@tishlang/tish-format 2.12.0 → 2.35.0

package/crates/tish_compile/src/types.rs

@@ -29,6 +29,10 @@ pub enum RustType {
     Vec(Box<RustType>),
     /// Option<T> for nullable types (T | null)
     Option(Box<RustType>),
+    /// Box<T> — heap indirection required to make recursive structs finite-sized.
+    /// Only the recursive-struct native pass (#178) produces this, for child fields
+    /// like `Option<Box<TishRec_Node>>`; never from `from_annotation`.
+    Boxed(Box<RustType>),
     /// Inline object shape — used during inference / annotation lowering
     /// before a `Named` alias has been registered. Once a corresponding
     /// `type Foo = { ... }` declaration is found in the program, occurrences
@@ -49,6 +53,15 @@ pub enum RustType {
     },
     /// Tuple `(T0, T1, …)` for `[T0, T1]` tuple types — a native Rust tuple.
     Tuple(Vec<RustType>),
+    /// #179 Stage B: a closed set of 2..=8 distinct primitive-record shapes read at one site — the
+    /// "megamorphic" array-of-heterogeneous-objects pattern. Emitted as a generated Rust enum
+    /// `TishUnion_<name> { V0(TishStruct_<v0>), … }` (one variant per shape); a `.field` read present
+    /// in EVERY variant lowers to a `match` with a direct field load per arm (no hash, no IC). `name`
+    /// is the union alias; each `variants` entry is `(per-variant struct alias, its fields)`.
+    ShapeUnion {
+        name: Arc<str>,
+        variants: Vec<(Arc<str>, Vec<(Arc<str>, RustType)>)>,
+    },
 }
 
 impl RustType {
@@ -95,6 +108,12 @@ impl RustType {
                 RustType::Vec(Box::new(Self::from_annotation_with_aliases(elem, aliases)))
             }
             TypeAnnotation::Object(fields) => {
+                // Security #379: a field key that is not a valid Rust identifier must not drive a
+                // native struct (it would be interpolated into generated Rust). Keep the whole object
+                // on the boxed `Value` path — always correct, just unspecialized.
+                if fields.iter().any(|(k, _)| !is_struct_field_safe(k)) {
+                    return RustType::Value;
+                }
                 let typed_fields: Vec<_> = fields
                     .iter()
                     .map(|(k, v)| (k.clone(), Self::from_annotation_with_aliases(v, aliases)))
@@ -234,6 +253,7 @@ impl RustType {
             RustType::Unit => "()".to_string(),
             RustType::Vec(inner) => format!("Vec<{}>", inner.to_rust_type_str()),
             RustType::Option(inner) => format!("Option<{}>", inner.to_rust_type_str()),
+            RustType::Boxed(inner) => format!("Box<{}>", inner.to_rust_type_str()),
             RustType::Object(_) => {
                 // Anonymous inline shapes don't have a Rust struct; fall
                 // back to the dynamic Value path.
@@ -249,6 +269,7 @@ impl RustType {
                 )
             }
             RustType::Tuple(elems) => tuple_text(&elems.iter().map(|e| e.to_rust_type_str()).collect::<Vec<_>>()),
+            RustType::ShapeUnion { name, .. } => shape_union_enum_ident(name),
         }
     }
 
@@ -263,6 +284,7 @@ impl RustType {
             RustType::Unit => "()".to_string(),
             RustType::Vec(_) => "Vec::new()".to_string(),
             RustType::Option(_) => "None".to_string(),
+            RustType::Boxed(inner) => format!("Box::new({})", inner.default_value()),
             RustType::Object(_) => "Value::Null".to_string(),
             RustType::Named { fields, .. } => {
                 // Build a literal struct with each field at its own default,
@@ -285,6 +307,22 @@ impl RustType {
             RustType::Tuple(elems) => {
                 tuple_text(&elems.iter().map(|e| e.default_value()).collect::<Vec<_>>())
             }
+            RustType::ShapeUnion { name, variants } => {
+                // Default = the first variant with each of its fields defaulted.
+                let (v0_alias, v0_fields) = &variants[0];
+                let init = v0_fields
+                    .iter()
+                    .map(|(k, t)| format!("{}: {}", field_ident(k), t.default_value()))
+                    .collect::<Vec<_>>()
+                    .join(", ");
+                format!(
+                    "{}::{}({} {{ {} }})",
+                    shape_union_enum_ident(name),
+                    shape_union_variant_ident(0),
+                    named_struct_ident(v0_alias),
+                    init
+                )
+            }
         }
     }
 
@@ -344,20 +382,34 @@ impl RustType {
                 )
             }
             RustType::Named { name, fields } => {
-                // Each field is fetched out of the Value::Object via
-                // `get_prop` and converted to its native type. Falls back
-                // to the field's `default_value()` if the field is absent
-                // (rare — usually these come from JSON or PG).
+                // Each field is fetched out of the Value::Object via `get_prop` and converted to its
+                // native type. The source Value is bound ONCE to `_src` so a non-trivial `value_expr`
+                // (an object literal, a call, …) is evaluated a single time instead of being textually
+                // re-inlined per field (which would re-allocate the whole object N times). Missing
+                // fields fall back to `default_value()` (rare — usually these come from JSON or PG).
                 let field_assigns = fields
                     .iter()
                     .map(|(k, ty)| {
-                        let fetch =
-                            format!("tishlang_runtime::get_prop(&{}, {:?})", value_expr, k.as_ref());
+                        let fetch = format!("tishlang_runtime::get_prop(&_src, {:?})", k.as_ref());
                         format!("{}: {}", field_ident(k), ty.from_value_expr(&fetch))
                     })
                     .collect::<Vec<_>>()
                     .join(", ");
-                format!("{} {{ {} }}", named_struct_ident(name), field_assigns)
+                format!(
+                    "{{ let _src = {}; {} {{ {} }} }}",
+                    value_expr,
+                    named_struct_ident(name),
+                    field_assigns
+                )
+            }
+            RustType::ShapeUnion { .. } => {
+                // #179 Stage B: converting a boxed Value INTO a ShapeUnion is a boundary the safety
+                // walk forbids (a typed union element never crosses to/from boxed), so codegen must
+                // never emit this. Present for match-completeness; fails loud if gating is violated.
+                format!(
+                    "{{ let _ = {}; unreachable!(\"ShapeUnion from Value is a forbidden boundary\") }}",
+                    value_expr
+                )
             }
             _ => value_expr.to_string(), // Fallback
         }
@@ -403,12 +455,15 @@ impl RustType {
                 )
             }
             RustType::Named { fields, .. } => {
-                // Walk fields, build an ObjectMap, wrap in Value::Object.
-                // The boundary is paid only when crossing into untyped
-                // Tish (JSON.stringify, calling a Value::Function, etc.);
-                // direct Rust-to-Rust paths between two Named values stay
-                // as plain struct moves.
-                let inserts = fields
+                // Build the boxed Value with an ORDERED PropMap via `object_from_pairs` (no
+                // intermediate `AHashMap`), so key order == field-declaration order == JS
+                // insertion order. The old `ObjectMap::default()` (`AHashMap`) + insert path
+                // scrambled key order NON-DETERMINISTICALLY per run (ahash seed) — a shipped
+                // `JSON.stringify` / `Object.keys` / `for..in` divergence from node whenever a
+                // native struct crosses back into untyped Tish. This boundary is paid only on
+                // that crossing (JSON.stringify, calling a Value::Function, etc.); direct
+                // Rust-to-Rust paths between two Named values stay as plain struct moves.
+                let pairs = fields
                     .iter()
                     .map(|(k, ty)| {
                         let access = format!("{}.{}", native_expr, field_ident(k));
@@ -420,22 +475,35 @@ impl RustType {
                         } else {
                             ty.to_value_expr(&access)
                         };
+                        format!("(::std::sync::Arc::from({:?}), {})", k.as_ref(), v_expr)
+                    })
+                    .collect::<Vec<_>>()
+                    .join(", ");
+                // `object_from_pairs::<N>` builds the `PropMap` in one ordered pass (N = field
+                // count, a codegen-time constant) — no AHashMap, so key order is preserved.
+                format!("Value::object_from_pairs([{}])", pairs)
+            }
+            RustType::ShapeUnion { name, variants } => {
+                // union → boxed Value::Object: one match arm per variant, delegating to that
+                // variant's Named glue (ordered `object_from_pairs`, preserving JS key order).
+                let arms = variants
+                    .iter()
+                    .enumerate()
+                    .map(|(i, (alias, fields))| {
+                        let named = RustType::Named {
+                            name: alias.clone(),
+                            fields: fields.clone(),
+                        };
                         format!(
-                            "_om.insert(::std::sync::Arc::from({:?}), {});",
-                            k.as_ref(),
-                            v_expr
+                            "{}::{}(__u) => {}",
+                            shape_union_enum_ident(name),
+                            shape_union_variant_ident(i),
+                            named.to_value_expr("__u")
                         )
                     })
                     .collect::<Vec<_>>()
-                    .join(" ");
-                // `Value::object` wraps the `ObjectMap` in an `ObjectData` (what `Value::Object`
-                // actually holds) — emitting `Value::Object(VmRef::new(_om))` directly is a type
-                // error (`ObjectMap` != `ObjectData`); only surfaced once a whole struct is boxed
-                // into a `Value`, e.g. passing it to a function.
-                format!(
-                    "{{ let mut _om = ObjectMap::default(); {} Value::object(_om) }}",
-                    inserts
-                )
+                    .join(", ");
+                format!("(match &{} {{ {} }})", native_expr, arms)
             }
             _ => native_expr.to_string(), // Fallback
         }
@@ -457,16 +525,75 @@ pub fn named_struct_ident(tish_name: &str) -> String {
     format!("TishStruct_{}", tish_name)
 }
 
+/// #179 Stage B: map a shape-union alias to the generated Rust enum identifier.
+pub fn shape_union_enum_ident(tish_name: &str) -> String {
+    format!("TishUnion_{}", tish_name)
+}
+
+/// #179 Stage B: the Rust variant identifier for the `idx`-th shape of a union (`V0`, `V1`, …).
+pub fn shape_union_variant_ident(idx: usize) -> String {
+    format!("V{}", idx)
+}
+
+/// Keywords that cannot be written as a raw identifier (`r#self` etc. are a hard Rust error), so an
+/// object key equal to one of these must NOT drive struct/shape inference — it stays boxed.
+const NON_RAWABLE_KEYWORDS: &[&str] = &["self", "Self", "super", "crate"];
+
+/// True iff `key` can be safely emitted as a generated Rust struct field name via [`field_ident`]:
+/// a plain ASCII identifier (`^[A-Za-z_][A-Za-z0-9_]*$`), excluding the bare wildcard `_` and the
+/// four non-rawable keywords. Any other key — one containing spaces/punctuation, empty, non-ASCII,
+/// etc. — is REJECTED so the object it belongs to falls back to the boxed `Value` path instead of
+/// being lowered to a native struct.
+///
+/// This is the front-line guard for the native-codegen key-injection class (security #379): an
+/// object literal key is arbitrary tish/JS text, and interpolating it verbatim into generated Rust
+/// (`pub {key}: {ty},`) is arbitrary-code injection. Inference/annotation lowering call this to keep
+/// unsafe-keyed objects on the always-correct boxed path; [`field_ident`] additionally sanitizes as a
+/// last-resort choke point so no path can ever emit a non-identifier verbatim.
+pub fn is_struct_field_safe(key: &str) -> bool {
+    if key == "_" || NON_RAWABLE_KEYWORDS.contains(&key) {
+        return false;
+    }
+    let mut chars = key.chars();
+    match chars.next() {
+        Some(c) if c == '_' || c.is_ascii_alphabetic() => {}
+        _ => return false,
+    }
+    chars.all(|c| c == '_' || c.is_ascii_alphanumeric())
+}
+
+/// FNV-1a 64-bit — a tiny, dependency-free hash used only to synthesize a deterministic safe field
+/// identifier for an (unexpected) non-identifier key. Deterministic so a struct's field definition,
+/// its constructor, its accessors, and its serializer all agree on the same name.
+fn fnv1a_64(s: &str) -> u64 {
+    let mut h: u64 = 0xcbf2_9ce4_8422_2325;
+    for b in s.as_bytes() {
+        h ^= *b as u64;
+        h = h.wrapping_mul(0x0000_0100_0000_01b3);
+    }
+    h
+}
+
 /// Map a Tish field name (`randomNumber`) to a valid Rust identifier
 /// (kept identical here — non-snake-case is allowed via
 /// `#[allow(non_snake_case)]` on the struct, so JS-style camelCase keys
 /// stay readable in the generated source).
+///
+/// A key that is not a valid Rust identifier is NEVER emitted verbatim (that would be code injection,
+/// security #379): inference/annotation lowering should already have kept such an object boxed via
+/// [`is_struct_field_safe`], so this is a defense-in-depth choke point — an unsafe key is replaced by
+/// a deterministic `__tish_field_<hash>` name. The worst case if a producer is missed is thus a wrong
+/// field name (a compile error / correctness bug), never injected Rust.
 pub fn field_ident(tish_name: &str) -> String {
-    // Reserve Rust keywords that would otherwise conflict.
+    if !is_struct_field_safe(tish_name) {
+        return format!("__tish_field_{:016x}", fnv1a_64(tish_name));
+    }
+    // Reserve Rust keywords that would otherwise conflict. (The non-rawable keywords are already
+    // excluded by `is_struct_field_safe` above, so every keyword reaching here has a valid `r#` form.)
     match tish_name {
-        "type" | "ref" | "fn" | "match" | "move" | "mod" | "self" | "Self" | "super" | "use"
+        "type" | "ref" | "fn" | "match" | "move" | "mod" | "use"
         | "where" | "loop" | "yield" | "async" | "await" | "dyn" | "impl" | "trait" | "in"
-        | "as" | "box" | "crate" | "const" | "extern" | "let" | "mut" | "pub" | "static"
+        | "as" | "box" | "const" | "extern" | "let" | "mut" | "pub" | "static"
         | "unsafe" | "abstract" | "become" | "do" | "final" | "macro" | "override" | "priv"
         | "typeof" | "unsized" | "virtual" => format!("r#{}", tish_name),
         _ => tish_name.to_string(),
@@ -571,6 +698,75 @@ mod tests {
         );
     }
 
+    // ---- security #379: object-literal key injection into generated Rust ----
+
+    #[test]
+    fn is_struct_field_safe_accepts_plain_and_camel_and_keywords() {
+        for k in ["x", "y", "randomNumber", "_priv", "a1", "TishAnon_0", "type", "fn", "match"] {
+            assert!(is_struct_field_safe(k), "{k:?} should be a safe field");
+        }
+    }
+
+    #[test]
+    fn is_struct_field_safe_rejects_injection_and_nonrawable() {
+        for k in [
+            // the #379 injection shapes: anything with punctuation/space/braces
+            "x: i32 } pub fn pwned() {} struct Z { pub y",
+            "a, b",
+            "0abc",
+            "has space",
+            "unicodé",
+            "",
+            // non-rawable keywords would become invalid `r#self` etc.
+            "self", "Self", "super", "crate",
+            // bare wildcard is not a legal field name
+            "_",
+        ] {
+            assert!(!is_struct_field_safe(k), "{k:?} must NOT be a safe field");
+        }
+    }
+
+    #[test]
+    fn field_ident_never_emits_non_identifier_for_unsafe_key() {
+        // The core RCE guarantee: whatever key comes in, field_ident() out is ALWAYS a legal Rust
+        // identifier (ASCII ident chars, or a leading `r#`) — never verbatim injectable text.
+        let malicious = "x: i32 } pub fn PWNED() -> i32 { 1337 } struct S { pub y";
+        let out = field_ident(malicious);
+        assert!(out.starts_with("__tish_field_"), "unsafe key must be sanitized, got {out:?}");
+        let body = out.trim_start_matches("r#");
+        assert!(
+            body.chars().enumerate().all(|(i, c)| {
+                if i == 0 { c == '_' || c.is_ascii_alphabetic() } else { c == '_' || c.is_ascii_alphanumeric() }
+            }),
+            "field_ident output {out:?} is not a legal Rust identifier"
+        );
+        // deterministic: the def, the accessor, and the serializer must agree.
+        assert_eq!(field_ident(malicious), field_ident(malicious));
+    }
+
+    #[test]
+    fn field_ident_preserves_legit_and_raws_keywords() {
+        assert_eq!(field_ident("randomNumber"), "randomNumber");
+        assert_eq!(field_ident("x"), "x");
+        assert_eq!(field_ident("type"), "r#type");
+        // a non-rawable keyword is sanitized, NOT emitted as the invalid `r#self`.
+        assert!(field_ident("self").starts_with("__tish_field_"));
+    }
+
+    #[test]
+    fn annotation_object_with_unsafe_key_stays_boxed() {
+        // A `type` alias whose object shape has a non-identifier key must fall back to boxed Value,
+        // never a native struct with an injected field name.
+        let obj = TypeAnnotation::Object(vec![
+            ("safe".into(), TypeAnnotation::Simple("number".into(), tishlang_ast::Span::default())),
+            (
+                "evil } fn pwned() {".into(),
+                TypeAnnotation::Simple("number".into(), tishlang_ast::Span::default()),
+            ),
+        ]);
+        assert_eq!(RustType::from_annotation(&obj), RustType::Value);
+    }
+
     #[test]
     fn test_nullable_type() {
         let nullable = TypeAnnotation::Union(vec![

package/crates/tish_compile/tests/dump_codegen.rs

@@ -0,0 +1,21 @@
+//! Dump perf fixtures to target/dump_*.rs for inspection.
+use std::path::PathBuf;
+use tishlang_compile::compile_project_full;
+
+fn compile(rel: &str) -> String {
+    let manifest = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let path = manifest.join("../..").join(rel).canonicalize().unwrap();
+    let (rust, _, _, _) = compile_project_full(&path, path.parent(), &[], true).unwrap();
+    rust
+}
+
+#[test]
+fn dump_perf_fixtures() {
+    let out = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../target");
+    std::fs::write(out.join("dump_mandelbrot.rs"), compile("tests/perf/mandelbrot.tish")).unwrap();
+    std::fs::write(out.join("dump_fasta.rs"), compile("tests/perf/fasta.tish")).unwrap();
+    std::fs::write(out.join("dump_fannkuch.rs"), compile("tests/perf/fannkuch.tish")).unwrap();
+    std::fs::write(out.join("dump_fnv_hash.rs"), compile("tests/perf/fnv_hash.tish")).unwrap();
+    std::fs::write(out.join("dump_spectral_norm.rs"), compile("tests/perf/spectral_norm.tish")).unwrap();
+    std::fs::write(out.join("dump_queens.rs"), compile("tests/perf/queens.tish")).unwrap();
+}

package/crates/tish_compile/tests/perf_codegen_169_173.rs

@@ -11,17 +11,6 @@ use tishlang_parser::parse;
 
 /// Enable every dark-shipped typed-native flag, matching `scripts/run_perf_gauntlet.sh`.
 fn enable_typed_flags() {
-    for k in [
-        "TISH_PARAM_NATIVE",
-        "TISH_PARAM_INFER",
-        "TISH_NATIVE_FN",
-        "TISH_STRUCT_INFER",
-        "TISH_FUSED_HOF",
-        "TISH_NATIVE_HOF",
-        "TISH_AGGREGATE_INFER",
-    ] {
-        std::env::set_var(k, "1");
-    }
 }
 
 fn compile_typed(src: &str) -> String {
@@ -130,10 +119,12 @@ fn issue_173_adversarial_cases_do_not_fuse() {
         !rust.contains("repeat((i * 2"),
         "non-constant push arg must not be fused into a repeat-fill"
     );
-    // Exactly the three sound fills are emitted (8, n, 3) — no extra fusions crept in.
-    let fusions = rust.matches("std::iter::repeat").count();
-    assert_eq!(
-        fusions, 3,
-        "exactly 3 fill loops should fuse (boolFill=8, sieve=n, oobGrow=3), found {fusions}"
-    );
+    // The three canonical fills DO fuse (boolFill=8, sieve=n, oobGrow=3); the adversarial cases keep
+    // their push loops. Assert each sound fill is present rather than a brittle exact total: with the
+    // typing stack on by default, a fn that has a native `_nv` form (e.g. `numFillSieve`) may emit its
+    // fill in both the native and the boxed closure form, so the same fill can legitimately appear
+    // more than once.
+    assert!(rust.contains("repeat(true).take((8"), "boolFill (8) should fuse");
+    assert!(rust.contains("repeat(1_f64).take((n"), "sieve (n) should fuse");
+    assert!(rust.contains("repeat(1_f64).take((3"), "oobGrow (3) should fuse");
 }

package/crates/tish_compile/tests/perf_codegen_173_part3.rs

@@ -0,0 +1,61 @@
+//! Generated-Rust assertions for #173 part 3 — in-bounds index elision.
+//!
+//! When a native `Vec` is filled to a fixed length and an index is proven `< len` (an enclosing
+//! `i < len` guard) and `>= 0`, the store drops its OOB-growth `resize` branch and the read drops its
+//! `.get().unwrap_or(..)` branch — a direct `a[i]` like V8/Bun emit after range-proving a loop. Any
+//! array that can't be proven (escapes, is reassigned, or the index isn't a guarded counter) keeps
+//! the OOB-safe lowering. Soundness across backends is covered by the `tests/core` parity corpus.
+
+use std::path::PathBuf;
+
+use tishlang_compile::compile_project_full;
+
+fn enable_typed_flags() {
+}
+
+fn compile_fixture_typed(rel: &str) -> String {
+    enable_typed_flags();
+    let manifest = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let path = manifest.join("../..").join(rel).canonicalize().unwrap();
+    let (rust, _, _, _) = compile_project_full(&path, path.parent(), &[], true).unwrap();
+    rust
+}
+
+#[test]
+fn nsieve_inbounds_store_and_read_elide_their_guards() {
+    // `isPrime` is filled to length `n` and only indexed; the read `isPrime[i]` (guard `i < n`) and
+    // the strided store `isPrime[k] = false` (guard `k < n`, `k` non-negative, stored before its own
+    // `k = k + i` reassignment) are both provably in-bounds.
+    let rust = compile_fixture_typed("tests/perf/nsieve.tish");
+    // Read: direct index, NOT `.get(..).copied().unwrap_or(false)`.
+    assert!(
+        rust.contains("isPrime[(i) as usize]"),
+        "in-bounds read should be a direct index:\n{}",
+        rust.lines().filter(|l| l.contains("isPrime")).take(8).collect::<Vec<_>>().join("\n")
+    );
+    // Store: direct index, NO `resize` grow branch. The strided `isPrime[k] = false` is a discarded
+    // statement, so it lowers to the bare side-effect form (no `{ …; Value::Null }` value wrapper);
+    // the point is it is a direct indexed store, not a resize-grow.
+    assert!(
+        rust.contains("isPrime[(k) as usize] = false;"),
+        "in-bounds store should be a direct indexed store (no resize-grow branch):\n{}",
+        rust.lines().filter(|l| l.contains("isPrime")).take(8).collect::<Vec<_>>().join("\n")
+    );
+    assert!(
+        !rust.contains("isPrime.resize") && !rust.contains("isPrime.get("),
+        "the proven-fixed-length isPrime must have no resize/get fallbacks left:\n{}",
+        rust.lines().filter(|l| l.contains("isPrime")).take(8).collect::<Vec<_>>().join("\n")
+    );
+}
+
+#[test]
+fn escaping_array_keeps_oob_safe_lowering() {
+    // `a` is passed to a function, so it could be mutated/shrunk out of line — the fixed-length fact
+    // must NOT apply and the store must keep its OOB-growth `resize` branch.
+    let rust = compile_fixture_typed("tests/core/inbounds_index.tish");
+    assert!(
+        rust.contains("resize"),
+        "an escaping array must retain the OOB-safe resize store:\n{}",
+        rust.lines().filter(|l| l.contains("resize") || l.contains("esc")).take(8).collect::<Vec<_>>().join("\n")
+    );
+}

package/crates/tish_compile/tests/perf_codegen_174.rs

@@ -0,0 +1,160 @@
+//! Generated-Rust assertions for the #174 Int32/U32 range-lattice round-trip erasure.
+//!
+//! #174 erases redundant `tishlang_runtime::to_int32` / `to_uint32` calls in the typed bitwise/shift
+//! emitter when an operand is PROVABLY a finite integer — either an integer literal (a compile-time
+//! constant) or a value the integer-range lattice bounds within `(-2^53, 2^53)`. The guarded
+//! `to_int32` (NaN/±Infinity → 0) is retained for every unproven leaf, so the lowering is purely
+//! additive and behaviour-identical (the gauntlet's `typed == boxed == node` checksum is the gate).
+//!
+//! These run in their own test binary so any env flags set here never leak into other tests.
+
+use tishlang_compile::compile;
+use tishlang_parser::parse;
+
+fn enable_typed_flags() {
+}
+
+/// FNV-style hash loop: the canonical bitwise hot loop. The accumulator `h` lives in an i32 register
+/// (existing lowering); #174 additionally folds the constant mask / shift counts and keeps the
+/// `(h * C) >>> 0` f64-rounding excursion intact.
+const FNV: &str = r#"
+let h = 2166136261
+for (let i = 0; i < 100; i++) {
+  h = h ^ (i & 255)
+  h = (h * 16777619) >>> 0
+  h = ((h << 13) | (h >>> 19)) >>> 0
+}
+let check = h >>> 0
+console.log(check)
+"#;
+
+#[test]
+fn issue_174_constant_mask_and_shift_counts_fold() {
+    // `i & 255`, `h << 13`, `h >>> 19`, `… >>> 0`: every integer-literal operand is a compile-time
+    // ToInt32 constant, so it must emit as a bare `i32` literal — NOT a runtime `to_int32(255_f64)`.
+    let rust = compile(&parse(FNV).unwrap()).unwrap();
+    assert!(
+        rust.contains("255i32"),
+        "the `& 255` mask must fold to an i32 constant:\n{}",
+        rust.lines().filter(|l| l.contains("255")).take(4).collect::<Vec<_>>().join("\n")
+    );
+    assert!(
+        rust.contains("13i32") && rust.contains("19i32"),
+        "shift counts 13 / 19 must fold to i32 constants"
+    );
+    // No runtime ToInt32/ToUint32 call on an integer LITERAL remains.
+    assert!(
+        !rust.contains("to_int32(255") && !rust.contains("to_uint32(13")
+            && !rust.contains("to_uint32(19") && !rust.contains("to_uint32(0"),
+        "integer-literal operands must not round-trip through a runtime to_int32/to_uint32 call:\n{}",
+        rust.lines().filter(|l| l.contains("to_uint32(") || l.contains("to_int32(")).take(8).collect::<Vec<_>>().join("\n")
+    );
+}
+
+#[test]
+fn issue_174_fnv_accumulator_still_i32_register_no_regression() {
+    // The i32-register accumulator lowering (and its `(h * C)` f64-rounding excursion) is preserved:
+    // `h` is an i32 register, there is no per-op `to_int32(h)` round-trip, and the multiply excursion
+    // lowers to an unchecked f64 truncation. (Mirror of `fnv_accumulator_lowers_to_i32_register`.)
+    let rust = compile(&parse(FNV).unwrap()).unwrap();
+    assert!(
+        rust.contains("let mut h: i32 = (2166136261u32) as i32;"),
+        "h must stay an i32 register seeded via u32 reinterpretation"
+    );
+    assert!(
+        !rust.contains("to_int32(h)"),
+        "no per-op to_int32(h) round-trip on the i32 accumulator"
+    );
+    assert!(
+        rust.contains(".to_int_unchecked::<i64>()") && rust.contains("16777619"),
+        "the `h * 16777619` excursion stays an f64 multiply with an unchecked truncation"
+    );
+}
+
+#[test]
+fn issue_174_range_proven_counter_drops_is_finite_guard() {
+    // A loop counter masked into a bitwise op is range-proven integral, so its ToInt32 must not
+    // round-trip through the guarded `to_int32(i)` call. The guard-free lowering is the saturating
+    // `(i) as i64 as i32` cast — #380 (PR #387) replaced the original `to_int_unchecked::<i64>()`
+    // here because `int_valued_locals` proves integrality but not magnitude, making the unchecked
+    // truncation UB on an overflowing accumulator; the saturating cast is defined for all f64 at
+    // the same hot-path cost (fnv_hash/fannkuch/mandelbrot measured at baseline in #387).
+    let src = r#"
+let acc = 0
+for (let i = 0; i < 64; i = i + 1) {
+  acc = acc ^ (i & 15)
+}
+console.log(acc >>> 0)
+"#;
+    let rust = compile(&parse(src).unwrap()).unwrap();
+    assert!(
+        rust.contains("as i64 as i32"),
+        "a range-proven counter `i` in `i & 15` must lower to the guard-free saturating cast:\n{}",
+        rust.lines().filter(|l| l.contains("acc") || l.contains("to_int")).take(8).collect::<Vec<_>>().join("\n")
+    );
+    assert!(
+        !rust.contains("to_int32(i)"),
+        "a range-proven counter must not round-trip through the guarded to_int32 call:\n{}",
+        rust.lines().filter(|l| l.contains("to_int32(")).take(8).collect::<Vec<_>>().join("\n")
+    );
+    // Nothing in this program is the bounded `(h * C) >>> 0` excursion shape, so the UB-prone
+    // unchecked truncation must not appear at all (#380).
+    assert!(
+        !rust.contains("to_int_unchecked"),
+        "no unchecked truncation may appear for an unbounded-magnitude program"
+    );
+}
+
+#[test]
+fn fnv_value_fn_uses_usize_for_loop() {
+    let src = r#"
+function fnv1a(n) {
+  let h = 2166136261
+  for (let i = 0; i < n; i++) {
+    h = h ^ (i & 255)
+    h = (h * 16777619) >>> 0
+    h = ((h << 13) | (h >>> 19)) >>> 0
+  }
+  return h >>> 0
+}
+let check = fnv1a(100)
+console.log(check)
+"#;
+    enable_typed_flags();
+    let rust = compile(&parse(src).unwrap()).unwrap();
+    assert!(
+        rust.contains("for _usize_i_0 in 0..(n as usize)"),
+        "fnv1a hot loop should lower to a usize `for` over param n:\n{}",
+        rust.lines().filter(|l| l.contains("usize") || l.contains("fnv1a")).take(6).collect::<Vec<_>>().join("\n")
+    );
+    assert!(
+        rust.contains("let mut h: i32 = (2166136261u32) as i32;"),
+        "accumulator h must stay on the i32 register path"
+    );
+}
+
+#[test]
+fn issue_174_unproven_leaf_keeps_guarded_to_int32() {
+    // SOUNDNESS: an f64 value that is NOT provably a finite integer (here a fractional accumulator —
+    // the range lattice drops it because `n = n + 0.5` is not integer-preserving) must KEEP the
+    // guarded `tishlang_runtime::to_int32`, never the unchecked truncation (a non-integer/NaN/±Inf
+    // input must map through the JS ToInt32 path, not a raw `to_int_unchecked`).
+    let src = r#"
+let n = 0.0
+for (let i = 0; i < 10; i = i + 1) { n = n + 0.5 }
+let m = n & 7
+console.log(m >>> 0)
+"#;
+    let rust = compile(&parse(src).unwrap()).unwrap();
+    // `n` is a top-level numeric used only at top level, so per #313 it is a native `let mut n: f64`
+    // local (not a `thread_local Cell` — no function references it). The soundness invariant is
+    // unchanged: the unproven fractional value must STILL pass through the guarded `to_int32` (not an
+    // unchecked truncation) before the `& 7` mask.
+    assert!(
+        rust.contains("tishlang_runtime::to_int32(n) & 7i32"),
+        "an unproven f64 leaf must keep the guarded to_int32 before the mask:\n{}",
+        rust.lines().filter(|l| l.contains("& ") || l.contains("to_int")).take(6).collect::<Vec<_>>().join("\n")
+    );
+    // The literal `7` still folds; only the unproven `n` keeps the guard.
+    assert!(rust.contains("7i32"), "the literal mask `7` still folds to a constant");
+}