gofront 1.6.1 → 1.8.0

package/src/link/wasm.js

@@ -0,0 +1,294 @@
+// Linking of `wasm`/`both` package units into one `app.wasm`: unit
+// registration, collision checks, link-copy AST rewrites and the facade splice.
+
+import { compileWasmModule } from "../backend/wasm/index.js";
+import { lower } from "../lower/index.js";
+import { reachableStdlibDecls } from "../lower/reachability.js";
+import { forEachChild } from "../lower/walk.js";
+import { TypeCheckError, TypeChecker } from "../typechecker/index.js";
+
+// ── WASM linking ──────────────────────────────────────────────
+//
+// Every `wasm`/`both` package reached during a build registers a unit in the
+// shared `options.wasmUnits` array.  The root compile links all units into a
+// single `app.wasm` and splices the generated JS facade into the bundle where
+// the first wasm package's JS would have been.
+
+const WASM_MARKER_RE = /^\/\*__GOFRONT_WASM_UNIT:[^*]*\*\/$/m;
+
+export function wasmMarker(pkgName) {
+	return `/*__GOFRONT_WASM_UNIT:${pkgName}*/`;
+}
+
+export function registerWasmUnit(options, unit) {
+	const units = options.wasmUnits;
+	if (!units) return;
+	if (units.some((u) => u.key === unit.key)) return;
+	units.push(unit);
+}
+
+// Registers a `wasm`/`both` package as a link unit and returns the target the
+// package's own code is emitted for.  `options.wasmTests` runs a `both`
+// package's tests through the wasm backend (the package is then treated as
+// `wasm` for linking so its test functions are exposed by the facade).
+export function registerPackageUnit(options, unit) {
+	const { pkgTarget, programs } = unit;
+	if (pkgTarget !== "wasm" && pkgTarget !== "both") return pkgTarget;
+	const emitTarget =
+		options.wasmTests && options.isTest && pkgTarget === "both"
+			? "wasm"
+			: pkgTarget;
+	registerWasmUnit(options, {
+		...unit,
+		target: emitTarget,
+		programs:
+			emitTarget === pkgTarget
+				? programs
+				: programs.map((p) => ({ ...p, target: emitTarget })),
+	});
+	return emitTarget;
+}
+
+function linkWasmUnits(
+	units,
+	{ emitWat = false, rootTarget = "js", sourceMappingURL = null } = {},
+) {
+	if (!units.some((u) => u.target === "wasm")) return null;
+	checkLinkCollisions(units);
+
+	const types = new Map();
+	const bundledPackages = new Set();
+	const programs = [];
+	const stdlibPrograms = [];
+	for (const u of units) {
+		for (const b of u.bundledPackages) bundledPackages.add(b);
+		const copies = u.programs.map((p) => cloneAstForWasm(p));
+		programs.push(...copies);
+		if (u.key.startsWith("stdlib:")) stdlibPrograms.push(...copies);
+	}
+	lowerStdlibRefs(programs);
+	dequalifyBundledRefs(programs, bundledPackages);
+	const keepType = pruneStdlibPrograms(programs, stdlibPrograms);
+	for (const u of units)
+		for (const [k, v] of u.types) if (keepType(v)) types.set(k, v);
+	const checker = Object.assign(new TypeChecker(), {
+		types,
+		errors: [],
+		err(msg, node) {
+			const e = new TypeCheckError(
+				msg,
+				node,
+				this._currentFile,
+				this._currentSource,
+			);
+			this.errors.push(e);
+			return e;
+		},
+	});
+	const lowerRes = lower(programs, checker);
+	return compileWasmModule(programs, checker, lowerRes, {
+		boundary: true,
+		bundledPackages,
+		emitWat,
+		callMain: rootTarget === "wasm",
+		sourceMappingURL,
+	});
+}
+
+// The WASM pipeline rewrites ASTs in place (package dequalification,
+// monomorphisation, variadic desugaring).  Parsed ASTs are cached across
+// builds and shared with JS codegen, so the link works on a structural copy;
+// side tables (`_type`, …) are shared by reference.
+function cloneAstForWasm(node, seen = new Map()) {
+	if (!node || typeof node !== "object") return node;
+	const prev = seen.get(node);
+	if (prev) return prev;
+	const copy = Array.isArray(node) ? [] : {};
+	seen.set(node, copy);
+	if (Array.isArray(node)) {
+		for (const n of node) copy.push(cloneAstForWasm(n, seen));
+		return copy;
+	}
+	for (const [k, v] of Object.entries(node)) {
+		copy[k] = k.charCodeAt(0) === 95 ? v : cloneAstForWasm(v, seen);
+	}
+	return copy;
+}
+
+// Drops unreachable Go-source stdlib declarations from the link copy and
+// returns a filter that drops their (mangled) named types.
+function pruneStdlibPrograms(programs, stdlibPrograms) {
+	if (stdlibPrograms.length === 0) return () => true;
+	const std = new Set(stdlibPrograms);
+	const reached = reachableStdlibDecls(
+		programs.filter((p) => !std.has(p)),
+		stdlibPrograms,
+	);
+	const types = new Set();
+	for (const p of stdlibPrograms) {
+		p.decls = p.decls.filter((d) => reached.has(d));
+		for (const d of p.decls) if (d.kind === "TypeDecl") types.add(d.name);
+	}
+	return (t) => {
+		const name = typeof t?.name === "string" ? t.name : "";
+		return !name.includes("$$") || types.has(name.replace(/\[.*$/, ""));
+	};
+}
+
+// The linked module is flat, so `util.Two` names the top-level `Two`.  Done on
+// the link copy before monomorphisation, whose re-check of all programs has no
+// package namespaces.  A local variable that shadows the package is typed and
+// is left alone.
+function isBundledSelector(node, bundled) {
+	const base = node.expr;
+	return (
+		base?.kind === "Ident" &&
+		bundled.has(base.name) &&
+		(base._type == null || base._type.kind === "namespace")
+	);
+}
+
+function dequalifyBundledRefs(node, bundled) {
+	if (!node || typeof node !== "object") return;
+	if (Array.isArray(node)) {
+		for (const n of node) dequalifyBundledRefs(n, bundled);
+		return;
+	}
+	if (node.kind === "SelectorExpr" && isBundledSelector(node, bundled)) {
+		node.kind = "Ident";
+		node.name = node.field;
+		delete node.expr;
+		delete node.field;
+	} else if (node.kind === "TypeName" || node.kind === "GenericTypeName") {
+		const dot = node.name?.indexOf(".") ?? -1;
+		if (dot > 0 && bundled.has(node.name.slice(0, dot)))
+			node.name = node.name.slice(dot + 1);
+	}
+	forEachChild(node, (child) => dequalifyBundledRefs(child, bundled));
+}
+
+// The linked module is one flat namespace (like the JS bundle), so a top-level
+// name declared by two different packages would silently resolve to whichever
+// was emitted last.  Reject it up front.
+function topLevelDeclNames(decl) {
+	switch (decl.kind) {
+		case "FuncDecl":
+			return [decl.name];
+		case "MethodDecl":
+			return [`${decl.recvType?.name ?? "?"}.${decl.name}`];
+		case "TypeDecl":
+			return [decl.name];
+		case "VarDecl":
+		case "ConstDecl":
+			return (decl.decls ?? []).flatMap((spec) => spec.names ?? []);
+		default:
+			return [];
+	}
+}
+
+export function checkLinkCollisions(units) {
+	const owner = new Map(); // name -> pkgName
+	const errors = [];
+	for (const u of units) {
+		for (const p of u.programs) {
+			for (const d of p.decls ?? []) {
+				for (const name of topLevelDeclNames(d)) {
+					if (name === "_") continue;
+					const prev = owner.get(name);
+					if (prev === undefined) owner.set(name, u.pkgName);
+					else if (prev !== u.pkgName)
+						errors.push(
+							`cannot link wasm packages: '${name}' is declared in both '${prev}' and '${u.pkgName}' (linked wasm packages share one namespace)`,
+						);
+				}
+			}
+		}
+	}
+	if (errors.length > 0) throw new Error([...new Set(errors)].join("\n"));
+}
+
+// Replaces the first wasm marker with the facade (dropping the others) and
+// shifts source-map lines that follow it.
+function spliceFacade(merged, facade) {
+	const lines = merged.js.split("\n");
+	const first = lines.findIndex((l) => WASM_MARKER_RE.test(l));
+	if (first < 0) {
+		merged.js = `${facade}\n${merged.js}`;
+		const shift = facade.split("\n").length;
+		for (const m of merged.mappings) m.genLine += shift;
+		return;
+	}
+	const facadeLines = facade.split("\n");
+	const delta = facadeLines.length - 1;
+	for (const m of merged.mappings) {
+		if (m.genLine > first) m.genLine += delta;
+	}
+	const out = [...lines.slice(0, first), ...facadeLines];
+	for (let i = first + 1; i < lines.length; i++) {
+		if (!WASM_MARKER_RE.test(lines[i])) out.push(lines[i]);
+	}
+	merged.js = out.join("\n");
+}
+
+// Root compiles only: link every registered unit into app.wasm and splice the
+// facade into the merged bundle.  Returns `{ wasm, wat, sourceMapInfo }`
+// (nulls when there is nothing to link).
+export function linkIntoBundle(
+	options,
+	merged,
+	pkgTarget,
+	{ sourceMappingURL } = {},
+) {
+	const none = { wasm: null, wat: null, sourceMapInfo: null };
+	if (options.isDependency) return none;
+	const linked = linkWasmUnits(options.wasmUnits, {
+		emitWat: options.emitWat,
+		rootTarget: pkgTarget,
+		sourceMappingURL,
+	});
+	if (!linked) return none;
+	spliceFacade(merged, linked.facade);
+	return {
+		wasm: linked.wasm,
+		wat: linked.wat ?? null,
+		sourceMapInfo: linked.sourceMapInfo ?? null,
+	};
+}
+
+// Turns `cmp.Compare` / `cmp.Ordered` references (marked `_stdName` by the
+// checker) into plain identifiers with the mangled name, so WASM
+// monomorphisation sees ordinary top-level references.  Only for ASTs that
+// are not cached: a stdlib package's own parse and the WASM link copy (user
+// ASTs are re-checked on the next build; the JS backend reads `_stdName`).
+export function lowerStdlibRefs(node) {
+	if (!node || typeof node !== "object") return;
+	if (Array.isArray(node)) {
+		for (const n of node) lowerStdlibRefs(n);
+		return;
+	}
+	if (node._stdName) {
+		if (node.kind === "SelectorExpr") {
+			delete node.expr;
+			delete node.field;
+			node.kind = "Ident";
+		}
+		node.name = node._stdName;
+		delete node._stdName;
+	}
+	if (node.kind === "CallExpr" && node.func?._jsonStream) {
+		const entry = node.func._jsonGen;
+		node.args.unshift(node.func.expr);
+		delete node.func.expr;
+		delete node.func.field;
+		delete node.func._jsonStream;
+		delete node.func._jsonGen;
+		node.func.kind = "Ident";
+		node.func.name = entry;
+	} else if (node._jsonGen && node.kind === "SelectorExpr") {
+		delete node.expr;
+		delete node.field;
+		node.kind = "Ident";
+		node.name = node._jsonGen;
+	}
+	forEachChild(node, lowerStdlibRefs);
+}

package/src/lower/bounds.js

@@ -0,0 +1,394 @@
+// src/lower/bounds.js
+// Index-check elision for strict mode (`both` packages in JS).  Marks an
+// IndexExpr `_inBounds` when its index is provably within the operand's
+// length, so the backend emits a plain `xs[i]` instead of `__at`/`__ix`:
+//
+//   - `for i := range xs { … xs[i] … }`
+//   - `for i := K; i < len(xs); i++ { … xs[i] … }` with a constant K >= 0
+//   - a constant index into an array (the checker rejects out-of-range ones)
+//   - constant indexes into a slice after a length proof: the hint `_ = xs[K]`,
+//     `if len(xs) > K { … }`, or `if len(xs) <= K { return }` (also `>=`, `<`
+//     and the mirrored `K < len(xs)` forms); proves `xs[0]` through `xs[K]`
+//
+
+// The loop forms need `xs` to be a local slice or array that the body never
+// assigns or shadows, `i` to be written only by the loop, and neither to be
+// address-taken, used as a method receiver, or assigned inside any closure
+// in the function.  Indexes inside func literals in the body are not marked:
+// a closure may run after the loop, when `xs` has changed.
+
+import { constIntValue } from "../typechecker/const-fold.js";
+import { forEachChild } from "./walk.js";
+
+function underlying(t) {
+	return t?.kind === "named" ? underlying(t.underlying) : t;
+}
+
+function isSliceOrArray(t) {
+	const u = underlying(t);
+	return u?.kind === "slice" || u?.kind === "array";
+}
+
+function constInt(node) {
+	const v = node?._const ? constIntValue(node._const) : null;
+	return typeof v === "bigint" ? v : null;
+}
+
+function isIdent(node, name) {
+	return node?.kind === "Ident" && (name === undefined || node.name === name);
+}
+
+// Names a node makes unsafe to reason about: taken by address, or used as a
+// selector base (a possible pointer-receiver method call).
+function unsafeNamesOf(node) {
+	if (node.kind === "UnaryExpr" && node.op === "&" && isIdent(node.operand))
+		return [node.operand.name];
+	if (node.kind === "SelectorExpr" && isIdent(node.expr))
+		return [node.expr.name];
+	return [];
+}
+
+// Names that are unsafe anywhere in the function: see unsafeNamesOf, plus
+// every name assigned inside a closure.
+function collectUnsafeNames(fnBody) {
+	const unsafe = new Set();
+	const visit = (node, inClosure) => {
+		if (!node || typeof node !== "object") return;
+		if (Array.isArray(node)) {
+			for (const n of node) visit(n, inClosure);
+			return;
+		}
+		const names = inClosure
+			? [...unsafeNamesOf(node), ...assignedNames(node)]
+			: unsafeNamesOf(node);
+		for (const n of names) unsafe.add(n);
+		forEachChild(node, (c) => visit(c, inClosure || node.kind === "FuncLit"));
+	};
+	visit(fnBody, false);
+	return unsafe;
+}
+
+// Identifiers a single node assigns to (not declarations).
+function assignedNames(node) {
+	if (node.kind === "AssignStmt")
+		return node.lhs.filter((l) => isIdent(l)).map((l) => l.name);
+	if (node.kind === "IncDecStmt" && isIdent(node.expr)) return [node.expr.name];
+	return [];
+}
+
+// Identifiers a single node declares.
+function declaredNames(node) {
+	switch (node.kind) {
+		case "DefineStmt":
+			return node.lhs.filter((l) => isIdent(l)).map((l) => l.name);
+		case "VarDecl":
+			return (node.decls ?? []).flatMap((d) =>
+				(d.names ?? []).map((n) => (typeof n === "string" ? n : n?.name)),
+			);
+		case "FuncLit":
+			return (node.params ?? []).map((p) => p.name).filter(Boolean);
+		case "TypeSwitchStmt":
+			return node.assign ? [node.assign] : [];
+		default:
+			return [];
+	}
+}
+
+// True when `body` assigns or redeclares any of `names`.
+function touches(body, names) {
+	let hit = false;
+	const visit = (node) => {
+		if (hit || !node || typeof node !== "object") return;
+		if (Array.isArray(node)) {
+			for (const n of node) visit(n);
+			return;
+		}
+		for (const n of [...assignedNames(node), ...declaredNames(node)])
+			if (names.includes(n)) hit = true;
+		forEachChild(node, visit);
+	};
+	visit(body);
+	return hit;
+}
+
+// Marks `xs[i]` in `body`, outside func literals.
+function markIndexes(body, xs, i) {
+	const visit = (node) => {
+		if (!node || typeof node !== "object") return;
+		if (Array.isArray(node)) {
+			for (const n of node) visit(n);
+			return;
+		}
+		if (node.kind === "FuncLit") return;
+		if (
+			node.kind === "IndexExpr" &&
+			isIdent(node.expr, xs) &&
+			isIdent(node.index, i)
+		)
+			node._inBounds = true;
+		forEachChild(node, visit);
+	};
+	visit(body);
+}
+
+// `len(xs)` over a slice or array identifier: its name, or null.
+function lenOfName(node) {
+	const ok =
+		node?.kind === "CallExpr" &&
+		isIdent(node.func, "len") &&
+		node.args?.length === 1 &&
+		isIdent(node.args[0]) &&
+		isSliceOrArray(node.args[0]._type);
+	return ok ? node.args[0].name : null;
+}
+
+// for i := range xs / for i, v := range xs
+function rangeLoop(init, i) {
+	const rhs = init.rhs?.[0];
+	if (!isIdent(rhs.expr) || !isSliceOrArray(rhs.expr._type)) return null;
+	// `for i, xs := range xs`: the body's xs is the element, not the slice.
+	if (isIdent(init.lhs[1], rhs.expr.name)) return null;
+	return { xs: rhs.expr.name, i };
+}
+
+// for i := K; i < len(xs); i++ with a constant K >= 0
+function countingLoop(stmt, i) {
+	const { init, cond, post } = stmt;
+	const k = constInt(init.rhs?.[0]);
+	if (init.lhs.length !== 1 || k === null || k < 0n) return null;
+	if (cond?.kind !== "BinaryExpr" || cond.op !== "<" || !isIdent(cond.left, i))
+		return null;
+	const xs = lenOfName(cond.right);
+	const step =
+		post?.kind === "IncDecStmt" && post.op === "++" && isIdent(post.expr, i);
+	return xs && step ? { xs, i } : null;
+}
+
+// The (slice name, index name) a for statement proves in range, or null.
+function inBoundsLoop(stmt) {
+	const init = stmt.init;
+	if (init?.kind !== "DefineStmt" || !isIdent(init.lhs?.[0])) return null;
+	const i = init.lhs[0].name;
+	return init.rhs?.[0]?.kind === "RangeExpr"
+		? rangeLoop(init, i)
+		: countingLoop(stmt, i);
+}
+
+// Marks the loop's `xs[i]` when its slice is a local the loop cannot change.
+function markLoop(stmt, scope, unsafe) {
+	const loop = inBoundsLoop(stmt);
+	if (!loop || !scope.has(loop.xs) || scope.has("len")) return;
+	if (unsafe.has(loop.xs) || unsafe.has(loop.i)) return;
+	if (touches(stmt.body, [loop.xs, loop.i])) return;
+	markIndexes(stmt.body, loop.xs, loop.i);
+}
+
+const SCOPE_KINDS = new Set([
+	"Block",
+	"ForStmt",
+	"IfStmt",
+	"FuncLit",
+	"CaseClause",
+	"TypeSwitchStmt",
+]);
+
+// How often each name is declared in the function (parameters included) and
+// which names are assigned anywhere.  A slice declared once and never
+// assigned keeps its length for the whole function.
+function nameStats(params, body) {
+	const declared = new Map();
+	const assigned = new Set();
+	const bump = (n) => n && declared.set(n, (declared.get(n) ?? 0) + 1);
+	for (const n of params) bump(n);
+	const visit = (node) => {
+		if (!node || typeof node !== "object") return;
+		if (Array.isArray(node)) {
+			for (const n of node) visit(n);
+			return;
+		}
+		for (const n of declaredNames(node)) bump(n);
+		for (const n of assignedNames(node)) assigned.add(n);
+		forEachChild(node, visit);
+	};
+	visit(body);
+	return { declared, assigned };
+}
+
+// A slice whose length no statement in the function can change.
+function isStableSlice(node, stats, unsafe) {
+	if (!isIdent(node) || underlying(node._type)?.kind !== "slice") return false;
+	const { name } = node;
+	return (
+		stats.declared.get(name) === 1 &&
+		!stats.assigned.has(name) &&
+		!unsafe.has(name)
+	);
+}
+
+// `_ = xs[K]` with a constant K >= 0: the slice and K, or null.
+function hintOf(stmt, stats, unsafe) {
+	if (stmt?.kind !== "AssignStmt" || stmt.op !== "=") return null;
+	const [lhs] = stmt.lhs;
+	const rhs = stmt.rhs?.[0];
+	if (stmt.lhs.length !== 1 || !isIdent(lhs, "_")) return null;
+	if (rhs?.kind !== "IndexExpr" || !isStableSlice(rhs.expr, stats, unsafe))
+		return null;
+	const k = constInt(rhs.index);
+	return k !== null && k >= 0n ? { xs: rhs.expr.name, k } : null;
+}
+
+const FLIPPED = { ">": "<", ">=": "<=", "<": ">", "<=": ">=" };
+
+// `len(xs) op K` (or `K op len(xs)`) over a stable slice: [xs, op, K] or null.
+function lenComparison(cond, stats, unsafe) {
+	if (cond?.kind !== "BinaryExpr" || !(cond.op in FLIPPED)) return null;
+	const direct = cond.left?.kind === "CallExpr";
+	const call = direct ? cond.left : cond.right;
+	const k = constInt(direct ? cond.right : cond.left);
+	const arg = call?.args?.[0];
+	const ok =
+		k !== null &&
+		isIdent(call?.func, "len") &&
+		call.args.length === 1 &&
+		isStableSlice(arg, stats, unsafe);
+	if (!ok || stats.declared.has("len")) return null;
+	return [arg.name, direct ? cond.op : FLIPPED[cond.op], k];
+}
+
+// Highest index `len(xs) op K` proves when it holds (`holds`) or fails.
+function provenMax(op, k, holds) {
+	let max = null;
+	if (holds && op === ">") max = k;
+	else if (holds && op === ">=") max = k - 1n;
+	else if (!holds && op === "<=") max = k;
+	else if (!holds && op === "<") max = k - 1n;
+	return max !== null && max >= 0n ? max : null;
+}
+
+function isTerminating(stmt) {
+	if (stmt?.kind === "ReturnStmt") return true;
+	const call = stmt?.kind === "ExprStmt" ? stmt.expr : null;
+	return call?.kind === "CallExpr" && isIdent(call.func, "panic");
+}
+
+// Marks `xs[0]` … `xs[max]` (constant indexes) anywhere under `root`.
+function markProven(root, xs, max) {
+	const visit = (node) => {
+		if (!node || typeof node !== "object") return;
+		if (Array.isArray(node)) {
+			for (const n of node) visit(n);
+			return;
+		}
+		if (node.kind === "IndexExpr" && isIdent(node.expr, xs)) {
+			const k = constInt(node.index);
+			if (k !== null && k >= 0n && k <= max) node._inBounds = true;
+		}
+		forEachChild(node, visit);
+	};
+	visit(root);
+}
+
+// Length facts a statement establishes for what follows it in its block.
+function factAfter(stmt, stats, unsafe) {
+	const hint = hintOf(stmt, stats, unsafe);
+	if (hint) return { xs: hint.xs, max: hint.k };
+	const exits =
+		stmt?.kind === "IfStmt" &&
+		!stmt.init &&
+		!stmt.elseBody &&
+		isTerminating(stmt.body?.stmts?.at(-1));
+	const cmp = exits ? lenComparison(stmt.cond, stats, unsafe) : null;
+	const max = cmp ? provenMax(cmp[1], cmp[2], false) : null;
+	return max === null ? null : { xs: cmp[0], max };
+}
+
+// Slice length proofs: hints and guards over every statement list.
+function markSliceFacts(body, stats, unsafe) {
+	const visit = (node) => {
+		if (!node || typeof node !== "object") return;
+		if (Array.isArray(node)) {
+			for (const n of node) visit(n);
+			return;
+		}
+		if (node.kind === "IfStmt") {
+			const cmp = lenComparison(node.cond, stats, unsafe);
+			const max = cmp ? provenMax(cmp[1], cmp[2], true) : null;
+			if (max !== null) markProven(node.body, cmp[0], max);
+		}
+		if (Array.isArray(node.stmts)) {
+			node.stmts.forEach((stmt, i) => {
+				const fact = factAfter(stmt, stats, unsafe);
+				if (fact) markProven(node.stmts.slice(i + 1), fact.xs, fact.max);
+			});
+		}
+		forEachChild(node, visit);
+	};
+	visit(body);
+}
+
+function analyzeFunc(params, body) {
+	const unsafe = collectUnsafeNames(body);
+	// Walk in source order with a scope chain of local names, so `xs` counts
+	// as local only when a declaration in an enclosing scope precedes the loop.
+	const visit = (node, scope) => {
+		if (!node || typeof node !== "object") return;
+		if (Array.isArray(node)) {
+			for (const n of node) visit(n, scope);
+			return;
+		}
+		if (node.kind === "IndexExpr") markConstArrayIndex(node);
+		if (node.kind === "ForStmt") markLoop(node, scope, unsafe);
+		const inner = SCOPE_KINDS.has(node.kind) ? scope.child() : scope;
+		const declared = declaredNames(node);
+		// Func literal parameters and a type switch binding belong to its
+		// body; other declarations follow the node in its enclosing scope.
+		const ownsDecls = node.kind === "FuncLit" || node.kind === "TypeSwitchStmt";
+		const target = ownsDecls ? inner : null;
+		if (target) for (const n of declared) target.add(n);
+		forEachChild(node, (c) => visit(c, inner));
+		if (!target) for (const n of declared) scope.add(n);
+	};
+	const root = new LocalScope(null);
+	for (const n of params) root.add(n);
+	visit(body, root);
+	markSliceFacts(body, nameStats(params, body), unsafe);
+}
+
+function markConstArrayIndex(node) {
+	const u = underlying(node.expr?._type);
+	if (u?.kind !== "array" || typeof u.size !== "number") return;
+	const k = constInt(node.index);
+	if (k !== null && k >= 0n && k < BigInt(u.size)) node._inBounds = true;
+}
+
+class LocalScope {
+	constructor(parent) {
+		this.parent = parent;
+		this.names = new Set();
+	}
+	child() {
+		return new LocalScope(this);
+	}
+	add(name) {
+		if (name && name !== "_") this.names.add(name);
+	}
+	has(name) {
+		return this.names.has(name) || (this.parent?.has(name) ?? false);
+	}
+}
+
+function paramNames(decl) {
+	const names = (decl.params ?? []).map((p) => p.name);
+	if (decl.recvName) names.push(decl.recvName);
+	for (const r of decl.returnType?._namedReturns ?? [])
+		names.push(typeof r === "string" ? r : r?.name);
+	return names;
+}
+
+/** Marks provably in-range IndexExprs `_inBounds` in every function. */
+export function markInBoundsIndexes(program) {
+	for (const d of program?.decls ?? []) {
+		if ((d.kind === "FuncDecl" || d.kind === "MethodDecl") && d.body)
+			analyzeFunc(paramNames(d), d.body);
+	}
+}

package/src/lower/boxing.js

@@ -6,12 +6,7 @@ import { forEachChild } from "./walk.js";
 export function isReferenceType(t) {
 	if (!t) return false;
 	const base = t.kind === "named" ? t.underlying : t;
-	return (
-		base?.kind === "struct" ||
-		base?.kind === "slice" ||
-		base?.kind === "map" ||
-		base?.kind === "func"
-	);
+	return base?.kind === "struct";
 }
 
 // Scan AST node for _addressTaken idents on scalars and populate a Set of boxed variable names.