@scriptc/compiler 0.4.5 → 0.4.6

package/dist/backend/llvm/classes.js

@@ -1,3 +1,4 @@
+import { ARENA_RC, arenaDisposeLines, arenaDisposeSym, arenaNewLines, disposeFieldLines, plainRefType, } from "./arenas.js";
 import { InternalCompilerError } from "../../errors.js";
 import { isRefCounted, RUNTIME_EMITTER_CLASS, RUNTIME_EVENT_CLASS, RUNTIME_EVENT_TARGET_CLASS, RUNTIME_ERROR_CLASSES, RUNTIME_STREAM_CLASSES, classValueConstructor, } from "../../ir/ir.js";
 import { streamRooted, undefinedArmTag } from "../../ir/analysis.js";
@@ -6,7 +7,7 @@ import { cycTypeDescriptor, emitObjectAlloc, emitObjectFree } from "./alloc.js";
 import { llvmCommentText } from "./common.js";
 import { INLINE_UNION_FIELD } from "./inline-unions.js";
 import { NullableRefFields } from "./nullable-fields.js";
-import { cycleRootLines, traceFieldVisitLines, FN_ATTRS, cycleDeadLines, destroyDefinitions, directChildReleaseLines, directDestroyTarget, segmentPrologueLines, segmentTeardownLines, segmentedTeardown, usedDirectTargets, llFieldType, releaseBody, releaseFastPath, needsBoundedRelease, releaseSym, retainBody, traceAdapter, youngEntryLines, } from "./shapes.js";
+import { cycleRootLines, traceFieldVisitLines, FN_ATTRS, cycleDeadLines, destroyDefinitions, directChildReleaseLines, directDestroyTarget, segmentPrologueLines, segmentTeardownLines, iterativeTeardownDefinitions, segmentedTeardown, usedDirectTargets, llFieldType, releaseBody, releaseFastPath, needsBoundedRelease, releaseSym, retainBody, traceAdapter, youngEntryLines, arrElemInit, } from "./shapes.js";
 /** Per-class node of the class graph. */
 export class LlClassMeta {
     def;
@@ -29,7 +30,9 @@ export class LlClassMeta {
      * a vtable word, the rc word holds the class id (classIdRcWord) in its
      * high 32 bits (CLASS_ID_OFFSET) and the reference count in its low 32
      * bits, and the hierarchy's vtables are one array indexed by the id
-     * (mangleVtArray). */
+     * (mangleVtArray). A standalone class that is an arm of a class union
+     * (nullable-unions.ts taggedClasses) keeps its id the same way, without
+     * vtables. */
     idInRc = false;
     /** A ProgramLifetime class with the 32-bit header (assignCompactLayouts):
      * the i32 at offset 0 is compactHeaderWord, with the class id in place of
@@ -44,6 +47,11 @@ export class LlClassMeta {
      * a compact class instance as a 32-bit index (COMPACT_REF) rather than a
      * pointer: compactRefLoadLines decodes it, compactRefStoreLines encodes it. */
     compressed = [];
+    /** Compact classes with an inline array field (ir/inline-arrays.ts): the
+     * field's slot holds the element count as an i32, and the elements follow
+     * the fixed fields as 32-bit references from `tailOffset`, the same offset
+     * in every class of the declaring class's subtree. Absent otherwise. */
+    inlineTail;
     constructor(def) {
         this.def = def;
         this.root = this;
@@ -55,7 +63,7 @@ export class LlClassMeta {
  * slots — a class's method gets a slot iff no ancestor declares it AND some
  * strict descendant redeclares it (whole-program devirtualization).
  * The preorder intervals also identify runtime class membership. */
-export function buildClassGraph(mod, fnByName, sizeType = "i64") {
+export function buildClassGraph(mod, fnByName, sizeType = "i64", tagged = new Set()) {
     const metaMap = new Map();
     for (const cls of mod.classes ?? []) {
         const meta = new LlClassMeta(cls);
@@ -88,7 +96,10 @@ export function buildClassGraph(mod, fnByName, sizeType = "i64") {
     // EventEmitter, EventTarget, Event and the streams) and 32-bit targets
     // have no spare half in the rc word: those keep the vtable word.
     for (const meta of metaMap.values())
-        meta.idInRc = sizeType === "i64" && meta.hierarchy && meta.root.def.runtime !== true;
+        meta.idInRc =
+            sizeType === "i64" &&
+                (meta.hierarchy || tagged.has(meta.def.name)) &&
+                meta.root.def.runtime !== true;
     const slotRoots = new Set();
     for (const key of mod.threadSlotKeys ?? []) {
         const meta = metaMap.get(key);
@@ -273,12 +284,33 @@ function runtimePrefixOf(meta) {
  * on classes rooted at a runtime base, then the stream-state slot on
  * stream-rooted ones. */
 function headerEnd(meta) {
+    if (meta.def.arrayElem !== undefined)
+        return ARRAY_PREFIX.length + 1;
     if (!meta.hierarchy || meta.idInRc)
         return 1;
     if (streamRooted(meta))
         return 5;
     return runtimePrefixOf(meta) ? 4 : 2;
 }
+/** The array header a class declared `extends Array` begins with, after
+ * the size_t reference count: %ScrArr's len, cap, elem, cyc, spare, filled
+ * and data (scr_array.h). */
+const ARRAY_PREFIX = ["i32", "i32", "i8", "i8", "i16", "i32", "ptr"];
+/** LLVM `c"..."` text of a string's UTF-8 bytes and a terminating NUL. */
+function nulTerminatedBytes(text) {
+    let out = "";
+    for (const byte of Buffer.from(text, "utf8"))
+        out +=
+            byte >= 0x20 && byte < 0x7f && byte !== 0x22 && byte !== 0x5c
+                ? String.fromCharCode(byte)
+                : `\\${byte.toString(16).padStart(2, "0").toUpperCase()}`;
+    return out + "\\00";
+}
+/** The class descriptor (ScrArrClass: name, destroy) of a class declared
+ * `extends Array`. */
+export function arrayClassDescriptor(className) {
+    return `@${mangleClassStruct(className)}.arrcls`;
+}
 /** The GEP index of the ThreadSlots slot word (an i32) in a class whose
  * hierarchy holds ThreadSlots keys: right after the header words, so every
  * member of the hierarchy has it at the same offset. */
@@ -304,6 +336,10 @@ export function classFieldIndex(meta, field, refs = "pointer") {
     const idx = meta.def.fields.findIndex((f) => f.name === field);
     if (idx < 0)
         throw new InternalCompilerError(`llvm emitter bug: unknown field ${field} on class ${meta.def.name}`);
+    // An inline array field's slot holds its element count: its reads and
+    // writes go through inline-arrays.ts.
+    if (meta.inlineTail?.field === idx && meta.compact)
+        throw new InternalCompilerError(`llvm emitter bug: field slot of the inline array field ${meta.def.name}.${field}`);
     const compressed = meta.compressed[idx] === true;
     // Callers that read or write a field's storage as a pointer must not see
     // a compressed one; callers that decode and encode pass "compressed".
@@ -338,7 +374,9 @@ function slotForgetLines(host, struct, meta, tag) {
  * hierarchy folds away. The cycle analysis leaves the hierarchy untraced, so
  * no trace adapter ever visits an instance (as for every untraced class). */
 export function programLifetimeClass(host, meta) {
-    return host.programLifetime?.has(meta.root.def.name) === true && meta.root.def.runtime !== true;
+    return (host.programLifetime?.has(meta.root.def.name) === true &&
+        meta.root.def.runtime !== true &&
+        meta.root.def.arrayElem === undefined);
 }
 /** The reference count a program-lifetime instance is created with: the
  * midpoint of the size_t range (2^63, or 2^31 on 32-bit targets).
@@ -416,19 +454,35 @@ export function classIdLoadLines(meta, obj, id, group) {
  * keeps it there (LlClassMeta.idInRc): the high half of the little-endian
  * 64-bit word. The count is the i32 at offset 0. */
 export const CLASS_ID_OFFSET = 4;
+/** The bound on layout ids (scr_rc.h SCR_RC_LAYOUT_ID_LIMIT): the high
+ * half of a 64-bit rc word keeps the layout id in its low 30 bits, beside
+ * the program-lifetime and frozen bits. A class id is the layout id of its
+ * class's canonical layout. */
+export const LAYOUT_ID_LIMIT = 0x3fffffff;
 /** The rc word an LlClassMeta.idInRc instance is created with: the class
  * id, its preorder number plus 1, in the high 32 bits, and in the low 32 bits
  * a count of 1, or for a program-lifetime instance the midpoint of the 32-bit
- * count (as programLifetimeRc is of the 32-bit word). The id is never 0,
- * 0x80000000 or 0xffffffff, the high halves of other objects' rc words, so
- * the runtime can tell an object with a class id (scr_rc.h scr_rc_class_id). */
+ * count (as programLifetimeRc is of the 32-bit word). The id is a layout id
+ * (LAYOUT_ID_LIMIT), so it never sets the program-lifetime or frozen bit
+ * and the runtime reads it back (scr_rc.h scr_rc_layout_id). */
 export function classIdRcWord(meta, lifetime) {
+    if (meta.pre + 1 >= LAYOUT_ID_LIMIT)
+        throw new InternalCompilerError(`class id ${meta.pre + 1} is not a layout id`);
     return (BigInt(meta.pre + 1) * 2n ** 32n + (lifetime ? 2n ** 31n : 1n)).toString();
 }
+/** The rc word of an immortal LlClassMeta.idInRc instance (a frame
+ * object): the class id in the high half and the immortal count, all ones,
+ * in the low half, which scr_rc_immortal reads as immortal. */
+export function classIdImmortalRcWord(meta) {
+    if (meta.pre + 1 >= LAYOUT_ID_LIMIT)
+        throw new InternalCompilerError(`class id ${meta.pre + 1} is not a layout id`);
+    return (BigInt(meta.pre + 1) * 2n ** 32n + 0xffffffffn).toString();
+}
 /** The 32-bit header of a compact class instance (LlClassMeta.compact):
  * COMPACT_HEADER_TAG, the class id (classIdRcWord's preorder number + 1, 0
- * outside a hierarchy) in the low 28 bits, and COMPACT_PUBLISHED once
- * publication marks the object. No other object's count reaches
+ * for a class without LlClassMeta.idInRc) in the low 28 bits, and
+ * COMPACT_PUBLISHED once publication marks the object. No other object's
+ * count reaches
  * 0x70000000, so the runtime reads a word of 0xf0000000 and up as published
  * for every object (scr_rc.h SCR_RC_PUBLISHED). */
 export const COMPACT_HEADER_TAG = 0x70000000;
@@ -446,7 +500,7 @@ export function storedHeaderBytes(meta) {
 }
 /** The header word a compact instance is created with. */
 export function compactHeaderWord(meta) {
-    return COMPACT_HEADER_TAG | (meta.hierarchy ? meta.pre + 1 : 0);
+    return COMPACT_HEADER_TAG | (meta.idInRc ? meta.pre + 1 : 0);
 }
 /** Lines that decode the 32-bit reference `idx` (an i32) of a compressed
  * field into the pointer `out`. The program-lifetime region lies below
@@ -547,10 +601,13 @@ export function classFieldTypes(host, cls, int32) {
  * cache line; then the other fields, widest first. So 32-bit and smaller
  * fields share 8-byte words. The struct lists the header and the fields by
  * offset, which LLVM's layout of the type reproduces (checked). */
-export function assignCompactLayouts(metaMap, compact, fieldTypes, compressedRef) {
+export function assignCompactLayouts(metaMap, compact, fieldTypes, compressedRef, inlineArrays) {
     const isCompact = (className) => {
         const target = metaMap.get(className);
-        return target !== undefined && target.def.runtime !== true && compact(target.root);
+        return (target !== undefined &&
+            target.def.runtime !== true &&
+            target.root.def.arrayElem === undefined &&
+            compact(target.root));
     };
     const byPre = [...metaMap.values()].sort((a, b) => a.pre - b.pre);
     for (const meta of byPre) {
@@ -570,7 +627,17 @@ export function assignCompactLayouts(metaMap, compact, fieldTypes, compressedRef
         const compressed = meta.def.fields.map((_, i) => i < baseCount
             ? base.compressed[i]
             : compressedRef !== undefined && compressedRef(meta.def, i, isCompact));
+        // An inline array field (ir/inline-arrays.ts) whose elements are compact
+        // keeps its element count in its slot.
+        const inline = inlineArrays?.get(meta.def.name);
+        const inlineField = inline !== undefined && isCompact(inline.elemClass) && isCompact(inline.declaringClass)
+            ? inline.fieldIndex
+            : -1;
         const types = fieldTypes(meta.def).map((t, i) => {
+            if (i === inlineField) {
+                compressed[i] = false;
+                return "i32";
+            }
             if (!compressed[i])
                 return t;
             if (t !== "ptr")
@@ -616,6 +683,46 @@ export function assignCompactLayouts(metaMap, compact, fieldTypes, compressedRef
         meta.compactSlots = slots;
         meta.compressed = compressed;
     }
+    if (inlineArrays !== undefined)
+        assignInlineTails(metaMap, inlineArrays);
+}
+/** Gives each compact class of an inline array field's subtree its tail
+ * (LlClassMeta.inlineTail): the elements start after the largest fixed part
+ * of any class in the subtree, so that a read through any static type of
+ * the subtree finds them at the same offset. */
+function assignInlineTails(metaMap, inlineArrays) {
+    const subtrees = new Map();
+    for (const [name, plan] of inlineArrays) {
+        const meta = metaMap.get(name);
+        if (meta === undefined || !meta.compact)
+            continue;
+        // The layout gave the field its i32 count only when the elements are
+        // compact (assignCompactLayouts).
+        const slot = meta.compactSlots[plan.fieldIndex];
+        if (slot === undefined || meta.compactElems[slot]?.type !== "i32")
+            continue;
+        const members = subtrees.get(plan.declaringClass);
+        if (members === undefined)
+            subtrees.set(plan.declaringClass, [meta]);
+        else
+            members.push(meta);
+    }
+    for (const members of subtrees.values()) {
+        let end = 0;
+        for (const meta of members)
+            for (const e of meta.compactElems)
+                end = Math.max(end, e.offset + e.size);
+        const tailOffset = alignTo(end, 4);
+        for (const meta of members) {
+            const plan = inlineArrays.get(meta.def.name);
+            meta.inlineTail = {
+                field: plan.fieldIndex,
+                tailOffset,
+                elemClass: plan.elemClass,
+                lengthArg: plan.lengthArg,
+            };
+        }
+    }
 }
 function alignTo(n, align) {
     return Math.ceil(n / align) * align;
@@ -625,6 +732,13 @@ function sameFieldPrefix(base, cls) {
         base.fields.every((f, i) => cls.fields[i].name === f.name));
 }
 function undefFieldInits(host, meta, nullable) {
+    return classUndefinedFieldInits(host, meta, nullable, "%o", "%uf");
+}
+/** The stores that start an instance's union and dyn fields at undefined,
+ * for the instance at `object`, with temporaries named `<prefix><index>`
+ * and `<prefix>v<index>`. A nullable-pointer field's zeroed slot already is
+ * its unit arm. */
+export function classUndefinedFieldInits(host, meta, nullable, object, prefix) {
     const out = [];
     meta.def.fields.forEach((f, i) => {
         // Error.cause uses NULL for absence; an options constructor installs
@@ -634,6 +748,9 @@ function undefFieldInits(host, meta, nullable) {
         // A nullable-pointer field's zeroed slot already is its unit arm.
         if (nullable?.get(meta.def.name, f.name))
             return;
+        // An inline array field's slot holds its count, which `new` stores.
+        if (meta.inlineTail?.field === i && meta.compact)
+            return;
         // Only union and dyn fields get a store here; a compressed field is a
         // class reference, which starts NULL.
         const { index, compressed } = classFieldIndex(meta, f.name, "compressed");
@@ -644,12 +761,12 @@ function undefFieldInits(host, meta, nullable) {
             const tag = undefinedArmTag(f.type, host.unionsById);
             if (tag < 0)
                 return;
-            out.push(`  %uf${i} = getelementptr inbounds %${mangleClassStruct(meta.def.name)}, ptr %o, i64 0, i32 ${index}, i32 0`, `  store i32 ${tag}, ptr %uf${i} ; ${llvmCommentText(f.name)} starts undefined`);
+            out.push(`  ${prefix}${i} = getelementptr inbounds %${mangleClassStruct(meta.def.name)}, ptr ${object}, i64 0, i32 ${index}, i32 0`, `  store i32 ${tag}, ptr ${prefix}${i} ; ${llvmCommentText(f.name)} starts undefined`);
             return;
         }
         if (f.type.kind === "dyn") {
             host.declare("declare ptr @scr_dyn_undefined()");
-            out.push(`  %ufv${i} = call ptr @scr_dyn_undefined()`, `  %uf${i} = getelementptr inbounds %${mangleClassStruct(meta.def.name)}, ptr %o, i64 0, i32 ${index}`, `  store ptr %ufv${i}, ptr %uf${i} ; ${llvmCommentText(f.name)} starts undefined`);
+            out.push(`  ${prefix}v${i} = call ptr @scr_dyn_undefined()`, `  ${prefix}${i} = getelementptr inbounds %${mangleClassStruct(meta.def.name)}, ptr ${object}, i64 0, i32 ${index}`, `  store ptr ${prefix}v${i}, ptr ${prefix}${i} ; ${llvmCommentText(f.name)} starts undefined`);
             return;
         }
         if (f.type.kind !== "union")
@@ -657,7 +774,7 @@ function undefFieldInits(host, meta, nullable) {
         const tag = undefinedArmTag(f.type, host.unionsById);
         if (tag < 0)
             return;
-        out.push(`  %uf${i} = getelementptr inbounds %${mangleClassStruct(meta.def.name)}, ptr %o, i64 0, i32 ${index}`, `  store ptr ${host.unitInstanceRef(f.type.unionId, tag)}, ptr %uf${i} ; ${llvmCommentText(f.name)} starts undefined`);
+        out.push(`  ${prefix}${i} = getelementptr inbounds %${mangleClassStruct(meta.def.name)}, ptr ${object}, i64 0, i32 ${index}`, `  store ptr ${host.unitInstanceRef(f.type.unionId, tag)}, ptr ${prefix}${i} ; ${llvmCommentText(f.name)} starts undefined`);
     });
     return out;
 }
@@ -697,13 +814,15 @@ export function emitClassShapes(host, mod, metaMap, nullable, int32) {
         // ScrEmitter* / ScrStream* / ScrEventTargetObj* / ScrEventObj* are the
         // usual pointer reinterprets.
         const runtimePrefix = runtimePrefixOf(meta);
-        const prefix = meta.hierarchy && !meta.idInRc
-            ? streamRooted(meta)
-                ? ["ptr", "ptr", "ptr", "ptr"]
-                : runtimePrefix
-                    ? ["ptr", "ptr", "ptr"]
-                    : ["ptr"]
-            : [];
+        const prefix = cls.arrayElem !== undefined
+            ? ARRAY_PREFIX
+            : meta.hierarchy && !meta.idInRc
+                ? streamRooted(meta)
+                    ? ["ptr", "ptr", "ptr", "ptr"]
+                    : runtimePrefix
+                        ? ["ptr", "ptr", "ptr"]
+                        : ["ptr"]
+                : [];
         const members = [...prefix, ...(meta.threadSlot ? ["i32"] : []), ...fieldTys];
         typeDefs.push(`%${mangleClassStruct(cls.name)} = type { ${host.sizeType}${members.length ? ", " + members.join(", ") : ""} } ` +
             `; class ${cls.name}${meta.idInRc ? " (class id in rc)" : meta.hierarchy ? " (vt at 1)" : ""}${streamRooted(meta) ? " (ScrStream prefix at 2)" : runtimePrefix ? ` (${runtimePrefix.struct} prefix at 2)` : ""} { ${cls.fields.map((f) => llvmCommentText(f.name)).join("; ")} }`);
@@ -746,7 +865,7 @@ export function emitClassShapes(host, mod, metaMap, nullable, int32) {
     // instance is the element at its number minus the root's.
     for (const name of roots) {
         const root = metaMap.get(name);
-        if (!root.idInRc)
+        if (!root.hierarchy || !root.idInRc)
             continue;
         const members = [...metaMap.values()]
             .filter((m) => m.root === root)
@@ -772,6 +891,8 @@ export function emitClassShapes(host, mod, metaMap, nullable, int32) {
             fieldTypes.push(t);
         if (programLifetimeClass(host, meta))
             continue;
+        if (cls.arrayElem !== undefined)
+            continue;
         if (meta.hierarchy && (meta.children.length !== 0 || meta.root.def.runtime === true))
             continue;
         if (!types.some((t) => isRefCounted(t) && needsBoundedRelease(t)))
@@ -789,6 +910,11 @@ export function emitClassShapes(host, mod, metaMap, nullable, int32) {
         ]);
     }
     const directTargets = usedDirectTargets(host, candidates, fieldTypes);
+    // The descriptor entries of a class declared `extends Array`: a helper
+    // the module defines, or null (a class that is never constructed has
+    // neither).
+    const defined = new Set(mod.functions.map((fn) => fn.name));
+    const arrayClassFn = (name) => name !== undefined && defined.has(name) ? `@${mangleFunction(name)}` : "null";
     for (const cls of emitted) {
         const meta = metaMap.get(cls.name);
         const struct = mangleClassStruct(cls.name);
@@ -818,8 +944,14 @@ export function emitClassShapes(host, mod, metaMap, nullable, int32) {
         // A traced class whose trace visits nothing carries the collector header
         // only because its hierarchy is traced: it is never on a cycle. Its
         // descriptor names scr_cyc_no_children and its objects start out
-        // SCR_CYC_ACYCLIC, so releases never buffer them.
-        const acyclic = traced && runtimePrefix === null && !isStreamRooted && tracedFields.length === 0;
+        // SCR_CYC_ACYCLIC, so releases never buffer them. An Array subclass's
+        // trace also visits its elements by their current element ops
+        // (scr_arr_subclass_trace), so it is never acyclic.
+        const acyclic = traced &&
+            runtimePrefix === null &&
+            !isStreamRooted &&
+            tracedFields.length === 0 &&
+            cls.arrayElem === undefined;
         const bounded = runtimePrefix !== null ||
             isStreamRooted ||
             refFields.some((field) => needsBoundedRelease(field.type));
@@ -853,6 +985,7 @@ export function emitClassShapes(host, mod, metaMap, nullable, int32) {
         // segmentedTeardown).
         const destroy = `${meta.hierarchy ? mangleClassReleaseDirect(cls.name) : mangleClassRelease(cls.name)}_destroy`;
         const segmented = chained &&
+            cls.arrayElem === undefined &&
             !meta.compact &&
             runtimePrefix === null &&
             !isStreamRooted &&
@@ -863,7 +996,11 @@ export function emitClassShapes(host, mod, metaMap, nullable, int32) {
         // members). Runs at rc == 0.
         const teardown = (lines) => {
             const release = (prefix, f, t) => {
-                const direct = bounded ? directDestroyTarget(host, f.type, directTargets) : null;
+                // An Array subclass instance's destroy releases its fields plainly
+                // (it takes no chain length).
+                const direct = bounded && cls.arrayElem === undefined
+                    ? directDestroyTarget(host, f.type, directTargets)
+                    : null;
                 if (direct === null)
                     return [
                         `  call void ${releaseSym(host, f.type)}(ptr %v${t}) ; ${llvmCommentText(f.name)}`,
@@ -947,17 +1084,52 @@ export function emitClassShapes(host, mod, metaMap, nullable, int32) {
                 defs.push(...reld);
             }
         }
+        else if (cls.arrayElem !== undefined) {
+            // An instance is an array: its release is the array's, which reaches
+            // the class's destroy (the descriptor's) when the count reaches zero.
+            host.declare(`declare void @scr_arr_release(ptr)`);
+            host.declare(`declare void @scr_arr_subclass_drop(ptr)`);
+            const destroy = `${mangleClassRelease(cls.name)}.arrdestroy`;
+            const destroyBody = [
+                `define internal void @${destroy}(ptr %o) ${FN_ATTRS} { ; destroy ${cls.name} (an Array subclass instance)`,
+                `entry:`,
+            ];
+            const fieldsTeardown = [];
+            teardown(fieldsTeardown);
+            const free = emitObjectFree(host, traced);
+            destroyBody.push(...fieldsTeardown.slice(0, fieldsTeardown.length - free.length), `  call void @scr_arr_subclass_drop(ptr %o)`, ...free, `  ret void`, `}`, ``);
+            const displayName = cls.name.includes(".")
+                ? cls.name.slice(cls.name.lastIndexOf(".") + 1)
+                : cls.name;
+            const jsName = cls.jsName ?? displayName;
+            defs.push(...destroyBody, 
+            // The name is the class's own copy: its address identifies the
+            // class in dyn snapshots of an instance (scr_arr_copy_metadata).
+            `${arrayClassDescriptor(cls.name)}.name = private constant [${Buffer.byteLength(jsName, "utf8") + 1} x i8] c"${nulTerminatedBytes(jsName)}"`, `${arrayClassDescriptor(cls.name)} = internal constant { ptr, ptr, ptr, ptr } { ptr ${arrayClassDescriptor(cls.name)}.name, ptr @${destroy}, ptr ${arrayClassFn(cls.arrayFields)}, ptr ${arrayClassFn(cls.arraySpecies)} }`, ``, `define internal void @${mangleClassRelease(cls.name)}(ptr %o) ${FN_ATTRS} { ; release ${cls.name} (the array's)`, `entry:`, `  call void @scr_arr_release(ptr %o)`, `  ret void`, `}`, ``);
+        }
         else {
             const freeBody = [];
             teardown(freeBody);
-            defs.push(...releaseBody(host, mangleClassRelease(cls.name), traced, freeBody, `release ${cls.name}`, bounded, lifetime, chained, segmented), ``);
+            // A segmented class whose every reference field holds its own type and
+            // that has no collector header tears down in one loop (shapes.ts
+            // iterativeTeardownDefinitions).
+            const iterative = segmented &&
+                !traced &&
+                refFields.every((f) => directDestroyTarget(host, f.type, directTargets)?.destroy === destroy);
+            defs.push(...releaseBody(host, mangleClassRelease(cls.name), traced, freeBody, `release ${cls.name}`, bounded, lifetime, chained, segmented, false, iterative
+                ? iterativeTeardownDefinitions(host, destroy, struct, refFields.map((f) => f.index), `@${mangleClassRelease(cls.name)}`, "weak", count)
+                : null, count), ``);
         }
         // new: zeroed allocation, rc = 1, the vtable word on hierarchy
         // members, undefined-admitting union fields at the interned unit
         // instance. Traced shapes allocate with the collector header; alloc.ts
         // inlines the allocator fast paths and the alloc note.
+        // An inline array field's instance (LlClassMeta.inlineTail) takes the
+        // field's element count and has room for the elements after its fixed
+        // fields.
+        const tail = meta.compact && regionRefs ? (meta.inlineTail ?? null) : null;
         const nw = [
-            `define internal ptr @${mangleClassNew(cls.name)}() ${FN_ATTRS} { ; new ${cls.name}`,
+            `define internal ptr @${mangleClassNew(cls.name)}(${tail !== null ? "i32 %inl.len" : ""}) ${FN_ATTRS} { ; new ${cls.name}`,
             `entry:`,
         ];
         const cycType = `@${mangleClassTrace(cls.name)}.cyctype`;
@@ -979,10 +1151,17 @@ export function emitClassShapes(host, mod, metaMap, nullable, int32) {
             // Compressed fields refer to compact instances by their index in the
             // program-lifetime region, so every compact instance lives there:
             // zeroed, 8-byte aligned and never freed.
-            nw.push(...plrAllocLines(host, sizeOf));
+            if (tail !== null) {
+                nw.push(`  %inl.n = zext i32 %inl.len to ${host.sizeType}`, `  %inl.bytes = shl nuw nsw ${host.sizeType} %inl.n, 2`, `  %inl.size = add nuw nsw ${host.sizeType} %inl.bytes, ${tail.tailOffset}`);
+                nw.push(...plrAllocLines(host, "%inl.size"));
+            }
+            else
+                nw.push(...plrAllocLines(host, sizeOf));
         }
         else
             nw.push(...emitObjectAlloc(host, sizeOf, traced && !lifetime ? { type: cycType, acyclic } : null, storedHeaderBytes(meta)));
+        // The header and field set-up, shared with the arena-aware constructor.
+        const initStart = nw.length;
         if (meta.compact && !meta.hierarchy)
             nw.push(`  store i32 ${compactHeaderWord(meta)}, ptr %o ; no count (compactHeaderWord)`);
         else if (meta.compact) {
@@ -1002,6 +1181,11 @@ export function emitClassShapes(host, mod, metaMap, nullable, int32) {
         }
         else
             nw.push(`  store ${host.sizeType} ${lifetime ? programLifetimeRc(host.sizeType) : 1}, ptr %o`);
+        if (cls.arrayElem !== undefined) {
+            const init = arrElemInit(host, cls.arrayElem);
+            host.declare(`declare void @scr_arr_subclass_init(ptr, i8, ptr, ptr, i1 zeroext)`);
+            nw.push(`  call void @scr_arr_subclass_init(ptr %o, i8 ${init.kind}, ptr ${init.ops}, ptr ${arrayClassDescriptor(cls.name)}, i1 ${traced})`);
+        }
         if (lifetime && audit) {
             // --sanitize builds: the RC audit skips its leak report when the
             // program keeps program-lifetime objects (scr_console.c), and
@@ -1028,13 +1212,40 @@ export function emitClassShapes(host, mod, metaMap, nullable, int32) {
             nw.push(`  %clsp = getelementptr inbounds %${struct}, ptr %o, i64 0, i32 3`, `  store ptr ${host.cstr(displayName)}, ptr %clsp ; ${runtimePrefix.what} display name`);
         }
         nw.push(...undefFieldInits(host, meta, nullable));
+        if (tail !== null)
+            nw.push(`  %inl.countp = getelementptr inbounds %${struct}, ptr %o, i64 0, i32 ${meta.compactSlots[tail.field]}`, `  store i32 %inl.len, ptr %inl.countp ; ${llvmCommentText(cls.name)} inline array count`);
         // Young instances: program-owned traced classes. Classes rooted at a
         // runtime base (errors, emitters, events, streams) carry runtime state
         // and stay with trial deletion, like every runtime family.
-        if (traced && !lifetime && (!meta.hierarchy || meta.root.def.runtime !== true))
+        const init = nw.slice(initStart);
+        if (traced &&
+            !lifetime &&
+            (!meta.hierarchy || meta.root.def.runtime !== true) &&
+            cls.arrayElem === undefined)
             nw.push(...youngEntryLines(host));
         nw.push(`  ret ptr ${meta.hierarchy ? "%o.vt" : "%o"}`, `}`, ``);
         defs.push(...nw);
+        if (host.arenaClasses?.has(cls.name) === true &&
+            cls.arrayElem === undefined &&
+            !lifetime &&
+            regions === null &&
+            !meta.compact &&
+            runtimePrefix === null &&
+            !isStreamRooted &&
+            !meta.threadSlot) {
+            // The arena count in place of 1, in the rc word or its low half.
+            const counted = meta.idInRc
+                ? `  store i64 ${classIdRcWord(meta, false)}, ptr %o.vt`
+                : `  store ${host.sizeType} 1, ptr %o`;
+            const arenaCount = meta.idInRc
+                ? `  store i64 ${(BigInt(meta.pre + 1) * 2n ** 32n + BigInt(ARENA_RC)).toString()}, ptr %o.vt`
+                : `  store ${host.sizeType} ${ARENA_RC}, ptr %o`;
+            const newSym = mangleClassNew(cls.name);
+            const dispose = refFields.length > 0 && host.arenasClosed !== true ? arenaDisposeSym(newSym) : null;
+            defs.push(...arenaNewLines(host, newSym, sizeOf, traced ? cycType : null, dispose, init.map((line) => (line.startsWith(counted) ? arenaCount : line)), meta.hierarchy ? "%o.vt" : "%o"));
+            if (dispose !== null)
+                defs.push(...arenaDisposeLines(newSym, refFields.flatMap((f, t) => disposeFieldLines(t, `getelementptr inbounds %${struct}, ptr %o, i64 0, i32 ${f.index}`, plainRefType(f.type), releaseSym(host, f.type), llvmCommentText(f.name)))));
+        }
         if (traced) {
             // trace: visit exactly the cycle-capable fields; gcFree: release
             // exactly the complement, then free (the trace/teardown complement
@@ -1052,6 +1263,12 @@ export function emitClassShapes(host, mod, metaMap, nullable, int32) {
             tracedFields.forEach((f, i) => {
                 tr.push(...traceFieldVisitLines(struct, f.index, i, llvmCommentText(f.name)));
             });
+            // An Array subclass instance's elements, when its current element
+            // storage is cycle-capable (a species result can retype it).
+            if (cls.arrayElem !== undefined) {
+                host.declare(`declare void @scr_arr_subclass_trace(ptr, ptr, ptr)`);
+                tr.push(`  call void @scr_arr_subclass_trace(ptr %o, ptr %visit, ptr %ctx) ; the elements`);
+            }
             tr.push(`  ret void`, `}`, ``);
             defs.push(...tr);
             const gf = [
@@ -1067,6 +1284,12 @@ export function emitClassShapes(host, mod, metaMap, nullable, int32) {
             });
             if (meta.threadSlot)
                 gf.push(...slotForgetLines(host, struct, meta, "gfw"));
+            if (cls.arrayElem !== undefined) {
+                // The elements: traced ones are the collector's, the others are
+                // released with the storage (the same test as the trace's).
+                host.declare(`declare void @scr_arr_subclass_gc_drop(ptr)`);
+                gf.push(`  call void @scr_arr_subclass_gc_drop(ptr %o)`);
+            }
             gf.push(...emitObjectFree(host, true), `  ret void`, `}`, ``);
             defs.push(...gf);
         }
@@ -1096,6 +1319,8 @@ export function emitClassObjDefs(host, metaMap, classObjs, fnByName, llType, thr
         const ctor = fnByName.get(valueCtor.fn);
         if (!ctor)
             throw new InternalCompilerError(`llvm emitter bug: class object for ${className} without a constructor`);
+        if (meta.inlineTail !== undefined)
+            throw new InternalCompilerError(`llvm emitter bug: class object for ${className}, which has an inline array field`);
         const params = ctor.params.slice(valueCtor.firstArg);
         const paramDecls = params.map((p, i) => `${llType(p.type)} %a${i}`).join(", ");
         const ctorArgs = params.map((p, i) => `${llType(p.type)} %a${i}`);
@@ -1137,7 +1362,9 @@ export function emitClassObjDefs(host, metaMap, classObjs, fnByName, llType, thr
             localOwner = base;
             localValue = `%base.value${id}`;
         }
-        out.push(`define internal ptr @${mangleCtorThunk(className)}(ptr %class${paramDecls ? ", " + paramDecls : ""}) ${FN_ATTRS} { ; construct thunk ${className}`, `entry:`, `  %o = call ptr @${mangleClassNew(className)}()`, ...(meta.def.localCaptures !== undefined
+        out.push(`define internal ptr @${mangleCtorThunk(className)}(ptr %class${paramDecls ? ", " + paramDecls : ""}) ${FN_ATTRS} { ; construct thunk ${className}`, `entry:`, `  %o = call ptr @${mangleClassNew(className)}()`, 
+        // Construction through a class value: the census counts it here.
+        ...(host.heapCensus?.newLines(className) ?? []), ...(meta.def.localCaptures !== undefined
             ? [
                 `  %class.owned = call ptr @scr_classobj_retain_v(ptr %class)`,
                 `  %class.slot = getelementptr inbounds %${mangleClassStruct(className)}, ptr %o, i64 0, i32 ${classEnvironmentIndex(meta)}`,