@scriptc/compiler 0.4.1 → 0.4.3

package/dist/backend/llvm/bytes-loop-versions.js

@@ -1,13 +1,19 @@
+import { F64 } from "../../ir/ir.js";
 import { byteNumberAccess } from "../../ir/byte-numbers.js";
 import { everyExprChild, everyStmtChild } from "../../ir/traverse.js";
 import { exactInteger, widenInteger } from "./integer-values.js";
-import { emitCountedLoopLimit, emitCountedLoopSafety } from "./counted-loops.js";
-import { emitBytesHeaderLength } from "./expr-bytes.js";
+import { emitCountedLoopLimit, emitCountedLoopSafety, emitExactIntegerTest, } from "./counted-loops.js";
+import { emitBytesHeaderLength, emitBytesSharedStorage } from "./expr-bytes.js";
+import { f64Lit } from "./common.js";
+import { emitStringAsciiFlag, emitStringByteLength } from "./string-reads.js";
 const MAX_COST = 400;
-const MAX_FIXED_END = 2 ** 32;
+const MAX_FIXED_END = 2 ** 31;
 const MAX_CHECKS = 8;
 const MAX_OFFSET = 2 ** 31;
 const SAFE = Number.MAX_SAFE_INTEGER;
+/** The range the guard requires of an invariant index term without a
+ * proven one: every index of a typed array of at most 2^32 elements. */
+const GUARDED_TERM = { min: -(2 ** 32), max: 2 ** 32 };
 const INVARIANT_OPS = new Set(["+", "-", "*", "&", "|", "^", "<<", ">>", ">>>"]);
 /** Loop versioning for typed-array bounds. A typed array's length and data
  * pointer are fixed at construction (ScrBytes has no resize, transfer or
@@ -19,13 +25,28 @@ const INVARIANT_OPS = new Set(["+", "-", "*", "&", "|", "^", "<<", ">>", ">>>"])
  *   `hi < length`, such as `table[x & 0xff]` or a constant-trip counter;
  * - an index `k * counter + invariant + c` of a counted loop needs its first
  *   and last values in bounds, such as `out[base + i]` for `i < n` or
- *   `view.getUint32(i * 4)`.
+ *   `view.getUint32(i * 4)`. An invariant without a proven integer range,
+ *   such as `base` for `const base = r * cols`, must also be an exact
+ *   integer between -2^32 and 2^32, which the guard tests.
+ *
+ * `s.charCodeAt(index)` and `s.charAt(index)` (so `s[index]`) of a string
+ * binding qualify the same way. A string is immutable: its bytes, its
+ * length and the capacity-word bit that proves it ASCII (string-reads.ts)
+ * are fixed when it is built. The guard also requires that bit, so each
+ * UTF-16 unit is one byte and the length is the byte length. The fast copy
+ * reads each unit with one byte load, and each character as the immortal
+ * one-character string for its byte.
+ *
+ * In worker programs, every access of a view that may be shared tests its
+ * shared storage. A view's storage is also fixed at construction, so the
+ * same guard tests each invariant receiver once, and the fast copy reads
+ * and writes thread-owned views directly.
  *
  * Only small synchronous loops are versioned (nested loops included), and
  * the emitter bounds how deeply versions nest. The checked loop runs
  * whenever the guard fails, and keeps every out-of-bounds read, ignored
  * write and NaN-index behavior. */
-export function matchBytesLoopVersion(loop, counted, facts) {
+export function matchBytesLoopVersion(loop, counted, facts, paired = null) {
     const written = new Set();
     const temps = new Map();
     let cost = 0;
@@ -66,10 +87,10 @@ export function matchBytesLoopVersion(loop, counted, facts) {
     // The guard runs before the initializer, so a binding the initializer
     // writes is not invariant either: `for (let i = (a = b, 0); ...)` must
     // not keep the bounds the guard proved for the old `a`.
-    if ((loop.init !== null && !scanStmt(loop.init)) ||
+    if ((loop.kind === "for" && loop.init !== null && !scanStmt(loop.init)) ||
         !loop.body.every(scanStmt) ||
         (loop.cond !== null && !scanExpr(loop.cond)) ||
-        (loop.update !== null && !scanStmt(loop.update)))
+        (loop.kind === "for" && loop.update !== null && !scanStmt(loop.update)))
         return null;
     // A body temp stands for its initializer only when it is a constant
     // binding assigned exactly once, by that declaration.
@@ -106,7 +127,9 @@ export function matchBytesLoopVersion(loop, counted, facts) {
     };
     const resolving = new Set();
     const root = (e) => {
-        if (e.kind !== "varRef" || e.type.kind !== "bytes")
+        if (e.kind !== "varRef" || (e.type.kind !== "bytes" && e.type.kind !== "string"))
+            return null;
+        if (facts.scalarStrings.has(e.localId))
             return null;
         const init = temp(e.localId);
         if (init) {
@@ -119,10 +142,8 @@ export function matchBytesLoopVersion(loop, counted, facts) {
         }
         return invariant(e.localId) ? e : null;
     };
-    // A pure integer operand evaluated again before the loop.
-    const invariantKey = (e) => {
-        if (!facts.ranges.get(e))
-            return null;
+    // A pure loop-invariant number, evaluated again before the loop.
+    const pureKey = (e) => {
         if (e.kind === "numLit")
             return Number.isSafeInteger(e.value) ? `n${e.value}` : null;
         if (e.kind === "varRef")
@@ -131,15 +152,33 @@ export function matchBytesLoopVersion(loop, counted, facts) {
             INVARIANT_OPS.has(e.op) &&
             e.left.type.kind === "f64" &&
             e.right.type.kind === "f64") {
-            const left = invariantKey(e.left), right = invariantKey(e.right);
+            const left = pureKey(e.left), right = pureKey(e.right);
             return left !== null && right !== null ? `(${e.op} ${left} ${right})` : null;
         }
         return null;
     };
+    // Invariant terms without a proven range, such as `base` in
+    // `w[base + j]` with `const base = r * cols` for a parameter `cols`. The
+    // guard tests each one: an exact integer (not -0) within GUARDED_TERM.
+    const guardedRanges = new Map();
+    const guardedNodes = new Map();
+    // The key of a loop-invariant index term, with a proven range or guarded.
+    const invariantKey = (e) => {
+        const key = pureKey(e);
+        if (key === null || facts.ranges.get(e))
+            return key;
+        if (e.kind === "numLit")
+            return null;
+        guardedRanges.set(e, GUARDED_TERM);
+        guardedNodes.set(e, key);
+        return key;
+    };
+    const termRange = (e) => facts.ranges.get(e) ?? guardedRanges.get(e);
     // Every operand of an affine index is `counter * k + Σ terms + offset`.
-    // Invariant terms need proven ranges. Operands that involve the counter
-    // need none: the guard bounds the counter so that each of them is a safe
-    // integer, which makes the index's double arithmetic exact.
+    // Invariant terms need proven ranges or the guard's test (guarded terms).
+    // Operands that involve the counter need none: the guard bounds the
+    // counter so that each of them is a safe integer, which makes the index's
+    // double arithmetic exact.
     const shapes = new Map();
     const affine = (e) => {
         if (shapes.has(e))
@@ -224,9 +263,42 @@ export function matchBytesLoopVersion(loop, counted, facts) {
         }
     };
     const termMagnitude = (terms) => terms.reduce((sum, t) => {
-        const r = facts.ranges.get(t.expr);
+        const r = termRange(t.expr);
         return sum + Math.max(Math.abs(r.min), Math.abs(r.max));
     }, 0);
+    const whileAccesses = loop.kind === "while" ? whileCounterAccesses(loop) : null;
+    function whileCounterAccesses(loop) {
+        return findWhileCounterAccesses(loop, {
+            counterLocal: (id) => {
+                const local = facts.locals.get(id);
+                return (local?.type.kind === "f64" &&
+                    !local.boxed &&
+                    !local.tdz &&
+                    !facts.captured.has(id) &&
+                    facts.initialized.has(id));
+            },
+            boundKey: (e) => {
+                if (e.type.kind !== "f64")
+                    return null;
+                // The guard evaluates the bound before the loop: a typed array's
+                // length needs the binding itself, not a temp the body declares.
+                if (e.kind === "bytesIntrinsic" &&
+                    e.method === "length" &&
+                    e.receiver.kind === "varRef" &&
+                    e.receiver.type.kind === "bytes" &&
+                    invariant(e.receiver.localId))
+                    return `bytes-length:${e.receiver.localId}`;
+                if (e.kind === "strIntrinsic" &&
+                    e.method === "length" &&
+                    e.args.length === 0 &&
+                    e.receiver.kind === "varRef" &&
+                    e.receiver.type.kind === "string" &&
+                    invariant(e.receiver.localId))
+                    return `string-length:${e.receiver.localId}`;
+                return pureKey(e);
+            },
+        });
+    }
     const receivers = [];
     const receiverIndex = new Map();
     const fixed = new Map();
@@ -236,16 +308,49 @@ export function matchBytesLoopVersion(loop, counted, facts) {
         if (index === undefined) {
             index = receivers.length;
             receiverIndex.set(ref.localId, index);
-            receivers.push({ ref, global: !facts.locals.has(ref.localId) });
+            receivers.push({
+                ref,
+                global: !facts.locals.has(ref.localId),
+                string: ref.type.kind === "string",
+            });
         }
         return index;
     };
+    // Worker programs: accesses through invariant receivers, proven or not,
+    // become thread-owned when the guard finds no shared storage.
+    const owned = new Map();
+    // While loops: accesses at a counter below a bound, by receiver and bound.
+    const boundedChecks = new Map();
+    const pairedCounters = paired !== null && counted === null ? new Set([paired.low.localId, paired.high.localId]) : null;
+    const pairedNodes = new Map();
     const access = (node, array, index, width) => {
-        if (facts.proven.has(node))
-            return;
         const ref = root(array);
         if (!ref)
             return;
+        if (facts.workers && ref.type.kind === "bytes" && !facts.owned.has(node)) {
+            const receiver = receiverOf(ref);
+            const nodes = owned.get(receiver);
+            if (nodes)
+                nodes.push(node);
+            else
+                owned.set(receiver, [node]);
+        }
+        if (facts.proven.has(node))
+            return;
+        // An element at either counter of a two-counter loop.
+        if (pairedCounters !== null &&
+            width === 1 &&
+            ref.type.kind === "bytes" &&
+            index.kind === "varRef" &&
+            pairedCounters.has(index.localId)) {
+            const receiver = receiverOf(ref);
+            const nodes = pairedNodes.get(receiver);
+            if (nodes)
+                nodes.push(node);
+            else
+                pairedNodes.set(receiver, [node]);
+            return;
+        }
         const shape = counter !== null ? affine(index) : null;
         if (shape && shape.counter !== 0) {
             const operands = new Set();
@@ -270,12 +375,32 @@ export function matchBytesLoopVersion(loop, counted, facts) {
                 });
             return;
         }
+        const bounded = whileAccesses?.accesses.get(node);
+        const loopCounter = bounded && whileAccesses.counters.get(bounded.counter);
+        if (bounded && loopCounter && (!loopCounter.wraps || loopCounter.bounds !== null)) {
+            const receiver = receiverOf(ref);
+            const key = `${receiver}|${bounded.key}|${bounded.adj}`;
+            const slack = bounded.offset + width - 1 + bounded.adj;
+            const group = boundedChecks.get(key);
+            if (group) {
+                group.check.slack = Math.max(group.check.slack, slack);
+                group.nodes.push({ node, access: bounded });
+            }
+            else
+                boundedChecks.set(key, {
+                    check: { receiver, bound: bounded.bound, slack },
+                    nodes: [{ node, access: bounded }],
+                });
+            return;
+        }
         const range = facts.ranges.get(index);
         if (!range)
             return;
         const end = range.max + width - 1;
-        // Only a length a buffer can have: an outer loop must not pay for a
-        // guard that bounds an inner loop's unbounded counter.
+        // Only an end below 2^31: an outer loop must not pay for a guard that
+        // bounds an inner loop's unbounded counter, and the counter of a loop to
+        // an array's length reaches 2^32 - 2, a length no typed array in
+        // practice has.
         if (range.min < 0 || end >= MAX_FIXED_END)
             return;
         const receiver = receiverOf(ref);
@@ -295,6 +420,10 @@ export function matchBytesLoopVersion(loop, counted, facts) {
             else if (e.method === "get" && e.args[0])
                 access(e, e.receiver, e.args[0], 1);
         }
+        else if (e.kind === "strIntrinsic" &&
+            (e.method === "charCodeAt" || e.method === "charAt") &&
+            e.args[0])
+            access(e, e.receiver, e.args[0], 1);
         return everyExprChild(e, visitExpr, visitStmt);
     };
     const visitStmt = (s) => {
@@ -303,6 +432,8 @@ export function matchBytesLoopVersion(loop, counted, facts) {
         return everyStmtChild(s, visitExpr, visitStmt);
     };
     loop.body.every(visitStmt);
+    if (loop.kind === "while")
+        visitExpr(loop.cond);
     // Bound the counter so every counter operand stays a safe integer.
     let bound = SAFE;
     const affineGroups = [...affineChecks.values()].filter((group) => {
@@ -319,10 +450,23 @@ export function matchBytesLoopVersion(loop, counted, facts) {
     });
     const fixedKept = [...fixed.values()].slice(0, MAX_CHECKS);
     const affineKept = affineGroups.slice(0, MAX_CHECKS - fixedKept.length);
-    if (fixedKept.length === 0 && affineKept.length === 0)
+    const boundedKept = [...boundedChecks.values()].slice(0, Math.max(0, MAX_CHECKS - fixedKept.length - affineKept.length));
+    const ownedKept = [...owned.entries()].slice(0, MAX_CHECKS);
+    const pairedKept = [...pairedNodes.entries()].slice(0, Math.max(0, MAX_CHECKS - fixedKept.length - affineKept.length - boundedKept.length));
+    if (fixedKept.length === 0 &&
+        affineKept.length === 0 &&
+        boundedKept.length === 0 &&
+        ownedKept.length === 0 &&
+        pairedKept.length === 0)
         return null;
     const bounds = new Set();
+    const ownedNodes = new Set();
     const used = new Set();
+    for (const [receiver, nodes] of ownedKept) {
+        used.add(receiver);
+        for (const node of nodes)
+            ownedNodes.add(node);
+    }
     const ranges = new Map();
     const counterLow = Math.max(counted?.range.min ?? 0, -bound), counterHigh = Math.min(counted?.range.max ?? 0, bound);
     for (const group of fixedKept) {
@@ -335,20 +479,72 @@ export function matchBytesLoopVersion(loop, counted, facts) {
         for (const node of group.nodes)
             bounds.add(node);
         for (const operand of group.operands) {
-            if (facts.ranges.get(operand))
-                continue;
             const shape = shapes.get(operand);
             const a = shape.counter * counterLow, b = shape.counter * counterHigh;
             let min = Math.min(a, b) + shape.offset, max = Math.max(a, b) + shape.offset;
             for (const term of shape.terms) {
-                const r = facts.ranges.get(term.expr);
+                const r = termRange(term.expr);
                 min += term.sign > 0 ? r.min : -r.max;
                 max += term.sign > 0 ? r.max : -r.min;
             }
-            if (counterLow <= counterHigh)
+            if (counterLow > counterHigh)
+                continue;
+            // The guard's bound on the counter can narrow a range the operand
+            // already has (a loop to a length proves only `i < 2^53`), so that
+            // `i * 4` in the fast copy is exact integer arithmetic.
+            const known = facts.ranges.get(operand);
+            if (!known)
                 ranges.set(operand, { min, max });
+            else if (min > known.min || max < known.max)
+                ranges.set(operand, { min: Math.max(min, known.min), max: Math.min(max, known.max) });
         }
     }
+    // Guarded terms of the kept checks, and the range the guard proves for
+    // every node of each in the fast copy.
+    const guarded = new Set();
+    for (const group of affineKept)
+        for (const term of group.check.terms)
+            if (guardedRanges.has(term.expr))
+                guarded.add(term.key);
+    for (const [node, key] of guardedNodes)
+        if (guarded.has(key))
+            ranges.set(node, GUARDED_TERM);
+    // While loop counters of the kept checks: each entry value is an exact
+    // integer that no access offset takes below 0. In the fast copy each
+    // access's index is below its length, and its counter read at least the
+    // most negative offset.
+    const narrow = (e, range) => {
+        const known = ranges.get(e) ?? facts.ranges.get(e);
+        ranges.set(e, known ? { min: Math.max(known.min, range.min), max: Math.min(known.max, range.max) } : range);
+    };
+    const counterMins = new Map();
+    for (const group of boundedKept) {
+        used.add(group.check.receiver);
+        for (const { node, access } of group.nodes) {
+            bounds.add(node);
+            const min = 0 - access.offset;
+            counterMins.set(access.counter, Math.max(counterMins.get(access.counter) ?? -SAFE, min));
+            narrow(access.ref, { min: -MAX_OFFSET, max: SAFE });
+            if (access.index !== access.ref)
+                narrow(access.index, { min: 0, max: SAFE });
+        }
+    }
+    for (const [receiver, nodes] of pairedKept) {
+        used.add(receiver);
+        for (const node of nodes)
+            bounds.add(node);
+    }
+    const counterChecks = [];
+    for (const [id, min] of counterMins) {
+        const info = whileAccesses.counters.get(id);
+        counterChecks.push({
+            ref: { kind: "varRef", localId: id, type: F64, loc: loop.loc },
+            min,
+            wrapBounds: info.wraps
+                ? info.bounds.map((b) => ({ bound: b.bound, limit: 2 ** 31 - info.sum - b.adj }))
+                : [],
+        });
+    }
     // Renumber the receivers the kept checks use.
     const order = [...used].sort((a, b) => a - b);
     const renumber = new Map(order.map((old, index) => [old, index]));
@@ -357,7 +553,9 @@ export function matchBytesLoopVersion(loop, counted, facts) {
         (counted.range.min < -bound || counted.range.max > bound);
     return {
         bounds,
+        owned: ownedNodes,
         receivers: order.map((index) => receivers[index]),
+        ownedReceivers: ownedKept.map(([receiver]) => renumber.get(receiver)),
         fixed: fixedKept.map((g) => ({
             receiver: renumber.get(g.check.receiver),
             end: g.check.end,
@@ -369,13 +567,279 @@ export function matchBytesLoopVersion(loop, counted, facts) {
             minOffset: g.check.minOffset,
             maxEnd: g.check.maxEnd,
         })),
+        bounded: boundedKept.map((g) => ({
+            receiver: renumber.get(g.check.receiver),
+            bound: g.check.bound,
+            slack: g.check.slack,
+        })),
+        counters: counterChecks,
+        guarded,
         counted: affineKept.length > 0 ? counted : null,
+        paired: paired !== null && pairedKept.length > 0
+            ? { loop: paired, receivers: pairedKept.map(([receiver]) => renumber.get(receiver)) }
+            : null,
         counterBound: needsBound ? bound : null,
         ranges,
     };
 }
+/** `counter = counter + k`, `counter = (counter + k) | 0` or `counter++`. */
+function counterStep(s) {
+    if (s.kind === "exprStmt" && s.expr.kind === "incDec" && s.expr.op === "+")
+        return { id: s.expr.localId, k: 1, wraps: false };
+    if (s.kind !== "assign")
+        return null;
+    let value = s.value, wraps = false;
+    if (value.kind === "bin" &&
+        value.op === "|" &&
+        value.right.kind === "numLit" &&
+        value.right.value === 0 &&
+        value.left.kind === "bin") {
+        value = value.left;
+        wraps = true;
+    }
+    if (value.kind !== "bin" ||
+        value.op !== "+" ||
+        value.left.kind !== "varRef" ||
+        value.left.localId !== s.localId ||
+        value.right.kind !== "numLit" ||
+        !Number.isSafeInteger(value.right.value) ||
+        value.right.value <= 0 ||
+        value.right.value > MAX_OFFSET)
+        return null;
+    return { id: s.localId, k: value.right.value, wraps };
+}
+/** Typed-array and string accesses of a while loop that happen at a
+ * counter below a loop-invariant bound. A counter is a number local that
+ * the loop changes only by positive integer increments, written as
+ * statements of the body, of its blocks and branches, or of nested while
+ * loops. The condition of the loop, an `if` or a `&&` chain that compares
+ * the counter below a bound (`while (pos < end && bytes[pos] === 32)
+ * pos++`, or `s.charCodeAt(pos)` of a string) makes it below that bound
+ * until the next increment on the path. The counter starts at its entry
+ * value and only grows (a `| 0` increment never wraps when every bound is
+ * at most 2^31 minus the increments), so an access at `counter + d` is in
+ * bounds for the whole loop when the entry value is at least `-d` and
+ * `bound + d < length` (`+ 1` for `<=`). */
+function findWhileCounterAccesses(loop, host) {
+    const steps = new Map();
+    const refused = new Set();
+    // Increments count only as statements of the loop's straight-line
+    // structure; any other write refuses the binding.
+    const writes = (list, direct) => {
+        for (const s of list) {
+            const step = counterStep(s);
+            if (step && direct) {
+                const prior = steps.get(step.id);
+                steps.set(step.id, {
+                    sum: (prior?.sum ?? 0) + step.k,
+                    wraps: (prior?.wraps ?? false) || step.wraps,
+                });
+                continue;
+            }
+            if (step)
+                refused.add(step.id);
+            const nested = direct &&
+                (s.kind === "if" || s.kind === "while" || (s.kind === "block" && !s.labels?.length));
+            if (s.kind === "assign" || s.kind === "varDecl" || s.kind === "forOf")
+                refused.add(s.localId);
+            if (s.kind === "tryCatch" && s.catchLocalId)
+                refused.add(s.catchLocalId);
+            everyStmtChild(s, (e) => (exprWrites(e), true), (c) => (writes([c], nested), true));
+        }
+    };
+    const exprWrites = (e) => {
+        if (e.kind === "assignExpr" || e.kind === "incDec")
+            refused.add(e.localId);
+        everyExprChild(e, (c) => (exprWrites(c), true), (c) => (writes([c], false), true));
+    };
+    exprWrites(loop.cond);
+    writes(loop.body, true);
+    const counter = (id) => steps.has(id) && !refused.has(id) && host.counterLocal(id);
+    // The bounds a condition puts on counters while it holds.
+    const facts = (cond, into) => {
+        if (cond.kind === "toBool")
+            return facts(cond.operand, into);
+        if (cond.kind === "logical" && cond.op === "&&") {
+            facts(cond.left, into);
+            facts(cond.right, into);
+            return;
+        }
+        if (cond.kind !== "bin")
+            return;
+        const below = cond.op === "<" || cond.op === "<=", above = cond.op === ">" || cond.op === ">=";
+        const c = below ? cond.left : above ? cond.right : null, bound = below ? cond.right : cond.left;
+        if (c?.kind !== "varRef" || !counter(c.localId) || into.has(c.localId))
+            return;
+        const key = host.boundKey(bound);
+        if (key === null)
+            return;
+        into.set(c.localId, { bound, key, adj: cond.op === "<=" || cond.op === ">=" ? 1 : 0 });
+    };
+    // The facts that hold after either of two paths.
+    const meet = (a, b) => {
+        if (a === null)
+            return b;
+        if (b === null)
+            return a;
+        const out = new Map();
+        for (const [id, fact] of a)
+            if (b.get(id) === fact)
+                out.set(id, fact);
+        return out;
+    };
+    const withFacts = (clean, cond) => {
+        const out = new Map(clean);
+        facts(cond, out);
+        return out;
+    };
+    const accesses = new Map();
+    const record = (node, index, clean) => {
+        let ref = index, offset = 0;
+        if (index.kind === "bin" && (index.op === "+" || index.op === "-")) {
+            const literal = index.right.kind === "numLit" ? index.right : index.op === "+" ? index.left : null;
+            const other = literal === index.right ? index.left : index.right;
+            if (literal?.kind !== "numLit" || !Number.isSafeInteger(literal.value))
+                return;
+            if (Math.abs(literal.value) > MAX_OFFSET || Object.is(literal.value, -0))
+                return;
+            offset = index.op === "-" ? -literal.value : literal.value;
+            ref = other;
+        }
+        if (ref.kind !== "varRef")
+            return;
+        const fact = clean.get(ref.localId);
+        if (fact)
+            accesses.set(node, { counter: ref.localId, index, ref, ...fact, offset });
+    };
+    const expr = (e, clean) => {
+        if (e.kind === "bytesIntrinsic") {
+            const numeric = byteNumberAccess(e);
+            const index = numeric
+                ? e.args[numeric.offsetArg]
+                : e.method === "get"
+                    ? e.args[0]
+                    : undefined;
+            if (index)
+                record(e, index, clean);
+        }
+        if (e.kind === "strIntrinsic" &&
+            (e.method === "charCodeAt" || e.method === "charAt") &&
+            e.args[0])
+            record(e, e.args[0], clean);
+        if (e.kind === "logical" && e.op === "&&") {
+            expr(e.left, clean);
+            expr(e.right, withFacts(clean, e.left));
+            return;
+        }
+        if (e.kind === "ternary") {
+            expr(e.cond, clean);
+            expr(e.then, withFacts(clean, e.cond));
+            expr(e.else_, clean);
+            return;
+        }
+        everyExprChild(e, (c) => (expr(c, clean), true), (c) => (stmts([c], clean), true));
+    };
+    // Walks statements in order; the result is the clean state where the
+    // list falls through, or null when it never does.
+    const stmts = (list, clean) => {
+        let current = clean;
+        for (const s of list) {
+            if (current === null)
+                return null;
+            const step = counterStep(s);
+            if (step) {
+                const next = new Map(current);
+                next.delete(step.id);
+                current = next;
+                continue;
+            }
+            switch (s.kind) {
+                case "if": {
+                    expr(s.cond, current);
+                    const then = stmts(s.then, withFacts(current, s.cond));
+                    const otherwise = stmts(s.else_ ?? [], current);
+                    current = meet(then, otherwise);
+                    break;
+                }
+                case "while": {
+                    // A pass of the nested loop may follow its own increments.
+                    const advanced = new Map(current);
+                    for (const id of writtenCounters(s.body))
+                        advanced.delete(id);
+                    expr(s.cond, advanced);
+                    stmts(s.body, withFacts(advanced, s.cond));
+                    current = advanced;
+                    break;
+                }
+                case "block":
+                    if (!s.labels?.length) {
+                        current = stmts(s.body, current);
+                        break;
+                    }
+                    everyStmtChild(s, (e) => (expr(e, current), true), (c) => (stmts([c], current), true));
+                    break;
+                case "bytesSet":
+                    record(s, s.index, current);
+                    everyStmtChild(s, (e) => (expr(e, current), true), (c) => (stmts([c], current), true));
+                    break;
+                case "break":
+                case "continue":
+                case "return":
+                case "throw":
+                    everyStmtChild(s, (e) => (expr(e, current), true), (c) => (stmts([c], current), true));
+                    current = null;
+                    break;
+                default:
+                    everyStmtChild(s, (e) => (expr(e, current), true), (c) => (stmts([c], current), true));
+                    break;
+            }
+        }
+        return current;
+    };
+    const writtenCounters = (list) => {
+        const out = new Set();
+        const visit = (s) => {
+            const step = counterStep(s);
+            if (step)
+                out.add(step.id);
+            return everyStmtChild(s, () => true, visit);
+        };
+        list.every(visit);
+        return out;
+    };
+    expr(loop.cond, new Map());
+    stmts(loop.body, withFacts(new Map(), loop.cond));
+    // Each counter's bounds: the loop's and those of nested while loops that
+    // advance it.
+    const counters = new Map();
+    const loops = [loop];
+    const collectLoops = (s) => {
+        if (s.kind === "while")
+            loops.push(s);
+        return everyStmtChild(s, () => true, collectLoops);
+    };
+    loop.body.every(collectLoops);
+    for (const [id, step] of steps) {
+        if (!counter(id))
+            continue;
+        let bounds = [];
+        for (const l of loops) {
+            if (l !== loop && !writtenCounters(l.body).has(id))
+                continue;
+            const fact = withFacts(new Map(), l.cond).get(id);
+            if (!fact) {
+                bounds = null;
+                break;
+            }
+            bounds.push({ bound: fact.bound, adj: fact.adj });
+        }
+        counters.set(id, { ...step, bounds });
+    }
+    return { accesses, counters };
+}
 /** Branches to `fast` when every access the version proves is in bounds for
- * every iteration, and to `slow` otherwise (including a counted loop whose
+ * every iteration and every view it proves thread-owned has no shared
+ * storage, and to `slow` otherwise (including a counted loop whose
  * integer form is not established, or a module receiver not yet set). */
 export function emitBytesLoopVersionGuard(host, version, fast, slow) {
     const B = host.B;
@@ -398,8 +862,10 @@ export function emitBytesLoopVersionGuard(host, version, fast, slow) {
         }
         return value;
     });
-    const lengths = receivers.map((receiver) => {
-        const len = emitBytesHeaderLength(host, receiver);
+    const lengths = receivers.map((receiver, index) => {
+        const len = version.receivers[index].string
+            ? emitStringByteLength(host, receiver)
+            : emitBytesHeaderLength(host, receiver);
         if (host.sizeType === "i64")
             return len;
         const wide = B.tmp();
@@ -407,11 +873,55 @@ export function emitBytesLoopVersionGuard(host, version, fast, slow) {
         return wide;
     });
     const conditions = [];
+    // A string's byte length is its UTF-16 length when it is ASCII.
+    version.receivers.forEach(({ string }, index) => {
+        if (string)
+            conditions.push(emitStringAsciiFlag(host, receivers[index]));
+    });
+    for (const index of version.ownedReceivers) {
+        const owned = B.tmp();
+        B.line(`${owned} = icmp eq ptr ${emitBytesSharedStorage(host, receivers[index])}, null`);
+        conditions.push(owned);
+    }
     for (const check of version.fixed) {
         const ok = B.tmp();
         B.line(`${ok} = icmp ugt i64 ${lengths[check.receiver]}, ${check.end}`);
         conditions.push(ok);
     }
+    for (const counter of version.counters) {
+        const value = host.emitExpr(counter.ref);
+        // A counter held as an integer (an int32 slot) is exact already and
+        // needs at most its lower bound tested.
+        const integer = exactInteger(host, value, counter.ref);
+        if (integer && integer.range.max <= SAFE) {
+            if (integer.range.min < counter.min) {
+                const ok = B.tmp();
+                B.line(`${ok} = icmp sge i64 ${widenInteger(host, integer)}, ${counter.min}`);
+                conditions.push(ok);
+            }
+        }
+        else
+            conditions.push(emitExactIntegerTest(host, value.name, counter.min, SAFE).ok);
+        for (const wrap of counter.wrapBounds) {
+            const bound = host.emitExpr(wrap.bound);
+            const boundInteger = exactInteger(host, bound, wrap.bound);
+            if (boundInteger && boundInteger.range.max <= wrap.limit)
+                continue;
+            const ok = B.tmp();
+            B.line(`${ok} = fcmp ole double ${bound.name}, ${f64Lit(wrap.limit)}`);
+            conditions.push(ok);
+        }
+    }
+    for (const check of version.bounded) {
+        // `bound <= length - slack` in doubles: both sides are exact (a length
+        // is below 2^53 and a slack below 2^32), and NaN fails.
+        const bound = host.emitExpr(check.bound).name;
+        const length = B.tmp(), room = B.tmp(), ok = B.tmp();
+        B.line(`${length} = uitofp i64 ${lengths[check.receiver]} to double`);
+        B.line(`${room} = fsub double ${length}, ${f64Lit(check.slack)}`);
+        B.line(`${ok} = fcmp ole double ${bound}, ${room}`);
+        conditions.push(ok);
+    }
     if (counted && version.affine.length > 0) {
         // The first and last counter values, in ascending order. The last value
         // of a non-unit step is exact: `start + ⌊(limit ∓ 1 - start) / step⌋ *
@@ -453,6 +963,14 @@ export function emitBytesLoopVersionGuard(host, version, fast, slow) {
             let base = "0";
             for (const term of check.terms) {
                 const value = host.emitExpr(term.expr);
+                if (version.guarded.has(term.key)) {
+                    const tested = emitExactIntegerTest(host, value.name, GUARDED_TERM.min, GUARDED_TERM.max);
+                    conditions.push(tested.ok);
+                    const sum = B.tmp();
+                    B.line(`${sum} = ${term.sign > 0 ? "add" : "sub"} i64 ${base}, ${tested.integer}`);
+                    base = sum;
+                    continue;
+                }
                 const integer = exactInteger(host, value, term.expr);
                 if (!integer) {
                     // Unreachable: every term has a proven range. Stay checked.
@@ -481,6 +999,25 @@ export function emitBytesLoopVersionGuard(host, version, fast, slow) {
             conditions.push(both);
         }
     }
+    if (version.paired !== null) {
+        // Both counters stay within [lo, hi] (exact integers below 2^53): every
+        // access at either one is in bounds when `lo >= 0` and `hi < length`.
+        const { loop } = version.paired;
+        const [low, high] = [loop.low.start, loop.high.start].map((expr) => {
+            const tested = emitExactIntegerTest(host, host.emitExpr(expr).name, -SAFE, SAFE);
+            conditions.push(tested.ok);
+            return tested.integer;
+        });
+        const nonNegative = B.tmp();
+        B.line(`${nonNegative} = icmp sge i64 ${low}, 0`);
+        conditions.push(nonNegative);
+        for (const receiver of version.paired.receivers) {
+            // Lengths are at most 2^53 elements: a signed comparison is exact.
+            const below = B.tmp();
+            B.line(`${below} = icmp slt i64 ${high}, ${lengths[receiver]}`);
+            conditions.push(below);
+        }
+    }
     let valid = "true";
     for (const cond of conditions) {
         if (valid === "true")