jz 0.6.0 → 0.7.0

package/src/ctx.js

@@ -8,7 +8,7 @@
  */
 
 import { makeAbi } from './abi/index.js'
-export { HEAP, LAYOUT, PTR, ATOM, nanPrefixHex, atomNanHex, ssoBitI64Hex, sliceBitI64Hex, ptrNanHex, ptrBoxPrefixBigInt, encodePtrHi, decodePtrType, decodePtrAux, ATOM_HI, oobNanLiteral, oobNanIR, followForwardingWat } from '../layout.js'
+export { HEAP, LAYOUT, PTR, ATOM, FORWARDING_MASK, nanPrefixHex, atomNanHex, ssoBitI64Hex, sliceBitI64Hex, ptrNanHex, ptrBoxPrefixBigInt, encodePtrHi, decodePtrType, decodePtrAux, ATOM_HI, oobNanLiteral, oobNanIR, followForwardingWat } from '../layout.js'
 
 // === Carrier layout ===
 // Canonical bit layout lives in layout.js (compiler-free). Re-exported above for
@@ -144,18 +144,45 @@ export const getter = (fn) => (fn.getter = true, fn)
  *  Each module co-locates its own deps with its stdlib registrations at init time. */
 export function resolveIncludes() {
   const graph = ctx.core.stdlibDeps
+  const stdlib = ctx.core.stdlib
+  // Auto-derived deps: a stdlib template that calls `$__foo` (a registered stdlib
+  // func) depends on it, whether or not the hand-maintained `deps()` list says so.
+  // Scanning the *realized* template keeps the graph honest, so a missing manual
+  // entry can't silently drop a transitively-needed helper (the bug class the old
+  // blanket `inc('__mkptr','__alloc')` masked). Factory templates are realized
+  // (called) so feature-gated branches — `${hasExt ? '(call $__ext_prop …)' : ''}`
+  // — resolve before scanning; reading raw source would over-pull the dead branch.
+  // jz's templates are pure string builders, so realizing here (and again at
+  // emission) is side-effect-free. A `$__foo` naming a global (not a stdlib func)
+  // is skipped. Realization can fail if called before its inputs are ready — then
+  // we return nothing *without caching*, so a later pass retries. Memoized per compile.
+  const autoCache = ctx.core._autoDeps ??= new Map()
+  const autoDepsOf = (name) => {
+    let found = autoCache.get(name)
+    if (found !== undefined) return found
+    const v = stdlib[name]
+    let text
+    if (typeof v === 'string') text = v
+    else if (typeof v === 'function') { try { text = v() } catch { return [] } }
+    if (typeof text !== 'string') return (autoCache.set(name, []), [])
+    found = []
+    const seen = new Set()
+    for (const m of text.matchAll(/\$(__[A-Za-z0-9_]+)/g)) {
+      const d = m[1]
+      if (d !== name && stdlib[d] && !seen.has(d)) { seen.add(d); found.push(d) }
+    }
+    autoCache.set(name, found)
+    return found
+  }
   let changed = true
   while (changed) {
     changed = false
     for (const name of [...ctx.core.includes]) {
       const entry = graph[name]
       const deps = typeof entry === 'function' ? entry() : entry
-      if (deps) for (const dep of deps) {
-        if (!ctx.core.includes.has(dep)) {
-          ctx.core.includes.add(dep)
-          changed = true
-        }
-      }
+      const add = (dep) => { if (!ctx.core.includes.has(dep)) { ctx.core.includes.add(dep); changed = true } }
+      if (deps) for (const dep of deps) add(dep)
+      for (const dep of autoDepsOf(name)) add(dep)
     }
   }
 }
@@ -241,6 +268,7 @@ export function reset(proto, globals, bridge) {
   ctx.types = {
     typedElem: null,
     dynKeyVars: null,
+    dynWriteVars: null,
     anyDynKey: false,
   }
 
@@ -316,6 +344,7 @@ export function reset(proto, globals, bridge) {
   ctx.memory = {
     shared: false,
     pages: 0,
+    max: 0,         // 0 = unbounded; >0 emits a maximum on the memory type (cap growth)
   }
 
   ctx.error = {
@@ -440,6 +469,15 @@ export function warn(code, message, meta = {}, loc = null) {
   ctx.warnings.sink.entries.push(entry)
 }
 
+/** Advise that an emit site fell back to generic runtime dispatch (the slow,
+ *  un-inferred path). Called from the actual emission point so it fires only when
+ *  inference/optimization truly couldn't fold it — never a false positive on a
+ *  case that vectorized/unrolled/slot-folded. `ctx.error.loc` is the current AST
+ *  node's byte offset (kept up to date by the emit walk), giving line/column. */
+export function warnDeopt(code, message) {
+  warn(code, message, { fn: ctx.func.current?.name }, ctx.error.loc)
+}
+
 /** Throw with source location context. */
 export function err(msg, cause) {
   let detail = msg

package/src/ir.js

@@ -55,6 +55,15 @@ function boxPtrIR(i32node, ptrType, aux = 0) {
  *  `(x >>> 0)` uint32 idiom converts to a positive f64 in [0, 2^32) instead of sign-flipping. */
 export const asF64 = n => {
   if (n == null) err(`compiler internal: expected emitted IR value in ${ctx.func.current?.name || '<module>'}, got empty value`)
+  // A v128 (SIMD) value can't be NaN-boxed into the uniform f64 closure ABI — there is no
+  // lossless f64 carrier for 128 bits. This is reached only at a closure boundary: a SIMD
+  // value captured by, passed to, returned from, or flowing through a `(…)=>…` used as a
+  // VALUE — most commonly an IIFE `(() => f32x4.…)()`, which jz lowers via the closure path.
+  // Without this guard the coercion emits `f64.convert_i32_s(<v128>)` and dies in the wasm
+  // validator with an opaque type error. Keep SIMD inside a NAMED top-level function called
+  // directly (`let sdf = (x) => f32x4.…; sdf(v)` lowers to a typed v128 `call`, no boxing),
+  // and extract scalars with `f64x2.lane` / `f32x4.lane` before crossing a closure boundary.
+  if (n.type === 'v128') err(`SIMD (v128) values can't cross a closure/IIFE boundary — closures use the uniform f64 ABI. Move the SIMD into a named top-level function called directly, or extract a lane (f64x2.lane / f32x4.lane) to an f64 first.`)
   if (n.ptrKind != null) return boxPtrIR(n, valKindToPtr(n.ptrKind), n.ptrAux || 0)
   if (n.type === 'f64') return n
   if (n.type === 'i64') {
@@ -97,6 +106,22 @@ export const asPtrOffset = (n, ptrKind) => {
 /** Coerce emitted IR to a target WASM param type ('i32' | 'i64' | 'f64'). */
 export const asParamType = (n, t) => t === 'i32' ? asI32(n) : t === 'i64' ? asI64(n) : t === 'v128' ? n : asF64(n)
 
+// Sound upper bound on the value of a masking expr (`&` / `>>>`), so a product
+// against it can be proven < 2^53 and narrow to i32.mul instead of the guarded f64
+// path. `& m` with a non-negative mask m clamps the result to [0, m] (regardless of
+// the other operand's sign); `>>> k` is logical, so it's ≤ 2^(32−k). Anything else
+// (signed shift, plain locals, negative mask) stays the full i32 range.
+export const maskBound = (x) => {
+  if (!Array.isArray(x)) return 2 ** 31
+  if (x[0] === 'i32.const') return x[1] >= 0 ? x[1] : 2 ** 31
+  if (x[0] === 'i32.and') return Math.min(maskBound(x[1]), maskBound(x[2]))
+  if (x[0] === 'i32.shr_u') {
+    const k = Array.isArray(x[2]) && x[2][0] === 'i32.const' ? (x[2][1] & 31) : 0
+    return k > 0 ? 2 ** (32 - k) : 2 ** 31
+  }
+  return 2 ** 31
+}
+
 /**
  * Narrow an f64 arithmetic tree under ToInt32 — the general int-accumulator path.
  *
@@ -459,7 +484,7 @@ const PURE_F64_OPS = new Set([
  *  is correctly NOT numeric, while `cond ? n*2 : n*3` is. Conservative: any shape
  *  not provably numeric (property gets, user calls, local.get, f64.const nan:…)
  *  returns false, so the caller keeps the __to_num coercion. */
-const isNumericIR = (r) => {
+export const isNumericIR = (r) => {
   if (!Array.isArray(r)) return false
   const op = r[0]
   if (PURE_F64_OPS.has(op)) return true
@@ -550,19 +575,21 @@ export function buildRefcount(fn) {
  *  existing ids in a single walk. Replaces the per-pass
  *  `while (fn.some(... === $__prefixK)) k++` (O(K·N)) with one O(N) scan. */
 export function nextLocalId(fn, prefix) {
-  const seen = new Set()
+  // HIGH-WATER mark (max existing + 1), NOT the first free id. Callers allocate sequentially
+  // (id++), so a first-gap start would walk straight into an existing higher local once watr's
+  // coalesce has left non-contiguous numbering (e.g. $__pe0,$__pe1,$__pe5 → start at 2, then
+  // mint 3,4,5 and collide on $__pe5 = "Duplicate local"). High-water is always collision-free.
   const needle = `$__${prefix}`
+  let id = 0
   const walk = (n) => {
     if (!Array.isArray(n)) return
     if (n[0] === 'local' && typeof n[1] === 'string' && n[1].startsWith(needle)) {
       const tail = n[1].slice(needle.length)
-      if (/^\d+$/.test(tail)) seen.add(+tail)
+      if (/^\d+$/.test(tail)) { const k = +tail; if (k >= id) id = k + 1 }
     }
     for (let i = 0; i < n.length; i++) walk(n[i])
   }
   walk(fn)
-  let id = 0
-  while (seen.has(id)) id++
   return id
 }
 
@@ -731,10 +758,15 @@ export function toNumF64(node, v) {
     if (ctx.schema.slotIntCertainAt?.(node[1], node[2]) === true) return asF64(v)
   }
   // IR-level shapes that produce real f64 numbers (never NaN-boxed pointers):
-  // i32→f64 conversions, stdlib clock helper. Skip the __to_num call wrapper.
+  // i32→f64 conversions, stdlib clock helper, length/ptr helpers.
+  // Skip the __to_num call wrapper for these — they always return plain f64.
   if (Array.isArray(v)) {
     if (v[0] === 'f64.convert_i32_s' || v[0] === 'f64.convert_i32_u') return v
     if (v[0] === 'call' && v[1] === '$__time_ms') return v
+    // __length, __str_len return f64.convert_i32_s of an i32 — never a boxed pointer.
+    if (v[0] === 'call' && (v[1] === '$__length' || v[1] === '$__len' || v[1] === '$__str_len')) return v
+    // __ptr_type returns i32 tag, __ptr_offset returns i32 offset — both numeric.
+    if (v[0] === 'call' && (v[1] === '$__ptr_type' || v[1] === '$__ptr_offset')) return v
   }
   // f64 arithmetic ops and math intrinsics never produce NaN-boxed pointers — the
   // result is always a plain f64 number. Skip __to_num for these, eliminating the
@@ -785,6 +817,14 @@ export function toStrI64(node, v) {
       return typed(['call', '$__to_str', prim], 'i64')
     }
   }
+  // Provably-integer operand → render with the i32-only formatter, bypassing __to_str's
+  // float machinery (__ftoa/__toExp/__pow10, ~2 KB). A raw i32 value (`n|0`, a bitwise
+  // result, a loop counter) carries no NaN-box, so its ToString is just digits + sign.
+  // ptrKind != null means it's an unboxed pointer (i32 offset), NOT a number — exclude.
+  if (v.type === 'i32' && v.ptrKind == null) {
+    inc('__i32_to_str')
+    return typed(['i64.reinterpret_f64', ['call', '$__i32_to_str', v]], 'i64')
+  }
   inc('__to_str')
   return typed(['call', '$__to_str', asI64(v)], 'i64')
 }
@@ -809,8 +849,16 @@ const numericTruthy = e => {
 
 // i32 ops whose result is already a 0/1 boolean (comparisons + eqz) — safe to use
 // directly as a truthiness without a redundant `!= 0`.
+// Ops whose result is already a canonical i32 boolean (0 or 1) — a condition built
+// from one needs no `i32.ne(_, 0)` normalization. Every wasm comparison returns 0/1,
+// so the f64/f32/i64 relations belong here too (they were missing — a `a > b ? …`
+// f64 compare was wrapped in a dead `i32.ne(f64.gt …, 0)` in every branch/select).
 const I32_BOOL_OPS = new Set(['i32.eq', 'i32.ne', 'i32.lt_s', 'i32.lt_u', 'i32.gt_s', 'i32.gt_u',
-  'i32.le_s', 'i32.le_u', 'i32.ge_s', 'i32.ge_u', 'i32.eqz'])
+  'i32.le_s', 'i32.le_u', 'i32.ge_s', 'i32.ge_u', 'i32.eqz',
+  'f64.eq', 'f64.ne', 'f64.lt', 'f64.gt', 'f64.le', 'f64.ge',
+  'f32.eq', 'f32.ne', 'f32.lt', 'f32.gt', 'f32.le', 'f32.ge',
+  'i64.eq', 'i64.ne', 'i64.lt_s', 'i64.lt_u', 'i64.gt_s', 'i64.gt_u',
+  'i64.le_s', 'i64.le_u', 'i64.ge_s', 'i64.ge_u', 'i64.eqz'])
 
 export function truthyIR(e) {
   // An i32 *constant* is a concrete number, not a known 0/1 boolean — fold it to its

package/src/kind-traits.js

@@ -94,9 +94,36 @@ export function methodValType(method, obj, objType, ctx) {
     if (objType === VAL.STRING || objType === VAL.ARRAY || objType === VAL.TYPED) return objType
     return null
   }
+  // .subarray / .toReversed / .toSorted / .with all return a typed array of the same kind.
+  if (method === 'subarray' || method === 'toReversed' || method === 'toSorted' || method === 'with')
+    return objType === VAL.TYPED ? VAL.TYPED : null
   return null
 }
 
+// Built-in PROPERTY val-types — the property-read mirror of methodValType.
+// These are language invariants: `.length` is always a number on the sized
+// value kinds, `.size` on Set/Map, `.byteLength`/`.byteOffset` on typed arrays.
+// Without this, `arr.length + x` sees `.length` as untyped and routes `+`
+// through the __is_str_key string-concat dispatch — even though `.length` can
+// never be a string on a known sized kind. (Object schema slots override this
+// earlier in VT['.'], so `{length:'x'}.length` keeps its true slot type.)
+//
+// Gate on a known objType: an untyped receiver could be an object with a
+// string-valued shadow of the same name, so leave it null there (conservative).
+// null-proto: user code reads `.valueOf`, `.toString` etc. — a plain `{}` would
+// expose inherited Object.prototype members as bogus "numeric props".
+const NUMERIC_PROPS = Object.assign(Object.create(null), {
+  length: new Set([VAL.STRING, VAL.ARRAY, VAL.TYPED]),
+  byteLength: new Set([VAL.TYPED, VAL.BUFFER]),
+  byteOffset: new Set([VAL.TYPED]),
+  size: new Set([VAL.SET, VAL.MAP]),
+})
+export function propValType(prop, objType) {
+  if (objType == null) return null
+  const kinds = NUMERIC_PROPS[prop]
+  return kinds && kinds.has(objType) ? VAL.NUMBER : null
+}
+
 export function typedCtorElemValType(ctor) {
   if (!ctor) return null
   const isView = ctor.endsWith('.view')

package/src/kind.js

@@ -8,10 +8,10 @@
 
 import { ctx } from './ctx.js'
 import { VAL, lookupValType } from './reps.js'
-import { intLiteralValue } from './static.js'
+import { intLiteralValue, staticIndexKey } from './static.js'
 import {
   BOOL_OPS, NUMERIC_BINARY_OPS, NUMERIC_UNARY_OPS, COMPOUND_NUMERIC_OPS,
-  calleeValType, methodValType, typedCtorElemValType,
+  calleeValType, methodValType, propValType, typedCtorElemValType,
 } from './kind-traits.js'
 
 export { typedCtorElemValType } from './kind-traits.js'
@@ -145,7 +145,11 @@ VT['?:'] = (args) => {
 // (a condition/guard) and the other has a known non-boolean type,
 // return the non-boolean type — common in `condition && numericValue`
 // guard patterns where the falsey boolean is coerced to 0 in numeric context.
-VT['&&'] = VT['||'] = (args) => {
+// `a && b` / `a || b` / `a ?? b` all yield one of the two operands, so the result
+// type is their common type (else unknown). Giving `??` a type — not just ||/&& —
+// lets `numA ?? numB` read NaN-safe (value-typed NUMBER → f64.eq) instead of routing
+// through the bit-comparing __is_truthy, which mis-reads a non-canonical NaN.
+VT['&&'] = VT['||'] = VT['??'] = (args) => {
   const ta = valTypeOf(args[0]), tb = valTypeOf(args[1])
   if (ta && ta === tb) return ta
   if (ta === VAL.BOOL && tb && tb !== VAL.BOOL) return tb
@@ -158,6 +162,20 @@ VT['&&'] = VT['||'] = (args) => {
 // Index access:  `arr[i]` → ['[]', arr, i].
 VT['[]'] = (args) => {
   if (args.length < 2) return VAL.ARRAY
+  // SRoA flat-array slot read: `a[k]` (static index) where `a` dissolved into
+  // scalar `a#i` locals (scanFlatObjects). A write-once slot's value-type is its
+  // element literal's — same numeric-binding as the `VT['.']` object case, so
+  // `a[0] * 2` stays a plain f64 op instead of the polymorphic ToNumber battery.
+  if (typeof args[0] === 'string') {
+    const flat = ctx.func.flatObjects?.get(args[0])
+    if (flat) {
+      const k = staticIndexKey(args[1])
+      if (k != null && !flat.written?.has(k)) {
+        const i = flat.names.indexOf(k)
+        if (i >= 0 && flat.values[i] !== undefined) return valTypeOf(flat.values[i])
+      }
+    }
+  }
   // Indexed read on a known typed-array receiver yields Number except for
   // BigInt64Array/BigUint64Array, whose i64 carriers must stay BigInt-typed.
   if (typeof args[0] === 'string' && lookupValType(args[0]) === VAL.TYPED)
@@ -170,6 +188,25 @@ VT['[]'] = (args) => {
   if (typeof args[0] === 'string') {
     const elemVt = ctx.func.localReps?.get(args[0])?.arrayElemValType
     if (elemVt) return elemVt
+    // Module-level const array (a numeric/uniform table): its element val-type was
+    // recorded on the global rep at decl time. Trust it only when no function element-
+    // writes the array — dynWriteVars holds every var written via a non-named-property
+    // index, so a `X[i]=str` anywhere disables this and falls back to the untyped read.
+    if (!ctx.func.localReps?.has(args[0])) {
+      const gElem = ctx.scope.globalReps?.get(args[0])?.arrayElemValType
+      if (gElem && !ctx.types?.dynWriteVars?.has(args[0])) return gElem
+    }
+  }
+  // Direct double-index on a module-level nested numeric table — `C[i][j]` where
+  // `C = [[…number…], …]`. The receiver is itself a single-index read of a global
+  // array whose nested element kind was recorded at decl time. Same dynWriteVars
+  // guard (now root-aware, so a `C[i][j]=…` write anywhere disables it).
+  if (Array.isArray(args[0]) && args[0][0] === '[]' && args[0].length === 3 && typeof args[0][1] === 'string') {
+    const base = args[0][1]
+    if (!ctx.func.localReps?.has(base)) {
+      const gNested = ctx.scope.globalReps?.get(base)?.arrayElemElemValType
+      if (gNested && !ctx.types?.dynWriteVars?.has(base)) return gNested
+    }
   }
   // Indexed read on an inline all-numeric array literal — `[2,4,2,9][i]` (floatbeat
   // chord/pattern tables; literal op is `[`, elements inline). Every element is a
@@ -183,6 +220,21 @@ VT['[]'] = (args) => {
 
 VT['.'] = (args) => {
   if (typeof args[1] !== 'string') return null
+  // SRoA flat-object slot read: `p.x` where `p` dissolved into scalar `p#i`
+  // locals (scanFlatObjects). A write-once slot's value-type IS its literal
+  // initializer's, so bind by it — exactly as a plain `let slot = value` local
+  // would. Without this `p.x * 2` looks like "could be anything" and pulls the
+  // ToNumber + string-format battery, though it can only be numeric. Computed
+  // on-demand (not cached at analyze time) because param val-types — `{x:n}`'s
+  // `n` is numeric-by-divergence — are only seeded at emit. A reassigned slot
+  // (`p.x = …`) stays untyped: its runtime value may differ from the literal.
+  if (typeof args[0] === 'string') {
+    const flat = ctx.func.flatObjects?.get(args[0])
+    if (flat && !flat.written?.has(args[1])) {
+      const i = flat.names.indexOf(args[1])
+      if (i >= 0 && flat.values[i] !== undefined) return valTypeOf(flat.values[i])
+    }
+  }
   // Schema slot read: when `varName` has a bound schemaId and `.prop` resolves
   // to a slot whose VAL kind is monomorphic across program-wide observations,
   // return that kind. Lets `+`, `===`, method dispatch skip runtime str-key
@@ -200,6 +252,14 @@ VT['.'] = (args) => {
     const child = sh.props[args[1]]
     if (child) return child.val
   }
+  // Built-in property on a known sized kind — `.length` on STRING/ARRAY/TYPED,
+  // `.size` on SET/MAP, `.byteLength`/`.byteOffset` on TYPED/BUFFER. These are
+  // language invariants (the property is always a number on that kind), so typing
+  // them NUMBER lets `+` skip the string-concat dispatch. Object schema slots
+  // resolved above override this, keeping user-defined same-name slots sound.
+  const objType = typeof args[0] === 'string' ? lookupValType(args[0]) : valTypeOf(args[0])
+  const pvt = propValType(args[1], objType)
+  if (pvt) return pvt
   return null
 }
 
@@ -248,6 +308,8 @@ VT['()'] = (args) => {
     const t = valTypeOf(args[1])
     return t === VAL.SET || t === VAL.MAP ? VAL.ARRAY : t
   }
+  // for-in's read-only key list (src/prepare) — always an Array of key strings.
+  if (callee === '__keys_ro') return VAL.ARRAY
   // Ternary is parsed as call to '?' operator: ['()', ['?', cond, a, b]]
   if (Array.isArray(callee) && callee[0] === '?') {
     const truthy = literalTruthiness(callee[1])