@scriptc/compiler 0.4.2 → 0.4.4

package/dist/ir/int32-slots.js

@@ -1,7 +1,9 @@
 import { analyzeIntegerRanges, INT32_RANGE, NON_NEGATIVE_INT32_RANGE, withinInt32, } from "./integer-ranges.js";
-import { exprFunctionReference, moduleFunctionReferences } from "./function-references.js";
+import { exprFunctionReference, FUNCTION_REFERENCE_KINDS, moduleFunctionReferences, } from "./function-references.js";
+import { eachNodeOfKinds, } from "./node-index.js";
 import { findInitializerBindings, withInitializerBindings } from "./initializer-bindings.js";
-import { everyExprChild, everyStmtChild, everyStmtList, everyTypeChild } from "./traverse.js";
+import { checkableInt32Allocations, int32ArrayGroups, int32ArrayKey, int32ArraySlot, int32ArrayStores, } from "./int32-arrays.js";
+import { everyExprChild, everyStmtChild, everyTypeChild } from "./traverse.js";
 /** The storage slot an array-valued expression reads, as an
  * IrContracts.int32Elements key: a local or parameter
  * (`l:${function}\0${localId}`), a module global (`g:${globalId}`), a class
@@ -151,8 +153,11 @@ export class Int32Slots {
             result.locals = (localId) => this.int32Locals.has(`${fnName}\0${localId}`) || this.int32Locals.has(`\0${localId}`)
                 ? INT32_RANGE
                 : null;
-        if (this.int32Elements.size > 0)
+        if (this.int32Elements.size > 0) {
             result.elements = (arr) => this.hasInt32Elements(fnName, arr);
+            if (this.narrowedReads)
+                result.narrowedReads = true;
+        }
         const params = this.paramFacts.get(fnName);
         if (params)
             result.params =
@@ -212,6 +217,29 @@ export class Int32Slots {
     addInt32Elements(key) {
         this.int32Elements.add(key);
     }
+    dropInt32Elements(key) {
+        return this.int32Elements.delete(key);
+    }
+    hasInt32ElementSlot(key) {
+        return this.int32Elements.has(key);
+    }
+    /** Whether the module has int32 array candidates (the narrowedReads
+     * range fact). */
+    narrowedReads = false;
+    /** Number arrays stored as int32 slots (int32ArrayKey keys: locals and
+     * parameters as `function\0local`, globals as `\0global`): the module's
+     * int32 array candidates whose every stored element, through every
+     * binding that can hold the same array, the fixpoint proved an int32. */
+    int32Arrays = new Set();
+    /** Local number arrays that may hold int32 slots with checked stores: the
+     * candidates whose element stores the fixpoint proved exact integers but
+     * not int32s, allocated only by fills that may be long. A fill of at least
+     * CHECKED_INT32_MIN_LENGTH elements creates one with int32 slots and a
+     * shorter one with doubles. Their elements give no int32 facts; compiled
+     * accesses test the array's kind (once per innermost loop where they can,
+     * backend/llvm/int32-kind-loops.ts), and a store that is not an int32
+     * widens it first (scr_arr_widen_i32). */
+    checkedInt32Arrays = new Set();
     /** Whether every present element of the number array `arr` evaluates to
      * (read inside `fnName`) is an int32. */
     hasInt32Elements(fnName, arr) {
@@ -351,6 +379,7 @@ const DYN_READ_ONLY = new Set([
     "dyn.forInStable",
     "dyn.getOwnPropertyNames",
     "dyn.getPrototype",
+    "dyn.getPrototypeForIdentity",
     "dyn.hasKey",
     "dyn.hasOwn",
     "dyn.in",
@@ -391,6 +420,13 @@ const DYN_READ_ONLY = new Set([
     "error.new",
     "error.newOptions",
     "fs.utimesSync",
+    // Buffer.prototype members read as values: a lookup by key.
+    "buffer.prototypeMember",
+    // Buffer.from(value, offset[, length]) over checked values: an
+    // ArrayBuffer's view after Node's offset and length conversions, or a copy
+    // of a string, array-like or typed array's values.
+    "buffer.poolFromDynOffset",
+    "buffer.poolFromDynRange",
     "insp.dyn",
     "insp.dynS",
     // The dynamic-tier operators run their dyn twins (scr_js_value.c); the
@@ -426,7 +462,58 @@ const DYN_READ_ONLY = new Set([
     "text.decodeStream",
     "worker.new",
 ]);
-function walkFunction(fn, visit) {
+/** The node kinds each walk below reads. */
+const LIB_CALL_KINDS = ["libCall"];
+const CALL_FACT_KINDS = [
+    ...FUNCTION_REFERENCE_KINDS,
+    "virtualCall",
+    "instanceOfValue",
+    "varRef",
+    "assignExpr",
+    "incDec",
+    "classRef",
+    "varDecl",
+    "assign",
+    "forOf",
+];
+const CENSUS_KINDS = [
+    "call",
+    "new",
+    "varRef",
+    "fieldGet",
+    "fieldIncDec",
+    "closure",
+    "classRef",
+    "incDec",
+    "forOf",
+    "tryCatch",
+];
+const DECLARATION_KINDS = ["varDecl"];
+const CANDIDATE_WRITE_KINDS = [
+    "assign",
+    "varDecl",
+    "fieldSet",
+    "return",
+    "call",
+    "new",
+    "assignExpr",
+];
+const CALL_KINDS = ["call", "new"];
+const SLOT_WRITE_KINDS = ["return", "call", "new"];
+const NARROW_WRITE_KINDS = ["assign", "varDecl", "fieldSet", "assignExpr"];
+/** Visits the nodes of `fn` in walk order; with `scan`, only those of its
+ * kinds, read from the module's node index (the visitors must ignore the
+ * other kinds). */
+function walkFunction(fn, scan, visit) {
+    if (scan !== undefined) {
+        eachNodeOfKinds(fn, scan, (node, statement) => {
+            if (statement)
+                visit.stmt?.(node);
+            else
+                visit.expr?.(node);
+        });
+        return;
+    }
     const expr = (e) => {
         visit.expr?.(e);
         return everyExprChild(e, expr, stmt);
@@ -440,7 +527,7 @@ function walkFunction(fn, visit) {
 }
 /** Computes DynamicFieldStores with one walk of every function. Analyses of
  * the same module accept the result so the emitter walks the module once. */
-export function dynamicFieldStores(mod, records = new Map((mod.records ?? []).map((r) => [r.id, r])), unions = new Map((mod.unions ?? []).map((u) => [u.id, u]))) {
+export function dynamicFieldStores(mod, records = new Map((mod.records ?? []).map((r) => [r.id, r])), unions = new Map((mod.unions ?? []).map((u) => [u.id, u])), nodes) {
     const dynTypes = new Map();
     const dynNamed = new Map();
     const dynish = (type) => {
@@ -480,8 +567,13 @@ export function dynamicFieldStores(mod, records = new Map((mod.records ?? []).ma
     };
     const dynWritten = new Set();
     let dynWritesAll = false;
-    for (const fn of mod.functions)
-        walkFunction(fn, {
+    // A store whose key is not a literal names every field: later stores add
+    // nothing, so the walk stops there.
+    const scan = nodes?.scan(LIB_CALL_KINDS);
+    for (const fn of mod.functions) {
+        if (dynWritesAll)
+            break;
+        walkFunction(fn, scan, {
             expr: (e) => {
                 if (dynWritesAll)
                     return;
@@ -496,6 +588,7 @@ export function dynamicFieldStores(mod, records = new Map((mod.records ?? []).ma
                 }
             },
         });
+    }
     return { all: dynWritesAll, names: dynWritten };
 }
 /** The f64 class field families a runtime store through a live dynamic view
@@ -503,6 +596,21 @@ export function dynamicFieldStores(mod, records = new Map((mod.records ?? []).ma
  * another exposed type), and some dynamic store in the program can name the
  * field. */
 export function dynamicallyStoredFamilies(mod, slots, stores) {
+    const records = new Map((mod.records ?? []).map((r) => [r.id, r]));
+    const unions = new Map((mod.unions ?? []).map((u) => [u.id, u]));
+    // A live dyn view (typed-ref capsule) of an instance writes back into
+    // its fields only after a runtime store into the capsule; the commit then
+    // writes every field from the view, which holds the exact snapshot value
+    // of any property no store named. So reaching dynamic code disqualifies
+    // exactly the field names some dynamic store in the program can name.
+    const { all: dynWritesAll, names: dynWritten } = stores ?? dynamicFieldStores(mod, records, unions);
+    const storable = (field) => field.type.kind === "f64" &&
+        !field.name.startsWith("%") &&
+        (dynWritesAll || dynWritten.has(field.name));
+    const families = new Set();
+    // Without a field some store can name, no class is worth exposing.
+    if (!(mod.classes ?? []).some((cls) => cls.fields.some(storable)))
+        return families;
     const classes = new Map((mod.classes ?? []).map((c) => [c.name, c]));
     const children = new Map();
     for (const cls of classes.values())
@@ -524,8 +632,6 @@ export function dynamicallyStoredFamilies(mod, slots, stores) {
         }
         return out;
     };
-    const records = new Map((mod.records ?? []).map((r) => [r.id, r]));
-    const unions = new Map((mod.unions ?? []).map((u) => [u.id, u]));
     const exposedClasses = new Set();
     const seenNamed = new Set();
     let exposeAll = false;
@@ -574,14 +680,8 @@ export function dynamicallyStoredFamilies(mod, slots, stores) {
                 });
         }
     };
-    // A live dyn view (typed-ref capsule) of an instance writes back into
-    // its fields only after a runtime store into the capsule; the commit then
-    // writes every field from the view, which holds the exact snapshot value
-    // of any property no store named. So reaching dynamic code disqualifies
-    // exactly the field names some dynamic store in the program can name.
-    const { all: dynWritesAll, names: dynWritten } = stores ?? dynamicFieldStores(mod, records, unions);
     for (const fn of mod.functions)
-        walkFunction(fn, {
+        walkFunction(fn, undefined, {
             expr: (e) => {
                 const dynResult = DYN_KINDS.has(e.type.kind);
                 const boundary = BOUNDARY_KINDS.has(e.kind);
@@ -604,14 +704,11 @@ export function dynamicallyStoredFamilies(mod, slots, stores) {
                     expose(s.value.type);
             },
         });
-    const families = new Set();
     for (const cls of classes.values()) {
         if (!exposeAll && !exposedClasses.has(cls.name))
             continue;
         for (const field of cls.fields)
-            if (field.type.kind === "f64" &&
-                !field.name.startsWith("%") &&
-                (dynWritesAll || dynWritten.has(field.name)))
+            if (storable(field))
                 families.add(slots.family(cls.name, field.name));
     }
     return families;
@@ -620,7 +717,7 @@ export function dynamicallyStoredFamilies(mod, slots, stores) {
  * the entry, constructors behind class values: `valueEscaped`), through
  * virtual dispatch (`virtualTargets`), or as vtable entries the runtime
  * calls (`runtimeVirtual`: methods of runtime-rooted hierarchies). */
-export function functionCallFacts(mod, classes, subtree) {
+export function functionCallFacts(mod, classes, subtree, nodes) {
     const escaped = new Set(moduleFunctionReferences(mod));
     const virtualTargets = new Set();
     // Virtual dispatch: a `virtualCall` can reach the method's implementation
@@ -652,7 +749,7 @@ export function functionCallFacts(mod, classes, subtree) {
         const count = (map, id) => {
             map.set(id, (map.get(id) ?? 0) + 1);
         };
-        walkFunction(fn, {
+        walkFunction(fn, nodes?.scan(CALL_FACT_KINDS), {
             expr: (e) => {
                 const referenced = exprFunctionReference(e);
                 if (referenced !== undefined)
@@ -695,6 +792,7 @@ export function functionCallFacts(mod, classes, subtree) {
     return { valueEscaped: escaped, virtualTargets, runtimeVirtual };
 }
 export function analyzeInt32Slots(mod, inputs = {}) {
+    const nodes = inputs.nodes;
     const classes = new Map((mod.classes ?? []).map((c) => [c.name, c]));
     const slots = new Int32Slots(classes);
     if (mod.lib)
@@ -723,6 +821,32 @@ export function analyzeInt32Slots(mod, inputs = {}) {
         slots.addInt32Local(key);
     for (const key of contracts?.int32Elements ?? [])
         slots.addInt32Elements(key);
+    // Int32 array candidates (ir/int32-arrays.ts): assumed to hold int32
+    // elements until a store the fixpoint cannot prove drops one, with every
+    // candidate the same array can reach (its group).
+    const arrayCandidates = new Map();
+    const globalArrays = new Set();
+    const arrayKeys = new Set(mod.int32ArrayCandidates ?? []);
+    slots.narrowedReads = arrayKeys.size > 0;
+    for (const key of arrayKeys) {
+        const cut = key.indexOf("\0");
+        if (cut === 0)
+            globalArrays.add(key.slice(1));
+        else {
+            const fnName = key.slice(0, cut);
+            const set = arrayCandidates.get(fnName) ?? new Set();
+            set.add(key.slice(cut + 1));
+            arrayCandidates.set(fnName, set);
+        }
+        slots.addInt32Elements(int32ArraySlot(key));
+    }
+    const arrayGroups = arrayKeys.size > 0 ? int32ArrayGroups(mod, arrayKeys) : null;
+    // Functions that read or write a candidate global.
+    const globalArrayFunctions = new Set();
+    if (arrayGroups)
+        for (const names of arrayGroups.globalReaders.values())
+            for (const name of names)
+                globalArrayFunctions.add(name);
     /* ── candidate fields ── */
     const children = new Map();
     for (const cls of classes.values())
@@ -783,7 +907,7 @@ export function analyzeInt32Slots(mod, inputs = {}) {
     }
     /* ── functions: escapes, parameter and return candidates ── */
     const functions = new Map(mod.functions.map((fn) => [fn.name, fn]));
-    const calls = functionCallFacts(mod, classes, subtree);
+    const calls = functionCallFacts(mod, classes, subtree, nodes);
     const escaped = new Set([...calls.valueEscaped, ...calls.virtualTargets]);
     const virtual = calls.runtimeVirtual;
     const paramKey = (fnName, localId) => `param:${fnName}\0${localId}`;
@@ -846,7 +970,7 @@ export function analyzeInt32Slots(mod, inputs = {}) {
         for (const capture of fn.classCaptures ?? [])
             unstableBoxes.add(boxKey(fn.name, capture.localId));
         const read = new Set();
-        walkFunction(fn, {
+        walkFunction(fn, nodes?.scan(CENSUS_KINDS), {
             expr: (e) => {
                 if (e.kind === "call") {
                     called.add(e.callee);
@@ -958,7 +1082,7 @@ export function analyzeInt32Slots(mod, inputs = {}) {
         let ids = initializedDeclarations.get(fn.name);
         if (ids === undefined) {
             const found = new Set();
-            walkFunction(fn, {
+            walkFunction(fn, nodes?.scan(DECLARATION_KINDS), {
                 stmt: (s) => {
                     if (s.kind === "varDecl" && s.init)
                         found.add(s.localId);
@@ -1032,31 +1156,44 @@ export function analyzeInt32Slots(mod, inputs = {}) {
         }
         return false;
     };
+    const candidateWrites = nodes?.scan(CANDIDATE_WRITE_KINDS);
     const hasCandidateWrite = (fn) => {
+        if (arrayCandidates.has(fn.name))
+            return true;
+        if (globalArrayFunctions.has(fn.name))
+            return true;
         const box = (localId) => slots.hasBox(slots.boxGroup(fn.name, localId));
         const returns = slots.hasReturn(fn.name);
-        return !everyStmtList(fn.body, {
-            stmt: (s) => {
-                if (s.kind === "assign")
-                    return !box(s.localId);
-                if (s.kind === "varDecl")
-                    return s.init === null || !box(s.localId);
-                if (s.kind === "fieldSet") {
-                    const family = slots.family(s.className, s.field);
-                    return !family || !slots.hasFamily(family);
+        let found = false;
+        eachNodeOfKinds(fn, candidateWrites, (node) => {
+            switch (node.kind) {
+                case "assign":
+                    found = box(node.localId);
+                    break;
+                case "varDecl":
+                    found = node.init !== null && box(node.localId);
+                    break;
+                case "fieldSet": {
+                    const family = slots.family(node.className, node.field);
+                    found = !!family && slots.hasFamily(family);
+                    break;
                 }
-                return !(s.kind === "return" && returns);
-            },
-            expr: (e) => {
-                if (e.kind === "call")
-                    return !candidateArgs(functions.get(e.callee), e.args.length, 0);
-                if (e.kind === "new")
-                    return !candidateArgs(functions.get(`%${e.className}.constructor`), e.args.length, 1);
-                if (e.kind === "assignExpr")
-                    return !box(e.localId);
-                return true;
-            },
+                case "return":
+                    found = returns;
+                    break;
+                case "call":
+                    found = candidateArgs(functions.get(node.callee), node.args.length, 0);
+                    break;
+                case "new":
+                    found = candidateArgs(functions.get(`%${node.className}.constructor`), node.args.length, 1);
+                    break;
+                case "assignExpr":
+                    found = box(node.localId);
+                    break;
+            }
+            return !found;
         });
+        return found;
     };
     const provenByFunction = new Map();
     // Each function's parameter and result writes under its latest analysis:
@@ -1071,15 +1208,84 @@ export function analyzeInt32Slots(mod, inputs = {}) {
                 reads(`param:${fn.name}\0${id}`, fn.name);
         // Range facts are consulted only at writes into candidate slots; slots
         // are only ever dropped, so a body without such a write needs none.
-        const ranges = hasCandidateWrite(fn)
+        const candidate = hasCandidateWrite(fn);
+        const ranges = candidate
             ? analyzeIntegerRanges(numeric(fn), slots.facts(fn.name))
             : new Map();
         if (ranges.size > 0)
-            lastWrites.set(fn.name, slotWrites(fn, ranges, functions));
+            lastWrites.set(fn.name, slotWrites(fn, ranges, functions, nodes));
         else
             lastWrites.delete(fn.name);
         const proven = [];
+        // The walk below acts only at writes into candidate slots.
+        if (!candidate) {
+            provenByFunction.set(fn.name, proven);
+            continue;
+        }
         const int32 = (e) => withinInt32(ranges.get(e));
+        // Every element stored into an int32 array candidate must be an int32
+        // under the facts that assume the candidates' own elements are; a
+        // failing store drops its array's element facts, and the function is
+        // analyzed again without them. When every failing store is still an
+        // exact integer under those facts (a counter, `a[i]! + 1`) and the array
+        // is only ever allocated by a fill that may be long
+        // (checkableInt32Allocations), it keeps int32 slots with checked stores
+        // (checkedInt32Arrays), which widen it to doubles in place at the first
+        // store that is not an int32.
+        const locals = arrayCandidates.get(fn.name);
+        let arrays = locals;
+        if (globalArrayFunctions.has(fn.name)) {
+            const both = new Set();
+            if (locals)
+                for (const id of locals)
+                    both.add(id);
+            for (const id of globalArrays)
+                both.add(id);
+            arrays = both;
+        }
+        if (arrays && arrayGroups) {
+            const requeue = (name) => {
+                if (queued.has(name))
+                    return;
+                queued.add(name);
+                queue.push(name);
+            };
+            const params = new Set(fn.params.map((param) => param.localId));
+            for (const [id, values] of int32ArrayStores(fn, arrays)) {
+                const key = int32ArrayKey(fn.name, id);
+                if (!slots.hasInt32ElementSlot(int32ArraySlot(key)) || values.every(int32))
+                    continue;
+                // The array's group drops together: every function reading a
+                // member is analyzed again without its facts.
+                const group = arrayGroups.group.get(key) ?? [key];
+                for (const member of group) {
+                    slots.dropInt32Elements(int32ArraySlot(member));
+                    if (member.startsWith("\0")) {
+                        const names = arrayGroups.globalReaders.get(member);
+                        if (names)
+                            for (const name of names)
+                                requeue(name);
+                    }
+                    else
+                        requeue(member.slice(0, member.indexOf("\0")));
+                }
+                // Checked stores serve a lone local: its allocations are the only
+                // arrays it holds.
+                const checkable = (value) => {
+                    const range = ranges.get(value);
+                    return int32(value) || range != null;
+                };
+                if (group.length === 1 &&
+                    !key.startsWith("\0") &&
+                    !params.has(id) &&
+                    values.every(checkable) &&
+                    checkableInt32Allocations(fn, id))
+                    slots.checkedInt32Arrays.add(key);
+                else
+                    for (const member of group)
+                        reason(`array:${member}`, "an element store is not int32");
+            }
+        }
         // An int32 written into a slot still assumed non-negative: widen the
         // assumption when the value may be negative, and reanalyze its readers.
         const settle = (slot, e) => {
@@ -1125,7 +1331,7 @@ export function analyzeInt32Slots(mod, inputs = {}) {
             else if (dropBox(group, `write in ${fn.name} is not int32`))
                 invalidate(`box:${group}`);
         };
-        walkFunction(fn, {
+        walkFunction(fn, nodes?.scan(CANDIDATE_WRITE_KINDS), {
             stmt: (s) => {
                 if (s.kind === "assign")
                     boxWrite(s.localId, s.value);
@@ -1166,8 +1372,11 @@ export function analyzeInt32Slots(mod, inputs = {}) {
     for (const proven of provenByFunction.values())
         for (const value of proven)
             slots.provenWrites.add(value);
-    const ranged = rangedParameters(slots, functions, retry, numeric, (callee) => readers.get(`ret:${callee}`));
-    narrowSlotRanges(slots, functions, numeric, lastWrites, ranged, (slot) => readers.get(slot));
+    for (const key of arrayKeys)
+        if (slots.hasInt32ElementSlot(int32ArraySlot(key)))
+            slots.int32Arrays.add(key);
+    const ranged = rangedParameters(slots, functions, retry, numeric, (callee) => readers.get(`ret:${callee}`), nodes);
+    narrowSlotRanges(slots, functions, numeric, lastWrites, ranged, (slot) => readers.get(slot), nodes);
     return slots;
 }
 /** Bounds a widened parameter range jumps to: the int32 limits, and the
@@ -1194,7 +1403,7 @@ const widenMax = (max) => WIDEN_MAX.find((bound) => bound >= max) ?? Infinity;
  * other waiting functions) fail their parameters and are analyzed too, so
  * every call site is checked under the final ranges. The facts the main
  * fixpoint proved are fixed here: these ranges only add precision. */
-function rangedParameters(slots, functions, retry, numeric, callersOf) {
+function rangedParameters(slots, functions, retry, numeric, callersOf, nodes) {
     const changed = new Set();
     if (retry.size === 0)
         return changed;
@@ -1277,7 +1486,7 @@ function rangedParameters(slots, functions, retry, numeric, callersOf) {
                     contribute(callee, param.localId, ranges.get(arg) ?? null);
             });
         };
-        walkFunction(fn, {
+        walkFunction(fn, nodes?.scan(CALL_KINDS), {
             expr: (e) => {
                 if (e.kind === "call")
                     args(functions.get(e.callee), e.args, 0);
@@ -1320,7 +1529,7 @@ const sameRange = (a, b) => a.min === b.min && a.max === b.max;
 /** The values one analysis of a function writes into parameter slots of
  * its direct callees and into its own result slot (`param:` and `ret:`
  * keys), joined per slot; null when some write has no proven range. */
-function slotWrites(fn, ranges, functions) {
+function slotWrites(fn, ranges, functions, nodes) {
     const writes = new Map();
     const write = (key, value) => {
         const range = value ? (ranges.get(value) ?? null) : null;
@@ -1336,7 +1545,7 @@ function slotWrites(fn, ranges, functions) {
                 write(`param:${callee.name}\0${param.localId}`, arg);
         });
     };
-    walkFunction(fn, {
+    walkFunction(fn, nodes?.scan(SLOT_WRITE_KINDS), {
         stmt: (s) => {
             if (s.kind === "return")
                 write(`ret:${fn.name}`, s.value);
@@ -1373,7 +1582,7 @@ const NARROW_ROUNDS = 6;
  * function must still prove every write into a field or box slot (whose
  * facts do not change here), or the narrowing is abandoned. Pinned
  * (contract) slots keep their contract range. */
-function narrowSlotRanges(slots, functions, numeric, lastWrites, changed, readersOf) {
+function narrowSlotRanges(slots, functions, numeric, lastWrites, changed, readersOf, nodes) {
     // Every parameter and result slot with a fact, and that fact.
     const proven = new Map();
     const fixed = new Set();
@@ -1434,7 +1643,7 @@ function narrowSlotRanges(slots, functions, numeric, lastWrites, changed, reader
             if (!rangeWithin(range, level))
                 sound = false;
         };
-        walkFunction(fn, {
+        walkFunction(fn, nodes?.scan(NARROW_WRITE_KINDS), {
             stmt: (s) => {
                 if (s.kind === "assign")
                     box(s.localId, s.value);
@@ -1449,7 +1658,7 @@ function narrowSlotRanges(slots, functions, numeric, lastWrites, changed, reader
                     box(e.localId, e.value);
             },
         });
-        return { writes: slotWrites(fn, ranges, functions), sound };
+        return { writes: slotWrites(fn, ranges, functions, nodes), sound };
     };
     const writesByFunction = new Map(lastWrites);
     const join = () => {