jz 0.5.1 → 0.7.0

package/src/{infer.js → compile/infer.js}

@@ -43,12 +43,15 @@
  * @module src/infer
  */
 
-import { ctx } from './ctx.js'
-import {
-  VAL, collectParamNames, valTypeOf,
-  updateRep, updateGlobalRep, analyzeValTypes, analyzeIntCertain,
-  staticObjectProps, typedElemCtor, ctorFromElemAux, shapeOfObjectLiteralAst,
-} from './analyze.js'
+import { ctx } from '../ctx.js'
+import { collectParamNames, ASSIGN_OPS } from '../ast.js'
+import { analyzeValTypes, analyzeIntCertain } from './analyze.js'
+import { staticObjectProps, staticArrayElems } from '../static.js'
+import { typedElemCtor } from '../type.js'
+import { ctorFromElemAux } from '../../layout.js'
+import { shapeOfObjectLiteralAst, valTypeOf } from '../kind.js'
+import { includeForStringValue } from '../autoload.js'
+import { VAL, updateRep, updateGlobalRep } from '../reps.js'
 
 // === typeof predicate helper ==============================================
 //
@@ -63,7 +66,7 @@ import {
 /** Match a `typeof name <op> lit` predicate. Returns `{ name, code, eq }` —
  *  `name` is the typeof's operand binding, `code` is either the raw type
  *  string ('string'|'number'|'function'|…) or the prepare-normalized typeof
- *  code (-1|-2|-3|-4|-5|-6, see TYPEOF_MAP in prepare.js), and `eq` is true
+ *  code (TYPEOF in ast.js), and `eq` is true
  *  for `==`/`===` (false for `!=`/`!==`). Returns null when the node isn't a
  *  typeof predicate. */
 export function typeofPredicate(node) {
@@ -80,91 +83,10 @@ export function typeofPredicate(node) {
   return { name: typeofSide[1], code, eq: op === '==' || op === '===' }
 }
 
-// === paramReps lattice primitives ==========================================
+// === paramReps lattice =====================================================
 //
-// `paramReps: Map<funcName, Map<paramIdx, ValueRep>>` is the cross-call fact
-// lattice. Evidence sources (body-walk and call-site `infer*`) produce
-// raw observations; these primitives apply them with sticky-null poison
-// semantics: undefined → observe (set); equal → stay; disagreement → null
-// (sticky). null is "no consensus" — readers treat it as missing.
-//
-// Lifecycle phases (chronological — readers should know which fields are
-// valid at which point):
-//
-//   1. prepare      ─ no paramReps yet. AST walk collects callSites with raw
-//                     arg lists; programFacts.paramReps is allocated empty.
-//
-//   2. collectProgramFacts ─ unchanged paramReps; aggregates module-global
-//                     callSites, valueUsed, hasSchemaLiterals into
-//                     programFacts. paramReps still empty here.
-//
-//   3. narrowSignatures phase D (call-site lattice) ─
-//                     runCallsiteLattice merges raw call-site facts via
-//                     mergeParamFact for fields: val, schemaId, intConst,
-//                     arrayElemSchema, arrayElemValType, typedCtor, wasm.
-//                     After D, these may be undefined/null/value.
-//                     Sticky-null reachable on any field whose call sites
-//                     disagreed.
-//
-//   4. validateIntConstParams ─ clears intConst on any param whose body
-//                     contains a write to it (intConst's contract is "no
-//                     writes after the call").
-//
-//   5. phase E / E2 / E3 (param ABI narrowing) ─
-//                     applyI32ParamSpecialization sets sig.params[k].type
-//                     to 'i32' based on rep.wasm consensus. Then
-//                     applyPointerParamAbi sets rep.ptrKind on
-//                     consistently-OBJECT/ARRAY/etc params; this prepares
-//                     the i32-offset ABI for unboxed pointer params.
-//
-//   6. phase F (signature fixpoint) ─ clearStickyNull on val + schemaId,
-//                     then re-runs D until stable. New evidence from
-//                     newly-narrowed return types (valResult) can unstick.
-//
-//   7. phase G (narrowReturnArrayElems) ─ propagates Array<T> element
-//                     facts back through return paths into caller param
-//                     reps. After G, arrayElemSchema/arrayElemValType
-//                     reflect the transitive closure.
-//
-//   8. phase H (applyTypedPointerParamAbi) ─ sets ptrKind=TYPED + ptrAux
-//                     (elem code) for params whose val converged to TYPED.
-//                     Depends on F having seeded val first.
-//
-//   9. phase I (resetParamWasmFacts + final i32 spec) ─ last WASM-level
-//                     pass. After H/I, sig.params[k].type and rep.ptrKind
-//                     are frozen for emit.
-//
-//  10. per-function compile (emit start) ─ each func reads its
-//                     paramReps[name][k] and folds the consensus facts
-//                     into ctx.func.localReps via updateRep. Locals and
-//                     params then share one ValueRep store for the
-//                     remainder of emit.
-
-/** Per-call-site fact merge into a param's ValueRep field. */
-export const mergeParamFact = (rep, key, observed) => {
-  if (rep[key] === null) return                        // sticky poison
-  if (observed == null) { rep[key] = null; return }    // unknown → poison
-  if (rep[key] === undefined) rep[key] = observed
-  else if (rep[key] !== observed) rep[key] = null
-}
-
-/** Get-or-create per-param rep at (funcName, paramIdx) on a paramReps map. */
-export const ensureParamRep = (paramReps, funcName, k) => {
-  let m = paramReps.get(funcName)
-  if (!m) { m = new Map(); paramReps.set(funcName, m) }
-  let r = m.get(k)
-  if (!r) { r = {}; m.set(k, r) }
-  return r
-}
-
-/** Reset sticky-null on a single field across all params program-wide.
- *  Used between fixpoint phases when newly-narrowed facts unblock previously-
- *  poisoned observations (e.g. valResult set after first pass). */
-export const clearStickyNull = (paramReps, key) => {
-  for (const m of paramReps.values()) for (const r of m.values()) {
-    if (r[key] === null) r[key] = undefined
-  }
-}
+// Primitives live in src/param-reps.js (cycle-free leaf). Lifecycle phases
+// below document when each field is valid during narrowSignatures.
 
 // === Source registry =======================================================
 
@@ -212,7 +134,7 @@ const STRING_ONLY_METHODS = new Set([
   'charCodeAt', 'charAt', 'codePointAt', 'startsWith', 'endsWith',
   'toUpperCase', 'toLowerCase', 'toLocaleLowerCase', 'normalize', 'localeCompare',
   'padStart', 'padEnd', 'repeat', 'trimStart', 'trimEnd', 'trim',
-  'matchAll', 'match', 'replace', 'replaceAll', 'split',
+  'matchAll', 'match', 'replace', 'replaceAll', 'split', 'lastIndexOf',
 ])
 const ARRAY_ONLY_POISON = new Set([
   'push', 'pop', 'shift', 'unshift', 'splice', 'sort', 'fill', 'reverse',
@@ -312,9 +234,6 @@ const isLengthAccess = (n) =>
 const isIndexAccess = (n) =>
   Array.isArray(n) && n[0] === '[]' && typeof n[1] === 'string'
 
-const isAssignOp = (op) =>
-  typeof op === 'string' && (op === '=' || (op.length > 1 && op.endsWith('=') && op !== '==' && op !== '===' && op !== '!=' && op !== '!==' && op !== '<=' && op !== '>='))
-
 const isStringLiteralRhs = (rhs) =>
   Array.isArray(rhs) && (rhs[0] === 'str' || (rhs[0] == null && typeof rhs[1] === 'string'))
 
@@ -354,11 +273,11 @@ const notStringEvidence = (body, names) => {
       markStringy(node[1])
     }
     // Index write: `xs[i] = v` or compound `xs[i] op= v`.
-    if (isAssignOp(op) && isIndexAccess(node[1]) && scope.has(node[1][1]) && !stringy.has(node[1][1])) {
+    if (ASSIGN_OPS.has(op) && isIndexAccess(node[1]) && scope.has(node[1][1]) && !stringy.has(node[1][1])) {
       writes.add(node[1][1])
     }
     // Length mutation: `xs.length = n`, `xs.length += k`, `xs.length++`.
-    if (isAssignOp(op) && isLengthAccess(node[1]) && scope.has(node[1][1]) && !stringy.has(node[1][1])) {
+    if (ASSIGN_OPS.has(op) && isLengthAccess(node[1]) && scope.has(node[1][1]) && !stringy.has(node[1][1])) {
       writes.add(node[1][1])
     }
     if ((op === '++' || op === '--') && isLengthAccess(node[1]) && scope.has(node[1][1]) && !stringy.has(node[1][1])) {
@@ -422,11 +341,56 @@ export function recordGlobalRep(name, expr) {
   }
   const ctor = typedElemCtor(expr)
   if (ctor) (ctx.scope.globalTypedElem ||= new Map()).set(name, ctor)
+  // Module-level const array literal with a uniform element val-type (e.g. a numeric
+  // table `const FREQS = [261.63, …]`): record it so `FREQS[i]` reads in any using
+  // function are typed (NUMBER) rather than untyped. Without this an untyped element
+  // read makes `s += FREQS[i]` take the polymorphic +/ToString path — dragging the
+  // entire string runtime (~5 kB) into a kernel that uses no strings. A function-local
+  // array gets this from analyzeValTypes; a module-level one is invisible to the using
+  // function's body walk, so capture it here. Soundness for a later `FREQS[i]=…` is the
+  // read-site dynWriteVars guard in valTypeOf (kind.js) — this is just the literal fact.
+  if (vt === VAL.ARRAY) {
+    const elems = staticArrayElems(expr)
+    if (elems && elems.length && elems.every(e => e != null)) {
+      let common = valTypeOf(elems[0])
+      for (let k = 1; k < elems.length && common != null; k++)
+        if (valTypeOf(elems[k]) !== common) common = null
+      if (common != null) updateGlobalRep(name, { arrayElemValType: common })
+      // Array-of-arrays numeric table (`const C = [[0,4,7], …]`): also record the
+      // nested element kind so `C[i][j]` (and `ch = C[i]; ch[j]`) reads stay typed —
+      // the same string-runtime drop as the flat case, one level down. Single-level
+      // (mirrors analyzeValTypes' local arrElemElemValTypes); deeper nesting falls back.
+      if (common === VAL.ARRAY) {
+        let nested = null, seen = false, ok = true
+        for (const el of elems) {
+          const inner = staticArrayElems(el)
+          if (!inner || !inner.length || !inner.every(e => e != null)) { ok = false; break }
+          for (const ie of inner) {
+            const ivt = valTypeOf(ie)
+            if (!seen) { nested = ivt; seen = true }
+            else if (ivt !== nested) { ok = false; break }
+          }
+          if (!ok) break
+        }
+        if (ok && nested != null) updateGlobalRep(name, { arrayElemElemValType: nested })
+      }
+    }
+  }
   // Static-shape capture for module-level object literals — lets `{ ...G.path }`
   // resolve its source schema by walking the global rep's shape tree at the
   // spread site (see shape walk in analyze.js / resolveSchema in object.js).
   const sh = shapeOfObjectLiteralAst(expr)
-  if (sh) updateGlobalRep(name, { jsonShape: sh })
+  if (sh) {
+    updateGlobalRep(name, { jsonShape: sh })
+    // A module-global object is read via __dyn_get (its props live behind a
+    // runtime key, not a function-local schema slot), which emits a `['str', key]`
+    // node at compile time. Ensure the string module's `str` emitter is bound now
+    // — a string-literal-free program (`let g = {l:{a:1}}; export let f = () => g.l`)
+    // would otherwise abort late with "Unknown op: str". Scoped to globals that
+    // actually capture an object shape, so string-free local-object programs keep
+    // their minimal bundle (and golden-size pins).
+    includeForStringValue()
+  }
 }
 
 // === Call-site argument inference =========================================

package/src/compile/loop-divmod.js

@@ -0,0 +1,155 @@
+// Loop induction strength-reduction for `i % w` and `(i / w) | 0`.
+//
+// JS `%` and `/` are float ops; `i % w` with a RUNTIME divisor lowers to f64
+// (i % 0 is NaN, so it can't be soundly typed i32 — see type.js exprType `%`).
+// That makes the column `x = i % w` an f64 local, which cascades: every dependent
+// neighbour index becomes f64 and each typed-array access pays an f64→i32 convert.
+// Measured ~5× slower than V8, which speculates the divisor non-zero and uses i32.
+//
+// This pass replaces the per-iteration division with incremental i32 counters in a
+// unit-stride loop: the column `cx` increments by 1 and wraps to 0 at `w`, bumping
+// the row `cy`. No division survives in the body, so the whole index chain stays
+// i32. Fully sound — counters are pure increment (the divisor-zero question never
+// arises), and if `w == 0` the loop's `i < w*h` guard never admits an iteration, so
+// the one-time seed `(i%w)|0` (NaN→0) is unused.
+//
+// Recognized (post-prepare AST): a `while` whose body increments one IV `i` by +1
+// exactly once, reads `['%', i, w]` and/or `['|', ['/', i, w], LIT0]` with `w`
+// loop-invariant, and has no `continue` / closure-capture of i,w (which could
+// desync the counters). Number literals are sparse-array holes `[, v]` (n[0] is the
+// hole = undefined), so literal tests use `== null`; created literals are bare numbers.
+
+import { findMutations } from './analyze-scans.js'
+
+const litN = (n, k) => Array.isArray(n) && n.length === 2 && n[0] == null && n[1] === k
+const isMod = (n, i, w) => Array.isArray(n) && n[0] === '%' && n[1] === i && n[2] === w
+const isFloorDiv = (n, i, w) =>
+  Array.isArray(n) && n[0] === '|' && litN(n[2], 0) &&
+  Array.isArray(n[1]) && n[1][0] === '/' && n[1][1] === i && n[1][2] === w
+
+// IV a statement increments by exactly +1, or null. Covers `i++` (post-inc desugars
+// to `(++i) - 1`), `++i`, `i += 1`, `i = i + 1`.
+function incVarOf(stmt) {
+  if (!Array.isArray(stmt)) return null
+  let inc = stmt
+  if (stmt[0] === '-' && litN(stmt[2], 1) && Array.isArray(stmt[1]) && stmt[1][0] === '++') inc = stmt[1]
+  if (inc[0] === '++' && typeof inc[1] === 'string') return inc[1]
+  if (stmt[0] === '+=' && typeof stmt[1] === 'string' && litN(stmt[2], 1)) return stmt[1]
+  if (stmt[0] === '=' && typeof stmt[1] === 'string' && Array.isArray(stmt[2]) && stmt[2][0] === '+') {
+    const [, a, b] = stmt[2]
+    if (a === stmt[1] && litN(b, 1)) return stmt[1]
+    if (b === stmt[1] && litN(a, 1)) return stmt[1]
+  }
+  return null
+}
+
+const usesPattern = (n, i, w, pred) => Array.isArray(n) && (pred(n, i, w) || n.some(c => usesPattern(c, i, w, pred)))
+const replace = (n, i, w, cx, cy) =>
+  !Array.isArray(n) ? n : isMod(n, i, w) ? cx : isFloorDiv(n, i, w) ? cy : n.map(c => replace(c, i, w, cx, cy))
+// a `continue` that targets THIS loop (not one nested inside) — would skip the increment
+const hasOuterContinue = (n) => Array.isArray(n) &&
+  (n[0] === 'continue' || (n[0] !== 'while' && n[0] !== 'for' && n[0] !== 'do' && n[0] !== '=>' && n.some(hasOuterContinue)))
+// Vars assigned anywhere inside a closure in the function. Such a var can be
+// mutated by a call in the loop body (the closure may be defined outside the loop,
+// so a body-local findMutations misses it), so it is not safe as the IV or divisor.
+const ASSIGN_OPS = new Set(['=', '+=', '-=', '*=', '/=', '%=', '**=', '&=', '|=', '^=', '<<=', '>>=', '>>>=', '&&=', '||=', '??='])
+const collectAssigns = (n, out) => {
+  if (!Array.isArray(n)) return
+  if (typeof n[1] === 'string' && (ASSIGN_OPS.has(n[0]) || n[0] === '++' || n[0] === '--')) out.add(n[1])
+  n.forEach(c => collectAssigns(c, out))
+}
+const closureMutated = (n, out) => {
+  if (!Array.isArray(n)) return out
+  if (n[0] === '=>') collectAssigns(n, out)
+  n.forEach(c => closureMutated(c, out))
+  return out
+}
+
+let _uniq = 0
+let _cm = new Set()  // closure-mutated vars for the function currently being transformed
+
+// Try to strength-reduce one `while` statement. Returns [seed, loop] or null.
+function tryReduce(stmt) {
+  if (!Array.isArray(stmt) || stmt[0] !== 'while') return null
+  const cond = stmt[1], lbody = stmt[2]
+  if (!Array.isArray(lbody) || lbody[0] !== ';') return null
+
+  // exactly one IV incremented by +1
+  let iv = null, ivIdx = -1
+  for (let k = 1; k < lbody.length; k++) {
+    const v = incVarOf(lbody[k])
+    if (v) { if (iv) return null; iv = v; ivIdx = k }
+  }
+  if (!iv) return null
+
+  // a single invariant divisor `w` (`i % w` / `(i/w)|0` all share it)
+  let w = null
+  const findW = (n) => {
+    if (!Array.isArray(n)) return
+    const d = n[0] === '%' && n[1] === iv ? n[2]
+      : (n[0] === '|' && litN(n[2], 0) && Array.isArray(n[1]) && n[1][0] === '/' && n[1][1] === iv) ? n[1][2] : null
+    if (typeof d === 'string') { if (w == null) w = d; else if (w !== d) w = false }
+    n.forEach(findW)
+  }
+  findW(lbody)
+  if (!w || w === iv) return null
+
+  const usesMod = usesPattern(lbody, iv, w, isMod)
+  const usesDiv = usesPattern(lbody, iv, w, isFloorDiv)
+  if (!usesMod && !usesDiv) return null
+
+  // soundness: w invariant, iv written ONLY by the increment, no continue/closure capture
+  const wMut = new Set(); findMutations(lbody, new Set([w]), wMut)
+  if (wMut.has(w)) return null
+  const ivMut = new Set()
+  findMutations([';', ...lbody.slice(1).filter((_, k) => k !== ivIdx - 1)], new Set([iv]), ivMut)
+  if (ivMut.has(iv)) return null
+  if (hasOuterContinue(lbody)) return null
+  if (_cm.has(iv) || _cm.has(w)) return null  // IV/divisor mutable via a closure call
+
+  const id = _uniq++
+  const cx = `__lsrx${id}`, cy = `__lsry${id}`
+  // seed (inside the w>0 branch): cx = (i%w)|0, cy = (i/w)|0 — one-time, i32 via |0
+  const seedDecls = [['=', cx, ['|', ['%', iv, w], 0]]]
+  if (usesDiv) seedDecls.push(['=', cy, ['|', ['/', iv, w], 0]])
+  const seed = ['let', ...seedDecls]
+
+  // transformed body: replace patterns, inject `cx++; if(cx>=w){cx=0; cy++}` after the increment
+  const newBody = [';']
+  for (let k = 1; k < lbody.length; k++) {
+    newBody.push(replace(lbody[k], iv, w, cx, cy))
+    if (k === ivIdx) {
+      newBody.push(['=', cx, ['+', cx, 1]])
+      if (usesDiv) newBody.push(['=', cy, ['+', cy, ['?:', ['>=', cx, w], 1, 0]]])
+      newBody.push(['=', cx, ['?:', ['>=', cx, w], 0, cx]])
+    }
+  }
+  const fast = ['while', replace(cond, iv, w, cx, cy), newBody]
+  // The counters track i%w only when w>0 AND i>=0: w<=0 gives NaN / a negative-divisor
+  // modulo, and i<0 makes i%w negative (JS modulo takes the dividend's sign) — neither
+  // follows the 0..w-1 +1-wrap the counters model. A one-time `w>0 && i>=0` guard (i is
+  // the IV's entry value; it only increments, so it stays ≥0) keeps the fast i32 path
+  // for the universal positive-dimension, forward-counting case and falls back to the
+  // unmodified loop otherwise — sound for any w, any start.
+  return [['if', ['&&', ['>', w, 0], ['>=', iv, 0]], ['{}', [';', seed, fast]], stmt]]
+}
+
+// Walk the body; transform `while` loops inside every block (post-order so a nested
+// loop is reduced before its enclosing one is examined).
+function walk(node) {
+  if (!Array.isArray(node)) return node
+  const n = node.map(walk)
+  if (n[0] !== ';') return n
+  const out = [';']
+  for (let k = 1; k < n.length; k++) {
+    const r = tryReduce(n[k])
+    if (r) out.push(...r)
+    else out.push(n[k])
+  }
+  return out
+}
+
+export function strengthReduceLoopDivMod(body) {
+  _cm = closureMutated(body, new Set())
+  return walk(body)
+}