@tishlang/tish-format 2.37.0 → 2.37.3

package/crates/tish_compile/src/infer.rs

@@ -283,7 +283,7 @@ fn param_infer_program(program: Program) -> Program {
     // numeric" (`return SHARED`) yet the caller passes e.g. `"arg"`, which the f64 coercion would
     // panic on / turn to NaN where JS keeps the value. Skip those fns (they stay fully boxed). Same
     // set `collect_native_fns` uses to refuse the M5 native form.
-    let nonnumeric = crate::codegen::Codegen::fns_called_with_nonnumeric_arg(&program.statements);
+    let nonnumeric = fns_with_unsafe_numeric_arg(&program.statements);
     // Soundness (#477): a fn referenced as a first-class VALUE — passed as a call ARGUMENT
     // (`serve(port, handler)`), assigned, returned, or stored, i.e. any use that is NOT a direct
     // `f(...)` call — escapes into the boxed `Value::Function` path and is later invoked via
@@ -322,6 +322,522 @@ fn escaping_fn_names(statements: &[Statement]) -> HashSet<String> {
     out
 }
 
+/// Shared candidate predicate: would param `pname` (unannotated, default-less) of a fn with `body`
+/// be M4-promoted to `: number` on the basis of its BODY uses (the #172 optimistic per-param
+/// fixpoint)? Used by BOTH pi_stmt (the promotion) and `numeric_candidate_positions` (the call-arg
+/// whitelist) so the two agree on exactly which positions are numeric candidates.
+fn param_is_body_numeric_candidate(body: &Statement, base_nums: &HashSet<String>, pname: &str) -> bool {
+    let mut nums = base_nums.clone();
+    nums.insert(pname.to_string());
+    collect_numeric_locals_fixpoint(body, &mut nums);
+    let copy_descendants: Vec<&String> = nums
+        .iter()
+        .filter(|x| x.as_str() != pname && !base_nums.contains(*x))
+        .collect();
+    nus_stmt(body, pname, &nums)
+        && copy_descendants.iter().all(|x| lns_stmt(body, x.as_str(), &nums))
+}
+
+/// analyze_aggregate's S-0 numeric-param set for one fn: the optimistic `pus_stmt` fixpoint (a param
+/// used only as an object-field VALUE / numeric operand is numeric). Shared with the call-arg
+/// whitelist so its candidate set covers what S-0 (via `stamp_numeric_params`) actually promotes.
+fn s0_numeric_candidates(params: &[FunParam], body: &Statement) -> HashSet<String> {
+    let mut nums = HashSet::new();
+    collect_numeric_locals_fixpoint(body, &mut nums);
+    let mut numeric_params: HashSet<String> = params
+        .iter()
+        .filter_map(|p| match p {
+            FunParam::Simple(tp) if tp.type_ann.is_none() && tp.default.is_none() => {
+                Some(tp.name.to_string())
+            }
+            _ => None,
+        })
+        .collect();
+    loop {
+        let mut local_nums = nums.clone();
+        for n in &numeric_params {
+            local_nums.insert(n.clone());
+        }
+        let drop: Vec<String> = numeric_params
+            .iter()
+            .filter(|n| !pus_stmt(body, n.as_str(), &local_nums))
+            .cloned()
+            .collect();
+        if drop.is_empty() {
+            break;
+        }
+        for n in drop {
+            numeric_params.remove(&n);
+        }
+    }
+    numeric_params
+}
+
+/// Per fn (top-level and nested), the parameter POSITIONS that are numeric candidates — i.e. either
+/// promotion path would M4-promote them to f64. The call-arg whitelist (#485/#477/#484) checks ONLY
+/// these positions, so array/object params (e.g. native-vec devirt) never disqualify a fn.
+pub(crate) fn numeric_candidate_positions(
+    statements: &[Statement],
+) -> std::collections::HashMap<String, Vec<(usize, String)>> {
+    let mut out = std::collections::HashMap::new();
+    ncp_stmt_list(statements, &mut out);
+    out
+}
+fn ncp_stmt_list(statements: &[Statement], out: &mut std::collections::HashMap<String, Vec<(usize, String)>>) {
+    for s in statements {
+        ncp_stmt(s, out);
+    }
+}
+fn ncp_stmt(s: &Statement, out: &mut std::collections::HashMap<String, Vec<(usize, String)>>) {
+    use Statement::*;
+    match s {
+        FunDecl { name, params, body, .. } => {
+            let mut base_nums = HashSet::new();
+            collect_numeric_locals_fixpoint(body, &mut base_nums);
+            // A position is a candidate if EITHER promotion path would take it: pi_stmt (nus_stmt) OR
+            // analyze_aggregate's S-0 (pus_stmt — which also accepts a param used as an object-field
+            // VALUE, e.g. `{ v: s }`). The whitelist must cover BOTH or a param S-0 promotes but
+            // pi_stmt doesn't (tishlang/tish#484) gets an f64 unbox with no call-arg check.
+            let s0 = s0_numeric_candidates(params, body);
+            let mut positions: Vec<(usize, String)> = Vec::new();
+            for (i, p) in params.iter().enumerate() {
+                if let FunParam::Simple(tp) = p {
+                    if tp.type_ann.is_none()
+                        && tp.default.is_none()
+                        && (param_is_body_numeric_candidate(body, &base_nums, tp.name.as_ref())
+                            || s0.contains(tp.name.as_ref()))
+                    {
+                        positions.push((i, tp.name.to_string()));
+                    }
+                }
+            }
+            if !positions.is_empty() {
+                out.insert(name.to_string(), positions);
+            }
+            ncp_stmt(body, out); // nested fns
+        }
+        Block { statements, .. } | Multi { statements, .. } => ncp_stmt_list(statements, out),
+        If { then_branch, else_branch, .. } => {
+            ncp_stmt(then_branch, out);
+            if let Some(e) = else_branch {
+                ncp_stmt(e, out);
+            }
+        }
+        While { body, .. }
+        | DoWhile { body, .. }
+        | For { body, .. }
+        | ForOf { body, .. }
+        | ForIn { body, .. } => ncp_stmt(body, out),
+        Try { body, catch_body, finally_body, .. } => {
+            ncp_stmt(body, out);
+            if let Some(c) = catch_body {
+                ncp_stmt(c, out);
+            }
+            if let Some(f) = finally_body {
+                ncp_stmt(f, out);
+            }
+        }
+        Switch { cases, default_body, .. } => {
+            for (_, b) in cases {
+                ncp_stmt_list(b, out);
+            }
+            if let Some(d) = default_body {
+                ncp_stmt_list(d, out);
+            }
+        }
+        Export { declaration, .. } => {
+            if let tishlang_ast::ExportDeclaration::Named(inner) = declaration.as_ref() {
+                ncp_stmt(inner, out);
+            }
+        }
+        _ => {}
+    }
+}
+
+// ---- interprocedural numeric-arg soundness (tishlang/tish#485/#477/#484) ----
+//
+// M4 promotes an unannotated param to native f64 and unboxes it at the (boxed) closure entry, which
+// panics `"expected number"` if a caller ever passes a non-number. Instead of BLACKLISTING the known
+// ways that happens (a non-numeric literal / an escaping fn / an await), compute — soundly, by
+// construction — which parameter POSITIONS provably receive only numbers, then disqualify any fn with
+// a body-numeric CANDIDATE position that is NOT provably numeric. An optimistic fixpoint (assume all
+// positions numeric, then drop any that a call site violates) makes pass-through params transitive:
+// `f(n)` where `n` is a numeric param of the caller stays numeric down the chain, back to a literal.
+
+#[derive(Clone)]
+enum ArgClass {
+    Num,                       // provably a number regardless of context (literal, arithmetic, Math)
+    NotNum,                    // provably NOT reliably a number (string/object/unknown-return call)
+    NeedsNumeric(Vec<String>), // a number iff every listed ident is numeric in the caller's context
+}
+
+struct CallSite {
+    caller: Option<String>, // enclosing fn (None = top level)
+    callee: String,
+    args: Vec<ArgClass>,
+    has_spread: bool,
+}
+
+fn arg_number_producing_call(callee: &Expr) -> bool {
+    match callee {
+        Expr::Ident { name, .. } => name.as_ref() == "Number",
+        Expr::Member { object, prop: tishlang_ast::MemberProp::Name { name: m, .. }, .. } => {
+            matches!(object.as_ref(), Expr::Ident { name, .. } if name.as_ref() == "Math")
+                && matches!(
+                    m.as_ref(),
+                    "sqrt" | "sin" | "cos" | "tan" | "abs" | "floor" | "ceil" | "exp" | "trunc"
+                        | "log" | "log2" | "log10" | "round" | "pow" | "min" | "max" | "sign"
+                        | "cbrt" | "atan" | "atan2" | "asin" | "acos" | "hypot" | "random"
+                )
+        }
+        _ => false,
+    }
+}
+
+fn combine_add(l: ArgClass, r: ArgClass) -> ArgClass {
+    match (l, r) {
+        (ArgClass::NotNum, _) | (_, ArgClass::NotNum) => ArgClass::NotNum,
+        (ArgClass::Num, ArgClass::Num) => ArgClass::Num,
+        (ArgClass::Num, x) | (x, ArgClass::Num) => x,
+        (ArgClass::NeedsNumeric(mut a), ArgClass::NeedsNumeric(b)) => {
+            a.extend(b);
+            ArgClass::NeedsNumeric(a)
+        }
+    }
+}
+
+fn classify_arg(e: &Expr) -> ArgClass {
+    use tishlang_ast::BinOp::*;
+    match e {
+        Expr::Literal { value: Literal::Number(_), .. } => ArgClass::Num,
+        Expr::Ident { name, .. } => ArgClass::NeedsNumeric(vec![name.to_string()]),
+        // `-`,`*`,`/`,`%`,`**`, bitwise/shift JS-ToNumber unconditionally → always a number.
+        Expr::Binary {
+            op: Sub | Mul | Div | Mod | Pow | BitAnd | BitOr | BitXor | Shl | Shr | UShr,
+            ..
+        } => ArgClass::Num,
+        // `+` is a number only if BOTH sides are (else string concat).
+        Expr::Binary { op: Add, left, right, .. } => {
+            combine_add(classify_arg(left), classify_arg(right))
+        }
+        Expr::Unary {
+            op:
+                tishlang_ast::UnaryOp::Neg
+                | tishlang_ast::UnaryOp::Pos
+                | tishlang_ast::UnaryOp::BitNot,
+            ..
+        } => ArgClass::Num,
+        Expr::Call { callee, .. } | Expr::New { callee, .. } => {
+            if arg_number_producing_call(callee) {
+                ArgClass::Num
+            } else {
+                ArgClass::NotNum
+            }
+        }
+        _ => ArgClass::NotNum,
+    }
+}
+
+fn arg_ok(ac: &ArgClass, ctx: &HashSet<String>) -> bool {
+    match ac {
+        ArgClass::Num => true,
+        ArgClass::NotNum => false,
+        ArgClass::NeedsNumeric(idents) => idents.iter().all(|n| ctx.contains(n)),
+    }
+}
+
+// Collect (param-name-list, numeric-locals) for every fn (top-level and nested).
+fn cfm_stmt(
+    s: &Statement,
+    params: &mut std::collections::HashMap<String, Vec<String>>,
+    locals: &mut std::collections::HashMap<String, HashSet<String>>,
+) {
+    use Statement::*;
+    match s {
+        FunDecl { name, params: ps, body, .. } => {
+            let pnames: Vec<String> = ps
+                .iter()
+                .map(|p| match p {
+                    FunParam::Simple(tp) => tp.name.to_string(),
+                    _ => String::new(),
+                })
+                .collect();
+            params.insert(name.to_string(), pnames);
+            let mut nums = HashSet::new();
+            collect_numeric_locals_fixpoint(body, &mut nums);
+            locals.insert(name.to_string(), nums);
+            cfm_stmt(body, params, locals);
+        }
+        Block { statements, .. } | Multi { statements, .. } => {
+            for x in statements {
+                cfm_stmt(x, params, locals);
+            }
+        }
+        If { then_branch, else_branch, .. } => {
+            cfm_stmt(then_branch, params, locals);
+            if let Some(e) = else_branch {
+                cfm_stmt(e, params, locals);
+            }
+        }
+        While { body, .. } | DoWhile { body, .. } | For { body, .. } | ForOf { body, .. }
+        | ForIn { body, .. } => cfm_stmt(body, params, locals),
+        Try { body, catch_body, finally_body, .. } => {
+            cfm_stmt(body, params, locals);
+            if let Some(c) = catch_body {
+                cfm_stmt(c, params, locals);
+            }
+            if let Some(f) = finally_body {
+                cfm_stmt(f, params, locals);
+            }
+        }
+        Switch { cases, default_body, .. } => {
+            for (_, b) in cases {
+                for x in b {
+                    cfm_stmt(x, params, locals);
+                }
+            }
+            if let Some(d) = default_body {
+                for x in d {
+                    cfm_stmt(x, params, locals);
+                }
+            }
+        }
+        Export { declaration, .. } => {
+            if let tishlang_ast::ExportDeclaration::Named(inner) = declaration.as_ref() {
+                cfm_stmt(inner, params, locals);
+            }
+        }
+        _ => {}
+    }
+}
+
+// Record every direct `f(...)` call in `e`, tagged with the enclosing fn; recurse into sub-exprs.
+fn collect_calls_expr(e: &Expr, encl: &Option<String>, out: &mut Vec<CallSite>) {
+    if let Expr::Call { callee, args, .. } | Expr::New { callee, args, .. } = e {
+        if let Expr::Ident { name, .. } = callee.as_ref() {
+            let mut classes = Vec::new();
+            let mut has_spread = false;
+            for a in args {
+                match a {
+                    CallArg::Expr(x) => classes.push(classify_arg(x)),
+                    CallArg::Spread(_) => has_spread = true,
+                }
+            }
+            out.push(CallSite {
+                caller: encl.clone(),
+                callee: name.to_string(),
+                args: classes,
+                has_spread,
+            });
+        }
+    }
+    walk_exprs_expr(e, &mut |sub| {
+        if let Expr::Call { callee, args, .. } | Expr::New { callee, args, .. } = sub {
+            if !std::ptr::eq(sub, e) {
+                if let Expr::Ident { name, .. } = callee.as_ref() {
+                    let mut classes = Vec::new();
+                    let mut has_spread = false;
+                    for a in args {
+                        match a {
+                            CallArg::Expr(x) => classes.push(classify_arg(x)),
+                            CallArg::Spread(_) => has_spread = true,
+                        }
+                    }
+                    out.push(CallSite {
+                        caller: encl.clone(),
+                        callee: name.to_string(),
+                        args: classes,
+                        has_spread,
+                    });
+                }
+            }
+        }
+    });
+}
+
+fn collect_calls_stmt(s: &Statement, encl: &Option<String>, out: &mut Vec<CallSite>) {
+    use Statement::*;
+    match s {
+        FunDecl { name, body, .. } => {
+            let inner = Some(name.to_string());
+            collect_calls_stmt(body, &inner, out);
+        }
+        Block { statements, .. } | Multi { statements, .. } => {
+            for x in statements {
+                collect_calls_stmt(x, encl, out);
+            }
+        }
+        VarDecl { init: Some(e), .. } => collect_calls_expr(e, encl, out),
+        VarDeclDestructure { init, .. } => collect_calls_expr(init, encl, out),
+        ExprStmt { expr, .. } => collect_calls_expr(expr, encl, out),
+        Return { value: Some(e), .. } | Throw { value: e, .. } => collect_calls_expr(e, encl, out),
+        If { cond, then_branch, else_branch, .. } => {
+            collect_calls_expr(cond, encl, out);
+            collect_calls_stmt(then_branch, encl, out);
+            if let Some(e) = else_branch {
+                collect_calls_stmt(e, encl, out);
+            }
+        }
+        While { cond, body, .. } | DoWhile { cond, body, .. } => {
+            collect_calls_expr(cond, encl, out);
+            collect_calls_stmt(body, encl, out);
+        }
+        For { init, cond, update, body, .. } => {
+            if let Some(i) = init {
+                collect_calls_stmt(i, encl, out);
+            }
+            if let Some(c) = cond {
+                collect_calls_expr(c, encl, out);
+            }
+            if let Some(u) = update {
+                collect_calls_expr(u, encl, out);
+            }
+            collect_calls_stmt(body, encl, out);
+        }
+        ForOf { iterable, body, .. } | ForIn { object: iterable, body, .. } => {
+            collect_calls_expr(iterable, encl, out);
+            collect_calls_stmt(body, encl, out);
+        }
+        Switch { expr, cases, default_body, .. } => {
+            collect_calls_expr(expr, encl, out);
+            for (g, b) in cases {
+                if let Some(ge) = g {
+                    collect_calls_expr(ge, encl, out);
+                }
+                for x in b {
+                    collect_calls_stmt(x, encl, out);
+                }
+            }
+            if let Some(d) = default_body {
+                for x in d {
+                    collect_calls_stmt(x, encl, out);
+                }
+            }
+        }
+        Try { body, catch_body, finally_body, .. } => {
+            collect_calls_stmt(body, encl, out);
+            if let Some(c) = catch_body {
+                collect_calls_stmt(c, encl, out);
+            }
+            if let Some(f) = finally_body {
+                collect_calls_stmt(f, encl, out);
+            }
+        }
+        Export { declaration, .. } => {
+            if let tishlang_ast::ExportDeclaration::Named(inner) = declaration.as_ref() {
+                collect_calls_stmt(inner, encl, out);
+            }
+        }
+        _ => {}
+    }
+}
+
+/// SOUND replacement for the "nonnumeric arg" blacklist (tishlang/tish#485/#477/#484): a per-position
+/// interprocedural fixpoint. Returns the set of fns that have a body-numeric CANDIDATE param position
+/// which is NOT provably fed numbers at every call site — those must stay boxed (not `: number`).
+pub(crate) fn fns_with_unsafe_numeric_arg(statements: &[Statement]) -> HashSet<String> {
+    let cand = numeric_candidate_positions(statements);
+    if cand.is_empty() {
+        return HashSet::new();
+    }
+    let mut all_params: std::collections::HashMap<String, Vec<String>> =
+        std::collections::HashMap::new();
+    let mut fn_locals: std::collections::HashMap<String, HashSet<String>> =
+        std::collections::HashMap::new();
+    for s in statements {
+        cfm_stmt(s, &mut all_params, &mut fn_locals);
+    }
+    // Top-level numeric locals — run a fixpoint ACROSS statements so a chain propagates
+    // (`let PI = …; let SOLAR_MASS = 4 * PI * PI` ⇒ both numeric, so `body(…, SOLAR_MASS)` is safe).
+    let mut top_nums = HashSet::new();
+    loop {
+        let before = top_nums.len();
+        for s in statements {
+            collect_numeric_locals_fixpoint(s, &mut top_nums);
+        }
+        if top_nums.len() == before {
+            break;
+        }
+    }
+    let mut calls = Vec::new();
+    for s in statements {
+        collect_calls_stmt(s, &None, &mut calls);
+    }
+
+    // numeric_pos[f] = positions currently believed to receive only numbers. Start optimistic (all).
+    let mut numeric_pos: std::collections::HashMap<String, HashSet<usize>> = all_params
+        .iter()
+        .map(|(f, ps)| (f.clone(), (0..ps.len()).collect()))
+        .collect();
+
+    loop {
+        let mut changed = false;
+        for cs in &calls {
+            if !numeric_pos.contains_key(&cs.callee) {
+                continue;
+            }
+            // Caller context: its numeric locals + params whose position is still numeric.
+            let ctx: HashSet<String> = match &cs.caller {
+                None => top_nums.clone(),
+                Some(c) => {
+                    // Top-level numeric globals (`SOLAR_MASS`, `PI`, …) are numeric inside every fn,
+                    // plus this fn's numeric locals + its still-numeric params.
+                    let mut ctx = top_nums.clone();
+                    ctx.extend(fn_locals.get(c).cloned().unwrap_or_default());
+                    if let (Some(ps), Some(np)) = (all_params.get(c), numeric_pos.get(c)) {
+                        for &pos in np {
+                            if let Some(n) = ps.get(pos) {
+                                ctx.insert(n.clone());
+                            }
+                        }
+                    }
+                    ctx
+                }
+            };
+            let arity = all_params.get(&cs.callee).map(|p| p.len()).unwrap_or(0);
+            let set = numeric_pos.get_mut(&cs.callee).unwrap();
+            if cs.has_spread {
+                if !set.is_empty() {
+                    set.clear();
+                    changed = true;
+                }
+                continue;
+            }
+            for pos in 0..arity {
+                if !set.contains(&pos) {
+                    continue;
+                }
+                let ok = match cs.args.get(pos) {
+                    Some(ac) => arg_ok(ac, &ctx),
+                    None => false, // missing arg → undefined/Null → not a number
+                };
+                if !ok {
+                    set.remove(&pos);
+                    changed = true;
+                }
+            }
+        }
+        if !changed {
+            break;
+        }
+    }
+
+    let mut disq = HashSet::new();
+    for (f, positions) in &cand {
+        match numeric_pos.get(f) {
+            Some(np) => {
+                if positions.iter().any(|(pos, _)| !np.contains(pos)) {
+                    disq.insert(f.clone());
+                }
+            }
+            None => {
+                disq.insert(f.clone());
+            }
+        }
+    }
+    disq
+}
+
 fn pi_stmt(s: Statement, nonnumeric: &HashSet<String>, escaping: &HashSet<String>) -> Statement {
     if let Statement::FunDecl {
         async_,
@@ -374,21 +890,9 @@ fn pi_stmt(s: Statement, nonnumeric: &HashSet<String>, escaping: &HashSet<String
                     // Monotone, locals/param-candidate-only.
                     if tp.type_ann.is_none()
                         && tp.default.is_none()
+                        && param_is_body_numeric_candidate(&body, &base_nums, tp.name.as_ref())
                     {
-                        let mut nums = base_nums.clone();
-                        nums.insert(tp.name.to_string());
-                        collect_numeric_locals_fixpoint(&body, &mut nums);
-                        let copy_descendants: Vec<&String> = nums
-                            .iter()
-                            .filter(|x| x.as_str() != tp.name.as_ref() && !base_nums.contains(*x))
-                            .collect();
-                        if nus_stmt(&body, tp.name.as_ref(), &nums)
-                            && copy_descendants
-                                .iter()
-                                .all(|x| lns_stmt(&body, x.as_str(), &nums))
-                        {
-                            tp.type_ann = Some(TypeAnnotation::Simple(std::sync::Arc::from("number"), tishlang_ast::Span::default()));
-                        }
+                        tp.type_ann = Some(TypeAnnotation::Simple(std::sync::Arc::from("number"), tishlang_ast::Span::default()));
                     }
                     FunParam::Simple(tp)
                 }
@@ -484,7 +988,7 @@ fn collect_numeric_locals(s: &Statement, out: &mut HashSet<String>) {
 /// names (a copy of an already-numeric source), so it converges in at most one pass per copy-chain
 /// link; the `out.len()` watermark detects quiescence. Soundness: every added name is a copy of a
 /// value already proven/assumed numeric, the same basis as the literal seeding.
-fn collect_numeric_locals_fixpoint(body: &Statement, out: &mut HashSet<String>) {
+pub(crate) fn collect_numeric_locals_fixpoint(body: &Statement, out: &mut HashSet<String>) {
     loop {
         let before = out.len();
         collect_numeric_locals(body, out);
@@ -3710,7 +4214,7 @@ pub fn analyze_aggregate(program: &Program) -> AggregateAnalysis {
     // params either — `fn makeRecord(id, name){ return {id, name} }` called `makeRecord(1, "Alice")`
     // would otherwise emit a `match … panic!("expected number")` coercion on the String. Same set the
     // M4 `param_infer` path uses (infer.rs:273).
-    let nonnumeric = crate::codegen::Codegen::fns_called_with_nonnumeric_arg(&program.statements);
+    let nonnumeric = fns_with_unsafe_numeric_arg(&program.statements);
     // Soundness (#477): a fn referenced as a first-class VALUE (a `serve` handler / stored callback)
     // is invoked via the boxed `Value::Function` path with arbitrary runtime Values, so — exactly as
     // in `param_infer_program` — its params must NOT get an S-0 `: number` shadow either. Without this

package/crates/tish_compile/src/types.rs

@@ -390,13 +390,18 @@ impl RustType {
                 let field_assigns = fields
                     .iter()
                     .map(|(k, ty)| {
-                        let fetch = format!("tishlang_runtime::get_prop(&_src, {:?})", k.as_ref());
+                        let fetch = format!("tishlang_runtime::get_prop(_src, {:?})", k.as_ref());
                         format!("{}: {}", field_ident(k), ty.from_value_expr(&fetch))
                     })
                     .collect::<Vec<_>>()
                     .join(", ");
+                // Bind `_src` as a BORROW (not a move) of the source Value: field fetches only need
+                // `&Value` (get_prop borrows), and moving would use-after-move a caller-owned temp —
+                // e.g. an assignment-as-expression `{ let _v = obj; lhs = <coerce _v>; _v }` reuses
+                // `_v` for its value (tishlang/tish#486). `&(expr)` evaluates the source once and
+                // (for a temporary) lifetime-extends it to this block, so it's still single-eval.
                 format!(
-                    "{{ let _src = {}; {} {{ {} }} }}",
+                    "{{ let _src = &({}); {} {{ {} }} }}",
                     value_expr,
                     named_struct_ident(name),
                     field_assigns

package/crates/tish_compile/tests/regr_484_obj_field_param.rs

@@ -0,0 +1,18 @@
+//! tishlang/tish#484 — a string param used only as an object-field VALUE (`{ v: s }`) must not be
+//! native-promoted to f64. analyze_aggregate's S-0 (`pus_stmt`) treats a field-value param as
+//! numeric; the call-arg whitelist must cover S-0's candidate set, so `f("hello")` disqualifies f.
+use std::path::PathBuf;
+use tishlang_compile::compile_project_full;
+fn compile(rel: &str) -> String {
+    let manifest = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let path = manifest.join("../..").join(rel).canonicalize().unwrap();
+    compile_project_full(&path, path.parent(), &[], true).unwrap().0
+}
+#[test]
+fn obj_field_string_param_stays_boxed() {
+    for f in ["tests/regression/obj_field_string_param.tish", "tests/regression/async_param_across_await.tish"] {
+        let rust = compile(f);
+        let bad: Vec<&str> = rust.lines().filter(|l| l.contains("expected number")).collect();
+        assert!(bad.is_empty(), "{f}: string field-value param must not f64-unbox:\n{}", bad.join("\n"));
+    }
+}

package/crates/tish_compile/tests/regr_e0382_typed_struct.rs

@@ -0,0 +1,26 @@
+//! tishlang/tish#486 — a typed nullable-struct local reassigned to a struct literal in a conditional
+//! must not emit a Value→struct coercion that MOVES the source temp, because the assignment-as-
+//! expression wrapper (`{ let _v = obj; lhs = <coerce _v>; _v }`) reuses that temp for its value —
+//! moving it produced `error[E0382]: use of moved value`. The coercion must borrow the source.
+use std::path::PathBuf;
+use tishlang_compile::compile_project_full;
+
+fn compile(rel: &str) -> String {
+    let manifest = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let path = manifest.join("../..").join(rel).canonicalize().unwrap();
+    compile_project_full(&path, path.parent(), &[], true).unwrap().0
+}
+
+#[test]
+fn typed_struct_coercion_borrows_source() {
+    let rust = compile("tests/regression/typed_struct_cond_assign.tish");
+    // The Value→struct coercion must bind `_src` by BORROW, never by moving a bare temp.
+    assert!(
+        rust.contains("let _src = &("),
+        "expected the struct coercion to borrow its source (`let _src = &(...)`)"
+    );
+    assert!(
+        !rust.contains("let _src = _v;"),
+        "tishlang/tish#486: struct coercion must not MOVE the wrapper temp `_v` (use-after-move / E0382)"
+    );
+}

package/crates/tish_compile/tests/regr_numeric_arg_whitelist.rs

@@ -0,0 +1,29 @@
+//! tishlang/tish#485/#477/#484 — SYSTEMIC: a param is native-promoted to f64 only if the
+//! interprocedural per-position fixpoint proves every call site feeds it numbers. #485's
+//! return-either-param helper (called with string|null results) must NOT get an f64 unbox; the
+//! recursive + pass-through numeric fns MUST still promote (no perf regression).
+use std::path::PathBuf;
+use tishlang_compile::compile_project_full;
+
+fn compile(rel: &str) -> String {
+    let manifest = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let path = manifest.join("../..").join(rel).canonicalize().unwrap();
+    compile_project_full(&path, path.parent(), &[], true).unwrap().0
+}
+
+#[test]
+fn unsafe_numeric_arg_stays_boxed_no_f64_unbox() {
+    let rust = compile("tests/regression/f64_return_either_param.tish");
+    let bad: Vec<&str> = rust.lines().filter(|l| l.contains("expected number")).collect();
+    assert!(bad.is_empty(), "no fn here does arithmetic; nothing should f64-unbox:\n{}", bad.join("\n"));
+}
+
+#[test]
+fn recursive_and_passthrough_numeric_fns_still_promote() {
+    let rust = compile("tests/regression/numeric_arg_whitelist.tish");
+    // fib(n-1)/fib(n-2): n is arithmetic → promoted; work(n) via driver's param n → pass-through.
+    assert!(
+        rust.contains("fib") && (rust.contains(": f64") || rust.contains("Value::Number")),
+        "recursive/pass-through numeric params must still get the native f64 fast path"
+    );
+}

package/crates/tish_fmt/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tishlang_fmt"
-version = "2.37.0"
+version = "2.37.3"
 edition = "2021"
 description = "Opinionated formatter for Tish source (parse → pretty-print)"
 license-file = { workspace = true }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tishlang/tish-format",
-  "version": "2.37.0",
+  "version": "2.37.3",
   "description": "Tish code formatter",
   "license": "PIF",
   "repository": {