@scriptc/compiler 0.4.1 → 0.4.3

package/dist/ir/int32-slots.js

@@ -1,7 +1,9 @@
 import { analyzeIntegerRanges, INT32_RANGE, NON_NEGATIVE_INT32_RANGE, withinInt32, } from "./integer-ranges.js";
-import { exprFunctionReference, moduleFunctionReferences } from "./function-references.js";
+import { exprFunctionReference, FUNCTION_REFERENCE_KINDS, moduleFunctionReferences, } from "./function-references.js";
+import { eachNodeOfKinds, } from "./node-index.js";
 import { findInitializerBindings, withInitializerBindings } from "./initializer-bindings.js";
-import { everyExprChild, everyStmtChild, everyStmtList, everyTypeChild } from "./traverse.js";
+import { checkableInt32Allocations, int32ArrayGroups, int32ArrayKey, int32ArraySlot, int32ArrayStores, } from "./int32-arrays.js";
+import { everyExprChild, everyStmtChild, everyTypeChild } from "./traverse.js";
 /** The storage slot an array-valued expression reads, as an
  * IrContracts.int32Elements key: a local or parameter
  * (`l:${function}\0${localId}`), a module global (`g:${globalId}`), a class
@@ -151,8 +153,11 @@ export class Int32Slots {
             result.locals = (localId) => this.int32Locals.has(`${fnName}\0${localId}`) || this.int32Locals.has(`\0${localId}`)
                 ? INT32_RANGE
                 : null;
-        if (this.int32Elements.size > 0)
+        if (this.int32Elements.size > 0) {
             result.elements = (arr) => this.hasInt32Elements(fnName, arr);
+            if (this.narrowedReads)
+                result.narrowedReads = true;
+        }
         const params = this.paramFacts.get(fnName);
         if (params)
             result.params =
@@ -212,6 +217,29 @@ export class Int32Slots {
     addInt32Elements(key) {
         this.int32Elements.add(key);
     }
+    dropInt32Elements(key) {
+        return this.int32Elements.delete(key);
+    }
+    hasInt32ElementSlot(key) {
+        return this.int32Elements.has(key);
+    }
+    /** Whether the module has int32 array candidates (the narrowedReads
+     * range fact). */
+    narrowedReads = false;
+    /** Number arrays stored as int32 slots (int32ArrayKey keys: locals and
+     * parameters as `function\0local`, globals as `\0global`): the module's
+     * int32 array candidates whose every stored element, through every
+     * binding that can hold the same array, the fixpoint proved an int32. */
+    int32Arrays = new Set();
+    /** Local number arrays that may hold int32 slots with checked stores: the
+     * candidates whose element stores the fixpoint proved exact integers but
+     * not int32s, allocated only by fills that may be long. A fill of at least
+     * CHECKED_INT32_MIN_LENGTH elements creates one with int32 slots and a
+     * shorter one with doubles. Their elements give no int32 facts; compiled
+     * accesses test the array's kind (once per innermost loop where they can,
+     * backend/llvm/int32-kind-loops.ts), and a store that is not an int32
+     * widens it first (scr_arr_widen_i32). */
+    checkedInt32Arrays = new Set();
     /** Whether every present element of the number array `arr` evaluates to
      * (read inside `fnName`) is an int32. */
     hasInt32Elements(fnName, arr) {
@@ -335,6 +363,7 @@ const DYN_READ_ONLY = new Set([
     "date.nativeNew",
     "date.nativeNewFields",
     "date.nativeNewValue",
+    "date.argumentsTime",
     // The dynamic operators run the ToPrimitive and coercion helpers of
     // dyn.compare, dyn.numberConstructor and dyn.toStringCoerce, then build a
     // fresh number, string or bigint. dyn.increment steps dyn.toNumeric's result.
@@ -350,6 +379,7 @@ const DYN_READ_ONLY = new Set([
     "dyn.forInStable",
     "dyn.getOwnPropertyNames",
     "dyn.getPrototype",
+    "dyn.getPrototypeForIdentity",
     "dyn.hasKey",
     "dyn.hasOwn",
     "dyn.in",
@@ -362,6 +392,7 @@ const DYN_READ_ONLY = new Set([
     "dyn.collectionIteratorIndex",
     "dyn.mapSeedEntries",
     "dyn.mapSeedEntry",
+    "dyn.nameClassPrototype",
     "dyn.numberConstructor",
     "dyn.objCreate",
     "dyn.objEntries",
@@ -424,7 +455,58 @@ const DYN_READ_ONLY = new Set([
     "text.decodeStream",
     "worker.new",
 ]);
-function walkFunction(fn, visit) {
+/** The node kinds each walk below reads. */
+const LIB_CALL_KINDS = ["libCall"];
+const CALL_FACT_KINDS = [
+    ...FUNCTION_REFERENCE_KINDS,
+    "virtualCall",
+    "instanceOfValue",
+    "varRef",
+    "assignExpr",
+    "incDec",
+    "classRef",
+    "varDecl",
+    "assign",
+    "forOf",
+];
+const CENSUS_KINDS = [
+    "call",
+    "new",
+    "varRef",
+    "fieldGet",
+    "fieldIncDec",
+    "closure",
+    "classRef",
+    "incDec",
+    "forOf",
+    "tryCatch",
+];
+const DECLARATION_KINDS = ["varDecl"];
+const CANDIDATE_WRITE_KINDS = [
+    "assign",
+    "varDecl",
+    "fieldSet",
+    "return",
+    "call",
+    "new",
+    "assignExpr",
+];
+const CALL_KINDS = ["call", "new"];
+const SLOT_WRITE_KINDS = ["return", "call", "new"];
+const NARROW_WRITE_KINDS = ["assign", "varDecl", "fieldSet", "assignExpr"];
+/** Visits the nodes of `fn` in walk order; with `scan`, only those of its
+ * kinds, read from the module's node index (the visitors must ignore the
+ * other kinds). */
+function walkFunction(fn, scan, visit) {
+    if (scan !== undefined) {
+        eachNodeOfKinds(fn, scan, (node, statement) => {
+            if (statement)
+                visit.stmt?.(node);
+            else
+                visit.expr?.(node);
+        });
+        return;
+    }
     const expr = (e) => {
         visit.expr?.(e);
         return everyExprChild(e, expr, stmt);
@@ -436,12 +518,9 @@ function walkFunction(fn, visit) {
     for (const s of fn.body)
         stmt(s);
 }
-/** The class field names that runtime stores through live dynamic views
- * (typed-ref capsules) can write: every name when `all` (a dynamic store
- * whose key is not a literal), otherwise the
- * literal keys of `dyn.keySet`/`dyn.keyDelete`. A view commits a store back
- * into the instance's native field slots, which the IR does not show. */
-export function dynamicFieldStores(mod, records = new Map((mod.records ?? []).map((r) => [r.id, r])), unions = new Map((mod.unions ?? []).map((u) => [u.id, u]))) {
+/** Computes DynamicFieldStores with one walk of every function. Analyses of
+ * the same module accept the result so the emitter walks the module once. */
+export function dynamicFieldStores(mod, records = new Map((mod.records ?? []).map((r) => [r.id, r])), unions = new Map((mod.unions ?? []).map((u) => [u.id, u])), nodes) {
     const dynTypes = new Map();
     const dynNamed = new Map();
     const dynish = (type) => {
@@ -481,8 +560,13 @@ export function dynamicFieldStores(mod, records = new Map((mod.records ?? []).ma
     };
     const dynWritten = new Set();
     let dynWritesAll = false;
-    for (const fn of mod.functions)
-        walkFunction(fn, {
+    // A store whose key is not a literal names every field: later stores add
+    // nothing, so the walk stops there.
+    const scan = nodes?.scan(LIB_CALL_KINDS);
+    for (const fn of mod.functions) {
+        if (dynWritesAll)
+            break;
+        walkFunction(fn, scan, {
             expr: (e) => {
                 if (dynWritesAll)
                     return;
@@ -497,13 +581,29 @@ export function dynamicFieldStores(mod, records = new Map((mod.records ?? []).ma
                 }
             },
         });
+    }
     return { all: dynWritesAll, names: dynWritten };
 }
 /** The f64 class field families a runtime store through a live dynamic view
  * can write: the class reaches checked-dynamic code (directly or through
  * another exposed type), and some dynamic store in the program can name the
  * field. */
-export function dynamicallyStoredFamilies(mod, slots) {
+export function dynamicallyStoredFamilies(mod, slots, stores) {
+    const records = new Map((mod.records ?? []).map((r) => [r.id, r]));
+    const unions = new Map((mod.unions ?? []).map((u) => [u.id, u]));
+    // A live dyn view (typed-ref capsule) of an instance writes back into
+    // its fields only after a runtime store into the capsule; the commit then
+    // writes every field from the view, which holds the exact snapshot value
+    // of any property no store named. So reaching dynamic code disqualifies
+    // exactly the field names some dynamic store in the program can name.
+    const { all: dynWritesAll, names: dynWritten } = stores ?? dynamicFieldStores(mod, records, unions);
+    const storable = (field) => field.type.kind === "f64" &&
+        !field.name.startsWith("%") &&
+        (dynWritesAll || dynWritten.has(field.name));
+    const families = new Set();
+    // Without a field some store can name, no class is worth exposing.
+    if (!(mod.classes ?? []).some((cls) => cls.fields.some(storable)))
+        return families;
     const classes = new Map((mod.classes ?? []).map((c) => [c.name, c]));
     const children = new Map();
     for (const cls of classes.values())
@@ -525,8 +625,6 @@ export function dynamicallyStoredFamilies(mod, slots) {
         }
         return out;
     };
-    const records = new Map((mod.records ?? []).map((r) => [r.id, r]));
-    const unions = new Map((mod.unions ?? []).map((u) => [u.id, u]));
     const exposedClasses = new Set();
     const seenNamed = new Set();
     let exposeAll = false;
@@ -575,14 +673,8 @@ export function dynamicallyStoredFamilies(mod, slots) {
                 });
         }
     };
-    // A live dyn view (typed-ref capsule) of an instance writes back into
-    // its fields only after a runtime store into the capsule; the commit then
-    // writes every field from the view, which holds the exact snapshot value
-    // of any property no store named. So reaching dynamic code disqualifies
-    // exactly the field names some dynamic store in the program can name.
-    const { all: dynWritesAll, names: dynWritten } = dynamicFieldStores(mod, records, unions);
     for (const fn of mod.functions)
-        walkFunction(fn, {
+        walkFunction(fn, undefined, {
             expr: (e) => {
                 const dynResult = DYN_KINDS.has(e.type.kind);
                 const boundary = BOUNDARY_KINDS.has(e.kind);
@@ -605,14 +697,11 @@ export function dynamicallyStoredFamilies(mod, slots) {
                     expose(s.value.type);
             },
         });
-    const families = new Set();
     for (const cls of classes.values()) {
         if (!exposeAll && !exposedClasses.has(cls.name))
             continue;
         for (const field of cls.fields)
-            if (field.type.kind === "f64" &&
-                !field.name.startsWith("%") &&
-                (dynWritesAll || dynWritten.has(field.name)))
+            if (storable(field))
                 families.add(slots.family(cls.name, field.name));
     }
     return families;
@@ -621,7 +710,7 @@ export function dynamicallyStoredFamilies(mod, slots) {
  * the entry, constructors behind class values: `valueEscaped`), through
  * virtual dispatch (`virtualTargets`), or as vtable entries the runtime
  * calls (`runtimeVirtual`: methods of runtime-rooted hierarchies). */
-export function functionCallFacts(mod, classes, subtree) {
+export function functionCallFacts(mod, classes, subtree, nodes) {
     const escaped = new Set(moduleFunctionReferences(mod));
     const virtualTargets = new Set();
     // Virtual dispatch: a `virtualCall` can reach the method's implementation
@@ -638,23 +727,11 @@ export function functionCallFacts(mod, classes, subtree) {
     for (const cls of classes.values())
         if (runtimeRooted(cls.name))
             runtimePrefixes.push(`%${cls.name}.`);
-    for (const fn of mod.functions)
-        walkFunction(fn, {
-            expr: (e) => {
-                const referenced = exprFunctionReference(e);
-                if (referenced !== undefined)
-                    escaped.add(referenced);
-                if (e.kind !== "virtualCall")
-                    return;
-                for (const name of subtree(e.className))
-                    virtualTargets.add(`%${name}.${e.method}`);
-                for (let c = classes.get(e.className); c; c = c.base ? classes.get(c.base) : undefined)
-                    virtualTargets.add(`%${c.name}.${e.method}`);
-            },
-        });
     // A class value can reach `new` through its construct thunk; one that
-    // only feeds an instanceof interval check cannot.
+    // only feeds an instanceof interval check cannot. Class references are
+    // checked once every function has contributed its tested-only ones.
     const testedOnly = new Set();
+    const classRefs = [];
     for (const fn of mod.functions) {
         // Direct operands, and unboxed locals bound once to a class reference
         // and read only as instanceof operands (the lowering's temporary).
@@ -665,9 +742,18 @@ export function functionCallFacts(mod, classes, subtree) {
         const count = (map, id) => {
             map.set(id, (map.get(id) ?? 0) + 1);
         };
-        walkFunction(fn, {
+        walkFunction(fn, nodes?.scan(CALL_FACT_KINDS), {
             expr: (e) => {
-                if (e.kind === "instanceOfValue") {
+                const referenced = exprFunctionReference(e);
+                if (referenced !== undefined)
+                    escaped.add(referenced);
+                if (e.kind === "virtualCall") {
+                    for (const name of subtree(e.className))
+                        virtualTargets.add(`%${name}.${e.method}`);
+                    for (let c = classes.get(e.className); c; c = c.base ? classes.get(c.base) : undefined)
+                        virtualTargets.add(`%${c.name}.${e.method}`);
+                }
+                else if (e.kind === "instanceOfValue") {
                     if (e.classValue.kind === "classRef")
                         testedOnly.add(e.classValue);
                     else if (e.classValue.kind === "varRef")
@@ -677,6 +763,8 @@ export function functionCallFacts(mod, classes, subtree) {
                     count(reads, e.localId);
                 else if (e.kind === "assignExpr" || e.kind === "incDec")
                     count(writes, e.localId);
+                else if (e.kind === "classRef")
+                    classRefs.push(e);
             },
             stmt: (s) => {
                 if (s.kind === "varDecl" && s.init?.kind === "classRef")
@@ -690,17 +778,14 @@ export function functionCallFacts(mod, classes, subtree) {
             if (!boxed.has(id) && writes.get(id) === 1 && reads.get(id) === tests.get(id))
                 testedOnly.add(ref);
     }
-    for (const fn of mod.functions)
-        walkFunction(fn, {
-            expr: (e) => {
-                if (e.kind === "classRef" && !testedOnly.has(e))
-                    escaped.add(`%${e.className}.constructor`);
-            },
-        });
+    for (const e of classRefs)
+        if (!testedOnly.has(e))
+            escaped.add(`%${e.className}.constructor`);
     const runtimeVirtual = (name) => runtimePrefixes.some((prefix) => name.startsWith(prefix));
     return { valueEscaped: escaped, virtualTargets, runtimeVirtual };
 }
-export function analyzeInt32Slots(mod) {
+export function analyzeInt32Slots(mod, inputs = {}) {
+    const nodes = inputs.nodes;
     const classes = new Map((mod.classes ?? []).map((c) => [c.name, c]));
     const slots = new Int32Slots(classes);
     if (mod.lib)
@@ -729,6 +814,32 @@ export function analyzeInt32Slots(mod) {
         slots.addInt32Local(key);
     for (const key of contracts?.int32Elements ?? [])
         slots.addInt32Elements(key);
+    // Int32 array candidates (ir/int32-arrays.ts): assumed to hold int32
+    // elements until a store the fixpoint cannot prove drops one, with every
+    // candidate the same array can reach (its group).
+    const arrayCandidates = new Map();
+    const globalArrays = new Set();
+    const arrayKeys = new Set(mod.int32ArrayCandidates ?? []);
+    slots.narrowedReads = arrayKeys.size > 0;
+    for (const key of arrayKeys) {
+        const cut = key.indexOf("\0");
+        if (cut === 0)
+            globalArrays.add(key.slice(1));
+        else {
+            const fnName = key.slice(0, cut);
+            const set = arrayCandidates.get(fnName) ?? new Set();
+            set.add(key.slice(cut + 1));
+            arrayCandidates.set(fnName, set);
+        }
+        slots.addInt32Elements(int32ArraySlot(key));
+    }
+    const arrayGroups = arrayKeys.size > 0 ? int32ArrayGroups(mod, arrayKeys) : null;
+    // Functions that read or write a candidate global.
+    const globalArrayFunctions = new Set();
+    if (arrayGroups)
+        for (const names of arrayGroups.globalReaders.values())
+            for (const name of names)
+                globalArrayFunctions.add(name);
     /* ── candidate fields ── */
     const children = new Map();
     for (const cls of classes.values())
@@ -782,14 +893,14 @@ export function analyzeInt32Slots(mod) {
                 dropFamily(family, "runtime-provided or generic class");
         }
     /* ── dynamic, reflective and runtime exposure ── */
-    for (const family of dynamicallyStoredFamilies(mod, slots)) {
+    for (const family of dynamicallyStoredFamilies(mod, slots, inputs.dynamicStores)) {
         if (slots.isPinnedField(family))
             continue;
         dropFamily(family, "dynamic stores can name the field");
     }
     /* ── functions: escapes, parameter and return candidates ── */
     const functions = new Map(mod.functions.map((fn) => [fn.name, fn]));
-    const calls = functionCallFacts(mod, classes, subtree);
+    const calls = functionCallFacts(mod, classes, subtree, nodes);
     const escaped = new Set([...calls.valueEscaped, ...calls.virtualTargets]);
     const virtual = calls.runtimeVirtual;
     const paramKey = (fnName, localId) => `param:${fnName}\0${localId}`;
@@ -801,57 +912,17 @@ export function analyzeInt32Slots(mod) {
         for (const param of fn.params)
             dropParam(fn.name, param.localId, why);
     };
-    // Only functions some IR call reaches directly get parameter facts: one
-    // the backend invokes by convention has no call site to prove against.
+    // One walk of every function collects what the steps below need: the
+    // functions IR calls reach directly, calls whose arity differs from their
+    // callee's, the captured bindings' boxes, and which functions read which
+    // slot facts. Facts that depend on earlier steps are applied in walk order
+    // where those steps complete.
     const called = slots.called;
-    for (const fn of mod.functions)
-        walkFunction(fn, {
-            expr: (e) => {
-                if (e.kind === "call")
-                    called.add(e.callee);
-                else if (e.kind === "new")
-                    called.add(`%${e.className}.constructor`);
-            },
-        });
-    for (const fn of mod.functions) {
-        if (fn.returnType.kind === "f64" && !fn.async && !fn.generator) {
-            slots.addReturn(fn.name);
-            slots.assumeNonNegative(`ret:${fn.name}`);
-        }
-        if (fn.async ||
-            fn.generator ||
-            !called.has(fn.name) ||
-            escaped.has(fn.name) ||
-            virtual(fn.name))
-            continue;
-        for (const param of fn.params)
-            if (param.type.kind === "f64" && !slots.isPinned(paramKey(fn.name, param.localId))) {
-                slots.addParam(fn.name, param.localId);
-                slots.assumeNonNegative(paramKey(fn.name, param.localId));
-            }
-    }
+    const arityMismatches = [];
     const arityChecked = (fn, args, offset) => {
         if (fn && fn.params.length !== args + offset)
-            dropAllParams(fn, "call arity differs");
+            arityMismatches.push(fn);
     };
-    for (const fn of mod.functions)
-        walkFunction(fn, {
-            expr: (e) => {
-                if (e.kind === "call")
-                    arityChecked(functions.get(e.callee), e.args.length, 0);
-                else if (e.kind === "new")
-                    arityChecked(functions.get(`%${e.className}.constructor`), e.args.length, 1);
-            },
-        });
-    // Candidates the fixpoint may drop; rangedParameters retries some.
-    const candidates = new Map();
-    const retry = new Set();
-    for (const fn of mod.functions) {
-        const ids = fn.params.filter((p) => slots.hasParam(fn.name, p.localId)).map((p) => p.localId);
-        if (ids.length > 0)
-            candidates.set(fn.name, ids);
-    }
-    /* ── captured bindings ── */
     // A captured local lives in one box shared by its declaring function and
     // every closure that captures it (closure.captures[i] is the lifted
     // function's captures[i]). The box holds an int32 when every write to it
@@ -869,6 +940,18 @@ export function analyzeInt32Slots(mod) {
     const boxKey = (fnName, localId) => `${fnName}\0${localId}`;
     const boxMembers = new Set();
     const unstableBoxes = new Set();
+    // Readers: which functions depend on which slot facts. Reads of a boxed
+    // local resolve to its box once the boxes are known.
+    const readers = new Map();
+    const reads = (slot, fnName) => {
+        const set = readers.get(slot);
+        if (set)
+            set.add(fnName);
+        else
+            readers.set(slot, new Set([fnName]));
+    };
+    const boxedReads = [];
+    const incrementedFamilies = [];
     for (const fn of mod.functions) {
         for (const local of fn.locals)
             if (local.boxed) {
@@ -879,9 +962,34 @@ export function analyzeInt32Slots(mod) {
             }
         for (const capture of fn.classCaptures ?? [])
             unstableBoxes.add(boxKey(fn.name, capture.localId));
-        walkFunction(fn, {
+        const read = new Set();
+        walkFunction(fn, nodes?.scan(CENSUS_KINDS), {
             expr: (e) => {
-                if (e.kind === "closure") {
+                if (e.kind === "call") {
+                    called.add(e.callee);
+                    arityChecked(functions.get(e.callee), e.args.length, 0);
+                    reads(`ret:${e.callee}`, fn.name);
+                }
+                else if (e.kind === "new") {
+                    const constructor = `%${e.className}.constructor`;
+                    called.add(constructor);
+                    arityChecked(functions.get(constructor), e.args.length, 1);
+                    // Constructors return nothing: this only records their callers.
+                    reads(`ret:${constructor}`, fn.name);
+                }
+                else if (e.kind === "varRef")
+                    read.add(e.localId);
+                else if (e.kind === "fieldGet") {
+                    const family = slots.family(e.className, e.field);
+                    if (family)
+                        reads(`field:${family}`, fn.name);
+                }
+                else if (e.kind === "fieldIncDec") {
+                    const family = slots.family(e.className, e.field);
+                    if (family)
+                        incrementedFamilies.push(family);
+                }
+                else if (e.kind === "closure") {
                     const lifted = functions.get(e.fnName);
                     e.captures.forEach((id, i) => {
                         const inner = lifted?.captures?.[i];
@@ -908,7 +1016,39 @@ export function analyzeInt32Slots(mod) {
                     unstableBoxes.add(boxKey(fn.name, s.catchLocalId));
             },
         });
+        if (read.size > 0)
+            boxedReads.push([fn, read]);
     }
+    // Only functions some IR call reaches directly get parameter facts: one
+    // the backend invokes by convention has no call site to prove against.
+    for (const fn of mod.functions) {
+        if (fn.returnType.kind === "f64" && !fn.async && !fn.generator) {
+            slots.addReturn(fn.name);
+            slots.assumeNonNegative(`ret:${fn.name}`);
+        }
+        if (fn.async ||
+            fn.generator ||
+            !called.has(fn.name) ||
+            escaped.has(fn.name) ||
+            virtual(fn.name))
+            continue;
+        for (const param of fn.params)
+            if (param.type.kind === "f64" && !slots.isPinned(paramKey(fn.name, param.localId))) {
+                slots.addParam(fn.name, param.localId);
+                slots.assumeNonNegative(paramKey(fn.name, param.localId));
+            }
+    }
+    for (const fn of arityMismatches)
+        dropAllParams(fn, "call arity differs");
+    // Candidates the fixpoint may drop; rangedParameters retries some.
+    const candidates = new Map();
+    const retry = new Set();
+    for (const fn of mod.functions) {
+        const ids = fn.params.filter((p) => slots.hasParam(fn.name, p.localId)).map((p) => p.localId);
+        if (ids.length > 0)
+            candidates.set(fn.name, ids);
+    }
+    /* ── captured bindings ── */
     const groups = new Map();
     for (const key of boxMembers) {
         const root = boxRoot(key);
@@ -935,7 +1075,7 @@ export function analyzeInt32Slots(mod) {
         let ids = initializedDeclarations.get(fn.name);
         if (ids === undefined) {
             const found = new Set();
-            walkFunction(fn, {
+            walkFunction(fn, nodes?.scan(DECLARATION_KINDS), {
                 stmt: (s) => {
                     if (s.kind === "varDecl" && s.init)
                         found.add(s.localId);
@@ -977,42 +1117,16 @@ export function analyzeInt32Slots(mod) {
         reason(`box:${group}`, why);
         return slots.dropBox(group);
     };
-    /* ── readers: which functions depend on which slot facts ── */
-    const readers = new Map();
-    const reads = (slot, fnName) => {
-        const set = readers.get(slot);
-        if (set)
-            set.add(fnName);
-        else
-            readers.set(slot, new Set([fnName]));
-    };
-    for (const fn of mod.functions)
-        walkFunction(fn, {
-            expr: (e) => {
-                if (e.kind === "fieldGet") {
-                    const family = slots.family(e.className, e.field);
-                    if (family)
-                        reads(`field:${family}`, fn.name);
-                }
-                else if (e.kind === "call")
-                    reads(`ret:${e.callee}`, fn.name);
-                // Constructors return nothing: this only records their callers.
-                else if (e.kind === "new")
-                    reads(`ret:%${e.className}.constructor`, fn.name);
-                else if (e.kind === "varRef") {
-                    const group = slots.boxGroup(fn.name, e.localId);
-                    if (group !== null)
-                        reads(`box:${group}`, fn.name);
-                }
-                else if (e.kind === "fieldIncDec") {
-                    const family = slots.family(e.className, e.field);
-                    if (family)
-                        dropFamily(family, "++/-- on the field");
-                }
-            },
-        });
+    for (const [fn, read] of boxedReads)
+        for (const localId of read) {
+            const group = slots.boxGroup(fn.name, localId);
+            if (group !== null)
+                reads(`box:${group}`, fn.name);
+        }
+    for (const family of incrementedFamilies)
+        dropFamily(family, "++/-- on the field");
     /* ── the optimistic fixpoint ── */
-    const bindings = findInitializerBindings(mod);
+    const bindings = inputs.initializerBindings ?? findInitializerBindings(mod);
     const numeric = (fn) => withInitializerBindings(fn, bindings.get(fn.name) ?? []);
     const queue = mod.functions.map((fn) => fn.name);
     const queued = new Set(queue);
@@ -1035,31 +1149,44 @@ export function analyzeInt32Slots(mod) {
         }
         return false;
     };
+    const candidateWrites = nodes?.scan(CANDIDATE_WRITE_KINDS);
     const hasCandidateWrite = (fn) => {
+        if (arrayCandidates.has(fn.name))
+            return true;
+        if (globalArrayFunctions.has(fn.name))
+            return true;
         const box = (localId) => slots.hasBox(slots.boxGroup(fn.name, localId));
         const returns = slots.hasReturn(fn.name);
-        return !everyStmtList(fn.body, {
-            stmt: (s) => {
-                if (s.kind === "assign")
-                    return !box(s.localId);
-                if (s.kind === "varDecl")
-                    return s.init === null || !box(s.localId);
-                if (s.kind === "fieldSet") {
-                    const family = slots.family(s.className, s.field);
-                    return !family || !slots.hasFamily(family);
+        let found = false;
+        eachNodeOfKinds(fn, candidateWrites, (node) => {
+            switch (node.kind) {
+                case "assign":
+                    found = box(node.localId);
+                    break;
+                case "varDecl":
+                    found = node.init !== null && box(node.localId);
+                    break;
+                case "fieldSet": {
+                    const family = slots.family(node.className, node.field);
+                    found = !!family && slots.hasFamily(family);
+                    break;
                 }
-                return !(s.kind === "return" && returns);
-            },
-            expr: (e) => {
-                if (e.kind === "call")
-                    return !candidateArgs(functions.get(e.callee), e.args.length, 0);
-                if (e.kind === "new")
-                    return !candidateArgs(functions.get(`%${e.className}.constructor`), e.args.length, 1);
-                if (e.kind === "assignExpr")
-                    return !box(e.localId);
-                return true;
-            },
+                case "return":
+                    found = returns;
+                    break;
+                case "call":
+                    found = candidateArgs(functions.get(node.callee), node.args.length, 0);
+                    break;
+                case "new":
+                    found = candidateArgs(functions.get(`%${node.className}.constructor`), node.args.length, 1);
+                    break;
+                case "assignExpr":
+                    found = box(node.localId);
+                    break;
+            }
+            return !found;
         });
+        return found;
     };
     const provenByFunction = new Map();
     // Each function's parameter and result writes under its latest analysis:
@@ -1074,15 +1201,84 @@ export function analyzeInt32Slots(mod) {
                 reads(`param:${fn.name}\0${id}`, fn.name);
         // Range facts are consulted only at writes into candidate slots; slots
         // are only ever dropped, so a body without such a write needs none.
-        const ranges = hasCandidateWrite(fn)
+        const candidate = hasCandidateWrite(fn);
+        const ranges = candidate
             ? analyzeIntegerRanges(numeric(fn), slots.facts(fn.name))
             : new Map();
         if (ranges.size > 0)
-            lastWrites.set(fn.name, slotWrites(fn, ranges, functions));
+            lastWrites.set(fn.name, slotWrites(fn, ranges, functions, nodes));
         else
             lastWrites.delete(fn.name);
         const proven = [];
+        // The walk below acts only at writes into candidate slots.
+        if (!candidate) {
+            provenByFunction.set(fn.name, proven);
+            continue;
+        }
         const int32 = (e) => withinInt32(ranges.get(e));
+        // Every element stored into an int32 array candidate must be an int32
+        // under the facts that assume the candidates' own elements are; a
+        // failing store drops its array's element facts, and the function is
+        // analyzed again without them. When every failing store is still an
+        // exact integer under those facts (a counter, `a[i]! + 1`) and the array
+        // is only ever allocated by a fill that may be long
+        // (checkableInt32Allocations), it keeps int32 slots with checked stores
+        // (checkedInt32Arrays), which widen it to doubles in place at the first
+        // store that is not an int32.
+        const locals = arrayCandidates.get(fn.name);
+        let arrays = locals;
+        if (globalArrayFunctions.has(fn.name)) {
+            const both = new Set();
+            if (locals)
+                for (const id of locals)
+                    both.add(id);
+            for (const id of globalArrays)
+                both.add(id);
+            arrays = both;
+        }
+        if (arrays && arrayGroups) {
+            const requeue = (name) => {
+                if (queued.has(name))
+                    return;
+                queued.add(name);
+                queue.push(name);
+            };
+            const params = new Set(fn.params.map((param) => param.localId));
+            for (const [id, values] of int32ArrayStores(fn, arrays)) {
+                const key = int32ArrayKey(fn.name, id);
+                if (!slots.hasInt32ElementSlot(int32ArraySlot(key)) || values.every(int32))
+                    continue;
+                // The array's group drops together: every function reading a
+                // member is analyzed again without its facts.
+                const group = arrayGroups.group.get(key) ?? [key];
+                for (const member of group) {
+                    slots.dropInt32Elements(int32ArraySlot(member));
+                    if (member.startsWith("\0")) {
+                        const names = arrayGroups.globalReaders.get(member);
+                        if (names)
+                            for (const name of names)
+                                requeue(name);
+                    }
+                    else
+                        requeue(member.slice(0, member.indexOf("\0")));
+                }
+                // Checked stores serve a lone local: its allocations are the only
+                // arrays it holds.
+                const checkable = (value) => {
+                    const range = ranges.get(value);
+                    return int32(value) || range != null;
+                };
+                if (group.length === 1 &&
+                    !key.startsWith("\0") &&
+                    !params.has(id) &&
+                    values.every(checkable) &&
+                    checkableInt32Allocations(fn, id))
+                    slots.checkedInt32Arrays.add(key);
+                else
+                    for (const member of group)
+                        reason(`array:${member}`, "an element store is not int32");
+            }
+        }
         // An int32 written into a slot still assumed non-negative: widen the
         // assumption when the value may be negative, and reanalyze its readers.
         const settle = (slot, e) => {
@@ -1128,7 +1324,7 @@ export function analyzeInt32Slots(mod) {
             else if (dropBox(group, `write in ${fn.name} is not int32`))
                 invalidate(`box:${group}`);
         };
-        walkFunction(fn, {
+        walkFunction(fn, nodes?.scan(CANDIDATE_WRITE_KINDS), {
             stmt: (s) => {
                 if (s.kind === "assign")
                     boxWrite(s.localId, s.value);
@@ -1169,8 +1365,11 @@ export function analyzeInt32Slots(mod) {
     for (const proven of provenByFunction.values())
         for (const value of proven)
             slots.provenWrites.add(value);
-    const ranged = rangedParameters(slots, functions, retry, numeric, (callee) => readers.get(`ret:${callee}`));
-    narrowSlotRanges(slots, functions, numeric, lastWrites, ranged, (slot) => readers.get(slot));
+    for (const key of arrayKeys)
+        if (slots.hasInt32ElementSlot(int32ArraySlot(key)))
+            slots.int32Arrays.add(key);
+    const ranged = rangedParameters(slots, functions, retry, numeric, (callee) => readers.get(`ret:${callee}`), nodes);
+    narrowSlotRanges(slots, functions, numeric, lastWrites, ranged, (slot) => readers.get(slot), nodes);
     return slots;
 }
 /** Bounds a widened parameter range jumps to: the int32 limits, and the
@@ -1197,7 +1396,7 @@ const widenMax = (max) => WIDEN_MAX.find((bound) => bound >= max) ?? Infinity;
  * other waiting functions) fail their parameters and are analyzed too, so
  * every call site is checked under the final ranges. The facts the main
  * fixpoint proved are fixed here: these ranges only add precision. */
-function rangedParameters(slots, functions, retry, numeric, callersOf) {
+function rangedParameters(slots, functions, retry, numeric, callersOf, nodes) {
     const changed = new Set();
     if (retry.size === 0)
         return changed;
@@ -1280,7 +1479,7 @@ function rangedParameters(slots, functions, retry, numeric, callersOf) {
                     contribute(callee, param.localId, ranges.get(arg) ?? null);
             });
         };
-        walkFunction(fn, {
+        walkFunction(fn, nodes?.scan(CALL_KINDS), {
             expr: (e) => {
                 if (e.kind === "call")
                     args(functions.get(e.callee), e.args, 0);
@@ -1323,7 +1522,7 @@ const sameRange = (a, b) => a.min === b.min && a.max === b.max;
 /** The values one analysis of a function writes into parameter slots of
  * its direct callees and into its own result slot (`param:` and `ret:`
  * keys), joined per slot; null when some write has no proven range. */
-function slotWrites(fn, ranges, functions) {
+function slotWrites(fn, ranges, functions, nodes) {
     const writes = new Map();
     const write = (key, value) => {
         const range = value ? (ranges.get(value) ?? null) : null;
@@ -1339,7 +1538,7 @@ function slotWrites(fn, ranges, functions) {
                 write(`param:${callee.name}\0${param.localId}`, arg);
         });
     };
-    walkFunction(fn, {
+    walkFunction(fn, nodes?.scan(SLOT_WRITE_KINDS), {
         stmt: (s) => {
             if (s.kind === "return")
                 write(`ret:${fn.name}`, s.value);
@@ -1376,7 +1575,7 @@ const NARROW_ROUNDS = 6;
  * function must still prove every write into a field or box slot (whose
  * facts do not change here), or the narrowing is abandoned. Pinned
  * (contract) slots keep their contract range. */
-function narrowSlotRanges(slots, functions, numeric, lastWrites, changed, readersOf) {
+function narrowSlotRanges(slots, functions, numeric, lastWrites, changed, readersOf, nodes) {
     // Every parameter and result slot with a fact, and that fact.
     const proven = new Map();
     const fixed = new Set();
@@ -1437,7 +1636,7 @@ function narrowSlotRanges(slots, functions, numeric, lastWrites, changed, reader
             if (!rangeWithin(range, level))
                 sound = false;
         };
-        walkFunction(fn, {
+        walkFunction(fn, nodes?.scan(NARROW_WRITE_KINDS), {
             stmt: (s) => {
                 if (s.kind === "assign")
                     box(s.localId, s.value);
@@ -1452,7 +1651,7 @@ function narrowSlotRanges(slots, functions, numeric, lastWrites, changed, reader
                     box(e.localId, e.value);
             },
         });
-        return { writes: slotWrites(fn, ranges, functions), sound };
+        return { writes: slotWrites(fn, ranges, functions, nodes), sound };
     };
     const writesByFunction = new Map(lastWrites);
     const join = () => {