@scriptc/compiler 0.3.4 → 0.3.6

package/dist/ir/int32-slots.js

@@ -1,4 +1,4 @@
-import { analyzeIntegerRanges, INT32_RANGE, withinInt32, } from "./integer-ranges.js";
+import { analyzeIntegerRanges, INT32_RANGE, NON_NEGATIVE_INT32_RANGE, withinInt32, } from "./integer-ranges.js";
 import { exprFunctionReference, moduleFunctionReferences } from "./function-references.js";
 import { findInitializerBindings, withInitializerBindings } from "./initializer-bindings.js";
 import { everyExprChild, everyStmtChild, everyStmtList, everyTypeChild } from "./traverse.js";
@@ -40,6 +40,8 @@ export class Int32Slots {
     familyOf = new Map();
     paramFacts = new Map();
     returns = new Set();
+    /** Results narrowed below their level (narrowSlotRanges). */
+    returnRanges = new Map();
     /** Captured-binding groups (one shared box) that hold an int32, and the
      * group of each `function\0local` member. */
     boxes = new Set();
@@ -58,6 +60,12 @@ export class Int32Slots {
     /** Drops the analysis attempted on pinned slots. The contract check and
      * this analysis use the same range proofs, so this stays empty. */
     pinViolations = [];
+    /** Parameter, return and box candidates (`param:`, `ret:`, `box:` keys)
+     * still assumed to hold only non-negative int32s. The optimistic fixpoint
+     * starts every unpinned candidate here and demotes it to int32 when a
+     * write is an int32 that may be negative: `(x * 31 + n) % m` only proves
+     * a result when x and n are known not to be negative. */
+    nonNegative = new Set();
     constructor(classes = new Map()) {
         this.classes = classes;
     }
@@ -96,10 +104,14 @@ export class Int32Slots {
             this.boxes.size === 0 &&
             this.int32Locals.size === 0)
             return {};
+        const level = (key) => this.nonNegative.has(key) ? NON_NEGATIVE_INT32_RANGE : INT32_RANGE;
         const result = {
             field: (className, field) => (this.isField(className, field) ? INT32_RANGE : null),
-            call: (callee) => (this.returns.has(callee) ? INT32_RANGE : null),
-            boxed: (localId) => (this.hasBox(this.boxGroup(fnName, localId)) ? INT32_RANGE : null),
+            call: (callee) => this.returns.has(callee) ? (this.returnRanges.get(callee) ?? level(`ret:${callee}`)) : null,
+            boxed: (localId) => {
+                const group = this.boxGroup(fnName, localId);
+                return group !== null && this.boxes.has(group) ? level(`box:${group}`) : null;
+            },
         };
         if (this.int32Locals.size > 0)
             result.locals = (localId) => this.int32Locals.has(`${fnName}\0${localId}`) || this.int32Locals.has(`\0${localId}`)
@@ -107,9 +119,47 @@ export class Int32Slots {
                 : null;
         const params = this.paramFacts.get(fnName);
         if (params)
-            result.params = params;
+            result.params =
+                this.nonNegative.size === 0
+                    ? params
+                    : new Map([...params].map(([id, range]) => {
+                        const key = `param:${fnName}\0${id}`;
+                        return [id, this.nonNegative.has(key) ? NON_NEGATIVE_INT32_RANGE : range];
+                    }));
         return result;
     }
+    /** Assume an unpinned candidate holds only non-negative int32s. */
+    assumeNonNegative(key) {
+        if (!this.pinned.has(key))
+            this.nonNegative.add(key);
+    }
+    isNonNegative(key) {
+        return this.nonNegative.has(key);
+    }
+    /** Widen a non-negative candidate to int32; whether it was one. */
+    demote(key) {
+        return this.nonNegative.delete(key);
+    }
+    isPinned(key) {
+        return this.pinned.has(key);
+    }
+    /** The range a parameter fact currently asserts, if it has one. */
+    paramRange(fnName, localId) {
+        return this.facts(fnName).params?.get(localId) ?? null;
+    }
+    /** The range a result fact currently asserts, if it has one. */
+    returnRange(fnName) {
+        return this.facts(fnName).call?.(fnName) ?? null;
+    }
+    /** Replace a parameter fact with a narrower proven range. */
+    narrowParam(fnName, localId, range) {
+        this.nonNegative.delete(`param:${fnName}\0${localId}`);
+        this.addParam(fnName, localId, range);
+    }
+    /** Replace a result fact with a narrower proven range. */
+    narrowReturn(fnName, range) {
+        this.returnRanges.set(fnName, range);
+    }
     boxGroup(fnName, localId) {
         return this.boxGroupOf.get(`${fnName}\0${localId}`) ?? null;
     }
@@ -137,6 +187,7 @@ export class Int32Slots {
     dropBox(group) {
         if (this.refusePinned(`box:${group}`))
             return false;
+        this.nonNegative.delete(`box:${group}`);
         return this.boxes.delete(group);
     }
     hasBox(group) {
@@ -162,6 +213,7 @@ export class Int32Slots {
     dropParam(fnName, localId) {
         if (this.refusePinned(`param:${fnName}\0${localId}`))
             return false;
+        this.nonNegative.delete(`param:${fnName}\0${localId}`);
         const params = this.paramFacts.get(fnName);
         if (!params?.delete(localId))
             return false;
@@ -178,6 +230,8 @@ export class Int32Slots {
     dropReturn(fnName) {
         if (this.refusePinned(`ret:${fnName}`))
             return false;
+        this.nonNegative.delete(`ret:${fnName}`);
+        this.returnRanges.delete(fnName);
         return this.returns.delete(fnName);
     }
     hasReturn(fnName) {
@@ -231,12 +285,25 @@ const DYN_READ_ONLY = new Set([
     "arrayBuffer.viewU8",
     "arrayBuffer.viewU8C",
     "date.nativeNew",
+    // The dynamic operators run the ToPrimitive and coercion helpers of
+    // dyn.compare, dyn.numberConstructor and dyn.toStringCoerce, then build a
+    // fresh number, string or bigint. dyn.increment steps dyn.toNumeric's result.
+    "dyn.add",
+    "dyn.arithmetic",
     "dyn.arrAt",
     "dyn.arrLen",
     "dyn.bagGet",
+    "dyn.bitwise",
     "dyn.compare",
+    "dyn.forInKeyStrings",
+    "dyn.forInKeys",
+    "dyn.forInStable",
+    "dyn.getOwnPropertyNames",
+    "dyn.getPrototype",
     "dyn.hasKey",
+    "dyn.hasOwn",
     "dyn.in",
+    "dyn.increment",
     "dyn.iterator",
     "dyn.iteratorCanStep",
     "dyn.iteratorResult",
@@ -245,13 +312,25 @@ const DYN_READ_ONLY = new Set([
     "dyn.mapSeedEntries",
     "dyn.mapSeedEntry",
     "dyn.numberConstructor",
+    "dyn.objCreate",
+    "dyn.objEntries",
+    "dyn.objEntryPairs",
+    "dyn.objKeyStrings",
+    "dyn.objKeys",
+    "dyn.objValues",
+    "dyn.objectTag",
+    "dyn.ownKeys",
     "dyn.packPush",
     "dyn.packPushSpread",
     "dyn.stringConstructor",
     "dyn.this",
+    "dyn.toNumberCoerce",
+    "dyn.toNumeric",
+    "dyn.toString",
     "dyn.toStringCoerce",
     "dyn.typedRefIs",
     "dyn.typedRefKeyIs",
+    "dyn.typeof",
     // error.ctorOptions runs scr_error_init_options, the initializer
     // error.newOptions also runs: it stamps the receiver's runtime-owned
     // error prefix and reads `options.cause`.
@@ -259,9 +338,24 @@ const DYN_READ_ONLY = new Set([
     "error.new",
     "error.newOptions",
     "fs.utimesSync",
+    "insp.dyn",
+    "insp.dynS",
     "json.stringifyReplacer",
     "json.stringifyValue",
     "num.toStringRadix",
+    // Process event listeners (signals, uncaughtException, unhandledRejection,
+    // rejectionHandled, warning): the runtime keeps the callback and calls it
+    // with fresh event values; off compares callbacks by identity.
+    "process.offRejectionHandled",
+    "process.offSignal",
+    "process.offUncaughtException",
+    "process.offUnhandledRejection",
+    "process.offWarning",
+    "process.onRejectionHandled",
+    "process.onSignal",
+    "process.onUncaughtException",
+    "process.onUnhandledRejection",
+    "process.onWarning",
     "sharedArrayBuffer.new",
     "text.decodeStream",
     "worker.new",
@@ -654,8 +748,10 @@ export function analyzeInt32Slots(mod) {
             },
         });
     for (const fn of mod.functions) {
-        if (fn.returnType.kind === "f64" && !fn.async && !fn.generator)
+        if (fn.returnType.kind === "f64" && !fn.async && !fn.generator) {
             slots.addReturn(fn.name);
+            slots.assumeNonNegative(`ret:${fn.name}`);
+        }
         if (fn.async ||
             fn.generator ||
             !called.has(fn.name) ||
@@ -663,8 +759,10 @@ export function analyzeInt32Slots(mod) {
             virtual(fn.name))
             continue;
         for (const param of fn.params)
-            if (param.type.kind === "f64")
+            if (param.type.kind === "f64" && !slots.isPinned(paramKey(fn.name, param.localId))) {
                 slots.addParam(fn.name, param.localId);
+                slots.assumeNonNegative(paramKey(fn.name, param.localId));
+            }
     }
     const arityChecked = (fn, args, offset) => {
         if (fn && fn.params.length !== args + offset)
@@ -784,6 +882,11 @@ export function analyzeInt32Slots(mod) {
         }
         boxOrigin.set(`param:${fnName}\0${localId}`, group);
         slots.addBox(group, members);
+        // A box starts from its origin parameter's value: it can only be
+        // non-negative while that parameter is.
+        if (!origin.params.some((p) => p.localId === localId) ||
+            slots.isNonNegative(paramKey(fnName, localId)))
+            slots.assumeNonNegative(`box:${group}`);
     }
     const dropBox = (group, why) => {
         if (group === null)
@@ -876,6 +979,9 @@ export function analyzeInt32Slots(mod) {
         });
     };
     const provenByFunction = new Map();
+    // Each function's parameter and result writes under its latest analysis:
+    // at the fixpoint, the ranges of every write under the final facts.
+    const lastWrites = new Map();
     while (queue.length) {
         const fn = functions.get(queue.pop());
         queued.delete(fn.name);
@@ -888,16 +994,35 @@ export function analyzeInt32Slots(mod) {
         const ranges = hasCandidateWrite(fn)
             ? analyzeIntegerRanges(numeric(fn), slots.facts(fn.name))
             : new Map();
+        if (ranges.size > 0)
+            lastWrites.set(fn.name, slotWrites(fn, ranges, functions));
+        else
+            lastWrites.delete(fn.name);
         const proven = [];
         const int32 = (e) => withinInt32(ranges.get(e));
+        // An int32 written into a slot still assumed non-negative: widen the
+        // assumption when the value may be negative, and reanalyze its readers.
+        const settle = (slot, e) => {
+            if (!slots.isNonNegative(slot) || (ranges.get(e)?.min ?? -1) >= 0)
+                return;
+            slots.demote(slot);
+            invalidate(slot);
+            const group = boxOrigin.get(slot);
+            if (group !== undefined && slots.demote(`box:${group}`))
+                invalidate(`box:${group}`);
+        };
         const args = (callee, list, offset) => {
             if (!callee)
                 return;
             list.forEach((arg, i) => {
                 const param = callee.params[i + offset];
-                if (!param || !slots.hasParam(callee.name, param.localId) || int32(arg))
+                if (!param || !slots.hasParam(callee.name, param.localId))
                     return;
                 const slot = `param:${callee.name}\0${param.localId}`;
+                if (int32(arg)) {
+                    settle(slot, arg);
+                    return;
+                }
                 if (dropParam(callee.name, param.localId, `argument in ${fn.name} is not int32`)) {
                     invalidate(slot);
                     // An argument computed where the caller's own parameters were
@@ -913,9 +1038,11 @@ export function analyzeInt32Slots(mod) {
         };
         const boxWrite = (localId, value) => {
             const group = slots.boxGroup(fn.name, localId);
-            if (!slots.hasBox(group) || int32(value))
+            if (!slots.hasBox(group))
                 return;
-            if (dropBox(group, `write in ${fn.name} is not int32`))
+            if (int32(value))
+                settle(`box:${group}`, value);
+            else if (dropBox(group, `write in ${fn.name} is not int32`))
                 invalidate(`box:${group}`);
         };
         walkFunction(fn, {
@@ -936,8 +1063,10 @@ export function analyzeInt32Slots(mod) {
                     }
                 }
                 else if (s.kind === "return" && slots.hasReturn(fn.name)) {
-                    if (s.value && int32(s.value))
+                    if (s.value && int32(s.value)) {
+                        settle(`ret:${fn.name}`, s.value);
                         return;
+                    }
                     reason(`ret:${fn.name}`, "return is not int32");
                     slots.dropReturn(fn.name);
                     invalidate(`ret:${fn.name}`);
@@ -957,7 +1086,8 @@ export function analyzeInt32Slots(mod) {
     for (const proven of provenByFunction.values())
         for (const value of proven)
             slots.provenWrites.add(value);
-    rangedParameters(slots, functions, retry, numeric, (callee) => readers.get(`ret:${callee}`));
+    const ranged = rangedParameters(slots, functions, retry, numeric, (callee) => readers.get(`ret:${callee}`));
+    narrowSlotRanges(slots, functions, numeric, lastWrites, ranged, (slot) => readers.get(slot));
     return slots;
 }
 /** Bounds a widened parameter range jumps to: the int32 limits, and the
@@ -985,8 +1115,9 @@ const widenMax = (max) => WIDEN_MAX.find((bound) => bound >= max) ?? Infinity;
  * every call site is checked under the final ranges. The facts the main
  * fixpoint proved are fixed here: these ranges only add precision. */
 function rangedParameters(slots, functions, retry, numeric, callersOf) {
+    const changed = new Set();
     if (retry.size === 0)
-        return;
+        return changed;
     // Per function: retried parameter → its range so far (absent: no call
     // site analyzed yet; null: failed).
     const retried = new Map();
@@ -1097,7 +1228,261 @@ function rangedParameters(slots, functions, retry, numeric, callersOf) {
     }
     for (const [fnName, ranges] of retried)
         for (const [id, range] of ranges)
-            if (range)
+            if (range) {
                 slots.addParam(fnName, id, range);
+                changed.add(fnName);
+            }
+    return changed;
+}
+const joinRanges = (a, b) => a && b ? { min: Math.min(a.min, b.min), max: Math.max(a.max, b.max) } : null;
+const rangeWithin = (inner, outer) => inner !== null && inner.min >= outer.min && inner.max <= outer.max;
+const sameRange = (a, b) => a.min === b.min && a.max === b.max;
+/** The values one analysis of a function writes into parameter slots of
+ * its direct callees and into its own result slot (`param:` and `ret:`
+ * keys), joined per slot; null when some write has no proven range. */
+function slotWrites(fn, ranges, functions) {
+    const writes = new Map();
+    const write = (key, value) => {
+        const range = value ? (ranges.get(value) ?? null) : null;
+        const previous = writes.get(key);
+        writes.set(key, previous === undefined ? range : joinRanges(previous, range));
+    };
+    const args = (callee, list, offset) => {
+        if (!callee)
+            return;
+        list.forEach((arg, i) => {
+            const param = callee.params[i + offset];
+            if (param)
+                write(`param:${callee.name}\0${param.localId}`, arg);
+        });
+    };
+    walkFunction(fn, {
+        stmt: (s) => {
+            if (s.kind === "return")
+                write(`ret:${fn.name}`, s.value);
+        },
+        expr: (e) => {
+            if (e.kind === "call")
+                args(functions.get(e.callee), e.args, 0);
+            else if (e.kind === "new")
+                args(functions.get(`%${e.className}.constructor`), e.args, 1);
+        },
+    });
+    return writes;
+}
+/** Rounds after which narrowSlotRanges keeps its last verified ranges. */
+const NARROW_ROUNDS = 6;
+/** Narrows parameter and result facts from their proven level (int32 or
+ * non-negative int32, or a call-site range) to the values actually written
+ * into them, and revives results the level could not prove. `(x * 31 + n)
+ * % m` proves its result only under a positive divisor, and keeps i32
+ * arithmetic only when `x` is known to be small; the levels know neither,
+ * the values passed and returned do.
+ *
+ * A descending iteration from the fixpoint's facts: each round assumes a
+ * range for every slot, reanalyzes the functions that read a slot whose
+ * assumption changed, and joins the ranges of every write into each slot.
+ * The assumptions are verified (inductive) when every slot's writes land
+ * inside its assumed range: then, by induction over the execution, every
+ * slot holds only values in its range. A verified round adopts the joined
+ * writes as the next assumptions (each bound moves at most once, so the
+ * iteration ends), and a reanalyzed function whose every return is now an
+ * int32 joins with that range as a result candidate. A slot whose writes
+ * leave its assumption falls back to its last verified range (a revived
+ * result to none). Only verified assumptions are kept, and a reanalyzed
+ * function must still prove every write into a field or box slot (whose
+ * facts do not change here), or the narrowing is abandoned. Pinned
+ * (contract) slots keep their contract range. */
+function narrowSlotRanges(slots, functions, numeric, lastWrites, changed, readersOf) {
+    // Every parameter and result slot with a fact, and that fact.
+    const proven = new Map();
+    const fixed = new Set();
+    // Results the fixpoint dropped (a return was not an int32 at the level).
+    const revivable = new Set();
+    for (const fn of functions.values()) {
+        const result = slots.hasReturn(fn.name) ? slots.returnRange(fn.name) : null;
+        if (result)
+            proven.set(`ret:${fn.name}`, result);
+        else if (fn.returnType.kind === "f64" && !fn.async && !fn.generator)
+            revivable.add(`ret:${fn.name}`);
+        for (const param of fn.params) {
+            const range = slots.hasParam(fn.name, param.localId)
+                ? slots.paramRange(fn.name, param.localId)
+                : null;
+            if (range)
+                proven.set(`param:${fn.name}\0${param.localId}`, range);
+        }
+    }
+    for (const key of proven.keys())
+        if (slots.isPinned(key))
+            fixed.add(key);
+    if (proven.size === fixed.size)
+        return;
+    // The readers of a slot: a parameter's function, a result's callers.
+    const readersOfKey = (key) => {
+        if (key.startsWith("param:"))
+            return [key.slice(6, key.indexOf("\0"))];
+        const readers = readersOf(key);
+        return readers ? [...readers] : [];
+    };
+    const factsUnder = (fn, assumed) => {
+        const base = slots.facts(fn.name);
+        const params = new Map(base.params ?? []);
+        for (const param of fn.params) {
+            const range = assumed.get(`param:${fn.name}\0${param.localId}`);
+            if (range)
+                params.set(param.localId, range);
+        }
+        const call = base.call;
+        return {
+            ...base,
+            params,
+            call: (callee) => assumed.get(`ret:${callee}`) ?? (call ? call(callee) : null),
+        };
+    };
+    // Reanalyze one function: its slot writes, and whether it still proves
+    // every write into field and box slots.
+    const observe = (fn, assumed) => {
+        const ranges = analyzeIntegerRanges(numeric(fn), factsUnder(fn, assumed));
+        let sound = true;
+        const box = (localId, value) => {
+            const group = slots.boxGroup(fn.name, localId);
+            if (!slots.hasBox(group))
+                return;
+            const range = ranges.get(value) ?? null;
+            const level = slots.isNonNegative(`box:${group}`) ? NON_NEGATIVE_INT32_RANGE : INT32_RANGE;
+            if (!rangeWithin(range, level))
+                sound = false;
+        };
+        walkFunction(fn, {
+            stmt: (s) => {
+                if (s.kind === "assign")
+                    box(s.localId, s.value);
+                else if (s.kind === "varDecl" && s.init)
+                    box(s.localId, s.init);
+                else if (s.kind === "fieldSet" && slots.isField(s.className, s.field))
+                    if (!withinInt32(ranges.get(s.value)))
+                        sound = false;
+            },
+            expr: (e) => {
+                if (e.kind === "assignExpr")
+                    box(e.localId, e.value);
+            },
+        });
+        return { writes: slotWrites(fn, ranges, functions), sound };
+    };
+    const writesByFunction = new Map(lastWrites);
+    const join = () => {
+        const joined = new Map();
+        for (const writes of writesByFunction.values())
+            for (const [key, range] of writes) {
+                if (!proven.has(key) && !revivable.has(key))
+                    continue;
+                const previous = joined.get(key);
+                joined.set(key, previous === undefined ? range : joinRanges(previous, range));
+            }
+        return joined;
+    };
+    // The ranges every function was last analyzed under.
+    let analyzed = new Map(proven);
+    let verified = new Map(proven);
+    // Functions whose recorded writes predate their current facts.
+    const dirty = new Set(changed);
+    // The narrowing operator: a bound moves at most once from its proven
+    // value (a revived result's from int32), so recursion that shifts its
+    // argument (`f(d - 1)`) cannot walk a bound down one step per round.
+    const narrowed = (joined) => {
+        const next = new Map(verified);
+        for (const [key, range] of joined) {
+            const current = verified.get(key);
+            if (!current || fixed.has(key) || !range || !rangeWithin(range, current))
+                continue;
+            const original = proven.get(key) ?? INT32_RANGE;
+            next.set(key, {
+                min: current.min === original.min ? range.min : current.min,
+                max: current.max === original.max ? range.max : current.max,
+            });
+        }
+        return next;
+    };
+    let assumed = dirty.size > 0 ? new Map(proven) : narrowed(join());
+    for (let round = 0; round < NARROW_ROUNDS; round++) {
+        for (const [key, range] of assumed) {
+            const before = analyzed.get(key);
+            if (!before || !sameRange(range, before))
+                for (const name of readersOfKey(key))
+                    dirty.add(name);
+        }
+        for (const key of analyzed.keys())
+            if (!assumed.has(key))
+                for (const name of readersOfKey(key))
+                    dirty.add(name);
+        const observedNow = new Set();
+        for (const name of dirty) {
+            const fn = functions.get(name);
+            if (!fn)
+                continue;
+            const observed = observe(fn, assumed);
+            if (!observed.sound)
+                return;
+            writesByFunction.set(name, observed.writes);
+            observedNow.add(name);
+        }
+        dirty.clear();
+        analyzed = assumed;
+        const joined = join();
+        let inductive = true;
+        const next = new Map(assumed);
+        for (const [key, range] of assumed) {
+            const written = joined.get(key);
+            if (written === undefined || rangeWithin(written, range))
+                continue;
+            inductive = false;
+            const fallback = verified.get(key);
+            if (fallback)
+                next.set(key, fallback);
+            else
+                next.delete(key);
+        }
+        if (inductive) {
+            verified = assumed;
+            const tighter = narrowed(joined);
+            // Results that reanalysis under the narrowed facts proves now.
+            for (const key of revivable) {
+                const range = joined.get(key);
+                if (!tighter.has(key) && observedNow.has(key.slice(4)) && withinInt32(range))
+                    tighter.set(key, range);
+            }
+            if (tighter.size === assumed.size &&
+                [...tighter].every(([key, range]) => sameRange(range, assumed.get(key))))
+                break;
+            assumed = tighter;
+        }
+        else if (next.size !== assumed.size ||
+            [...next].some(([key, range]) => !sameRange(range, assumed.get(key)))) {
+            assumed = next;
+        }
+        else
+            break; // narrowing other slots broke a verified one: keep `verified`
+    }
+    for (const [key, range] of verified) {
+        if (fixed.has(key))
+            continue;
+        const original = proven.get(key);
+        if (original && sameRange(range, original))
+            continue;
+        if (key.startsWith("ret:")) {
+            const fnName = key.slice(4);
+            if (!original) {
+                slots.addReturn(fnName);
+                slots.reasons.delete(key);
+            }
+            slots.narrowReturn(fnName, range);
+        }
+        else {
+            const cut = key.indexOf("\0");
+            slots.narrowParam(key.slice(6, cut), key.slice(cut + 1), range);
+        }
+    }
 }
 //# sourceMappingURL=int32-slots.js.map