes.",
+];
+const INERT_LIB_CALLS = new Set([
+    "dyn.compare",
+    "error.new",
+    "error.nodeThrow",
+    "dyn.typedRefIs",
+    "dyn.bagGet",
+    "json.parse",
+    "process.stderrWrite",
+    "process.stdoutWrite",
+    "process.envGet",
+    "process.envPairs",
+    "process.cwd",
+    "process.argv",
+    "process.platform",
+    "process.execPath",
+    "process.isTTY",
+    "worker.data",
+    "worker.isMainThread",
+    "worker.parentPort",
+    "worker.root",
+    "cp.spawnSyncOpts",
+]);
+/** Array methods that never release an existing element or run user code. */
+const PRESERVING_ARRAY_METHODS = new Set([
+    "length",
+    "getNumber",
+    "indexEq",
+    "push",
+    "pushSpread",
+    "concatSpread",
+    "unshift",
+    "unshiftSpread",
+    "indexOf",
+    "includes",
+    "nextPresent",
+    "join",
+    "slice",
+    "flatCopy",
+    "flatOne",
+    "toReversed",
+    "toSpliced",
+    "with",
+    "withUndefined",
+    "toSortedPrimitive",
+    // Permutes primitive payloads in place: every element keeps its owner.
+    "sortPrimitive",
+]);
+/** Which heap reference locations evaluating code may overwrite or remove.
+ *
+ * ReferenceEffects answers one bit (does anything remove any edge?). This
+ * analysis keeps the location, so a borrow that reads `x.f` only conflicts
+ * with code that can write field `f` of x's hierarchy (or array elements,
+ * map entries, a global or a captured box, for those reads), not with
+ * every reference store. Locations:
+ *
+ * - `f:<hierarchy root>.<field>` class fields (all classes of a hierarchy
+ *   that name the field share it, so redeclarations alias);
+ * - `r:<field>` record fields, plus `r:*` for computed-key writes and
+ *   deletions (every record read also depends on `r:*`);
+ * - `a` reference array elements, `m` map/set entries, `bx` boxes;
+ * - `g:<id>` module globals, `l:<id>` the current function's own locals
+ *   (dropped from summaries: a callee cannot rebind its caller's locals);
+ * - ALL for anything unknown: dynamic code, callbacks, suspension, unknown
+ *   runtime operations.
+ *
+ * Stores a constructor makes into its own `this` write a fresh object that
+ * no borrow outside the construction can reach, so `new` (and `super`
+ * calls from constructors) use a constructor summary without them, as long
+ * as constructors are invoked only through `new` and `super`.
+ *
+ * Facts belong to one finalized module and one emission. */
+export class ReferenceWrites {
+    functions;
+    intrinsicCall;
+    globals;
+    immutable;
+    keys = new Map();
+    roots = new Map();
+    fieldOwners = new Map();
+    classes = new Map();
+    virtualTargets;
+    summaries = new Map();
+    exprCache = new Map();
+    stmtCache = new Map();
+    words = 0;
+    /** The unknown heap write alone. */
+    heapAll = new Uint32Array(1).fill(1);
+    /** Constructors only ever run on fresh objects. */
+    freshConstructors;
+    unions;
+    records;
+    inertJson = new Map();
+    /** Closure bodies an indirect call can reach. */
+    functionValues = new Set();
+    callTargets;
+    /** Some function value comes from outside the module's closures. */
+    foreignFunctionValues = false;
+    current = null;
+    currentBoxed = new Set();
+    currentLocals = new Set();
+    constructors = new Set();
+    inConstructor = false;
+    constructor(functions, classes, intrinsicCall, globals, types = {}, 
+    /** Fields no code writes once their object is constructed
+     * (immutability.ts, from cycle-mutability's construction-only facts). */
+    immutable = null) {
+        this.functions = functions;
+        this.intrinsicCall = intrinsicCall;
+        this.globals = globals;
+        this.immutable = immutable;
+        this.key(HEAP_KEY);
+        this.unions = new Map((types.unions ?? []).map((u) => [u.id, u]));
+        this.records = new Map((types.records ?? []).map((r) => [r.id, r]));
+        for (const cls of classes)
+            this.classes.set(cls.name, cls);
+        this.virtualTargets = new VirtualTargets(classes);
+        const constructors = new Set(classes.map((cls) => `%${cls.name}.constructor`));
+        this.constructors = constructors;
+        this.freshConstructors = [...functions.values()].every((fn) => fn.body.every((s) => this.onlySuperCalls(fn, s, constructors)));
+        this.callTargets = new CallTargets(functions, this.virtualTargets);
+        this.solve(constructors);
+    }
+    /** Every direct call of a constructor is a `super` call from a
+     * constructor on its own `this`. */
+    onlySuperCalls(fn, s, constructors) {
+        const thisId = constructors.has(fn.name) ? fn.params[0]?.localId : undefined;
+        const expr = (e) => {
+            if (e.kind === "call" && constructors.has(e.callee)) {
+                const self = e.args[0];
+                if (thisId === undefined || !self || !isThisRef(self, thisId))
+                    return false;
+            }
+            return everyExprChild(e, expr, stmt);
+        };
+        const stmt = (node) => everyStmtChild(node, expr, stmt);
+        return stmt(s);
+    }
+    key(k) {
+        let id = this.keys.get(k);
+        if (id === undefined) {
+            id = this.keys.size;
+            this.keys.set(k, id);
+        }
+        return id;
+    }
+    /** The hierarchy root of a class (runtime bases included). */
+    root(className) {
+        let r = this.roots.get(className);
+        if (r !== undefined)
+            return r;
+        r = className;
+        for (let cls = this.classes.get(className); cls?.base !== undefined;) {
+            r = cls.base;
+            cls = this.classes.get(cls.base);
+        }
+        this.roots.set(className, r);
+        return r;
+    }
+    fieldKey(className, field) {
+        return `f:${this.root(className)}.${field}`;
+    }
+    // ── phase 1: per-function local writes and call edges ─────────────────
+    solve(constructors) {
+        const nodes = new Map();
+        const scan = (fn, external) => {
+            const node = { local: new Set(), edges: new Set() };
+            if (fn.async || fn.generator) {
+                node.local.add(0);
+                return node;
+            }
+            const thisId = external && constructors.has(fn.name) ? (fn.params[0]?.localId ?? null) : null;
+            const boxed = boxedLocals(fn);
+            const sink = {
+                add: (k) => {
+                    // Interned for queries; a callee's locals are private to it.
+                    const id = this.key(k);
+                    if (!k.startsWith("l:"))
+                        node.local.add(id);
+                },
+                all: () => node.local.add(0),
+                call: (callee, fresh) => {
+                    if (callee === ANY_FUNCTION) {
+                        node.edges.add(ANY_FUNCTION);
+                        return true;
+                    }
+                    if (!this.functions.has(callee))
+                        return false;
+                    node.edges.add(fresh && this.freshConstructors && constructors.has(callee) ? `${callee}#ext` : callee);
+                    return true;
+                },
+            };
+            const expr = (e) => {
+                this.nodeWrites(e, sink, boxed, fn, constructors);
+                if (e.kind === "closure")
+                    this.functionValues.add(e.fnName);
+                else if (e.type?.kind === "func" &&
+                    !FUNCTION_MOVES.has(e.kind) &&
+                    !(e.kind === "libCall" && e.fn === "error.nodeThrow"))
+                    this.foreignFunctionValues = true;
+                return everyExprChild(e, expr, stmt);
+            };
+            const stmt = (s) => {
+                if (thisId !== null && s.kind === "fieldSet" && isThisRef(s.obj, thisId)) {
+                    // A store into the fresh `this`: no outside borrow can reach it.
+                }
+                else
+                    this.stmtWrites(s, sink, boxed);
+                return everyStmtChild(s, expr, stmt);
+            };
+            fn.body.every(stmt);
+            return node;
+        };
+        for (const fn of this.functions.values()) {
+            nodes.set(fn.name, scan(fn, false));
+            if (this.freshConstructors && constructors.has(fn.name))
+                nodes.set(`${fn.name}#ext`, scan(fn, true));
+        }
+        // Indirect calls reach any closure body; values made elsewhere
+        // (dynamic conversions) reach unknown code.
+        nodes.set(ANY_FUNCTION, {
+            local: new Set(this.foreignFunctionValues ? [0] : []),
+            edges: new Set([...this.functionValues].filter((name) => this.functions.has(name))),
+        });
+        this.words = (this.keys.size + 31) >>> 5;
+        this.heapAll = new Uint32Array(this.words);
+        this.heapAll[0] = 1;
+        // Tarjan's SCCs, iteratively; components come out callees first.
+        const index = new Map();
+        const low = new Map();
+        const onStack = new Set();
+        const stack = [];
+        let counter = 0;
+        for (const start of nodes.keys()) {
+            if (index.has(start))
+                continue;
+            const work = [];
+            const enter = (name) => {
+                index.set(name, counter);
+                low.set(name, counter++);
+                stack.push(name);
+                onStack.add(name);
+                work.push({ name, edges: nodes.get(name).edges.values() });
+            };
+            enter(start);
+            while (work.length > 0) {
+                const top = work[work.length - 1];
+                const next = top.edges.next();
+                if (!next.done) {
+                    const callee = next.value;
+                    if (!nodes.has(callee))
+                        continue;
+                    if (!index.has(callee))
+                        enter(callee);
+                    else if (onStack.has(callee))
+                        low.set(top.name, Math.min(low.get(top.name), index.get(callee)));
+                    continue;
+                }
+                work.pop();
+                if (work.length > 0) {
+                    const parent = work[work.length - 1].name;
+                    low.set(parent, Math.min(low.get(parent), low.get(top.name)));
+                }
+                if (low.get(top.name) !== index.get(top.name))
+                    continue;
+                const members = [];
+                for (;;) {
+                    const m = stack.pop();
+                    onStack.delete(m);
+                    members.push(m);
+                    if (m === top.name)
+                        break;
+                }
+                const bits = new Uint32Array(this.words);
+                const inComponent = new Set(members);
+                for (const m of members) {
+                    const node = nodes.get(m);
+                    for (const id of node.local)
+                        setBit(bits, id);
+                    for (const callee of node.edges) {
+                        if (inComponent.has(callee))
+                            continue;
+                        const s = this.summaries.get(callee);
+                        if (s === undefined || s === null)
+                            continue;
+                        orInto(bits, s);
+                    }
+                }
+                // An unknown heap write subsumes the precise heap keys.
+                const summary = (bits[0] & 1) !== 0 ? this.heapAll : anyBit(bits) ? bits : null;
+                for (const m of members)
+                    this.summaries.set(m, summary);
+            }
+        }
+    }
+    /** Writes of one expression node itself (children are separate). */
+    nodeWrites(e, sink, boxed, fn, constructors) {
+        switch (e.kind) {
+            case "call": {
+                const fresh = fn !== null &&
+                    constructors.has(e.callee) &&
+                    constructors.has(fn.name) &&
+                    e.args[0] !== undefined &&
+                    isThisRef(e.args[0], fn.params[0]?.localId ?? "");
+                if (!sink.call(e.callee, fresh) && !this.intrinsicCall(e))
+                    sink.all();
+                return;
+            }
+            case "new":
+                if (!sink.call(`%${e.className}.constructor`, true))
+                    sink.all();
+                return;
+            case "virtualCall": {
+                const targets = this.virtualTargets.targets(e.className, e.method);
+                if (targets === null)
+                    sink.all();
+                else
+                    for (const t of targets)
+                        if (!sink.call(t, false))
+                            sink.all();
+                return;
+            }
+            case "assignExpr":
+            case "incDec":
+                if (isRefCounted(e.type))
+                    sink.add(this.localKey(e.localId, boxed));
+                return;
+            case "callValue": {
+                const targets = fn !== null ? this.callTargets.of(e.callee, fn) : null;
+                if (targets === null) {
+                    if (!sink.call(ANY_FUNCTION, false))
+                        sink.all();
+                }
+                else
+                    for (const t of targets)
+                        if (!sink.call(t, false))
+                            sink.all();
+                return;
+            }
+            case "arrIntrinsic":
+                if (!PRESERVING_ARRAY_METHODS.has(e.method)) {
+                    // The comparator sort orders a private snapshot.
+                    if (e.method === "sortValues") {
+                        const comparator = e.args[1];
+                        const targets = fn !== null && comparator !== undefined ? this.callTargets.of(comparator, fn) : null;
+                        if (targets === null) {
+                            if (!sink.call(ANY_FUNCTION, false))
+                                sink.all();
+                        }
+                        else
+                            for (const t of targets)
+                                if (!sink.call(t, false))
+                                    sink.all();
+                    }
+                    sink.add(ARRAY_KEY);
+                }
+                return;
+            case "mapIntrinsic":
+            case "setIntrinsic":
+                if (borrowsMapReadInputs(e))
+                    return;
+                if (borrowsMapMutationReceiver(e))
+                    sink.add(MAP_KEY);
+                else if (e.receiver.type.kind === "map" || e.receiver.type.kind === "set") {
+                    // Typed collections: copies and iteration bookkeeping run no
+                    // user code; leaving an iteration may compact removed entries.
+                    if (e.method === "iterEnter" || e.method === "iterExit")
+                        sink.add(MAP_KEY);
+                    else if (e.method !== "clone" &&
+                        e.method !== "keySet" &&
+                        e.method !== "valueSet" &&
+                        e.method !== "toArray")
+                        sink.all();
+                }
+                else
+                    sink.all();
+                return;
+            case "intrinsic":
+                // A TDZ test reads; publication only makes objects immortal.
+                if (e.name !== "module.tdzCheck" && e.name !== "threads.publish")
+                    sink.all();
+                return;
+            case "dynFrom":
+            case "dynArrLit":
+            case "dynObjLit":
+                return;
+            case "dynCheck":
+                // Identity and kind tests of class and primitive targets.
+                if (!this.checkedWithoutCode(e.type))
+                    sink.all();
+                return;
+            case "jsonStringify":
+                if (!this.jsonInert(e.value.type))
+                    sink.all();
+                return;
+            case "bytesNew":
+            case "bytesIntrinsic":
+                return;
+            case "strIntrinsic":
+                if (!borrowsStringInputs(e.method))
+                    sink.all();
+                return;
+            case "regexIntrinsic":
+                if (!preservesRegexInputs(e.method))
+                    sink.all();
+                return;
+            case "libCall":
+                if (!this.inertLibCall(e))
+                    sink.all();
+                return;
+            case "toString":
+                if (!this.primitive(e.operand.type))
+                    sink.all();
+                return;
+            case "dynTest":
+                if (!preservesDynTest(e.test))
+                    sink.all();
+                return;
+            // Reads, tests, arithmetic and fresh allocations.
+            case "numLit":
+            case "boolLit":
+            case "strLit":
+            case "unitLit":
+            case "varRef":
+            case "bin":
+            case "unary":
+            case "toBool":
+            case "logical":
+            case "nullish":
+            case "ternary":
+            case "seqExpr":
+            case "fieldGet":
+            case "recordGet":
+            case "unionNarrow":
+            case "unionIsTag":
+            case "unionWrap":
+            case "downcast":
+            case "upcast":
+            case "instanceOf":
+            case "strConcat":
+            case "strEq":
+            case "strCmp":
+            case "arrayGet":
+            case "arrayHas":
+            case "arrayState":
+            case "unionEq":
+            case "unionFuncEq":
+            case "dynScalarEq":
+            case "caughtTest":
+            case "caughtNarrow":
+            case "caughtCheck":
+            case "classRef":
+            case "recordLit":
+            case "arrayLit":
+            case "arrayNewLen":
+            case "closure":
+            case "mapNew":
+            case "setNew":
+            case "regexLit":
+            case "recordHas":
+            case "recordKeyGet":
+            case "recordOvfHas":
+            case "recordOvfKeys":
+            case "fieldAbsent":
+            case "unionDisc":
+            case "unionKeyGet":
+            case "fieldIncDec":
+            case "optChain":
+            case "chainRecv":
+            case "orDefault":
+            case "instanceOfValue":
+            case "promiseVoidWiden":
+                return;
+            default:
+                sink.all();
+        }
+    }
+    /** Writes of one statement node itself. */
+    stmtWrites(s, sink, boxed) {
+        switch (s.kind) {
+            case "assign":
+                if (isRefCounted(s.value.type))
+                    sink.add(this.localKey(s.localId, boxed));
+                return;
+            case "fieldSet":
+                if (isRefCounted(s.value.type))
+                    sink.add(this.fieldKey(s.className, s.field));
+                return;
+            case "recordSet":
+                if (isRefCounted(s.value.type))
+                    sink.add(`r:${s.field}`);
+                return;
+            case "recordKeySet":
+            case "recordKeyDelete":
+                sink.add(ANY_RECORD_KEY);
+                return;
+            case "arraySet":
+            case "arraySetUndefined":
+            case "arrayDelete":
+            case "arraySetLength":
+                sink.add(ARRAY_KEY);
+                return;
+            case "varDecl":
+            case "exprStmt":
+            case "return":
+            case "throw":
+            case "runtimeFence":
+            case "if":
+            case "for":
+            case "forOf":
+            case "while":
+            case "doWhile":
+            case "block":
+            case "switch":
+            case "break":
+            case "continue":
+            case "bytesSet":
+            case "tryCatch":
+            case "rethrow":
+                return;
+            default:
+                sink.all();
+        }
+    }
+    /** Library calls that run no user code: inert families without callback
+     * arguments, and an Error options bag that is a typed record (no
+     * accessors) or absent. */
+    inertLibCall(e) {
+        if (e.fn === "error.nodeThrow" || isStableReceiverOperand(e, ""))
+            return true;
+        if (e.fn === "error.newOptions")
+            return e.args.every((arg) => arg.type.kind !== "dyn" ||
+                (arg.kind === "dynFrom" &&
+                    (arg.value.type.kind === "record" || this.primitive(arg.value.type))));
+        if (!INERT_LIB_CALLS.has(e.fn) && !INERT_LIB_PREFIXES.some((p) => e.fn.startsWith(p)))
+            return false;
+        return e.args.every((arg) => arg.type.kind !== "func" &&
+            (arg.type.kind !== "dyn" ||
+                (e.fn !== "dyn.compare" && e.fn.startsWith("dyn.")) ||
+                // A wrapped primitive has no methods to call back into.
+                (arg.kind === "dynFrom" && this.primitive(arg.value.type))));
+    }
+    /** Numbers, booleans, strings and unit values (and unions of them). */
+    primitive(t) {
+        switch (t.kind) {
+            case "f64":
+            case "bool":
+            case "string":
+            case "undefinedT":
+            case "nullT":
+                return true;
+            case "union":
+                return this.unions.get(t.unionId)?.arms.every((arm) => this.primitive(arm)) ?? false;
+            default:
+                return false;
+        }
+    }
+    /** A dynamic-to-typed check that only tests identity or kind. */
+    checkedWithoutCode(t) {
+        if (t.kind === "object" || this.primitive(t))
+            return true;
+        if (t.kind !== "union")
+            return false;
+        return (this.unions
+            .get(t.unionId)
+            ?.arms.every((arm) => arm.kind === "object" || this.primitive(arm)) ?? false);
+    }
+    /** JSON.stringify of this type calls no toJSON or accessor: primitives
+     * and records/arrays/unions of them (class instances may define both). */
+    jsonInert(t) {
+        if (this.primitive(t))
+            return true;
+        const key = JSON.stringify(t);
+        const known = this.inertJson.get(key);
+        if (known !== undefined)
+            return known;
+        this.inertJson.set(key, true); // recursive shapes: assume, then confirm
+        let result;
+        if (t.kind === "array")
+            result = this.jsonInert(t.elem);
+        else if (t.kind === "record")
+            result = this.records.get(t.shapeId)?.fields.every((f) => this.jsonInert(f.type)) ?? false;
+        else if (t.kind === "union")
+            result = this.unions.get(t.unionId)?.arms.every((arm) => this.jsonInert(arm)) ?? false;
+        else
+            result = false;
+        this.inertJson.set(key, result);
+        return result;
+    }
+    localKey(id, boxed, locals) {
+        if (this.globals.has(id))
+            return `g:${id}`;
+        // A binding of another function (never expected) counts as a box.
+        if (boxed.has(id) || (locals !== undefined && !locals.has(id)))
+            return BOX_KEY;
+        return `l:${id}`;
+    }
+    // ── queries ────────────────────────────────────────────────────────────
+    /** Start answering expression queries for one function body. */
+    enter(fn) {
+        this.current = fn;
+        this.currentBoxed = boxedLocals(fn);
+        this.currentLocals = new Set(fn.locals.map((local) => local.id));
+        this.inConstructor = this.constructors.has(fn.name);
+        for (const p of fn.params)
+            this.currentLocals.add(p.localId);
+        this.exprCache.clear();
+        this.stmtCache.clear();
+    }
+    bodyWrites = new Map();
+    /** Whether a walk of `fn` reads only locations its whole body never
+     * writes; the candidate walk locals' own rebinding is exempt. */
+    unwrittenWalk(fn, value, candidates, call) {
+        if (this.current !== fn)
+            this.enter(fn);
+        const keys = this.readKeys(value, call);
+        if (keys === null)
+            return false;
+        let body = this.bodyWrites.get(fn.name);
+        if (body === undefined) {
+            body = this.stmts(fn.body);
+            this.bodyWrites.set(fn.name, body);
+        }
+        return !this.conflicts(keys.filter((k) => !(k.startsWith("l:") && candidates.has(k.slice(2)))), body);
+    }
+    /** The transitive writes of a call to a module function (`#ext` for a
+     * constructor reached through `new`). */
+    summary(name) {
+        const known = this.summaries.get(name);
+        return known === undefined ? this.heapAll : known;
+    }
+    constructWrites(className) {
+        const ctor = `%${className}.constructor`;
+        if (!this.functions.has(ctor))
+            return this.heapAll;
+        return this.summary(this.freshConstructors ? `${ctor}#ext` : ctor);
+    }
+    virtualWrites(className, method) {
+        const targets = this.virtualTargets.targets(className, method);
+        if (targets === null)
+            return this.heapAll;
+        return this.union(targets.map((t) => this.summary(t)));
+    }
+    /** Writes of evaluating an expression, with its operands. */
+    expr(e) {
+        const known = this.exprCache.get(e);
+        if (known !== undefined)
+            return known;
+        const parts = [];
+        const sink = this.querySink(parts);
+        this.nodeWrites(e, sink, this.currentBoxed, this.current, new Set());
+        everyExprChild(e, (child) => (parts.push(this.expr(child)), true), (child) => (parts.push(this.stmt(child)), true));
+        const result = this.union(parts);
+        this.exprCache.set(e, result);
+        return result;
+    }
+    stmt(s) {
+        const known = this.stmtCache.get(s);
+        if (known !== undefined)
+            return known;
+        const parts = [];
+        this.stmtWrites(s, this.querySink(parts), this.currentBoxed);
+        everyStmtChild(s, (child) => (parts.push(this.expr(child)), true), (child) => (parts.push(this.stmt(child)), true));
+        const result = this.union(parts);
+        this.stmtCache.set(s, result);
+        return result;
+    }
+    stmts(list) {
+        return this.union(list.map((s) => this.stmt(s)));
+    }
+    querySink(parts) {
+        return {
+            add: (k) => parts.push(this.bitsOf([k])),
+            all: () => parts.push(this.heapAll),
+            call: (callee, fresh) => {
+                if (callee === ANY_FUNCTION) {
+                    parts.push(this.summary(ANY_FUNCTION));
+                    return true;
+                }
+                if (!this.functions.has(callee))
+                    return false;
+                const ctor = fresh && callee.endsWith(".constructor") && this.freshConstructors;
+                parts.push(this.summary(ctor ? `${callee}#ext` : callee));
+                return true;
+            },
+        };
+    }
+    union(parts) {
+        let out = null;
+        for (const p of parts) {
+            if (p === null)
+                continue;
+            if (out === null)
+                out = new Uint32Array(this.words);
+            orInto(out, p);
+        }
+        return out;
+    }
+    /** A bitset over known keys; keys nothing writes are dropped. */
+    bitsOf(keys) {
+        let out = null;
+        for (const k of keys) {
+            const id = this.keys.get(k);
+            if (id === undefined || id >= this.words * 32)
+                continue;
+            if (out === null)
+                out = new Uint32Array(this.words);
+            setBit(out, id);
+        }
+        return out;
+    }
+    /** Whether writes may touch any of the read keys. */
+    conflicts(reads, writes) {
+        if (writes === null)
+            return false;
+        const heap = (writes[0] & 1) !== 0;
+        for (const k of reads) {
+            if (heap && !k.startsWith("l:"))
+                return true;
+            const id = this.keys.get(k);
+            if (id === undefined || id >= this.words * 32)
+                continue;
+            if ((writes[id >>> 5] & (1 << (id & 31))) !== 0)
+                return true;
+        }
+        return false;
+    }
+    /** The locations whose writes could release the object a borrowed read
+     * of `e` yields, or null when `e` is not such a projection. `call`
+     * resolves borrowed-return callees to the locations their walks read. */
+    readKeys(e, call) {
+        const out = [];
+        const walk = (node) => {
+            switch (node.kind) {
+                case "varRef":
+                    out.push(this.localKey(node.localId, this.currentBoxed, this.currentLocals));
+                    return true;
+                case "fieldGet":
+                    // A construction-only field of an existing object never changes;
+                    // only a constructor can still be writing it (its own `this`).
+                    if (this.inConstructor || !this.immutable?.classField(node.className, node.field))
+                        out.push(this.fieldKey(node.className, node.field));
+                    return walk(node.obj);
+                case "recordGet":
+                    if (this.inConstructor || !this.immutable?.recordField(node.shapeId, node.field))
+                        out.push(`r:${node.field}`, ANY_RECORD_KEY);
+                    return walk(node.obj);
+                case "arrayGet":
+                    out.push(ARRAY_KEY);
+                    return this.expr(node.index) === null && walk(node.arr);
+                case "unionNarrow":
+                case "upcast":
+                case "downcast":
+                    return walk(node.value);
+                case "unionWrap":
+                    return node.value.kind === "unitLit" || walk(node.value);
+                case "ternary":
+                    return this.expr(node.cond) === null && armWalk(node.then) && armWalk(node.else_);
+                case "seqExpr": {
+                    // Guarded projections: `(check, value)` where the checks only
+                    // read and throw.
+                    if (this.stmts(node.stmts) !== null)
+                        return false;
+                    return walk(node.result);
+                }
+                case "strLit":
+                    return true;
+                case "call": {
+                    const keys = call?.(node) ?? null;
+                    if (keys === null)
+                        return false;
+                    out.push(...keys);
+                    return node.args.every((arg) => !isRefCounted(arg.type) || walk(arg));
+                }
+                default:
+                    return false;
+            }
+        };
+        const armWalk = (node) => (node.kind === "libCall" && node.fn === "error.nodeThrow") || walk(node);
+        return walk(e) ? out : null;
+    }
+}
+function isThisRef(e, thisId) {
+    if (e.kind === "varRef")
+        return e.localId === thisId;
+    if (e.kind === "upcast")
+        return isThisRef(e.value, thisId);
+    return false;
+}
+/** Locals living in boxes: declared boxed or captured from an enclosing
+ * function. */
+function boxedLocals(fn) {
+    const out = new Set();
+    for (const local of fn.locals)
+        if (local.boxed)
+            out.add(local.id);
+    for (const c of fn.captures ?? [])
+        out.add(c.localId);
+    for (const c of fn.classCaptures ?? [])
+        out.add(c.localId);
+    return out;
+}
+/** The closure bodies a function value can be, when it flows only from
+ * closure expressions through stable locals and the function-typed
+ * parameters of functions that are only called directly (null: any
+ * function value). A small flow analysis over parameter positions: each
+ * position collects the targets every direct, virtual and `new` call site
+ * passes, to a fixpoint. */
+class CallTargets {
+    functions;
+    sites = new Map();
+    opaque = new Set();
+    params = new Map();
+    definitions = new Map();
+    /** Functions creating each closure body. */
+    creators = new Map();
+    constructor(functions, virtualTargets) {
+        this.functions = functions;
+        const site = (callee, caller, args) => {
+            let list = this.sites.get(callee);
+            if (!list)
+                this.sites.set(callee, (list = []));
+            list.push({ caller, args });
+        };
+        for (const fn of functions.values()) {
+            if (fn.captures !== undefined || fn.classCaptures !== undefined)
+                this.opaque.add(fn.name);
+            const expr = (e) => {
+                if (e.kind === "call")
+                    site(e.callee, fn, e.args);
+                else if (e.kind === "new")
+                    site(`%${e.className}.constructor`, fn, [e, ...e.args]);
+                else if (e.kind === "virtualCall") {
+                    const targets = virtualTargets.targets(e.className, e.method);
+                    for (const t of targets ?? [])
+                        site(t, fn, e.args);
+                }
+                else if (e.kind === "closure") {
+                    this.opaque.add(e.fnName);
+                    let list = this.creators.get(e.fnName);
+                    if (!list)
+                        this.creators.set(e.fnName, (list = []));
+                    list.push(fn);
+                }
+                return everyExprChild(e, expr, stmt);
+            };
+            const stmt = (st) => everyStmtChild(st, expr, stmt);
+            fn.body.every(stmt);
+        }
+        // Fixpoint over function-typed parameter positions.
+        const positions = [];
+        for (const fn of functions.values())
+            fn.params.forEach((p, i) => {
+                if (p.type.kind === "func") {
+                    positions.push([fn, i]);
+                    this.params.set(`${fn.name}#${i}`, new Set());
+                }
+            });
+        for (let changed = true; changed;) {
+            changed = false;
+            for (const [fn, i] of positions) {
+                const key = `${fn.name}#${i}`;
+                const known = this.params.get(key);
+                if (known === null)
+                    continue;
+                const sites = this.sites.get(fn.name);
+                let next = new Set(known);
+                if (this.opaque.has(fn.name) || !sites || this.assigned(fn, fn.params[i].localId))
+                    next = null;
+                else
+                    for (const { caller, args } of sites) {
+                        const arg = args[i];
+                        const t = arg === undefined ? null : this.resolve(arg, caller, 0);
+                        if (t === null) {
+                            next = null;
+                            break;
+                        }
+                        for (const name of t)
+                            next.add(name);
+                    }
+                if (next === null || next.size !== known.size) {
+                    this.params.set(key, next);
+                    changed = true;
+                }
+            }
+        }
+    }
+    of(callee, fn) {
+        const t = this.resolve(callee, fn, 0);
+        return t === null ? null : [...t];
+    }
+    resolve(e, fn, depth) {
+        if (depth > 8)
+            return null;
+        switch (e.kind) {
+            case "closure":
+                return new Set([e.fnName]);
+            case "ternary":
+            case "logical":
+            case "nullish":
+            case "orDefault": {
+                const arms = e.kind === "ternary" ? [e.then, e.else_] : [e.left, e.right];
+                const out = new Set();
+                for (const arm of arms) {
+                    if (arm.type.kind !== "func") {
+                        if (arm.kind === "libCall" && arm.fn === "error.nodeThrow")
+                            continue;
+                        if (e.kind === "ternary")
+                            return null;
+                        continue; // the tested operand of `a ?? f`, `a || f`
+                    }
+                    const t = this.resolve(arm, fn, depth + 1);
+                    if (t === null)
+                        return null;
+                    for (const name of t)
+                        out.add(name);
+                }
+                return out;
+            }
+            case "varRef": {
+                if ((fn.captures ?? []).some((c) => c.localId === e.localId)) {
+                    // A captured binding nothing rebinds holds what it held in every
+                    // function creating this closure.
+                    const creators = this.creators.get(fn.name);
+                    if (!creators || this.assigned(fn, e.localId))
+                        return null;
+                    const out = new Set();
+                    for (const creator of creators) {
+                        const t = this.resolve(e, creator, depth + 1);
+                        if (t === null)
+                            return null;
+                        for (const name of t)
+                            out.add(name);
+                    }
+                    return out;
+                }
+                const index = fn.params.findIndex((p) => p.localId === e.localId);
+                if (index >= 0) {
+                    if (this.assigned(fn, e.localId))
+                        return null;
+                    return this.params.get(`${fn.name}#${index}`) ?? null;
+                }
+                const def = this.definition(fn, e.localId);
+                return def ? this.resolve(def, fn, depth + 1) : null;
+            }
+            case "call": {
+                // A function value returned by a module function: whatever every
+                // return yields (adapters return closures over their argument).
+                const callee = this.functions.get(e.callee);
+                if (!callee || callee.async || callee.generator)
+                    return null;
+                const out = new Set();
+                let ok = true;
+                let any = false;
+                const stmt = (st) => {
+                    if (st.kind === "return") {
+                        any = true;
+                        const t = st.value ? this.resolve(st.value, callee, depth + 1) : null;
+                        if (t === null)
+                            return (ok = false);
+                        for (const name of t)
+                            out.add(name);
+                    }
+                    return everyStmtChild(st, () => true, stmt);
+                };
+                callee.body.every(stmt);
+                return ok && any ? out : null;
+            }
+            default:
+                return null;
+        }
+    }
+    /** The single initializer of a never-assigned, unboxed local. */
+    definition(fn, id) {
+        let defs = this.definitions.get(fn);
+        if (!defs) {
+            defs = new Map();
+            const boxed = new Set(fn.locals.filter((l) => l.boxed).map((l) => l.id));
+            const counts = new Map();
+            const expr = (e) => {
+                if (e.kind === "assignExpr" || e.kind === "incDec")
+                    counts.set(e.localId, 2);
+                return everyExprChild(e, expr, stmt);
+            };
+            const stmt = (st) => {
+                if (st.kind === "varDecl") {
+                    counts.set(st.localId, (counts.get(st.localId) ?? 0) + 1);
+                    defs.set(st.localId, st.init);
+                }
+                else if (st.kind === "assign")
+                    counts.set(st.localId, 2);
+                return everyStmtChild(st, expr, stmt);
+            };
+            fn.body.every(stmt);
+            for (const [local, n] of counts)
+                if (n !== 1 || boxed.has(local))
+                    defs.set(local, null);
+            this.definitions.set(fn, defs);
+        }
+        return defs.get(id) ?? null;
+    }
+    assigned(fn, id) {
+        this.definition(fn, id);
+        const defs = this.definitions.get(fn);
+        return defs.has(id);
+    }
+}
+function setBit(bits, id) {
+    const w = id >>> 5;
+    bits[w] = bits[w] | (1 << (id & 31));
+}
+function orInto(bits, other) {
+    for (let w = 0; w < bits.length; w++)
+        bits[w] = bits[w] | other[w];
+}
+function anyBit(bits) {
+    for (let w = 0; w < bits.length; w++)
+        if (bits[w] !== 0)
+            return true;
+    return false;
+}
+//# sourceMappingURL=reference-writes.js.map