jz 0.6.0 → 0.7.0

package/layout.js

@@ -41,6 +41,11 @@ export const PTR = {
 /** Reserved atom aux ids (PTR.ATOM). */
 export const ATOM = { NULL: 1, UNDEF: 2, FALSE: 4, TRUE: 5 }
 
+/** Tags whose heap block can relocate on growth (ARRAY/HASH/SET/MAP) — leaving a
+ *  forwarding header that `__ptr_offset` must follow. `(1 << tag) & FORWARDING_MASK`
+ *  tests membership in one shl+and, replacing a 4-way tag-equality OR. */
+export const FORWARDING_MASK = (1 << PTR.ARRAY) | (1 << PTR.HASH) | (1 << PTR.SET) | (1 << PTR.MAP)
+
 // =============================================================================
 // PTR.TYPED element-type aux codec — which typed-array flavor lives in the aux
 // field of a PTR.TYPED box. Pure (no compiler state) → lives with the NaN-box

package/module/array.js

@@ -10,13 +10,13 @@
 
 import { typed, asF64, asI64, asI32, NULL_NAN, UNDEF_NAN, temp, tempI32, allocPtr, multiCount, arrayLoop, elemLoad, elemStore, truthyIR, extractF64Bits, appendStaticSlots, mkPtrIR, slotAddr, isLiteralStr, resolveValType, undefExpr, ptrTypeEq } from '../src/ir.js'
 import { inBoundsArrIdx } from '../src/type.js'
-import { emit, spread, deps } from '../src/bridge.js'
+import { emit, spread, deps, idx as emitIndex } from '../src/bridge.js'
 import { valTypeOf } from '../src/kind.js'
 import { extractParams, classifyParam, ASSIGN_OPS, refsName, REFS_IN_EXPR } from '../src/ast.js'
-import { staticPropertyKey, staticObjectProps, inlineArraySid } from '../src/static.js'
+import { staticPropertyKey, staticObjectProps, inlineArraySid, staticIndexKey } from '../src/static.js'
 import { VAL, lookupValType, lookupNotString, updateRep } from '../src/reps.js'
 import { structInline } from '../src/abi/index.js'
-import { ctx, inc, err, PTR, LAYOUT, followForwardingWat } from '../src/ctx.js'
+import { ctx, inc, err, warnDeopt, PTR, LAYOUT, followForwardingWat } from '../src/ctx.js'
 import { strHashLiteral } from './collection.js'
 
 
@@ -33,7 +33,7 @@ function allocArray(len, cap) {
  *  only an 8-byte header left off-16 pointing at adjacent data-segment bytes, so
  *  for-in / named-prop lookup (which read off-16 as the props-sidecar pointer)
  *  walked garbage → OOB (test262 built-ins/Object/keys sparse-array). */
-function staticArrayPtr(slots) {
+export function staticArrayPtr(slots) {
   if (!ctx.runtime.data) ctx.runtime.data = ''
   while (ctx.runtime.data.length % 8 !== 0) ctx.runtime.data += '\0'
   const headerOff = ctx.runtime.data.length
@@ -625,8 +625,14 @@ export default (ctx) => {
     if (!hasSpread) {
       const len = elems.length
       // R: Static data segment for arrays of pure-literal elements (own-memory only).
-      // Saves N×(alloc+store) instructions in __start; raw f64 bits embedded directly.
-      if (len >= 4 && !ctx.memory.shared) {
+      // Raw f64 bits embedded directly — a constant array becomes a const pointer with no
+      // alloc and no per-element store. A static array aliases ONE shared data-segment
+      // region, so this is sound only when no caller expects a fresh instance per
+      // evaluation: at module scope the literal runs exactly once. A function-local
+      // literal (which would leak in-place mutations across calls — a latent bug the old
+      // len≥4 gate also had) allocs fresh instead. Module scope lifts the size floor too,
+      // so `const x = [1, 2, 3]` is a data segment, not an alloc.
+      if (ctx.func.atModuleScope && len >= 1 && !ctx.memory.shared) {
         // asF64 folds i32.const → f64.const literally, so int-literal arrays also qualify.
         const slots = elems.map(e => extractF64Bits(asF64(emit(e))))
         if (slots.every(b => b !== null)) return staticArrayPtr(slots)
@@ -676,10 +682,13 @@ export default (ctx) => {
     const litKey = isLiteralStr(idx) ? idx[1]
       : typeof arr === 'string' && lookupValType(arr) === VAL.OBJECT ? staticPropertyKey(idx)
       : null
-    // SRoA flat object: `o['k']` → `local.get $o#i` (analyze.js scanFlatObjects).
-    if (litKey != null && typeof arr === 'string' && ctx.func.flatObjects?.has(arr)) {
+    // SRoA flat object/array: `o['k']` / `a[2]` → `local.get $o#i` (scanFlatObjects).
+    // A bare integer index resolves its slot key here (not via `litKey`, which stays
+    // null for arrays so the heap-array / schema paths below are untouched).
+    if (typeof arr === 'string' && ctx.func.flatObjects?.has(arr)) {
       const fo = ctx.func.flatObjects.get(arr)
-      const fi = fo.names.indexOf(litKey)
+      const flatKey = litKey != null ? litKey : staticIndexKey(idx)
+      const fi = flatKey != null ? fo.names.indexOf(flatKey) : -1
       if (fi >= 0) return typed(['local.get', `$${arr}#${fi}`], 'f64')
     }
     if (litKey != null && typeof arr === 'string' && ctx.schema.slotOf) {
@@ -700,10 +709,24 @@ export default (ctx) => {
     // Multi-value calls are materialized at call site (see '()' handler), so
     // func()[i] works naturally — func() returns a heap array pointer, [i] indexes it.
     const vt = typeof arr === 'string' ? lookupValType(arr) : valTypeOf(arr)
-    const va = emit(arr), vi = asI32(emit(idx))
+    // Literal string key on a receiver that isn't a known array/typed/string:
+    // `x['a']` IS `x.a` — delegate to the dot emitter so an untyped/OBJECT/external
+    // receiver gets the same polymorphic dispatch (__dyn_get_any_t_h, host-external
+    // aware). The local `dynLoad` fallback below calls __dyn_get, which only probes
+    // the internal HASH layout — so `x['a']` on a host object silently returned
+    // undefined while `x.a` worked. (Known ARRAY/TYPED/STRING fall through unchanged:
+    // their string-key semantics differ from a HASH/OBJECT property read.)
+    if (litKey != null && vt !== VAL.ARRAY && vt !== VAL.TYPED && vt !== VAL.STRING)
+      return emit(['.', arr, litKey])
+    // emitIndex (not bare asI32(emit)) narrows integer index arithmetic — incl. a
+    // literal term like the `+1` of `a[i*W + x + 1]` — to i32 ops instead of the
+    // f64 convert/trunc round-trip. Non-i32 keys (string dispatch) fall back to
+    // asI32(emit) inside emitIndex, so this is a strict improvement for every branch.
+    const va = emit(arr), vi = emitIndex(idx)
     const ptrExpr = asF64(va)
     const dynLoad = (objExpr, keyExpr) => {
       if (ctx.transform.strict) err(`strict mode: dynamic property access \`${typeof arr === 'string' ? arr : '<expr>'}[<expr>]\` falls back to __dyn_get. Use a literal key or known typed-array receiver, or pass { strict: false }.`)
+      warnDeopt('deopt-dyn-read', `dynamic property read \`${typeof arr === 'string' ? arr : '<expr>'}[…]\` couldn't resolve a static type — it falls back to a runtime hash lookup (~1.5–2× slower than a typed/slot read, far worse in a hot loop). Use a literal key, a typed-array receiver, or a Map for genuinely dynamic keys.`)
       inc('__dyn_get')
       return ['f64.reinterpret_i64', ['call', '$__dyn_get', ['i64.reinterpret_f64', objExpr], ['i64.reinterpret_f64', keyExpr]]]
     }
@@ -753,6 +776,16 @@ export default (ctx) => {
     if (keyType === VAL.STRING)
       return typed(dynLoad(ptrExpr, asF64(emit(idx))), 'f64')
     if (vt === 'array') {
+      // Base offset of the array's data region. A binding proven never relocated
+      // (scanNeverGrown — a fresh array literal whose every use is a pure read, so no
+      // grow op can ever run) skips the realloc-forwarding follow: its base is the raw
+      // post-header offset `wrap(reinterpret(ptr) & OFFSET_MASK)`, no __ptr_offset call.
+      // Memory-safe ONLY under that proof — a relocated array read through this stale
+      // base would corrupt memory (see scanNeverGrown's default-deny rationale).
+      const neverGrown = typeof arr === 'string' && ctx.func.localReps?.get(arr)?.neverGrown === true
+      const arrBase = () => neverGrown
+        ? ['i32.wrap_i64', ['i64.and', ['i64.reinterpret_f64', ptrExpr], ['i64.const', LAYOUT.OFFSET_MASK]]]
+        : (inc('__ptr_offset'), ['call', '$__ptr_offset', ['i64.reinterpret_f64', ptrExpr]])
       // structInline Array<S>: element i is K consecutive inline f64 schema
       // cells — no per-row heap object, no stored element pointer. `arr[i]` is
       // the byte address of the element's first cell, returned as a first-class
@@ -761,11 +794,10 @@ export default (ctx) => {
       // structInline handles (src/analyze.js analyzeStructInline).
       const inlSid = inlineArraySid(arr)
       if (inlSid != null) {
-        inc('__ptr_offset')
         const baseI32 = tempI32('ab')
         const K = ctx.schema.list[inlSid].length
         const cell = typed(structInline(K).ops.elemAddr(
-          ['local.tee', `$${baseI32}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ptrExpr]]],
+          ['local.tee', `$${baseI32}`, arrBase()],
           vi), 'i32')
         cell.ptrKind = VAL.OBJECT
         cell.ptrAux = inlSid
@@ -775,51 +807,51 @@ export default (ctx) => {
       // not __typed_idx (which does __len + __ptr_offset = two forwarding follows
       // plus type-dispatch overhead irrelevant for plain arrays).
       const keyIsNum = keyType === VAL.NUMBER
-      // Inline fast path: when arr has a known element schema and key is a
-      // known number, the type-tag check and bounds check inside __arr_idx are
-      // dead weight in hot kernels. Emit (f64.load (i32.add base (shl i 3)))
-      // directly. base goes through __ptr_offset (still does forwarding follow),
-      // and hoistAddrBase will CSE the (base, i) pair across the iteration body.
-      // Array<NUMBER>/<STRING>/<OBJECT> all use 8-byte f64 slot layout — direct
-      // f64.load is correct regardless of elem kind (returns raw f64 for NUMBER,
-      // NaN-boxed pointer for OBJECT/STRING; downstream typed() handles both).
-      // Fast path fires on schemaId (Array<{x,y,z}> shapes) OR plain elem-val
-      // (Array<NUMBER> from `.map(x => x*k)` etc.) — both are proven facts from
-      // the narrowing fixpoint (carried onto params via paramReps).
-      const rep = typeof arr === 'string' ? ctx.func.localReps?.get(arr) : null
-      const hasElemFact = rep?.arrayElemSchema != null || rep?.arrayElemValType != null
-      // Take the unchecked inline load ONLY when the index is proven in-bounds by an
-      // enclosing canonical loop `for (let i=C; i<arr.length; i++)`. Skipping the bounds
-      // check on an arbitrary numeric index is unsound: `a[1]` on a length-1 array would
-      // read the raw (uninitialized) cell instead of undefined. Constant / unproven
-      // indices fall through to __arr_idx(_known) below, which bounds-checks → UNDEF_NAN.
-      const idxProvenInBounds = hasElemFact && keyIsNum
+      // Inline fast path for any known plain ARRAY + numeric key: the type-tag
+      // dispatch and bounds check inside __arr_idx(_known) are dead weight in hot
+      // kernels — most visibly AST walkers doing `node[i]` over heterogeneous
+      // arrays, where no element schema/valType is ever inferred. Emit the
+      // f64.load directly. base goes through __ptr_offset (still the forwarding
+      // follow), and hoistAddrBase CSEs the (base, i) pair across the iteration
+      // body. taggedLinear stores every element as one 8-byte f64 cell —
+      // Array<NUMBER>/<STRING>/<OBJECT> alike — so a direct f64.load is correct
+      // regardless of elem kind (raw f64 for NUMBER, NaN-boxed pointer for
+      // OBJECT/STRING; downstream typed() handles both). The load shape is fixed
+      // by the carrier, not by any rep fact, so we do NOT gate on a known element
+      // schema/valType: a bare `let a = [...]` walked by index gets the same
+      // inline load as an Array<{x,y,z}>. (structInline arrays returned above via
+      // inlineArraySid; typed arrays are VAL.TYPED, handled below.)
+      //
+      // Take the UNCHECKED inline load only when the index is proven in-bounds by
+      // an enclosing canonical loop `for (let i=C; i<arr.length; i++)` — a pure
+      // index<length structural proof (scanBoundedArrIdx, src/type.js), itself
+      // element-kind-independent. Skipping the bounds check on an arbitrary numeric
+      // index is unsound: `a[1]` on a length-1 array would read the raw cell instead
+      // of undefined; those fall through to the inline bounds-checked load below.
+      const idxProvenInBounds = keyIsNum
         && typeof arr === 'string' && typeof idx === 'string'
         && inBoundsArrIdx(ctx).has(arr + '\x00' + idx)
       if (idxProvenInBounds) {
-        inc('__ptr_offset')
-        // __ptr_offset returns i32 — base local must be i32 (not the default
-        // f64 NaN-box temp). Flat tee form so downstream peepholes can fold
+        // base local must be i32. Flat tee form so downstream peepholes can fold
         // `i32.wrap_i64 (i64.reinterpret_f64 (f64.load …))` → `i32.load …`
         // when this load feeds a ptrUnboxed OBJECT field.
         const baseI32 = tempI32('ab')
         return typed(ctx.abi.array.ops.load(
-          ['local.tee', `$${baseI32}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ptrExpr]]],
+          ['local.tee', `$${baseI32}`, arrBase()],
           vi), 'f64')
       }
-      // Known-elem array, numeric key, NOT proven in-bounds → inline bounds-checked
+      // Known plain array, numeric key, NOT proven in-bounds → inline bounds-checked
       // load: `idx < len ? load : undefined`. Same semantics as __arr_idx_known but
       // inline, so watr hoists the loop-invariant len load and CSEs the base — the
       // residual cost is a single (predictable) compare per access, not a call. Skipping
       // the check would read raw memory for OOB indices (e.g. `a[1]` on a length-1 array).
-      if (hasElemFact && keyIsNum) {
-        inc('__ptr_offset')
+      if (keyIsNum) {
         const baseI32 = tempI32('ab'), idxI32 = tempI32('ai')
         return typed(['if', ['result', 'f64'],
           ['i32.lt_u',
             ['local.tee', `$${idxI32}`, vi],
             ['i32.load', ['i32.sub',
-              ['local.tee', `$${baseI32}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ptrExpr]]],
+              ['local.tee', `$${baseI32}`, arrBase()],
               ['i32.const', 8]]]],
           ['then', ctx.abi.array.ops.load(['local.get', `$${baseI32}`], ['local.get', `$${idxI32}`])],
           ['else', undefExpr()]], 'f64')

package/module/collection.js

@@ -752,22 +752,30 @@ export default (ctx) => {
   // statically proven (e.g. a Map read off an object field): resolve MAP vs SET
   // vs ARRAY once at runtime. ARRAY.values() is the array itself; .keys() yields
   // indices; .entries() yields [i, el]. Any other receiver passes through.
-  const collViewDyn = (mapWalk, setWalk, arrWalk) => (expr) => {
+  // A typed array (PTR.TYPED) is NOT PTR.ARRAY, so without an explicit branch it fell
+  // through to `local.get $t` (return the receiver). For .values that is correct (the
+  // receiver iterates its values), but .keys then yielded values instead of indices and
+  // .entries yielded scalars instead of [i, value] pairs. The typedWalk arg restores the
+  // right behavior for typed receivers (keys → index array, entries → typed-aware pairs).
+  const collViewDyn = (mapWalk, setWalk, arrWalk, typedWalk) => (expr) => {
     inc('__ptr_type')
     const t = temp('cd')
     const pt = () => ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${t}`]]]
     const branch = (tag, walk, rest) =>
       ['if', ['result', 'f64'], ['i32.eq', pt(), ['i32.const', tag]], ['then', walk(t)], ['else', rest]]
     const tree = branch(PTR.MAP, mapWalk, branch(PTR.SET, setWalk,
-      branch(PTR.ARRAY, arrWalk, ['local.get', `$${t}`])))
+      branch(PTR.ARRAY, arrWalk, branch(PTR.TYPED, typedWalk, ['local.get', `$${t}`]))))
     return typed(['block', ['result', 'f64'], ['local.set', `$${t}`, asF64(emit(expr))], tree], 'f64')
   }
+  // keys: index array [0..len-1] for both plain and typed (length-based, no element reads).
   ctx.core.emit['.keys'] = collViewDyn(
-    t => collKeysFromTemp(t, MAP_ENTRY, 8), t => collKeysFromTemp(t, SET_ENTRY, 8), arrIdxFromTemp)
+    t => collKeysFromTemp(t, MAP_ENTRY, 8), t => collKeysFromTemp(t, SET_ENTRY, 8), arrIdxFromTemp, arrIdxFromTemp)
+  // values: the receiver iterates its own elements (correct for plain and typed alike).
   ctx.core.emit['.values'] = collViewDyn(
-    t => collKeysFromTemp(t, MAP_ENTRY, 16), t => collKeysFromTemp(t, SET_ENTRY, 8), t => ['local.get', `$${t}`])
+    t => collKeysFromTemp(t, MAP_ENTRY, 16), t => collKeysFromTemp(t, SET_ENTRY, 8), t => ['local.get', `$${t}`], t => ['local.get', `$${t}`])
+  // entries: [i, element] pairs; the typed variant reads elements width/kind-aware.
   ctx.core.emit['.entries'] = collViewDyn(
-    t => collEntriesFromTemp(t, MAP_ENTRY, 8, 16), t => collEntriesFromTemp(t, SET_ENTRY, 8, 8), arrEntriesFromTemp)
+    t => collEntriesFromTemp(t, MAP_ENTRY, 8, 16), t => collEntriesFromTemp(t, SET_ENTRY, 8, 8), arrEntriesFromTemp, arrEntriesFromTempTyped)
 
   // Map/Set forEach(cb): invoke cb(value, key) per live entry in insertion order.
   // Map yields (value=val@16, key=key@8); Set yields (value=key@8, key@8) — the
@@ -1754,3 +1762,31 @@ function arrEntriesFromTemp(t) {
       ['br', `$aeloop${id}`]]],
     out.ptr]
 }
+
+// TypedArray.prototype.entries() → dense Array of [index, element] pairs, reading each
+// element width/kind-aware via __typed_get_idx (the plain arrEntriesFromTemp uses a raw
+// f64.load, wrong for non-f64 typed arrays). Guarded on __typed_get_idx being registered:
+// it only is when the typedarray module is loaded, which is exactly when a PTR.TYPED
+// value can exist — so when absent, this branch is dead and falls back to the receiver.
+function arrEntriesFromTempTyped(t) {
+  if (!ctx.core.stdlib['__typed_get_idx']) return ['local.get', `$${t}`]
+  inc('__len', '__typed_get_idx', '__alloc_hdr')
+  const n = tempI32('aetn'), i = tempI32('aeti'), pair = tempI32('aetp')
+  const out = allocPtr({ type: PTR.ARRAY, len: ['local.get', `$${n}`], tag: 'aet' })
+  const id = ctx.func.uniq++
+  const P = () => ['i64.reinterpret_f64', ['local.get', `$${t}`]]
+  return ['block', ['result', 'f64'],
+    ['local.set', `$${n}`, ['call', '$__len', P()]],
+    out.init,
+    ['local.set', `$${i}`, ['i32.const', 0]],
+    ['block', `$aetbrk${id}`, ['loop', `$aetloop${id}`,
+      ['br_if', `$aetbrk${id}`, ['i32.ge_s', ['local.get', `$${i}`], ['local.get', `$${n}`]]],
+      ['local.set', `$${pair}`, ['call', '$__alloc_hdr', ['i32.const', 2], ['i32.const', 2]]],
+      ['f64.store', ['local.get', `$${pair}`], ['f64.convert_i32_s', ['local.get', `$${i}`]]],
+      ['f64.store', ['i32.add', ['local.get', `$${pair}`], ['i32.const', 8]],
+        ['call', '$__typed_get_idx', P(), ['local.get', `$${i}`]]],
+      elemStore(out.local, i, mkPtrIR(PTR.ARRAY, 0, ['local.get', `$${pair}`])),
+      ['local.set', `$${i}`, ['i32.add', ['local.get', `$${i}`], ['i32.const', 1]]],
+      ['br', `$aetloop${id}`]]],
+    out.ptr]
+}

package/module/core.js

@@ -16,7 +16,7 @@ import { valTypeOf, shapeOf } from '../src/kind.js'
 import { T } from '../src/ast.js'
 import { inlineArraySid } from '../src/static.js'
 import { VAL, lookupValType, lookupNotString, repOf, updateRep } from '../src/reps.js'
-import { ctx, err, inc, PTR, LAYOUT, HEAP, emitArity, followForwardingWat, declGlobal } from '../src/ctx.js'
+import { ctx, err, inc, PTR, LAYOUT, HEAP, FORWARDING_MASK, emitArity, followForwardingWat, declGlobal } from '../src/ctx.js'
 import { ptrOffsetFwdWat, STR_INTERN_BIT } from '../layout.js'
 import { nanPrefixHex } from '../layout.js'
 import { initSchema } from './schema.js'
@@ -153,9 +153,7 @@ export default (ctx) => {
     ;; (cap=-1 sentinel at -4, new offset at -8). Other types never forward, so they skip
     ;; the loop; a well-formed ptr without forwarding pays one bounds + cap check per hop.
     (local.set $t (i32.wrap_i64 (i64.and (i64.shr_u (local.get $bits) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))))
-    (if (i32.or (i32.eq (local.get $t) (i32.const ${PTR.ARRAY}))
-          (i32.or (i32.eq (local.get $t) (i32.const ${PTR.HASH}))
-            (i32.or (i32.eq (local.get $t) (i32.const ${PTR.SET})) (i32.eq (local.get $t) (i32.const ${PTR.MAP})))))
+    (if (i32.and (i32.shl (i32.const 1) (local.get $t)) (i32.const ${FORWARDING_MASK}))
       (then
         ${followForwardingWat('$off', { lowGuard: true })}))
     (local.get $off))`

package/module/math.js

@@ -129,7 +129,11 @@ export default (ctx) => {
   // undefined→NaN, and strings get parsed. Without this, raw NaN-boxed pointers
   // (null/undefined/strings) would propagate through math.log etc. and surface
   // as the original null/undefined sentinel after decode.
-  const fn = (name, ...args) => typed(['call', `$${name}`, ...args.map(a => toNumF64(a, emit(a)))], 'f64')
+  // A canon'd operand feeding a math call is redundant: the callee (log/sin/exp/…)
+  // propagates a non-canonical NaN identically and re-canon-izes its own result.
+  // `Math.log(Math.log(x))` thus sheds the inner per-call select + f64.ne.
+  const stripCanon = (v) => (v && v.canonOf != null) ? typed(v.canonOf, 'f64') : v
+  const fn = (name, ...args) => typed(['call', `$${name}`, ...args.map(a => stripCanon(toNumF64(a, emit(a))))], 'f64')
 
   // Canonicalize a possibly-NaN f64 result. A wasm arithmetic op that mints a
   // fresh NaN (f64.sqrt of a negative, f64.min/max with a NaN operand) leaves
@@ -139,12 +143,18 @@ export default (ctx) => {
   // untyped === / typeof. So fold any NaN back to canonical where one is born.
   const canon = (node) => {
     const t = temp('cn')
-    return typed(['block', ['result', 'f64'],
+    const ir = typed(['block', ['result', 'f64'],
       ['local.set', `$${t}`, node],
       ['select',
         ['f64.const', 'nan'],
         ['local.get', `$${t}`],
         ['f64.ne', ['local.get', `$${t}`], ['local.get', `$${t}`]]]], 'f64')
+    // Tag the wrapper so a NaN-propagating f64 consumer (`f64.add`/`mul`/… that
+    // itself canon-izes on escape) can strip the redundant inner canon: the raw
+    // op result `node` propagates a freshly-minted NaN identically through the
+    // consumer, and only the OUTERMOST escaping value needs the canonical form.
+    ir.canonOf = node
+    return ir
   }
 
   // sqrt(x) needs no NaN-canon when its argument is provably ≥ 0 with no spurious NaN:
@@ -499,6 +509,132 @@ export default (ctx) => {
     (if (f64.eq (f64.abs (local.get $x)) (f64.const inf)) (then (return (f64.const nan))))
     (f64.div (call $math.sin (local.get $x)) (call $math.cos (local.get $x))))`)
 
+  // ── f64x2 SIMD sin/cos — both lanes through one polynomial ───────────────────
+  // The scalar sin_core/cos_core algorithm lifted to two f64 lanes: same
+  // round-to-nearest π reduction, same minimax poly (SIN_C/COS_C), same quadrant
+  // parity — but every branch becomes branchless so two independent angles cost one
+  // evaluation. A kernel computing sin and cos of distinct args (rotations, de Jong /
+  // Clifford maps, oscillator banks) packs them two-per-vector and ≈halves trig cost.
+  //   • Both reduction passes run unconditionally: for an in-range r the second pass'
+  //     q2 = nearest(r/π) = 0, so it's an exact no-op — no per-lane branch needed, and
+  //     it still rescues |x| up to ~1e15 just like the scalar's gated pass.
+  //   • NaN and ±∞ fall out as NaN through the arithmetic (∞ − ∞·π = NaN); a v128 lane
+  //     is raw f64, not a NaN-box, so the canonical-NaN guard the scalar needs is moot.
+  //   • Sign flip for odd quadrants is `r XOR (mask & −0.0)` (mask = |q|>0.5); final
+  //     min/max clamps the ~1e-8 poly overshoot to [−1,1], same as scalar.
+  const splat = (c) => `(f64x2.splat (f64.const ${c}))`
+  const horner2 = (cs, v = '$r2') => cs.reduceRight((acc, c, i) =>
+    i === cs.length - 1 ? splat(c)
+      : `(f64x2.add ${splat(c)} (f64x2.mul (local.get ${v}) ${acc}))`, '')
+  // fdlibm log's even/odd split, as f64x2 coefficient arrays (the scalar $math.log inlines them):
+  // t1 = w·(L3 + w·(L5 + w·L7)), t2 = z·(L2 + w·(L4 + w·(L6 + w·L8))). Vectorized log_v reuses these.
+  const LOG_T1 = [0.3999999999940941908, 0.2222219843214978396, 0.1531383769920937332]
+  const LOG_T2 = [0.6666666666666735130, 0.2857142874366239149, 0.1818357216161805012, 0.1479819860511658591]
+  // Shared reduce → r ∈ [−π/2,π/2] in $r, quadrant parity in $q (branchless, 2 passes).
+  const reduce2 = `
+    (local.set $q (f64x2.nearest (f64x2.mul (local.get $x) ${splat(INV_PI)})))
+    (local.set $r (f64x2.sub (local.get $x) (f64x2.mul (local.get $q) ${splat(PI)})))
+    (local.set $q2 (f64x2.nearest (f64x2.mul (local.get $r) ${splat(INV_PI)})))
+    (local.set $r (f64x2.sub (local.get $r) (f64x2.mul (local.get $q2) ${splat(PI)})))
+    (local.set $q (f64x2.add (local.get $q) (local.get $q2)))
+    (local.set $q (f64x2.sub (local.get $q) (f64x2.mul ${splat(2)} (f64x2.nearest (f64x2.mul (local.get $q) ${splat(0.5)})))))
+    (local.set $r2 (f64x2.mul (local.get $r) (local.get $r)))`
+  // r XOR (|q|>0.5 ? −0.0 : 0), then clamp to [−1,1].
+  const signClamp = `
+    (local.set $r (v128.xor (local.get $r)
+      (v128.and (f64x2.gt (f64x2.abs (local.get $q)) ${splat(0.5)}) ${splat('-0.0')})))
+    (f64x2.min (f64x2.max (local.get $r) ${splat(-1)}) ${splat(1)})`
+  wat('math.sin2', `(func $math.sin2 (param $x v128) (result v128)
+    (local $q v128) (local $q2 v128) (local $r v128) (local $r2 v128)${reduce2}
+    (local.set $r (f64x2.mul (local.get $r) ${horner2(SIN_C)}))${signClamp})`)
+  wat('math.cos2', `(func $math.cos2 (param $x v128) (result v128)
+    (local $q v128) (local $q2 v128) (local $r v128) (local $r2 v128)${reduce2}
+    (local.set $r ${horner2(COS_C)})${signClamp})`)
+  // pow has no cheap 2-lane polynomial (it is exp(y·ln x) with cancellation-sensitive reductions),
+  // so the f64x2 mirror computes each lane with the scalar $math.pow and repacks — BIT-EXACT by
+  // construction. No transcendental speedup, but it keeps a pow-bearing pixel kernel's surrounding
+  // f64x2 arithmetic vectorized (the per-pixel-color pass only emits this when a truly-2-wide op —
+  // sin2/cos2/sqrt — already justifies the pair, so the extract/repack never makes a kernel slower).
+  wat('math.pow2', `(func $math.pow2 (param $x v128) (param $y v128) (result v128)
+    (f64x2.replace_lane 1
+      (f64x2.splat (call $math.pow (f64x2.extract_lane 0 (local.get $x)) (f64x2.extract_lane 0 (local.get $y))))
+      (call $math.pow (f64x2.extract_lane 1 (local.get $x)) (f64x2.extract_lane 1 (local.get $y)))))`, ['math.pow'])
+
+  // atan2/hypot/log have no cheap 2-lane polynomial (multi-`return` fdlibm bodies), so — like pow2 —
+  // each f64x2 mirror computes both lanes with the SCALAR helper and repacks: BIT-EXACT by
+  // construction. The per-pixel-color pass only emits these when a truly-2-wide op (sin2/cos2/sqrt)
+  // already justifies the f64x2 pair, so the extract/repack never makes a kernel slower.
+  // NOTE: names avoid the $math.log2/$math.exp2 collision (those are log-/exp-BASE-2).
+  wat('math.atan2_2', `(func $math.atan2_2 (param $y v128) (param $x v128) (result v128)
+    (f64x2.replace_lane 1
+      (f64x2.splat (call $math.atan2 (f64x2.extract_lane 0 (local.get $y)) (f64x2.extract_lane 0 (local.get $x))))
+      (call $math.atan2 (f64x2.extract_lane 1 (local.get $y)) (f64x2.extract_lane 1 (local.get $x)))))`, ['math.atan2'])
+  wat('math.hypot_2', `(func $math.hypot_2 (param $x v128) (param $y v128) (result v128)
+    (f64x2.replace_lane 1
+      (f64x2.splat (call $math.hypot (f64x2.extract_lane 0 (local.get $x)) (f64x2.extract_lane 0 (local.get $y))))
+      (call $math.hypot (f64x2.extract_lane 1 (local.get $x)) (f64x2.extract_lane 1 (local.get $y)))))`, ['math.hypot'])
+  // True f64x2 log — both lanes through one fdlibm poly (≈2× over two scalar calls). The HOT path
+  // (both lanes a normal finite x>0) mirrors $math.log's normal branch op-for-op: bit-exact (the
+  // sqrt2-center conditional becomes a per-lane bitselect; the i32 exponent k becomes an f64 via the
+  // 2^52 magic-add, identical to convert_i32_s for |k|≤1075). Any other lane (≤0/∞/NaN/denormal)
+  // routes BOTH lanes to the scalar fallback → bit-exact by construction, edges never lose precision.
+  wat('math.log_v', `(func $math.log_v (param $x v128) (result v128)
+    (local $k v128) (local $m v128) (local $mask v128) (local $f v128) (local $s v128) (local $z v128) (local $w v128) (local $hfsq v128)
+    (if (result v128)
+      (i64x2.all_true (v128.and
+        (f64x2.ge (local.get $x) (f64x2.splat (f64.const 0x1p-1022)))
+        (f64x2.lt (local.get $x) (f64x2.splat (f64.const inf)))))
+      (then
+        (local.set $k (f64x2.sub
+          (v128.or (v128.and (i64x2.shr_u (local.get $x) (i32.const 52)) (i64x2.splat (i64.const 0x7ff)))
+                   (i64x2.splat (i64.const 0x4330000000000000)))
+          (f64x2.splat (f64.const 4503599627371519))))
+        (local.set $m (v128.or (v128.and (local.get $x) (i64x2.splat (i64.const 0x000fffffffffffff))) (i64x2.splat (i64.const 0x3ff0000000000000))))
+        (local.set $mask (f64x2.ge (local.get $m) (f64x2.splat (f64.const 1.4142135623730951))))
+        (local.set $m (v128.bitselect (f64x2.mul (local.get $m) (f64x2.splat (f64.const 0.5))) (local.get $m) (local.get $mask)))
+        (local.set $k (f64x2.add (local.get $k) (v128.and (local.get $mask) (f64x2.splat (f64.const 1.0)))))
+        (local.set $f (f64x2.sub (local.get $m) (f64x2.splat (f64.const 1.0))))
+        (local.set $s (f64x2.div (local.get $f) (f64x2.add (local.get $f) (f64x2.splat (f64.const 2.0)))))
+        (local.set $z (f64x2.mul (local.get $s) (local.get $s)))
+        (local.set $w (f64x2.mul (local.get $z) (local.get $z)))
+        (local.set $hfsq (f64x2.mul (f64x2.splat (f64.const 0.5)) (f64x2.mul (local.get $f) (local.get $f))))
+        (f64x2.add
+          (f64x2.mul (local.get $k) (f64x2.splat (f64.const ${Math.LN2})))
+          (f64x2.add (f64x2.sub (local.get $f) (local.get $hfsq))
+            (f64x2.mul (local.get $s) (f64x2.add (local.get $hfsq)
+              (f64x2.add
+                (f64x2.mul (local.get $w) ${horner2(LOG_T1, '$w')})
+                (f64x2.mul (local.get $z) ${horner2(LOG_T2, '$w')})))))))
+      (else
+        (f64x2.replace_lane 1
+          (f64x2.splat (call $math.log (f64x2.extract_lane 0 (local.get $x))))
+          (call $math.log (f64x2.extract_lane 1 (local.get $x)))))))`, ['math.log'])
+
+  // True f64x2 exp2 — hot path (round(y) ∈ (−1023,1024), the normal-result range) mirrors $math.exp2's
+  // single-IEEE-build branch op-for-op (Horner over f=y−round(y), 2^k via (k+1023)<<52); edges
+  // (overflow/underflow/denormal/NaN) route both lanes to the scalar fallback → bit-exact.
+  wat('math.exp2_v', `(func $math.exp2_v (param $y v128) (result v128)
+    (local $k v128) (local $f v128)
+    (local.set $k (f64x2.nearest (local.get $y)))
+    (if (result v128)
+      (i64x2.all_true (v128.and
+        (f64x2.gt (local.get $k) (f64x2.splat (f64.const -1023)))
+        (f64x2.lt (local.get $k) (f64x2.splat (f64.const 1024)))))
+      (then
+        (local.set $f (f64x2.sub (local.get $y) (local.get $k)))
+        (f64x2.mul ${horner2(EXP2_C, '$f')}
+          (i64x2.shl (i64x2.add
+            (i64x2.extend_low_i32x4_s (i32x4.trunc_sat_f64x2_s_zero (local.get $k)))
+            (i64x2.splat (i64.const 1023))) (i32.const 52))))
+      (else
+        (f64x2.replace_lane 1
+          (f64x2.splat (call $math.exp2 (f64x2.extract_lane 0 (local.get $y))))
+          (call $math.exp2 (f64x2.extract_lane 1 (local.get $y)))))))`, ['math.exp2'])
+
+  // e^x = 2^(x·log2e) — defers to exp2_v exactly as scalar $math.exp defers to $math.exp2. Bit-exact.
+  wat('math.exp_v', `(func $math.exp_v (param $x v128) (result v128)
+    (call $math.exp2_v (f64x2.mul (local.get $x) (f64x2.splat (f64.const ${Math.LOG2E})))))`, ['math.exp2_v'])
+
   // e^x = 2^(x·log2 e) — defer to the faster $math.exp2 (one multiply, no division, and
   // exp2's NaN/overflow/underflow guards cover exp's). Accurate to exp2's ~6e-9, better
   // than the old 7-term Taylor, and it shares one code path with `2**`.

package/module/number.js

@@ -155,6 +155,7 @@ export default (ctx) => {
   deps({
     __mkstr: ['__alloc'],
     __ftoa: ['__itoa', '__pow10', '__mkstr', '__static_str', '__toExp'],
+    __i32_to_str: ['__itoa', '__mkstr'],
     __toExp: ['__itoa', '__pow10', '__mkstr', '__static_str'],
     __radix_str: ['__mkstr'],
     __num_radix: ['__ftoa', '__mkstr'],
@@ -215,6 +216,26 @@ export default (ctx) => {
     ${reverseBytesWat()}
     (local.get $len))`
 
+  // __i32_to_str(val: i32) → f64 (NaN-boxed string) — ToString for a value the
+  // compiler proved is a signed i32. The whole point is to bypass __ftoa's float
+  // machinery (shortest-repr search, __toExp, __pow10): a known integer renders with
+  // just __itoa over its magnitude plus a sign byte. Lets `"id " + (n|0)` and integer
+  // templates skip the ~2 KB float formatter the generic ToString hard-pulls.
+  ctx.core.stdlib['__i32_to_str'] = `(func $__i32_to_str (param $val i32) (result f64)
+    (local $buf i32) (local $len i32) (local $u i32)
+    (local.set $buf (call $__alloc (i32.const 12)))
+    (if (i32.lt_s (local.get $val) (i32.const 0))
+      (then
+        (i32.store8 (local.get $buf) (i32.const 45))   ;; '-'
+        ;; magnitude as unsigned: negate via 0 - val (INT_MIN maps to itself, read u below)
+        (local.set $u (i32.sub (i32.const 0) (local.get $val)))
+        (local.set $len (call $__itoa (local.get $u) (i32.add (local.get $buf) (i32.const 1))))
+        (return (call $__mkstr (local.get $buf) (i32.add (local.get $len) (i32.const 1)))))
+      (else
+        (local.set $len (call $__itoa (local.get $val) (local.get $buf)))
+        (return (call $__mkstr (local.get $buf) (local.get $len)))))
+    (f64.const 0))`
+
   // __radix_str(val: i64, radix: i32) → f64 (NaN-boxed string)
   // Signed integer → radix string for BigInt.prototype.toString(radix). Digits go
   // 0-9 then a-z (lowercase, per spec); magnitude is taken unsigned so i64.MIN

package/module/object.js

@@ -9,6 +9,7 @@
 
 import { typed, asF64, asI64, NULL_NAN, UNDEF_NAN, temp, tempI32, tempI64, block64, ptrTypeEq, dispatchByPtrType, allocPtr, needsDynShadow, mkPtrIR, extractF64Bits, appendStaticSlots, slotAddr, elemLoad, elemStore, boolBoxIR } from '../src/ir.js'
 import { emit } from '../src/bridge.js'
+import { staticArrayPtr } from './array.js'
 import { valTypeOf, shapeOf } from '../src/kind.js'
 import { VAL, lookupValType, repOf, updateRep } from '../src/reps.js'
 import { ctx, err, inc, PTR, LAYOUT, declGlobal } from '../src/ctx.js'
@@ -246,6 +247,31 @@ export default (ctx) => {
   }
   ctx.core.emit['Object.getOwnPropertyNames'] = ctx.core.emit['Object.keys']
 
+  // for-in's read-only key enumeration (src/prepare for…in lowering). Identical to
+  // Object.keys EXCEPT: when the receiver is a bare variable with a complete static
+  // schema, the key list is a compile-time constant, so it pools ONE static-data
+  // array (no per-evaluation alloc) — eliminating for-in's hot-loop heap-growth
+  // cliff and its unbounded-allocation OOM. The pooled array is shared/read-only,
+  // which is sound because for-in only reads ks[i]/ks.length (Object.keys can't pool:
+  // user code may `.sort()`/`.reverse()` the result in place). Anything not a static
+  // schema bare-var — arrays/strings/HASH/dyn-props/expressions — delegates to
+  // Object.keys (evaluates the receiver, full runtime enumeration).
+  ctx.core.emit['__keys_ro'] = (obj) => {
+    // Pool only when the receiver's enumerable key set is provably the static
+    // schema: a bare var with NO computed-key writes (`o[k]=v`) — those are the
+    // only writes that add enumerable keys (computed reads / dot-adds don't).
+    // `mayHaveDynProps` is too coarse here — it also flags computed-READ receivers,
+    // and for-in's own `o[k]` read would otherwise veto its own pooling.
+    if (typeof obj === 'string' && !ctx.types.dynWriteVars?.has(obj) && !isHashTyped(obj) && !arrayValType(obj) && !stringValType(obj)) {
+      const schema = resolveSchema(obj)
+      if (schema) {
+        const slots = schema.map(name => extractF64Bits(asF64(emit(['str', name]))))
+        if (slots.every(b => b !== null)) return staticArrayPtr(slots)
+      }
+    }
+    return ctx.core.emit['Object.keys'](obj)
+  }
+
   // Object.prototype.hasOwnProperty(key) — own-property presence check.
   // Compile-time fold for literal keys against object literals or variables
   // with known schemas; runtime path delegates to the `in` operator (same

package/module/simd.js

@@ -1,8 +1,9 @@
 /**
- * SIMD module — source-level f32x4 / i32x4 intrinsics that lower 1:1 to wasm SIMD
- * (v128). Lets a jz kernel process 4 lanes per instruction: the per-pixel-parallel
- * kernels (mandelbrot, raymarcher) run 4 pixels/rays in masked lockstep and beat
- * scalar V8 several-fold (validated: SIMD-4 mandelbrot ≈ 4.6× a warm-V8 scalar loop).
+ * SIMD module — source-level f32x4 / i32x4 / f64x2 intrinsics that lower 1:1 to wasm
+ * SIMD (v128). Lets a jz kernel process 4 (or, for f64x2, 2) lanes per instruction:
+ * the per-pixel-parallel kernels (mandelbrot, raymarcher) run 4 pixels/rays in masked
+ * lockstep, and the attractors kernel packs its two sines + two cosines two-per-f64x2.
+ * Several-fold over scalar V8 (validated: SIMD-4 mandelbrot ≈ 4.6× a warm-V8 scalar loop).
  *
  * A v128 value is just a local whose wasm type is `v128` (exprType returns 'v128'
  * for these calls; emit passes it through without an f64/i32 coercion). Building
@@ -18,11 +19,14 @@
  *   i32x4.splat(n) / add/sub(a,b) / lane(v,k)
  *   v128.and/or/xor(a,b) / not(a) / bitselect(t,f,mask)
  *   v128.anyTrue(v) / v128.allTrue(v) → i32 (loop-exit tests)
+ *   f64x2.splat(x) / lanes(a,b) / add/sub/mul/div/min/max / sqrt/abs/neg/… / cmp
+ *   f64x2.sin(v) / f64x2.cos(v) → both lanes through one poly ($math.sin2/$math.cos2)
+ *   f64x2.lane(v, k)          extract lane k (0..1) as a number
  *
  * @module simd
  */
 import { typed, asF64, asI32 } from '../src/ir.js'
-import { emit } from '../src/bridge.js'
+import { emit, emitter } from '../src/bridge.js'
 import { err } from '../src/ctx.js'
 
 export default (ctx) => {
@@ -82,4 +86,32 @@ export default (ctx) => {
   // ── lane extract (read a single lane back to a scalar) ───────────────────────
   e['f32x4.lane'] = (v, k) => F(['f64.promote_f32', ['f32x4.extract_lane', laneIdx(k), op(v)]])
   e['i32x4.lane'] = (v, k) => I(['i32x4.extract_lane', laneIdx(k), op(v)])
+
+  // ── f64x2 — two full-precision f64 lanes (no f32 demotion) ───────────────────
+  // For kernels whose hot value is f64: two independent angles/coords per instruction.
+  // `f64x2.sin`/`f64x2.cos` lower to the shared $math.sin2/$math.cos2 poly (module/math.js)
+  // — sin and cos of distinct args pack two-per-vector and ≈halve transcendental cost.
+  const lane2 = (k) => {
+    const v = typeof k === 'number' ? k : (Array.isArray(k) && k.length === 2 && k[0] == null && typeof k[1] === 'number') ? k[1] : null
+    if (v == null || (v | 0) !== v || v < 0 || v > 1)
+      err(`f64x2 lane index must be a 0..1 literal (got ${JSON.stringify(k)}).`)
+    return v
+  }
+  e['f64x2.splat'] = (a) => V(['f64x2.splat', asF64(emit(a))])
+  e['f64x2.lanes'] = (a, b) => V(['f64x2.replace_lane', 1, ['f64x2.splat', asF64(emit(a))], asF64(emit(b))])
+  for (const o of ['add', 'sub', 'mul', 'div', 'min', 'max'])
+    e[`f64x2.${o}`] = (a, b) => V([`f64x2.${o}`, op(a), op(b)])
+  for (const o of ['sqrt', 'abs', 'neg', 'floor', 'ceil', 'trunc', 'nearest'])
+    e[`f64x2.${o}`] = (a) => V([`f64x2.${o}`, op(a)])
+  for (const o of ['eq', 'ne', 'lt', 'le', 'gt', 'ge'])
+    e[`f64x2.${o}`] = (a, b) => V([`f64x2.${o}`, op(a), op(b)])
+  e['f64x2.sin'] = emitter(['math.sin2'], (a) => V(['call', '$math.sin2', op(a)]))
+  e['f64x2.cos'] = emitter(['math.cos2'], (a) => V(['call', '$math.cos2', op(a)]))
+  // f64x2.log/exp/exp2 lower to the true-vectorized $math.log_v/$math.exp_v/$math.exp2_v polys —
+  // both lanes through one fdlibm/2^f evaluation (≈2× over two scalar calls), bit-exact via a
+  // hot-path-vectorized + scalar-edge-fallback split (module/math.js).
+  e['f64x2.log'] = emitter(['math.log_v'], (a) => V(['call', '$math.log_v', op(a)]))
+  e['f64x2.exp'] = emitter(['math.exp_v'], (a) => V(['call', '$math.exp_v', op(a)]))
+  e['f64x2.exp2'] = emitter(['math.exp2_v'], (a) => V(['call', '$math.exp2_v', op(a)]))
+  e['f64x2.lane'] = (v, k) => F(['f64x2.extract_lane', lane2(k), op(v)])
 }