@scriptc/compiler 0.4.5 → 0.4.6

package/dist/frontend/shape-inference/analyze.js

@@ -24,7 +24,7 @@
 import * as ts from "../ts7/adapter.js";
 import { isJsSourceFile } from "../program.js";
 import { npmStaticPackageOfPath } from "../npm-static.js";
-import { AtomTable, MODELED_GLOBALS, STRING_METHOD_RESULTS } from "./domain.js";
+import { AtomTable, MODELED_GLOBALS, OBJECT_PROTOTYPE_MEMBERS, STRING_METHOD_RESULTS, } from "./domain.js";
 /** Array.prototype members: other names on an array are own properties. */
 const ARRAY_METHODS = new Set([
     "at",
@@ -67,6 +67,109 @@ const ARRAY_METHODS = new Set([
     "with",
 ]);
 const MAX_STEPS = 20_000_000;
+/** The well-known symbols, static members of `Symbol` (Node 24). */
+const WELL_KNOWN_SYMBOLS = new Set([
+    "asyncDispose",
+    "asyncIterator",
+    "dispose",
+    "hasInstance",
+    "isConcatSpreadable",
+    "iterator",
+    "match",
+    "matchAll",
+    "replace",
+    "search",
+    "species",
+    "split",
+    "toPrimitive",
+    "toStringTag",
+    "unscopables",
+]);
+/** The members String.prototype, Number.prototype and Boolean.prototype
+ * define (Node 24); Object.prototype's come from OBJECT_PROTOTYPE_MEMBERS. */
+const PRIMITIVE_MEMBERS = {
+    string: new Set([
+        "at",
+        "charAt",
+        "charCodeAt",
+        "codePointAt",
+        "concat",
+        "endsWith",
+        "includes",
+        "indexOf",
+        "isWellFormed",
+        "lastIndexOf",
+        "localeCompare",
+        "match",
+        "matchAll",
+        "normalize",
+        "padEnd",
+        "padStart",
+        "repeat",
+        "replace",
+        "replaceAll",
+        "search",
+        "slice",
+        "split",
+        "startsWith",
+        "substr",
+        "substring",
+        "toLocaleLowerCase",
+        "toLocaleUpperCase",
+        "toLowerCase",
+        "toString",
+        "toUpperCase",
+        "toWellFormed",
+        "trim",
+        "trimEnd",
+        "trimStart",
+        "trimLeft",
+        "trimRight",
+        "valueOf",
+        "anchor",
+        "big",
+        "blink",
+        "bold",
+        "fixed",
+        "fontcolor",
+        "fontsize",
+        "italics",
+        "link",
+        "small",
+        "strike",
+        "sub",
+        "sup",
+        "length",
+        "constructor",
+    ]),
+    number: new Set([
+        "toExponential",
+        "toFixed",
+        "toLocaleString",
+        "toPrecision",
+        "toString",
+        "valueOf",
+        "constructor",
+    ]),
+    boolean: new Set(["toString", "valueOf", "constructor"]),
+};
+/** Per-call-site clones of an init factory, at most (SCRIPTC_SHAPE_SITE_CLONES;
+ * 0 turns them off), and the deepest chain of nested clones. */
+const SITE_CLONES = Number(process.env["SCRIPTC_SHAPE_SITE_CLONES"] ?? 64);
+const SITE_CLONE_DEPTH = 4;
+/** The prototypes a string, number or boolean member read reaches. */
+const PRIMITIVE_PROTOTYPES = new Set([
+    "String.prototype",
+    "Number.prototype",
+    "Boolean.prototype",
+    "Object.prototype",
+]);
+function isPrimitivePrototype(a) {
+    return a.kind === "builtin" && a.receiver === undefined && PRIMITIVE_PROTOTYPES.has(a.path ?? "");
+}
+/** The most atoms a value node tracks before it widens to ⊤
+ * (SCRIPTC_SHAPE_WIDEN overrides). */
+const WIDEN_AT = Number(process.env["SCRIPTC_SHAPE_WIDEN"] ?? 32);
 function list(arr) {
     return arr?.nodes ?? [];
 }
@@ -103,7 +206,14 @@ function propertyNameText(name) {
     }
     return null;
 }
+const shortFiles = new Map();
 function shortFile(fileName) {
+    let short = shortFiles.get(fileName);
+    if (short === undefined)
+        shortFiles.set(fileName, (short = shortFileOf(fileName)));
+    return short;
+}
+function shortFileOf(fileName) {
     const norm = fileName.split("\\").join("/");
     const nm = norm.lastIndexOf("/node_modules/");
     if (nm >= 0) {
@@ -130,6 +240,38 @@ function isLoop(node) {
         ts.isWhileStatement(node) ||
         ts.isDoStatement(node));
 }
+/** Whether control can reach the end of `stmts`. False only when every
+ * path ends in a return or throw, or in a `while (true)`, `do … while
+ * (true)` or `for (;;)` loop with no break inside; anything else is
+ * assumed to complete. */
+function canComplete(stmts) {
+    return stmts.every(canCompleteStatement);
+}
+function canCompleteStatement(s) {
+    if (ts.isReturnStatement(s) || ts.isThrowStatement(s))
+        return false;
+    if (ts.isBlock(s))
+        return canComplete(list(s.statements));
+    if (ts.isIfStatement(s))
+        return (s.elseStatement === undefined ||
+            canCompleteStatement(s.thenStatement) ||
+            canCompleteStatement(s.elseStatement));
+    if (ts.isTryStatement(s)) {
+        if (s.finallyBlock !== undefined && !canCompleteStatement(s.finallyBlock))
+            return false;
+        return (canCompleteStatement(s.tryBlock) ||
+            (s.catchClause !== undefined && canCompleteStatement(s.catchClause.block)));
+    }
+    const endless = ((ts.isWhileStatement(s) || ts.isDoStatement(s)) &&
+        s.expression.kind === ts.SyntaxKind.TrueKeyword) ||
+        (ts.isForStatement(s) && s.condition === undefined);
+    return !endless || containsBreak(s);
+}
+/** Whether a break statement occurs in `node`'s body, outside nested
+ * functions. */
+function containsBreak(node) {
+    return (ts.forEachChild(node, (c) => ts.isBreakStatement(c) || (!ts.isFunctionLike(c) && containsBreak(c)) ? true : undefined) === true);
+}
 const LOOP_CALLBACK_METHODS = new Set([
     "map",
     "forEach",
@@ -149,12 +291,22 @@ const LOOP_CALLBACK_METHODS = new Set([
     "replace",
     "replaceAll",
 ]);
-export function analyzeShapes(program, checker) {
-    return new Analyzer(program, checker).run();
+export function analyzeShapes(program, checker, options = {}) {
+    return new Analyzer(program, checker, options.siteClones ?? SITE_CLONES).run();
 }
 class Analyzer {
     program;
     checker;
+    siteCloneLimit;
+    /** locLabel per node: sink reasons and atom labels name the same sites
+     * over and over, and each label reads the file's text for its line. */
+    locLabels = new Map();
+    loc(node) {
+        let label = this.locLabels.get(node);
+        if (label === undefined)
+            this.locLabels.set(node, (label = locLabel(node)));
+        return label;
+    }
     atoms = new AtomTable();
     nodes = [];
     functions = new Map();
@@ -165,6 +317,14 @@ class Analyzer {
     escaped = new Map();
     topWriteNames = new Map();
     topComputedWrites = [];
+    /** Names a write may add to a primitive's prototype chain, or every name
+     * (`primitiveExtensionsAll`). A read of a name the chain lacks reads ⊤
+     * for them as well as undefined. */
+    primitiveExtensions = new Set();
+    primitiveExtensionsAll = false;
+    /** Reads of names a primitive's prototype chain lacks, by name; each
+     * takes ⊤ once a write may add the name. */
+    primitiveReads = new Map();
     fields = new Map();
     elements = new Map();
     top;
@@ -196,8 +356,8 @@ class Analyzer {
      * (JSON.parse revivers, JSON.stringify replacers and toJSON methods),
      * which may run after the call's own handling. */
     repeatingSites = new Set();
-    edgeFor(site, callee) {
-        const ctx = this.siteCtx.get(site);
+    edgeFor(site, callee, args) {
+        const ctx = (args !== undefined ? this.argsFrom.get(args) : undefined) ?? this.siteCtx.get(site);
         this.calls.push({
             caller: ctx?.caller ?? null,
             callee,
@@ -205,11 +365,52 @@ class Analyzer {
             site,
         });
     }
-    constructor(program, checker) {
+    constructor(program, checker, siteCloneLimit) {
         this.program = program;
         this.checker = checker;
+        this.siteCloneLimit = siteCloneLimit;
         this.top = this.atoms.intern("top", () => ({ kind: "top", label: "⊤" }));
     }
+    /** SCRIPTC_DEBUG_SHAPES_PROFILE: where the solver's steps go. */
+    profileReport() {
+        const byNodeLabel = new Map();
+        let atomsTotal = 0;
+        let maxAtoms = 0;
+        let onAtoms = 0;
+        let succ = 0;
+        for (const n of this.nodes) {
+            atomsTotal += n.atoms.size;
+            maxAtoms = Math.max(maxAtoms, n.atoms.size);
+            onAtoms += n.onAtom.length;
+            succ += n.succ.size;
+        }
+        const kinds = new Map();
+        for (const a of this.atoms.atoms)
+            kinds.set(a.kind, (kinds.get(a.kind) ?? 0) + 1);
+        const ctxPerFn = new Map();
+        for (const info of this.functions.values())
+            ctxPerFn.set(info.node, (ctxPerFn.get(info.node) ?? 0) + 1);
+        const topFns = [...ctxPerFn.entries()].sort((a, b) => b[1] - a[1]).slice(0, 15);
+        const lines = [
+            `nodes ${this.nodes.length} atoms ${this.atoms.atoms.length} (${[...kinds].map(([k, v]) => `${k} ${v}`).join(", ")})`,
+            `solve ${this.solveMs.toFixed(0)} ms (nested walks included) checker ${this.checkerMs.toFixed(0)} ms in ${this.checkerCalls} calls`,
+            `node-atom pairs ${atomsTotal} max ${maxAtoms} edges ${succ} listeners ${onAtoms} functions ${this.functions.size} steps ${this.steps}`,
+            ...topFns.map(([n, c]) => `  ${c} contexts: ${locLabel(n)}`),
+            ...[...this.popsByAtom.entries()]
+                .sort((a, b) => b[1] - a[1])
+                .slice(0, 15)
+                .map(([a, c]) => `  ${c} pops: atom ${a.kind} ${a.label}`),
+            ...[...this.popsByNode.entries()]
+                .sort((a, b) => b[1] - a[1])
+                .slice(0, 10)
+                .map(([id, c]) => `  ${c} pops: node ${id} ${this.nodeLabel.get(id) ?? ""} atoms ${this.nodes[id].atoms.size} succ ${this.nodes[id].succ.size} listeners ${this.nodes[id].onAtom.length}`),
+        ];
+        void byNodeLabel;
+        process.stderr.write(lines.map((l) => `[shapes-profile] ${l}\n`).join(""));
+    }
+    profiling = process.env["SCRIPTC_DEBUG_SHAPES_PROFILE"] !== undefined;
+    popsByAtom = new Map();
+    popsByNode = new Map();
     run() {
         for (const sf of this.program.getImplementationSourceFiles()) {
             const name = sf.fileName.split("\\").join("/");
@@ -220,11 +421,15 @@ class Analyzer {
             if (inPackage)
                 this.packageFiles++;
         }
+        // Analysis resolves names and never asks for types: the program it
+        // runs on is usually replaced by the overlay's before lowering.
         for (const sf of this.files)
-            this.checker.prefetchSourceFile(sf);
+            this.checker.prefetchSourceFileSymbols(sf);
         for (const sf of this.files)
             this.moduleBody(sf);
         this.finish();
+        if (this.profiling)
+            this.profileReport();
         return {
             atoms: this.atoms,
             nodes: this.nodes,
@@ -247,6 +452,11 @@ class Analyzer {
             nodeLabel: this.nodeLabel,
             escapedFunctions: this.escapedFunctionCalls,
             protoOf: this.protoOf,
+            fnOfInstance: this.fnOfInstance,
+            declValues: (decl) => this.declValues(decl),
+            classChain: (decl) => this.classChain(decl),
+            branchIfs: this.branchIfs,
+            walkedBranches: this.walkedBranches,
         };
     }
     // ---- value nodes -------------------------------------------------------
@@ -264,7 +474,23 @@ class Analyzer {
         const n = this.nodes[node];
         if (n.atoms.has(atom))
             return;
+        if (n.wide === true) {
+            this.escape(atom, "a value set too large to track");
+            return;
+        }
         n.atoms.add(atom);
+        // Widening: a value set this large is merged code (a utility every
+        // value flows through). It becomes ⊤: its values escape, so the facts
+        // stay sound, and the solver stops multiplying constraints per atom.
+        if (n.atoms.size > WIDEN_AT) {
+            n.wide = true;
+            for (const a of n.atoms)
+                this.escape(a, "a value set too large to track");
+            if (!n.atoms.has(this.top)) {
+                n.atoms.add(this.top);
+                this.worklist.push([node, this.top]);
+            }
+        }
         if (this.traceTop && atom === this.top && !this.topCause.has(node))
             this.topCause.set(node, this.cause ??
                 (new Error().stack ?? "")
@@ -318,6 +544,27 @@ class Analyzer {
      * and which function each `new F()` instance atom belongs to. */
     protoOf = new Map();
     fnOfInstance = new Map();
+    /** Per dictionary atom, the prototypes it was created with (Object.create). */
+    dictProtos = new Map();
+    /** Per object literal atom, the keys it has from its creation: another
+     * key may be absent when read (flow-insensitively, before its write). */
+    literalOwnKeys = new Map();
+    protoReads = new Set();
+    /** Arrays whose elements an index read inside its bounds may still miss:
+     * shrunk (pop, shift, splice, a length write), holey (`new Array(n)`, a
+     * delete, a store at an index that is not proven in bounds or the end). */
+    unsafeArrays = new Set();
+    /** Index reads proven in bounds by their loop (`for (let i = 0; i <
+     * a.length; i++) a[i]`): undefined joins them only if the array turns
+     * out unsafe (finish). */
+    guardedIndexReads = [];
+    boundsMemo = new Map();
+    dictProto(d) {
+        let id = this.dictProtos.get(d);
+        if (id === undefined)
+            this.dictProtos.set(d, (id = this.newNode()));
+        return id;
+    }
     protoAtom(fn) {
         let p = this.protoOf.get(fn);
         if (p === undefined) {
@@ -333,11 +580,93 @@ class Analyzer {
         }
         return p;
     }
+    /** A boolean literal: labeled `boolean` like any boolean, but its
+     * truthiness is known, so `if` statements on it walk one branch. */
+    boolLiteral(value) {
+        return this.atoms.intern(`prim:boolean:${value}`, () => ({
+            kind: "prim",
+            label: "boolean",
+            literal: value,
+        }));
+    }
+    /** The analysis environment a deferred walk restores. */
+    env() {
+        return {
+            ctx: this.ctx,
+            ctxRoot: this.ctxRoot,
+            currentFn: this.currentFn,
+            loopDepth: this.loopDepth,
+        };
+    }
+    inEnv(env, walk) {
+        const saved = this.env();
+        this.ctx = env.ctx;
+        this.ctxRoot = env.ctxRoot;
+        this.currentFn = env.currentFn;
+        this.loopDepth = env.loopDepth;
+        try {
+            walk();
+        }
+        finally {
+            this.ctx = saved.ctx;
+            this.ctxRoot = saved.ctxRoot;
+            this.currentFn = saved.currentFn;
+            this.loopDepth = saved.loopDepth;
+        }
+    }
+    branchIfs = new Set();
+    walkedBranches = new Set();
+    /** Ifs whose branches wait for condition values; at the fixpoint, an
+     * `if` whose condition node stayed empty walks every waiting branch. */
+    pendingIfs = [];
+    /** An `if` walks a branch once a condition value allows it: the then
+     * branch on a value that may be truthy, the else branch on one that may
+     * be falsy. A branch no value allows is never walked, so its effects
+     * (returns, calls, writes) stay out of the facts; the overlay turns it
+     * into a checked internal error. */
+    ifStatement(s) {
+        const cond = this.expr(s.expression);
+        this.branchIfs.add(s);
+        const pending = {
+            s,
+            cond,
+            env: this.env(),
+            thenDone: false,
+            elseDone: s.elseStatement === undefined,
+        };
+        this.pendingIfs.push(pending);
+        this.on(cond, (a) => {
+            if (!pending.thenDone && mayBeTruthy(a))
+                this.walkBranch(pending, "then");
+            if (!pending.elseDone && mayBeFalsy(a))
+                this.walkBranch(pending, "else");
+        });
+    }
+    walkBranch(pending, which) {
+        const branch = which === "then" ? pending.s.thenStatement : pending.s.elseStatement;
+        if (which === "then")
+            pending.thenDone = true;
+        else
+            pending.elseDone = true;
+        this.walkedBranches.add(branch);
+        this.inEnv(pending.env, () => this.stmt(branch));
+    }
     builtin(path, receiver) {
         const key = receiver === undefined ? `builtin:${path}` : `builtin:${path}@${receiver.id}`;
         return this.atoms.intern(key, () => ({ kind: "builtin", label: path, path, receiver }));
     }
+    solveMs = 0;
     solve() {
+        const started = this.profiling ? performance.now() : 0;
+        try {
+            this.solveLoop();
+        }
+        finally {
+            if (this.profiling)
+                this.solveMs += performance.now() - started;
+        }
+    }
+    solveLoop() {
         while (this.worklist.length > 0) {
             if (++this.steps > MAX_STEPS) {
                 this.budgetExceeded = true;
@@ -345,6 +674,10 @@ class Analyzer {
             }
             const [id, atom] = this.worklist.pop();
             const n = this.nodes[id];
+            if (this.profiling) {
+                this.popsByAtom.set(atom, (this.popsByAtom.get(atom) ?? 0) + 1);
+                this.popsByNode.set(id, (this.popsByNode.get(id) ?? 0) + 1);
+            }
             this.cause = id;
             for (const s of n.succ)
                 this.add(s, atom);
@@ -401,6 +734,9 @@ class Analyzer {
     escape(atom, reason) {
         if (atom.kind === "prim" || atom.kind === "top")
             return;
+        // Unknown code may add any member to a primitive's prototype.
+        if (isPrimitivePrototype(atom))
+            this.extendPrimitives(null);
         if (atom.kind === "builtin" && atom.receiver === undefined)
             return;
         if (this.escaped.has(atom))
@@ -459,6 +795,8 @@ class Analyzer {
     }
     /** Property names that untyped code writes on receivers that may be ⊤ (census). */
     noteTopWrite(name, node) {
+        // ⊤ may be a primitive's prototype.
+        this.extendPrimitives(name);
         if (name === null) {
             const first = this.topComputedWrites.length === 0;
             this.topComputedWrites.push(node);
@@ -482,6 +820,47 @@ class Analyzer {
                 this.add(id, this.top);
         }
     }
+    /** A read of a name a primitive's prototype chain lacks: ⊤ as well, now
+     * or once a write may add the name there. */
+    primitiveRead(name, dst) {
+        if (this.primitiveExtensionsAll || this.primitiveExtensions.has(name)) {
+            this.add(dst, this.top);
+            return;
+        }
+        const reads = this.primitiveReads.get(name);
+        if (reads === undefined)
+            this.primitiveReads.set(name, [dst]);
+        else
+            reads.push(dst);
+    }
+    /** A write that may add `name` (any name when null) to String.prototype,
+     * Number.prototype, Boolean.prototype or Object.prototype. */
+    extendPrimitives(name) {
+        if (this.primitiveExtensionsAll)
+            return;
+        if (name === null || name === "__proto__") {
+            this.primitiveExtensionsAll = true;
+            for (const reads of this.primitiveReads.values())
+                for (const dst of reads)
+                    this.add(dst, this.top);
+            this.primitiveReads.clear();
+            return;
+        }
+        if (this.primitiveExtensions.has(name))
+            return;
+        this.primitiveExtensions.add(name);
+        for (const dst of this.primitiveReads.get(name) ?? [])
+            this.add(dst, this.top);
+        this.primitiveReads.delete(name);
+    }
+    /** An operation that may add, replace or remove `name` (any name when
+     * null) on its receiver: a primitive's prototype, or ⊤, which may be one. */
+    prototypeWrite(recv, name) {
+        this.on(recv, (t) => {
+            if (t.kind === "top" || isPrimitivePrototype(t))
+                this.extendPrimitives(name);
+        });
+    }
     // ---- classes ---------------------------------------------------------------
     /** The base class declaration of `decl`, via the checker; null at a
      * builtin base or none; undefined when unresolved. */
@@ -563,7 +942,22 @@ class Analyzer {
         return null;
     }
     // ---- symbols -----------------------------------------------------------------
+    checkerMs = 0;
+    checkerCalls = 0;
+    resolved = new Map();
     resolve(id) {
+        if (this.resolved.has(id))
+            return this.resolved.get(id);
+        const started = this.profiling ? performance.now() : 0;
+        const out = this.resolveUncached(id);
+        if (this.profiling) {
+            this.checkerMs += performance.now() - started;
+            this.checkerCalls++;
+        }
+        this.resolved.set(id, out);
+        return out;
+    }
+    resolveUncached(id) {
         let sym = this.checker.getSymbolAtLocation(id);
         if (sym === undefined)
             return undefined;
@@ -584,7 +978,7 @@ class Analyzer {
             id = this.newNode();
             this.bindings.set(key, id);
             if (this.traceTop)
-                this.nodeLabel.set(id, `binding ${decl.name?.text ?? "?"}@${locLabel(decl)}${this.ctx !== "" ? ` [${this.ctx}]` : ""}`);
+                this.nodeLabel.set(id, `binding ${decl.name?.text ?? "?"}@${this.loc(decl)}${this.ctx !== "" ? ` [${this.ctx}]` : ""}`);
         }
         return id;
     }
@@ -598,6 +992,27 @@ class Analyzer {
             node.end <= root.end;
         return `${inside ? this.ctx : ""}|${this.nodeKey(node)}`;
     }
+    declIndex = null;
+    declValues(decl) {
+        if (this.declIndex === null) {
+            this.declIndex = new Map();
+            for (const [key, id] of this.bindings) {
+                const k = Number(key.slice(key.lastIndexOf("|") + 1));
+                let l = this.declIndex.get(k);
+                if (l === undefined)
+                    this.declIndex.set(k, (l = []));
+                l.push(id);
+            }
+        }
+        const out = new Set();
+        const k = this.nodeKeys.get(decl);
+        if (k === undefined)
+            return out;
+        for (const id of this.declIndex.get(k) ?? [])
+            for (const a of this.nodes[id].atoms)
+                out.add(a);
+        return out;
+    }
     receiverCtx(atom) {
         return atom.kind === "instance" || atom.kind === "class" ? `C${atom.id}` : "";
     }
@@ -607,7 +1022,9 @@ class Analyzer {
         return this.functions.get(`${atom.ctx ?? ""}|${this.nodeKey(atom.node)}`);
     }
     // ---- functions ---------------------------------------------------------------
-    functionInfo(node, ownerClass, ctxArg = "") {
+    /** `lexicalThis`: an arrow's receiver node, for a clone walked away from
+     * the function that encloses the arrow. */
+    functionInfo(node, ownerClass, ctxArg = "", lexicalThis = null) {
         // A nested closure walked inside a clone shares the clone's context.
         const inherit = ctxArg === "" &&
             this.ctxRoot !== null &&
@@ -639,7 +1056,7 @@ class Analyzer {
         const nameNode = fn.name;
         const name = nameNode !== undefined ? (propertyNameText(nameNode) ?? "<computed>") : null;
         const owner = ownerClass !== null ? this.className(ownerClass) : null;
-        const label = `${owner !== null ? `${owner}.` : ""}${name ?? (ts.isConstructorDeclaration(node) ? "constructor" : "<fn>")}@${locLabel(node)}`;
+        const label = `${owner !== null ? `${owner}.` : ""}${name ?? (ts.isConstructorDeclaration(node) ? "constructor" : "<fn>")}@${this.loc(node)}`;
         const info = {
             node,
             ctx,
@@ -648,7 +1065,11 @@ class Analyzer {
             label: ctx === "" ? label : `${label} [${this.ctxLabel(ctx)}]`,
             params,
             rest,
-            thisNode: isArrow && this.currentFn !== null ? this.currentFn.thisNode : this.newNode(),
+            thisNode: isArrow && lexicalThis !== null
+                ? lexicalThis
+                : isArrow && this.currentFn !== null
+                    ? this.currentFn.thisNode
+                    : this.newNode(),
             ret: this.newNode(),
             isArrow,
             isAsync: mods.some((m) => m.kind === ts.SyntaxKind.AsyncKeyword),
@@ -685,7 +1106,7 @@ class Analyzer {
             if (p.dotDotDotToken !== undefined) {
                 const arr = this.atoms.intern(`rest:${this.nodes.length}`, () => ({
                     kind: "array",
-                    label: `rest@${locLabel(p)}`,
+                    label: `rest@${this.loc(p)}`,
                     node: p,
                 }));
                 this.add(this.binding(p), arr);
@@ -694,8 +1115,12 @@ class Analyzer {
         }
         const body = fn.body;
         if (body !== undefined) {
-            if (ts.isBlock(body))
+            if (ts.isBlock(body)) {
                 this.stmts(list(body.statements));
+                // A call that runs off the end of the body returns undefined.
+                if (canComplete(list(body.statements)))
+                    this.add(info.ret, this.prim("undefined"));
+            }
             else
                 this.edge(this.expr(body), info.ret);
         }
@@ -730,7 +1155,7 @@ class Analyzer {
         const p = decl.parent;
         if (p !== undefined && ts.isVariableDeclaration(p) && ts.isIdentifier(p.name))
             return p.name.text;
-        return `<class@${locLabel(decl)}>`;
+        return `<class@${this.loc(decl)}>`;
     }
     classAtoms(decl) {
         const name = this.className(decl);
@@ -769,7 +1194,7 @@ class Analyzer {
             ctx: "",
             root: null,
             walked: true,
-            label: `${label}.${suffix}@${locLabel(decl)}`,
+            label: `${label}.${suffix}@${this.loc(decl)}`,
             params: [],
             rest: -1,
             thisNode: this.newNode(),
@@ -838,7 +1263,9 @@ class Analyzer {
         this.callConstructorChain(decl, instance, args, spread, site);
     }
     callConstructorChain(decl, instance, args, spread, site) {
-        const key = `ctor:${this.nodeKey(decl)}:${instance.id}:${this.nodeKey(site)}`;
+        // The arguments' nodes too: one `new` site walked in several contexts
+        // (receiver classes, per-site clones) passes each context's values.
+        const key = `ctor:${this.nodeKey(decl)}:${instance.id}:${this.nodeKey(site)}:${args.join(",")}`;
         if (this.boundCalls.has(key))
             return;
         this.boundCalls.add(key);
@@ -850,7 +1277,7 @@ class Analyzer {
             this.activate(info);
             this.add(info.thisNode, instance);
             this.bindArgs(info, args, spread);
-            this.edgeFor(site, info);
+            this.edgeFor(site, info, args);
             return;
         }
         const base = this.baseClass(decl);
@@ -894,18 +1321,19 @@ class Analyzer {
         }
     }
     /** Call of a function atom with a receiver node. */
-    callFunction(info, thisNode, args, spread, dst, site) {
+    callFunction(callee, thisNode, args, spread, dst, site) {
         // `() => Object.create(null)` helpers: each call site gets its own
         // dictionary, as if the helper were inlined.
-        if (this.isFactory(info.node)) {
+        if (this.isFactory(callee.node)) {
             const d = this.atoms.intern(`dict:${this.nodeKey(site)}`, () => ({
                 kind: "dictionary",
-                label: `Object.create@${locLabel(site)}`,
+                label: `Object.create@${this.loc(site)}`,
                 node: site,
             }));
             this.add(dst, d);
             return;
         }
+        const info = this.siteClone(callee, site, args) ?? callee;
         this.activate(info);
         const fnNode = info.node;
         const key = `call:${info.ctx}|${this.nodeKey(fnNode)}:${this.nodeKey(site)}:${thisNode ?? -1}:${dst}`;
@@ -925,7 +1353,88 @@ class Analyzer {
         }
         else
             this.edge(info.ret, dst);
-        this.edgeFor(site, info);
+        this.edgeFor(site, info, args);
+    }
+    /** The prototype object of a class declaration (`C.prototype`). */
+    classProto(decl) {
+        return this.atoms.intern(`cproto:${this.nodeKey(decl)}`, () => ({
+            kind: "object",
+            label: `${this.className(decl)}.prototype`,
+            node: decl,
+        }));
+    }
+    /** Per-call-site clones of init factories: a function called from
+     * module initialization (top-level code outside loops, or another such
+     * clone) is analyzed once per call site, so the objects it creates are
+     * one allocation per site (`z.string()` and `z.object(…)` schemas,
+     * valibot's schema literals) instead of one per function. Clones run
+     * at most once, which makes their objects singletons. */
+    siteClones = new Map();
+    /** The site-clone context a literal at `node` is allocated in, or "". */
+    siteCloneCtx(node) {
+        const root = this.ctxRoot;
+        if (!this.ctx.includes("@S") || root === null)
+            return "";
+        const inside = node.getSourceFile() === root.getSourceFile() && node.pos >= root.pos && node.end <= root.end;
+        return inside ? this.ctx : "";
+    }
+    siteClone(info, site, args) {
+        if (this.siteCloneLimit === 0 || info.isGenerator || ts.isSourceFile(info.node))
+            return null;
+        if (ts.isClassLikeDeclaration(info.node))
+            return null;
+        // A function walked in an enclosing clone's or receiver's context reads
+        // and writes that context's bindings of the variables it captures. A
+        // clone is its own context root, so it would resolve them in the
+        // default context instead, and their writes would be lost.
+        if (info.root !== null && info.root !== info.node)
+            return null;
+        // A class's constructor and methods run in receiver contexts of their
+        // own, rooted at each member: inside a clone they too would resolve the
+        // function's bindings in the default context.
+        if (this.declaresClass(info.node))
+            return null;
+        const sc = this.argsFrom.get(args);
+        if (sc === undefined || sc.inLoop || this.forceLoop || this.repeatingSites.has(site))
+            return null;
+        const caller = sc.caller;
+        if (caller === null)
+            return null;
+        // The clone itself, not a closure created inside it (which inherits
+        // its context but may run any number of times).
+        const callerInit = ts.isSourceFile(caller.node) || (caller.ctx.includes("@S") && caller.root === caller.node);
+        if (!callerInit)
+            return null;
+        // A clone inside a clone keys on the whole chain of sites.
+        const chain = caller.ctx.includes("@S") ? caller.ctx.slice(caller.ctx.indexOf("@S")) : "";
+        if (chain.split("@S").length > SITE_CLONE_DEPTH)
+            return null;
+        const ctx = `${info.ctx}${chain}@S${this.nodeKey(site)}`;
+        const existing = this.functions.get(`${ctx}|${this.nodeKey(info.node)}`);
+        if (existing !== undefined)
+            return existing;
+        const count = this.siteClones.get(info.node) ?? 0;
+        if (count >= this.siteCloneLimit)
+            return null;
+        this.siteClones.set(info.node, count + 1);
+        // The clone keeps the function's receiver: an arrow's lexical `this`,
+        // and whatever reaches a function's own `this`, such as the receiver
+        // `bind` supplies.
+        const clone = this.functionInfo(info.node, info.ownerClass, ctx, info.thisNode);
+        if (!clone.isArrow)
+            this.edge(info.thisNode, clone.thisNode);
+        return clone;
+    }
+    classDeclarers = new Map();
+    /** Whether a class declaration or expression is anywhere inside `node`. */
+    declaresClass(node) {
+        let r = this.classDeclarers.get(node);
+        if (r === undefined) {
+            const visit = (n) => ts.isClassLikeDeclaration(n) ? true : ts.forEachChild(n, visit);
+            r = ts.forEachChild(node, visit) === true;
+            this.classDeclarers.set(node, r);
+        }
+        return r;
     }
     factories = new Map();
     isFactory(node) {
@@ -969,7 +1478,7 @@ class Analyzer {
     syntheticArray(site, tag) {
         return this.atoms.intern(`arr:${tag}:${this.nodeKey(site)}`, () => ({
             kind: "array",
-            label: `${tag}[]@${locLabel(site)}`,
+            label: `${tag}[]@${this.loc(site)}`,
             node: site,
         }));
     }
@@ -1013,8 +1522,12 @@ class Analyzer {
             return;
         }
         if (ts.isReturnStatement(s)) {
-            if (s.expression !== undefined && this.currentFn !== null)
+            if (this.currentFn === null)
+                return;
+            if (s.expression !== undefined)
                 this.edge(this.expr(s.expression), this.currentFn.ret);
+            else
+                this.add(this.currentFn.ret, this.prim("undefined"));
             return;
         }
         if (ts.isFunctionDeclaration(s)) {
@@ -1085,7 +1598,7 @@ class Analyzer {
             return;
         }
         if (ts.isThrowStatement(s)) {
-            this.sink(this.expr(s.expression), `thrown at ${locLabel(s)}`);
+            this.sink(this.expr(s.expression), `thrown at ${this.loc(s)}`);
             return;
         }
         if (ts.isImportDeclaration(s) ||
@@ -1097,6 +1610,10 @@ class Analyzer {
             this.expr(s.expression);
             return;
         }
+        if (ts.isIfStatement(s) && this.currentFn !== null) {
+            this.ifStatement(s);
+            return;
+        }
         // Blocks, ifs, switches, labels: walk children, evaluating expressions.
         ts.forEachChild(s, (child) => {
             if (ts.isExpression(child))
@@ -1110,6 +1627,13 @@ class Analyzer {
         const b = this.binding(d);
         if (d.initializer !== undefined)
             this.edge(this.expr(d.initializer), b);
+        else {
+            // `let x;` holds undefined until it is assigned (a for-in/for-of
+            // binding gets its values from the loop).
+            const loop = d.parent?.parent;
+            if (loop === undefined || !(ts.isForOfStatement(loop) || ts.isForInStatement(loop)))
+                this.add(b, this.prim("undefined"));
+        }
         this.bindPattern(d.name, b);
     }
     /** Destructuring: binding elements read from the source node. */
@@ -1168,7 +1692,7 @@ class Analyzer {
             else {
                 this.add(dst, this.top);
                 if (a.kind !== "top")
-                    this.escape(a, `iterated at ${locLabel(site)}`);
+                    this.escape(a, `iterated at ${this.loc(site)}`);
             }
         });
     }
@@ -1178,10 +1702,18 @@ class Analyzer {
         const memo = this.exprMemo.get(key);
         if (memo !== undefined)
             return memo;
-        const id = this.exprUncached(e);
+        let id = this.exprUncached(e);
+        // A member of an optional chain (`a?.b.c`, `f?.()`) is undefined when
+        // the chain short-circuits.
+        if ((e.flags & ts.NodeFlags.OptionalChain) !== 0) {
+            const out = this.newNode();
+            this.edge(id, out);
+            this.add(out, this.prim("undefined"));
+            id = out;
+        }
         this.exprMemo.set(key, id);
         if (this.traceTop && !this.nodeLabel.has(id))
-            this.nodeLabel.set(id, `expr ${e.getText().slice(0, 40).replace(/\s+/g, " ")}@${locLabel(e)}`);
+            this.nodeLabel.set(id, `expr ${e.getText().slice(0, 40).replace(/\s+/g, " ")}@${this.loc(e)}`);
         return id;
     }
     exprUncached(e) {
@@ -1201,8 +1733,9 @@ class Analyzer {
             case ts.SyntaxKind.BigIntLiteral:
                 return this.constNode(this.prim("bigint"));
             case ts.SyntaxKind.TrueKeyword:
+                return this.constNode(this.boolLiteral(true));
             case ts.SyntaxKind.FalseKeyword:
-                return this.constNode(this.prim("boolean"));
+                return this.constNode(this.boolLiteral(false));
             case ts.SyntaxKind.NullKeyword:
                 return this.constNode(this.prim("null"));
             case ts.SyntaxKind.RegularExpressionLiteral:
@@ -1298,18 +1831,23 @@ class Analyzer {
                 const recv = this.expr(target.expression);
                 const name = ts.isPropertyAccessExpression(target) ? target.name.text : null;
                 this.ops.push({ kind: "delete", recv, name, node: e });
+                this.prototypeWrite(recv, name);
             }
             return this.constNode(this.prim("boolean"));
         }
         if (ts.isPrefixUnaryExpression(e) || ts.isPostfixUnaryExpression(e)) {
             const operand = e.operand;
-            this.expr(operand);
-            if (e.operator === ts.SyntaxKind.PlusPlusToken ||
-                e.operator === ts.SyntaxKind.MinusMinusToken)
-                this.assignTo(operand, this.constNode(this.prim("number")));
+            const value = this.expr(operand);
             if (ts.isPrefixUnaryExpression(e) && e.operator === ts.SyntaxKind.ExclamationToken)
                 return this.constNode(this.prim("boolean"));
-            return this.constNode(this.prim("number"));
+            // `+x` is a number (a bigint throws); `-x`, `~x`, `++`/`--` keep a bigint.
+            if (ts.isPrefixUnaryExpression(e) && e.operator === ts.SyntaxKind.PlusToken)
+                return this.constNode(this.prim("number"));
+            const result = this.numericResult([value]);
+            if (e.operator === ts.SyntaxKind.PlusPlusToken ||
+                e.operator === ts.SyntaxKind.MinusMinusToken)
+                this.assignTo(operand, result);
+            return result;
         }
         if (ts.isSpreadElement(e))
             return this.expr(e.expression);
@@ -1317,7 +1855,7 @@ class Analyzer {
             return this.taggedTemplate(e);
         if (ts.isYieldExpression(e)) {
             if (e.expression !== undefined)
-                this.sink(this.expr(e.expression), `yielded at ${locLabel(e)}`);
+                this.sink(this.expr(e.expression), `yielded at ${this.loc(e)}`);
             return this.constNode(this.top);
         }
         if (ts.isMetaProperty(e))
@@ -1343,6 +1881,8 @@ class Analyzer {
                 const arr = this.syntheticArray(id, "arguments");
                 for (const p of fn.params)
                     this.edge(p, this.element(arr));
+                // Arguments past the declared parameters are not tracked.
+                this.add(this.element(arr), this.top);
                 return this.constNode(arr);
             }
         }
@@ -1581,7 +2121,7 @@ class Analyzer {
         let hasComputedKey = false;
         const spreads = [];
         const inPackage = isPackageJsFile(e.getSourceFile());
-        const label = () => `{${keys.slice(0, 6).join(",")}${keys.length > 6 ? ",…" : ""}${keysKnown ? "" : ",…"}}@${locLabel(e)}`;
+        const label = () => `{${keys.slice(0, 6).join(",")}${keys.length > 6 ? ",…" : ""}${keysKnown ? "" : ",…"}}@${this.loc(e)}`;
         // keys first, so the label is complete
         for (const p of list(e.properties)) {
             if (ts.isSpreadAssignment(p)) {
@@ -1600,11 +2140,8 @@ class Analyzer {
             if (!keys.includes(key))
                 keys.push(key);
         }
-        const atom = this.atoms.intern(`obj:${this.nodeKey(e)}`, () => ({
-            kind: "object",
-            label: label(),
-            node: e,
-        }));
+        const sctx = this.siteCloneCtx(e);
+        const atom = this.atoms.intern(sctx === "" ? `obj:${this.nodeKey(e)}` : `obj:${sctx}|${this.nodeKey(e)}`, () => ({ kind: "object", label: label(), node: e, ...(sctx === "" ? {} : { ctx: sctx }) }));
         const n = this.newNode();
         this.add(n, atom);
         for (const p of list(e.properties)) {
@@ -1649,17 +2186,21 @@ class Analyzer {
             else
                 this.edge(value, this.anyField(atom));
         }
+        if (!this.literalOwnKeys.has(atom))
+            this.literalOwnKeys.set(atom, new Set(keys));
         if (!this.siteAtoms.has(atom) && this.siteAtoms.add(atom))
             this.sites.push({
                 atom,
                 node: e,
                 kind: "object",
                 keys: keysKnown ? keys : null,
+                ownKeys: keys,
                 hasAccessor,
                 hasProto,
                 hasComputedKey,
                 spreads,
                 inPackage,
+                ctx: sctx,
             });
         return n;
     }
@@ -1786,10 +2327,12 @@ class Analyzer {
             this.lateCopies.push(call);
     }
     arrayLiteral(e) {
-        const atom = this.atoms.intern(`arr:${this.nodeKey(e)}`, () => ({
+        const sctx = this.siteCloneCtx(e);
+        const atom = this.atoms.intern(sctx === "" ? `arr:${this.nodeKey(e)}` : `arr:${sctx}|${this.nodeKey(e)}`, () => ({
             kind: "array",
-            label: `[]@${locLabel(e)}`,
+            label: `[]@${this.loc(e)}`,
             node: e,
+            ...(sctx === "" ? {} : { ctx: sctx }),
         }));
         const n = this.newNode();
         this.add(n, atom);
@@ -1811,11 +2354,13 @@ class Analyzer {
                 node: e,
                 kind: "array",
                 keys: null,
+                ownKeys: [],
                 hasAccessor: false,
                 hasProto: hasHole,
                 hasComputedKey: false,
                 spreads: [],
                 inPackage: isPackageJsFile(e.getSourceFile()),
+                ctx: sctx,
             });
         return n;
     }
@@ -1837,14 +2382,12 @@ class Analyzer {
             return n;
         }
         if (op >= ts.SyntaxKind.FirstCompoundAssignment && op <= ts.SyntaxKind.LastCompoundAssignment) {
-            this.expr(e.left);
-            this.expr(e.right);
-            const result = this.constNode(op === ts.SyntaxKind.PlusEqualsToken ? this.top : this.prim("number"));
-            if (op === ts.SyntaxKind.PlusEqualsToken) {
-                this.nodes[result].atoms.clear();
+            const lv = this.expr(e.left);
+            const rv = this.expr(e.right);
+            // Arithmetic on bigints answers bigints; `+=` may also concatenate.
+            const result = this.numericResult([lv, rv]);
+            if (op === ts.SyntaxKind.PlusEqualsToken)
                 this.add(result, this.prim("string"));
-                this.add(result, this.prim("number"));
-            }
             this.assignTo(e.left, result);
             return result;
         }
@@ -1885,13 +2428,15 @@ class Analyzer {
                         this.add(n, this.prim("number"));
                     if (a.kind === "top")
                         this.add(n, this.prim("number"));
+                    if (a.kind === "top" || (a.kind === "prim" && a.label === "bigint"))
+                        this.add(n, this.prim("bigint"));
                 };
                 this.on(l, strOrNum);
                 this.on(r, strOrNum);
                 return n;
             }
             default:
-                return this.constNode(this.prim("number"));
+                return this.numericResult([l, r]);
         }
     }
     assignTo(target, value) {
@@ -1899,7 +2444,7 @@ class Analyzer {
         if (ts.isIdentifier(t)) {
             const decl = this.resolve(t);
             if (decl === undefined || decl.getSourceFile().isDeclarationFile) {
-                this.sink(value, `global write at ${locLabel(t)}`);
+                this.sink(value, `global write at ${this.loc(t)}`);
                 return;
             }
             this.edge(value, this.binding(decl));
@@ -1972,8 +2517,22 @@ class Analyzer {
             case "prim":
                 if (name === "length" && a.label === "string")
                     this.add(dst, this.prim("number"));
-                else if (a.label === "string" || a.label === "number" || a.label === "boolean")
-                    this.add(dst, this.builtin(`${a.label}.${name}`, a));
+                else if (a.label === "string" && /^\d+$/.test(name)) {
+                    // An index past the end reads the prototype chain.
+                    this.add(dst, this.prim("string"));
+                    this.add(dst, this.prim("undefined"));
+                    this.primitiveRead(name, dst);
+                }
+                else if (a.label === "string" || a.label === "number" || a.label === "boolean") {
+                    // A name the primitive's prototype chain lacks reads undefined,
+                    // unless the program may add it there.
+                    if (PRIMITIVE_MEMBERS[a.label].has(name) || OBJECT_PROTOTYPE_MEMBERS.has(name))
+                        this.add(dst, this.builtin(`${a.label}.${name}`, a));
+                    else {
+                        this.add(dst, this.prim("undefined"));
+                        this.primitiveRead(name, dst);
+                    }
+                }
                 return;
             case "instance": {
                 const decl = a.node;
@@ -1984,6 +2543,9 @@ class Analyzer {
                     this.unknownKeysInto(a, dst);
                     return;
                 }
+                // Members stored on a class's prototype object after the fact.
+                for (const c of this.classChain(decl))
+                    this.edge(this.field(this.classProto(c), name), dst);
                 const member = this.lookupMember(decl, name, false);
                 if (member?.kind === "method")
                     this.add(dst, this.fnAtom(member.method, this.ownerOf(member.method), this.receiverCtx(a)));
@@ -2004,7 +2566,9 @@ class Analyzer {
             case "class": {
                 const decl = a.node;
                 if (name === "prototype" || name === "name") {
-                    this.add(dst, name === "prototype" ? this.top : this.prim("string"));
+                    // A class's prototype object: members stored on it later
+                    // (`C.prototype.isVector3 = true`) are members of its instances.
+                    this.add(dst, name === "prototype" ? this.classProto(decl) : this.prim("string"));
                     this.fieldInto(a, name, dst);
                     this.unknownKeysInto(a, dst);
                     return;
@@ -2051,8 +2615,10 @@ class Analyzer {
             case "array":
                 if (name === "length")
                     this.add(dst, this.prim("number"));
-                else if (/^\d+$/.test(name))
+                else if (/^\d+$/.test(name)) {
                     this.edge(this.element(a), dst);
+                    this.add(dst, this.prim("undefined"));
+                }
                 else {
                     // A named property, written by name or under an unknown key; an own field shadows a method.
                     if (ARRAY_METHODS.has(name)) {
@@ -2065,8 +2631,17 @@ class Analyzer {
                 }
                 return;
             case "object": {
+                // A read through a class's prototype object (`C.prototype.m`) may
+                // be any member: unknown, as before prototype objects were tracked.
+                if (a.label.endsWith(".prototype") &&
+                    a.node !== undefined &&
+                    ts.isClassLikeDeclaration(a.node))
+                    this.add(dst, this.top);
                 this.edge(this.field(a, name), dst);
                 this.edge(this.anyField(a), dst);
+                const own = this.literalOwnKeys.get(a);
+                if (own !== undefined && !own.has(name) && !OBJECT_PROTOTYPE_MEMBERS.has(name))
+                    this.add(dst, this.prim("undefined"));
                 if (this.namespaceAtoms.has(a) && name !== "exports") {
                     this.loadConstraint(this.field(a, "exports"), name, dst, site);
                 }
@@ -2092,10 +2667,24 @@ class Analyzer {
                     this.add(dst, this.builtin(`object.${name}`, a));
                 return;
             }
-            case "dictionary":
+            case "dictionary": {
                 this.edge(this.anyField(a), dst);
                 this.edge(this.field(a, name), dst);
+                // An absent key reads undefined, or what the prototype has.
+                this.add(dst, this.prim("undefined"));
+                const proto = this.dictProtos.get(a);
+                // Once per dictionary, name and destination: prototype chains can
+                // be cyclic in the analysis (`Object.create(this)`).
+                const key = `${a.id}:${name}:${dst}`;
+                if (proto !== undefined && !this.protoReads.has(key)) {
+                    this.protoReads.add(key);
+                    this.on(proto, (p) => {
+                        if (p.kind !== "prim")
+                            this.loadAtom(p, name, dst, site);
+                    });
+                }
                 return;
+            }
             case "promise":
                 if (name === "then" || name === "catch" || name === "finally")
                     this.add(dst, this.builtin(`promise.${name}`, a));
@@ -2130,8 +2719,16 @@ class Analyzer {
             this.add(dst, this.prim("number"));
         else if (path === "Math" && /^[A-Z0-9_]+$/.test(name))
             this.add(dst, this.prim("number"));
-        else if (path === "Symbol")
-            this.add(dst, this.prim("symbol"));
+        else if (path === "Symbol") {
+            // The well-known symbols are symbols; `Symbol.for` and `Symbol.keyFor`
+            // are functions (a call of a symbol would answer nothing).
+            if (WELL_KNOWN_SYMBOLS.has(name))
+                this.add(dst, this.prim("symbol"));
+            else if (name === "for" || name === "keyFor")
+                this.add(dst, this.builtin(`Symbol.${name}`));
+            else
+                this.add(dst, this.top);
+        }
         else if (path === "Error.instance" || path === "error") {
             if (name === "message" || name === "stack" || name === "name")
                 this.add(dst, this.prim("string"));
@@ -2140,6 +2737,7 @@ class Analyzer {
         }
         else if (a.receiver === undefined &&
             MODELED_GLOBALS.has(path.split(".")[0]) &&
+            !path.endsWith(".instance") &&
             path.split(".").length < 4)
             this.add(dst, this.builtin(`${path}.${name}`));
         else if (path === "RegExp.instance")
@@ -2152,7 +2750,7 @@ class Analyzer {
             switch (a.kind) {
                 case "top":
                     this.noteTopWrite(name, site);
-                    this.sink(value, `stored into ⊤.${name} at ${locLabel(site)}`);
+                    this.sink(value, `stored into ⊤.${name} at ${this.loc(site)}`);
                     return;
                 case "instance": {
                     const member = this.lookupMember(a.node, name, false);
@@ -2174,6 +2772,8 @@ class Analyzer {
                     this.edge(value, this.field(a, name));
                     return;
                 case "array":
+                    if (/^\d+$/.test(name) || name === "length")
+                        this.unsafeArrays.add(a);
                     if (/^\d+$/.test(name))
                         this.edge(value, this.element(a));
                     else if (name !== "length")
@@ -2182,7 +2782,9 @@ class Analyzer {
                 case "prim":
                     return;
                 default:
-                    this.sink(value, `stored into ${a.label} at ${locLabel(site)}`);
+                    if (isPrimitivePrototype(a))
+                        this.extendPrimitives(name);
+                    this.sink(value, `stored into ${a.label} at ${this.loc(site)}`);
             }
         });
     }
@@ -2193,12 +2795,23 @@ class Analyzer {
                     this.add(dst, this.top);
                     return;
                 case "array":
+                    // An index past the end (or a hole) reads undefined, unless the
+                    // loop proves the index in bounds of an array without holes.
+                    this.edge(this.element(a), dst);
+                    if (this.indexInBounds(site))
+                        this.guardedIndexReads.push({ recv: a, dst, done: false });
+                    else
+                        this.add(dst, this.prim("undefined"));
+                    return;
                 case "collection":
                     this.edge(this.element(a), dst);
                     return;
                 case "prim":
-                    if (a.label === "string")
+                    if (a.label === "string") {
                         this.add(dst, this.prim("string"));
+                        if (!this.indexInBounds(site))
+                            this.add(dst, this.prim("undefined"));
+                    }
                     return;
                 case "object":
                 case "dictionary":
@@ -2219,6 +2832,9 @@ class Analyzer {
                     this.lateCopies.push(copy);
                     if (a.kind === "instance" || a.kind === "class")
                         this.add(dst, this.top);
+                    // A key the object does not have reads undefined.
+                    else
+                        this.add(dst, this.prim("undefined"));
                     return;
                 }
                 default:
@@ -2232,12 +2848,14 @@ class Analyzer {
             switch (a.kind) {
                 case "top":
                     this.noteTopWrite(null, site);
-                    this.sink(value, `stored into ⊤[k] at ${locLabel(site)}`);
+                    this.sink(value, `stored into ⊤[k] at ${this.loc(site)}`);
                     return;
                 case "array":
                     // An index, or a named property under an unknown key.
                     this.edge(value, this.element(a));
                     this.edge(value, this.anyField(a));
+                    if (!this.indexInBounds(site) && !isAppendIndex(site))
+                        this.unsafeArrays.add(a);
                     return;
                 case "prim":
                     return;
@@ -2250,7 +2868,9 @@ class Analyzer {
                     return;
                 default:
                     // As a store under a name: a builtin, promise or collection keeps it where it isn't tracked.
-                    this.sink(value, `stored into ${a.label}[k] at ${locLabel(site)}`);
+                    if (isPrimitivePrototype(a))
+                        this.extendPrimitives(null);
+                    this.sink(value, `stored into ${a.label}[k] at ${this.loc(site)}`);
             }
         });
     }
@@ -2309,8 +2929,19 @@ class Analyzer {
             }
             out.push(this.expr(a));
         }
+        // The walk context of this call (one argument list per call site and
+        // context): calls fire during solving, after the walk moved on.
+        this.argsFrom.set(out, {
+            caller: this.currentFn,
+            inLoop: this.loopDepth > 0 || this.forceLoop,
+        });
         return { args: out, spread };
     }
+    /** Per argument list (args()), the calling function and whether the call
+     * is in a loop, in the context the call was walked in. siteCtx keeps
+     * the first context per syntax node, which a site walked in several
+     * contexts (receiver classes, per-site clones) does not determine. */
+    argsFrom = new Map();
     call(e) {
         this.noteSite(e);
         const callee = unparen(e.expression);
@@ -2328,7 +2959,7 @@ class Analyzer {
             }
             else if (base === undefined)
                 for (const a of args)
-                    this.sink(a, `super(...) at ${locLabel(e)}`);
+                    this.sink(a, `super(...) at ${this.loc(e)}`);
             return dst;
         }
         // CommonJS `require("<spec>")` of an analyzed module: its exports (the
@@ -2382,6 +3013,8 @@ class Analyzer {
             }
             if (name !== null)
                 this.ops.push({ kind: "read", recv, name, node: callee });
+            else
+                this.ops.push({ kind: "computedRead", recv, name: null, node: callee });
             // Per receiver atom: the member it resolves to runs with that atom as `this`.
             const member = name;
             this.on(recv, (a) => {
@@ -2416,9 +3049,9 @@ class Analyzer {
                     return;
                 default:
                     for (const x of args)
-                        this.sink(x, `argument of ⊤ call at ${locLabel(site)}`);
+                        this.sink(x, `argument of ⊤ call at ${this.loc(site)}`);
                     if (recv !== null && a.kind === "top")
-                        this.sink(recv, `receiver of ⊤ call at ${locLabel(site)}`);
+                        this.sink(recv, `receiver of ⊤ call at ${this.loc(site)}`);
                     this.add(dst, this.top);
             }
         });
@@ -2447,17 +3080,24 @@ class Analyzer {
                         this.activate(info);
                         this.add(info.thisNode, inst);
                         this.bindArgs(info, args, spread);
-                        this.edge(info.ret, dst);
-                        this.edgeFor(e, info);
+                        // `new` ignores a primitive result (and the undefined of a
+                        // body that runs off its end) and yields the instance.
+                        this.on(info.ret, (r) => {
+                            if (r.kind !== "prim")
+                                this.add(dst, r);
+                        });
+                        this.edgeFor(e, info, args);
                     }
                     return;
                 }
                 case "builtin":
                     this.constructBuiltin(a.path ?? "", args, dst, e);
                     return;
+                case "prim":
+                    return; // `new` of a primitive throws
                 default:
                     for (const x of args)
-                        this.sink(x, `argument of ⊤ constructor at ${locLabel(e)}`);
+                        this.sink(x, `argument of ⊤ constructor at ${this.loc(e)}`);
                     this.add(dst, this.top);
             }
         });
@@ -2471,7 +3111,7 @@ class Analyzer {
             case "WeakSet": {
                 const c = this.atoms.intern(`coll:${this.nodeKey(site)}`, () => ({
                     kind: "collection",
-                    label: `${path}@${locLabel(site)}`,
+                    label: `${path}@${this.loc(site)}`,
                     node: site,
                 }));
                 this.add(dst, c);
@@ -2486,7 +3126,7 @@ class Analyzer {
                 this.add(dst, this.builtin("Error.instance"));
                 return;
             case "Promise": {
-                const p = this.promiseAtom(site, locLabel(site));
+                const p = this.promiseAtom(site, this.loc(site));
                 this.add(this.field(p, "value"), this.top);
                 this.add(dst, p);
                 if (args[0] !== undefined) {
@@ -2505,7 +3145,10 @@ class Analyzer {
                 this.add(dst, this.builtin("RegExp.instance"));
                 return;
             case "Array": {
-                this.add(dst, this.syntheticArray(site, "Array"));
+                const arr = this.syntheticArray(site, "Array");
+                // `new Array(n)` has holes.
+                this.unsafeArrays.add(arr);
+                this.add(dst, arr);
                 return;
             }
             case "Proxy":
@@ -2513,12 +3156,12 @@ class Analyzer {
                 if (args[0] !== undefined)
                     this.ops.push({ kind: "proxy", recv: args[0], name: null, node: site });
                 for (const x of args)
-                    this.sink(x, `argument of new Proxy at ${locLabel(site)}`);
+                    this.sink(x, `argument of new Proxy at ${this.loc(site)}`);
                 this.add(dst, this.top);
                 return;
             default:
                 for (const x of args)
-                    this.sink(x, `argument of new ${path} at ${locLabel(site)}`);
+                    this.sink(x, `argument of new ${path} at ${this.loc(site)}`);
                 this.add(dst, this.top);
         }
     }
@@ -2540,7 +3183,7 @@ class Analyzer {
                 }
                 else if (f.kind === "top" || f.kind === "builtin") {
                     for (const x of cbArgs)
-                        this.sink(x, `argument of ⊤ callback at ${locLabel(site)}`);
+                        this.sink(x, `argument of ⊤ callback at ${this.loc(site)}`);
                     if (ret !== null)
                         this.add(ret, this.top);
                 }
@@ -2548,7 +3191,7 @@ class Analyzer {
         };
         const escapeAll = () => {
             for (const x of args)
-                this.sink(x, `argument of ${path} at ${locLabel(site)}`);
+                this.sink(x, `argument of ${path} at ${this.loc(site)}`);
             this.add(dst, this.top);
         };
         // Methods of builtin receivers.
@@ -2572,6 +3215,8 @@ class Analyzer {
                     case "pop":
                     case "shift":
                     case "at":
+                        if (method !== "at")
+                            this.unsafeArrays.add(recv);
                         this.edge(el, dst);
                         this.add(dst, this.prim("undefined"));
                         return;
@@ -2625,6 +3270,8 @@ class Analyzer {
                     case "toSorted":
                     case "toReversed":
                     case "flat": {
+                        if (method === "splice")
+                            this.unsafeArrays.add(recv);
                         if (method === "filter")
                             callback(0, [el, num, recvN], null);
                         if (method === "sort" || method === "toSorted")
@@ -2679,7 +3326,7 @@ class Analyzer {
                         return;
                 }
                 escapeAll();
-                this.escape(recv, `array.${method} at ${locLabel(site)}`);
+                this.escape(recv, `array.${method} at ${this.loc(site)}`);
                 return;
             }
             if (path.startsWith("string.") || path.startsWith("number.") || path.startsWith("boolean.")) {
@@ -2705,8 +3352,10 @@ class Analyzer {
                 if (method === "test")
                     prim("boolean");
                 else if (method === "exec") {
+                    // The match and its capture groups; a group that did not take part is undefined.
                     const out = this.syntheticArray(site, "exec");
                     this.add(this.element(out), this.prim("string"));
+                    this.add(this.element(out), this.prim("undefined"));
                     this.add(dst, out);
                     prim("null");
                 }
@@ -2715,7 +3364,7 @@ class Analyzer {
                 return;
             }
             if (path.startsWith("promise.")) {
-                const out = this.promiseAtom(site, locLabel(site));
+                const out = this.promiseAtom(site, this.loc(site));
                 const value = this.field(recv, "value");
                 const ret = this.newNode();
                 if (method === "then") {
@@ -2790,7 +3439,7 @@ class Analyzer {
                         for (const p of info.params)
                             this.add(p, this.top);
                         for (const x of args.slice(1))
-                            this.sink(x, `bound argument at ${locLabel(site)}`);
+                            this.sink(x, `bound argument at ${this.loc(site)}`);
                     }
                     this.add(dst, recv);
                     return;
@@ -2886,12 +3535,13 @@ class Analyzer {
                 return;
             case "Object.assign": {
                 this.ops.push({ kind: "assign", recv: arg(0), name: null, node: site });
+                this.prototypeWrite(arg(0), null);
                 this.on(arg(0), (t) => {
                     for (const s of args.slice(1))
                         this.copyFields(s, t, site);
                     if (t.kind === "top")
                         for (const s of args.slice(1))
-                            this.sink(s, `Object.assign into ⊤ at ${locLabel(site)}`);
+                            this.sink(s, `Object.assign into ⊤ at ${this.loc(site)}`);
                 });
                 this.edge(arg(0), dst);
                 return;
@@ -2900,29 +3550,35 @@ class Analyzer {
             case "Object.defineProperties":
             case "Reflect.defineProperty":
                 this.ops.push({ kind: "defineProperty", recv: arg(0), name: null, node: site });
-                this.sink(arg(2), `property descriptor at ${locLabel(site)}`);
-                this.sink(arg(1), `property descriptor at ${locLabel(site)}`);
+                this.prototypeWrite(arg(0), path === "Object.defineProperties" ? null : literalKey(site, 1));
+                this.sink(arg(2), `property descriptor at ${this.loc(site)}`);
+                this.sink(arg(1), `property descriptor at ${this.loc(site)}`);
                 this.edge(arg(0), dst);
                 return;
             case "Object.setPrototypeOf":
             case "Reflect.setPrototypeOf":
                 this.ops.push({ kind: "setPrototypeOf", recv: arg(0), name: null, node: site });
-                this.sink(arg(1), `prototype at ${locLabel(site)}`);
+                this.prototypeWrite(arg(0), null);
+                this.sink(arg(1), `prototype at ${this.loc(site)}`);
                 this.edge(arg(0), dst);
                 return;
             case "Object.create": {
                 const d = this.atoms.intern(`dict:${this.nodeKey(site)}`, () => ({
                     kind: "dictionary",
-                    label: `Object.create@${locLabel(site)}`,
+                    label: `Object.create@${this.loc(site)}`,
                     node: site,
                 }));
+                // Its members are inherited from the prototype argument.
+                this.edge(arg(0), this.dictProto(d));
+                if (args[1] !== undefined)
+                    this.sink(args[1], `property descriptors at ${locLabel(site)}`);
                 this.add(dst, d);
                 return;
             }
             case "Object.fromEntries": {
                 const d = this.atoms.intern(`dict:${this.nodeKey(site)}`, () => ({
                     kind: "dictionary",
-                    label: `fromEntries@${locLabel(site)}`,
+                    label: `fromEntries@${this.loc(site)}`,
                     node: site,
                 }));
                 const pairs = this.newNode();
@@ -2970,7 +3626,7 @@ class Analyzer {
                         if (f.kind === "function")
                             this.callFunction(this.infoOfAtom(f), revived, [this.constNode(this.prim("string")), revived], false, revived, site);
                         else if (f.kind === "top")
-                            this.sink(revived, `JSON.parse reviver at ${locLabel(site)}`);
+                            this.sink(revived, `JSON.parse reviver at ${this.loc(site)}`);
                     });
                 this.edge(revived, dst);
                 return;
@@ -2990,18 +3646,16 @@ class Analyzer {
                         if (f.kind === "function")
                             this.callFunction(this.infoOfAtom(f), serialized, [key, serialized], false, serialized, site);
                         else if (f.kind === "top")
-                            this.sink(serialized, `JSON.stringify replacer at ${locLabel(site)}`);
+                            this.sink(serialized, `JSON.stringify replacer at ${this.loc(site)}`);
                     });
                 prim("string");
                 prim("undefined");
                 return;
             }
             case "Reflect.deleteProperty": {
-                const key = ts.isCallExpression(site) ? unparen(list(site.arguments)[1]) : undefined;
-                const name = key !== undefined && (ts.isStringLiteral(key) || ts.isNoSubstitutionTemplateLiteral(key))
-                    ? key.text
-                    : null;
+                const name = literalKey(site, 1);
                 this.ops.push({ kind: "delete", recv: arg(0), name, node: site });
+                this.prototypeWrite(arg(0), name);
                 prim("boolean");
                 return;
             }
@@ -3019,7 +3673,7 @@ class Analyzer {
                     if (c.kind === "builtin" && c.path === "Proxy")
                         this.ops.push({ kind: "proxy", recv: listed, name: null, node: site });
                 });
-                this.sink(listed, `argument of ${path} at ${locLabel(site)}`);
+                this.sink(listed, `argument of ${path} at ${this.loc(site)}`);
                 escapeAll();
                 return;
             }
@@ -3048,7 +3702,7 @@ class Analyzer {
                 prim("bigint");
                 return;
             case "Promise.resolve": {
-                const p = this.promiseAtom(site, locLabel(site));
+                const p = this.promiseAtom(site, this.loc(site));
                 if (args[0] !== undefined)
                     this.awaitInto(args[0], this.field(p, "value"));
                 else
@@ -3057,17 +3711,17 @@ class Analyzer {
                 return;
             }
             case "Promise.reject": {
-                const p = this.promiseAtom(site, locLabel(site));
+                const p = this.promiseAtom(site, this.loc(site));
                 this.add(dst, p);
                 if (args[0] !== undefined)
-                    this.sink(args[0], `rejection at ${locLabel(site)}`);
+                    this.sink(args[0], `rejection at ${this.loc(site)}`);
                 return;
             }
             case "Promise.all":
             case "Promise.allSettled":
             case "Promise.race":
             case "Promise.any": {
-                const p = this.promiseAtom(site, locLabel(site));
+                const p = this.promiseAtom(site, this.loc(site));
                 const items = this.newNode();
                 if (args[0] !== undefined)
                     this.iterateInto(args[0], items, site);
@@ -3085,7 +3739,7 @@ class Analyzer {
             }
             case "promise.resolver":
                 for (const x of args)
-                    this.sink(x, `promise resolution at ${locLabel(site)}`);
+                    this.sink(x, `promise resolution at ${this.loc(site)}`);
                 return;
         }
         if (path.startsWith("console.")) {
@@ -3107,6 +3761,163 @@ class Analyzer {
         void recvNode;
         escapeAll();
     }
+    /** Whether an index access `x[i]` reads inside the bounds of `x` on
+     * every evaluation: an enclosing `for (let i = <n ≥ 0>; i < x.length;
+     * i++ | ++i | i += <n > 0>)` whose body assigns neither `i` nor `x`.
+     * (The array's own length may still shrink or have holes: unsafeArrays.) */
+    indexInBounds(site) {
+        if (!ts.isElementAccessExpression(site) || site.questionDotToken !== undefined)
+            return false;
+        const memo = this.boundsMemo.get(site);
+        if (memo !== undefined)
+            return memo;
+        const out = this.indexInBoundsUncached(site);
+        this.boundsMemo.set(site, out);
+        return out;
+    }
+    indexInBoundsUncached(site) {
+        const obj = unparen(site.expression);
+        const key = unparen(site.argumentExpression);
+        if (!ts.isIdentifier(obj) || !ts.isIdentifier(key))
+            return false;
+        const objDecl = this.resolve(obj);
+        const keyDecl = this.resolve(key);
+        if (objDecl === undefined || keyDecl === undefined)
+            return false;
+        const names = (id, decl) => ts.isIdentifier(id) && this.resolve(id) === decl;
+        for (let n = site.parent; n !== undefined; n = n.parent) {
+            if (ts.isFunctionLike(n) || ts.isSourceFile(n))
+                return false;
+            if (!ts.isForStatement(n) || n.statement === undefined)
+                continue;
+            if (!(site.pos >= n.statement.pos && site.end <= n.statement.end))
+                continue;
+            const cond = n.condition !== undefined ? unparen(n.condition) : undefined;
+            if (cond === undefined ||
+                !ts.isBinaryExpression(cond) ||
+                cond.operatorToken.kind !== ts.SyntaxKind.LessThanToken ||
+                !names(unparen(cond.left), keyDecl))
+                continue;
+            const bound = unparen(cond.right);
+            if (!ts.isPropertyAccessExpression(bound) ||
+                bound.name.text !== "length" ||
+                !names(unparen(bound.expression), objDecl))
+                continue;
+            // The index starts at a non-negative integer literal ...
+            const init = n.initializer;
+            let start;
+            // (declared by the loop, so only the loop's own code can write it)
+            if (init !== undefined &&
+                ts.isVariableDeclarationList(init) &&
+                (init.flags & (ts.NodeFlags.Let | ts.NodeFlags.Const)) !== 0) {
+                const d = init.declarations.nodes.find((x) => x === keyDecl);
+                start = d !== undefined ? d.initializer : undefined;
+            }
+            if (start === undefined || !nonNegativeIntegerLiteral(start))
+                continue;
+            if (!this.neverReassigned(objDecl))
+                continue;
+            // ... and only grows by integers,
+            const inc = n.incrementor !== undefined ? unparen(n.incrementor) : undefined;
+            const grows = inc !== undefined &&
+                (((ts.isPostfixUnaryExpression(inc) || ts.isPrefixUnaryExpression(inc)) &&
+                    inc.operator === ts.SyntaxKind.PlusPlusToken &&
+                    names(unparen(inc.operand), keyDecl)) ||
+                    (ts.isBinaryExpression(inc) &&
+                        inc.operatorToken.kind === ts.SyntaxKind.PlusEqualsToken &&
+                        names(unparen(inc.left), keyDecl) &&
+                        positiveIntegerLiteral(inc.right)));
+            if (!grows)
+                continue;
+            // ... and the body writes neither the index nor the array binding.
+            let written = false;
+            const visit = (m) => {
+                if (written)
+                    return;
+                if (ts.isBinaryExpression(m) &&
+                    m.operatorToken.kind >= ts.SyntaxKind.FirstAssignment &&
+                    m.operatorToken.kind <= ts.SyntaxKind.LastAssignment &&
+                    (names(unparen(m.left), keyDecl) || names(unparen(m.left), objDecl)))
+                    written = true;
+                else if ((ts.isPostfixUnaryExpression(m) || ts.isPrefixUnaryExpression(m)) &&
+                    (m.operator === ts.SyntaxKind.PlusPlusToken ||
+                        m.operator === ts.SyntaxKind.MinusMinusToken) &&
+                    (names(unparen(m.operand), keyDecl) || names(unparen(m.operand), objDecl)))
+                    written = true;
+                ts.forEachChild(m, (c) => {
+                    visit(c);
+                    return undefined;
+                });
+            };
+            visit(n.statement);
+            if (!written)
+                return true;
+        }
+        return false;
+    }
+    reassignMemo = new Map();
+    /** Whether a binding keeps the value it is declared with: a `const`, or a
+     * parameter or variable that no code in its scope assigns. */
+    neverReassigned(decl) {
+        const memo = this.reassignMemo.get(decl);
+        if (memo !== undefined)
+            return memo;
+        let out = false;
+        if (ts.isVariableDeclaration(decl) || ts.isParameter(decl)) {
+            const list = decl.parent;
+            if (ts.isVariableDeclaration(decl) &&
+                list !== undefined &&
+                ts.isVariableDeclarationList(list) &&
+                (list.flags & ts.NodeFlags.Const) !== 0)
+                out = true;
+            else {
+                let scope = decl.parent;
+                while (scope !== undefined && !ts.isFunctionLike(scope) && !ts.isSourceFile(scope))
+                    scope = scope.parent;
+                if (scope !== undefined && ts.isIdentifier(decl.name)) {
+                    const text = decl.name.text;
+                    let written = false;
+                    const target = (e) => {
+                        const u = unparen(e);
+                        return ts.isIdentifier(u) && u.text === text && this.resolve(u) === decl;
+                    };
+                    const visit = (m) => {
+                        if (written)
+                            return;
+                        if ((ts.isBinaryExpression(m) &&
+                            m.operatorToken.kind >= ts.SyntaxKind.FirstAssignment &&
+                            m.operatorToken.kind <= ts.SyntaxKind.LastAssignment &&
+                            target(m.left)) ||
+                            ((ts.isPostfixUnaryExpression(m) || ts.isPrefixUnaryExpression(m)) &&
+                                (m.operator === ts.SyntaxKind.PlusPlusToken ||
+                                    m.operator === ts.SyntaxKind.MinusMinusToken) &&
+                                target(m.operand)))
+                            written = true;
+                        ts.forEachChild(m, (c) => {
+                            visit(c);
+                            return undefined;
+                        });
+                    };
+                    visit(scope);
+                    out = !written;
+                }
+            }
+        }
+        this.reassignMemo.set(decl, out);
+        return out;
+    }
+    /** The result of arithmetic over the operands: a number, or a bigint
+     * where an operand may be one. */
+    numericResult(operands) {
+        const n = this.newNode();
+        this.add(n, this.prim("number"));
+        for (const o of operands)
+            this.on(o, (a) => {
+                if (a.kind === "top" || (a.kind === "prim" && a.label === "bigint"))
+                    this.add(n, this.prim("bigint"));
+            });
+        return n;
+    }
     /** Re-run deferred field copies until nothing new flows. */
     finish() {
         for (;;) {
@@ -3114,11 +3925,59 @@ class Analyzer {
             for (const c of this.lateCopies)
                 c();
             this.solve();
+            for (const o of this.ops)
+                if (o.kind === "delete" || o.kind === "lengthWrite")
+                    for (const a of this.nodes[o.recv].atoms)
+                        if (a.kind === "array")
+                            this.unsafeArrays.add(a);
+            for (const g of this.guardedIndexReads)
+                if (!g.done && this.unsafeArrays.has(g.recv)) {
+                    g.done = true;
+                    this.add(g.dst, this.prim("undefined"));
+                }
+            this.solve();
+            // A condition with no values at the fixpoint is one the analysis
+            // could not evaluate: walk both of its branches.
+            let walked = false;
+            for (const p of this.pendingIfs) {
+                if (this.nodes[p.cond].atoms.size > 0)
+                    continue;
+                if (!p.thenDone) {
+                    this.walkBranch(p, "then");
+                    walked = true;
+                }
+                if (!p.elseDone) {
+                    this.walkBranch(p, "else");
+                    walked = true;
+                }
+            }
+            if (walked)
+                continue;
             if (this.steps === before || this.budgetExceeded)
                 return;
         }
     }
 }
+function nonNegativeIntegerLiteral(e) {
+    const u = unparen(e);
+    return ts.isNumericLiteral(u) && Number.isInteger(Number(u.text)) && Number(u.text) >= 0;
+}
+function positiveIntegerLiteral(e) {
+    const u = unparen(e);
+    return ts.isNumericLiteral(u) && Number.isInteger(Number(u.text)) && Number(u.text) > 0;
+}
+/** `x[x.length] = v`: a store at the end, which appends without a hole. */
+function isAppendIndex(site) {
+    if (!ts.isElementAccessExpression(site))
+        return false;
+    const obj = unparen(site.expression);
+    const key = unparen(site.argumentExpression);
+    return (ts.isIdentifier(obj) &&
+        ts.isPropertyAccessExpression(key) &&
+        key.name.text === "length" &&
+        ts.isIdentifier(unparen(key.expression)) &&
+        unparen(key.expression).text === obj.text);
+}
 /** The export name of a CommonJS export declaration the checker resolves
  * bindings to: a member of the `module.exports` literal, or the target of
  * `exports.name =` / `module.exports.name =`. */
@@ -3135,4 +3994,30 @@ function cjsExportName(decl) {
         return decl.left.name.text;
     return null;
 }
+/** The string literal a call passes as argument `i`, or null. */
+function literalKey(site, i) {
+    const key = ts.isCallExpression(site) ? list(site.arguments)[i] : undefined;
+    if (key === undefined)
+        return null;
+    const k = unparen(key);
+    return ts.isStringLiteral(k) || ts.isNoSubstitutionTemplateLiteral(k) ? k.text : null;
+}
+/** Whether a value of the atom may be truthy (only `null`, `undefined` and
+ * the literal `false` never are; ⊤ may be anything). */
+function mayBeTruthy(a) {
+    if (a.kind !== "prim")
+        return true;
+    if (a.label === "null" || a.label === "undefined")
+        return false;
+    return a.literal !== false;
+}
+/** Whether a value of the atom may be falsy (objects, arrays, functions,
+ * classes, promises and collections never are). */
+function mayBeFalsy(a) {
+    if (a.kind === "top")
+        return true;
+    if (a.kind !== "prim")
+        return false;
+    return a.literal !== true;
+}
 //# sourceMappingURL=analyze.js.map