jz 0.6.0 → 0.8.0

package/src/compile/narrow.js

@@ -7,7 +7,7 @@
  * function `sig` records change.
  */
 
-import { ctx, warn } from '../ctx.js'
+import { ctx, warn, err } from '../ctx.js'
 import { isBlockBody, alwaysReturns, hasBareReturn, returnExprs } from '../ast.js'
 import { isLiteralStr, I32_MIN, I32_MAX } from '../ir.js'
 import {
@@ -24,10 +24,14 @@ import {
 } from '../param-reps.js'
 import {
   inferArrElemSchema, inferArrElemValType,
-  inferSchemaId, inferValType, inferTypedCtor,
+  inferSchemaId, inferValType, inferTypedCtor, inferParams,
 } from './infer.js'
 
 const PTR_ABI_KINDS = new Set([VAL.OBJECT, VAL.SET, VAL.MAP, VAL.BUFFER])
+// Integer-preserving ops: an expr over integers stays integer (ToInt32-consistent) through these.
+// Excludes /, %, ** (fractional). Used to recognize a recursive arg whose i32-ness follows from
+// its inputs' i32-ness (`f(n - 1)`), so it carries no independent type evidence.
+const RECUR_INT_OPS = new Set(['+', '-', '*', 'u-', 'u+', '&', '|', '^', '<<', '>>', '>>>', '~'])
 
 
 function filterLiveCallSites(callSites, valueUsed) {
@@ -156,12 +160,33 @@ function refreshCallerValTypes(callerCtx) {
   }
 }
 
+// Per-caller typed-elem context: the caller's body-local typed arrays, layered
+// over the module's typed-array globals so a call like `f(globalArr)` resolves
+// `globalArr`'s ctor (inferTypedCtor reads only this map for a bare-name arg).
+// A global is visible UNLESS the caller shadows the name with a param or local
+// of its own — only then could the name denote a non-typed value. Globals are
+// sound to consult: globalTypedElem holds a name only when EVERY assignment to
+// it is the same single typed-array ctor (scope.js invalidates on any conflict),
+// so it can't denote a different kind at the call site.
+function callerTypedElemsFor(func, globalTE) {
+  const facts = analyzeBody(func.body)
+  const local = facts.typedElems
+  if (!globalTE.size) return local
+  const shadowed = new Set(facts.locals.keys())
+  for (const p of func.sig?.params || []) shadowed.add(p.name)
+  const merged = new Map()
+  for (const [k, v] of globalTE) if (!shadowed.has(k)) merged.set(k, v)
+  for (const [k, v] of local) merged.set(k, v)  // local typed binding shadows the global
+  return merged
+}
+
 function buildCallerTypedCtx() {
   const callerTypedCtx = new Map()
-  callerTypedCtx.set(null, ctx.scope.globalTypedElem || new Map())
+  const globalTE = ctx.scope.globalTypedElem || new Map()
+  callerTypedCtx.set(null, globalTE)
   for (const func of ctx.func.list) {
     if (!func.body || func.raw) continue
-    callerTypedCtx.set(func, analyzeBody(func.body).typedElems)
+    callerTypedCtx.set(func, callerTypedElemsFor(func, globalTE))
   }
   return callerTypedCtx
 }
@@ -203,6 +228,7 @@ function enrichCallerValTypesFromPointerParams(callerCtx) {
 }
 
 function refreshCallerLocals(callerCtx) {
+  const prevTE = ctx.types.typedElem
   for (const func of ctx.func.list) {
     if (!func.body || func.raw) continue
     // Seed pointer-narrowed params' val-kind so analyzeBody recognises e.g.
@@ -212,13 +238,24 @@ function refreshCallerLocals(callerCtx) {
     // (heapsort→siftDown's `end`). analyzeFuncForEmit re-seeds + re-invalidates at
     // emit time, so this transient localReps doesn't leak past narrowing.
     ctx.func.localReps = new Map()
-    for (const p of func.sig.params) if (p.ptrKind != null) ctx.func.localReps.set(p.name, { val: p.ptrKind })
+    // Seed the typedElem overlay with this func's TYPED-pointer params (element ctor from
+    // ptrAux), exactly as analyzeFuncForEmit does at emit time. Without it, a local bound to
+    // an integer typed-array PARAM element — `aa = perm[perm[X]+Y]` (noise), perm an Int32
+    // pointer param — types f64 here, so a callee fed it (`grad(aa,…)`, used only as `aa&3`)
+    // never narrows its param to i32. Mirrors emit so narrow-time callerLocals agree with it.
+    const te = ctx.scope.globalTypedElem ? new Map(ctx.scope.globalTypedElem) : new Map()
+    for (const p of func.sig.params) {
+      if (p.ptrKind != null) ctx.func.localReps.set(p.name, { val: p.ptrKind })
+      if (p.ptrKind === VAL.TYPED && p.ptrAux != null) { const c = ctorFromElemAux(p.ptrAux); if (c != null) te.set(p.name, c) }
+    }
+    ctx.types.typedElem = te
     invalidateLocalsCache(func.body)
     const fresh = analyzeBody(func.body).locals
     for (const p of func.sig.params) if (!fresh.has(p.name)) fresh.set(p.name, p.type)
     callerCtx.get(func).callerLocals = fresh
   }
   ctx.func.localReps = null
+  ctx.types.typedElem = prevTE
 }
 
 function resetParamWasmFacts(paramReps) {
@@ -260,6 +297,35 @@ function narrowI32Results(funcs) {
     e[0] === '>>>' ||
     (e[0] === '()' && typeof e[1] === 'string' && ctx.func.map?.get(e[1])?.sig?.unsignedResult === true)
   )
+  const callsSelf = (n, name) => Array.isArray(n) && ((n[0] === '()' && n[1] === name) || n.some(c => callsSelf(c, name)))
+  // Classify a func's return tails as all-v128 / all-i32 (+ sign) under the CURRENT sig.results.
+  const evalTails = (func, body, exprs) => {
+    const savedCurrent = ctx.func.current
+    ctx.func.current = func.sig
+    const locals = isBlockBody(body) ? analyzeBody(body).locals : new Map()
+    for (const p of func.sig.params) if (!locals.has(p.name)) locals.set(p.name, p.type)
+    // Seed the typedElem overlay with this func's TYPED-pointer params so a return tail
+    // reading a typed-array element — `return vals[h]`, vals an Int32Array param (dict's
+    // `lookup`) — types as i32, not NaN-boxed f64. Without it the call site keeps the full
+    // __typed_idx/ToNumber unbox dispatch (491520× per dict kernel run). Mirrors
+    // refreshCallerLocals + analyzeFuncForEmit. Only meaningful once Phase G has tagged params
+    // ptrKind=TYPED (the I2 re-run below); harmless before (no typed params → overlay untouched).
+    const savedTE = ctx.types.typedElem
+    let te = null
+    for (const p of func.sig.params) {
+      if (p.ptrKind === VAL.TYPED && p.ptrAux != null) {
+        const c = ctorFromElemAux(p.ptrAux)
+        if (c != null) { if (!te) te = savedTE ? new Map(savedTE) : new Map(); te.set(p.name, c) }
+      }
+    }
+    if (te) ctx.types.typedElem = te
+    const allV128 = exprs.every(e => exprType(e, locals) === 'v128')
+    const allI32 = !allV128 && exprs.every(e => exprType(e, locals) === 'i32')
+    if (te) ctx.types.typedElem = savedTE
+    const r = { allV128, allI32, anyUnsigned: exprs.some(isUnsignedTail), allUnsigned: exprs.every(isUnsignedTail) }
+    ctx.func.current = savedCurrent
+    return r
+  }
   let changed = true
   while (changed) {
     changed = false
@@ -269,22 +335,40 @@ function narrowI32Results(funcs) {
       if (isBlockBody(body) && hasBareReturn(body)) continue
       const exprs = returnExprs(body)
       if (!exprs.length) continue
-      const savedCurrent = ctx.func.current
-      ctx.func.current = func.sig
-      const locals = isBlockBody(body) ? analyzeBody(body).locals : new Map()
-      for (const p of func.sig.params) if (!locals.has(p.name)) locals.set(p.name, p.type)
-      const allV128 = exprs.every(e => exprType(e, locals) === 'v128')
-      const allI32 = !allV128 && exprs.every(e => exprType(e, locals) === 'i32')
-      const anyUnsigned = exprs.some(isUnsignedTail)
-      const allUnsigned = exprs.every(isUnsignedTail)
-      ctx.func.current = savedCurrent
+      let r = evalTails(func, body, exprs)
+      // Recursive result cycle: a self-call in a return tail — or feeding a returned local
+      // (nqueens' `cnt = cnt + solve(…); return cnt`) — reads solve's own not-yet-narrowed
+      // f64 result, so `cnt` widens to f64 and the i32 narrowing never fires. Break the cycle
+      // optimistically: tentatively assume the i32 result, re-analyze, and keep it ONLY if every
+      // tail is then i32 (else revert). Sound — committed only when self-consistent.
+      if (!r.allI32 && !r.allV128 && callsSelf(body, func.name)) {
+        const saved = func.sig.results
+        func.sig.results = ['i32']
+        invalidateLocalsCache(body)
+        const opt = evalTails(func, body, exprs)
+        if (opt.allI32 && (!opt.anyUnsigned || opt.allUnsigned)) {
+          if (opt.allUnsigned) func.sig.unsignedResult = true
+          changed = true
+          continue
+        }
+        func.sig.results = saved
+        invalidateLocalsCache(body)
+        r = evalTails(func, body, exprs)
+      }
       // SIMD: every tail returns a lane vector → v128 result.
-      if (allV128) {
+      if (r.allV128) {
         func.sig.results = ['v128']
         changed = true
-      } else if (allI32 && (!anyUnsigned || allUnsigned)) {   // sign-consistent i32 tails
+      } else if (r.allI32 && (!r.anyUnsigned || r.allUnsigned)) {   // sign-consistent i32 tails
         func.sig.results = ['i32']
-        if (allUnsigned) func.sig.unsignedResult = true
+        if (r.allUnsigned) func.sig.unsignedResult = true
+        // A committed i32 result is a genuine NUMBER, so stamp valResult for the call-site
+        // VAL dispatch — E2 (narrowValResults) ran ABOVE the param lattice and so couldn't
+        // type a `return typedArrayParam[idx]` tail (hashjoin's `probe` → `vals[h]`), leaving
+        // valResult unset → the hot `sum + probe()` stayed the polymorphic string-or-number
+        // `+`. Only-if-unset: an UNBOXED-pointer i32 result already carries its ARRAY/OBJECT/
+        // TYPED valResult (the unboxing ABI needs it), so this never overwrites a pointer kind.
+        if (func.valResult == null) func.valResult = VAL.NUMBER
         changed = true
       }
     }
@@ -652,10 +736,20 @@ export default function narrowSignatures(programFacts, ast) {
       const state = siteState(callSites[s])
       if (!state) continue
       const { func, argList } = state
+      const recursive = state.callee === state.callerFunc?.name
       for (let k = 0; k < func.sig.params.length; k++) {
         const r = ensureParamRep(paramReps, state.callee, k)
         if (k >= argList.length) { for (const rule of rules) rule.missing(r, k, state); continue }
-        for (const rule of rules) rule.apply(r, argList[k], k, state)
+        const arg = argList[k]
+        // Recursive identity arg — `f(…, p, …)` calling itself with its own param p threaded
+        // through at the same position — is a fixpoint identity: it carries whatever type p
+        // settles to, so it constrains nothing. Skip it, else exprType(p) reads p's not-yet-
+        // narrowed f64 and the meet poisons the type the non-recursive call sites would prove
+        // (nqueens' `solve(all, …)` — `all` stuck f64 while cols/d1/d2, passed as i32 bitwise
+        // exprs, narrowed fine).
+        const pname = func.sig.params[k].name
+        if (recursive && (arg === pname || (Array.isArray(arg) && arg[0] === 'local.get' && arg[1] === pname))) continue
+        for (const rule of rules) rule.apply(r, arg, k, state)
       }
     }
   }
@@ -723,6 +817,46 @@ export default function narrowSignatures(programFacts, ast) {
       mergeParamFact(r, field, v)
     },
   })
+  // WASM type of a call arg. exprType resolves most shapes, but an INTEGER typed-array
+  // element read `intArr[idx]` (and arithmetic over it, `intArr[idx]+1`) types f64 here:
+  // exprType's `[]` rule reads the typedElem OVERLAY, which doesn't see a typedCtor-narrowed
+  // PARAM array at fixpoint time — yet the element is a 32-bit machine integer. Install the
+  // caller's resolved param-typedCtors (+ module globals) as that overlay for the duration
+  // of the type query, so a param fed only such integer elements (dict's key `k` ← src[i],
+  // threaded through Math.imul / === keys[h] / keys[h]=k) narrows to i32 instead of paying
+  // convert + f64-compare + trunc round-trips through its probe loop.
+  // A value built ONLY from the callee's own params + already-i32 locals + integer constants via
+  // integer-preserving ops. Its i32-ness follows from its inputs' — for a recursive self-call it
+  // carries no INDEPENDENT evidence about whether the params are i32. Used for the optimism below.
+  const isRecurIntExpr = (n, pnames, callerLocals) => {
+    if (typeof n === 'string') return pnames.has(n) || callerLocals?.get?.(n) === 'i32'
+    if (typeof n === 'number') return Number.isInteger(n)
+    if (!Array.isArray(n)) return false
+    if (n[0] == null) return typeof n[1] === 'number' && Number.isInteger(n[1])           // boxed int literal
+    if (n[0] === 'local.get') return pnames.has(n[1]) || callerLocals?.get?.(n[1]) === 'i32'
+    if (RECUR_INT_OPS.has(n[0])) return n.slice(1).every(c => isRecurIntExpr(c, pnames, callerLocals))
+    return false
+  }
+  const argWasmType = (arg, state) => {
+    // Recursive self-call: an arg built only from the callee's own params + already-i32 locals +
+    // int constants (`f(n - 1)`, `f(n - 1 - i)`) is i32 IFF those params are i32 — a fixpoint
+    // identity carrying no INDEPENDENT type evidence. Optimistically type it i32 so the NON-
+    // recursive call sites decide: all i32 ⇒ the param narrows; any f64 ⇒ the meet still poisons
+    // it. Lets a plain decreasing recursion narrow with no `|0` source crutch. (The bare-identity
+    // arg `f(n)` is already skipped wholesale in runCallsiteLattice.)
+    if (state.callee === state.callerFunc?.name &&
+        isRecurIntExpr(arg, new Set(state.func.sig.params.map(p => p.name)), state.callerLocals)) return 'i32'
+    if (!state._teOverlay) {
+      const m = new Map(ctx.scope.globalTypedElem || [])
+      const pf = state.callerParamFacts('typedCtor')
+      if (pf) for (const [name, ctor] of pf) if (ctor != null) m.set(name, ctor)
+      state._teOverlay = m
+    }
+    const prev = ctx.func.localTypedElemsOverlay
+    ctx.func.localTypedElemsOverlay = state._teOverlay
+    try { return exprType(arg, state.callerLocals) }
+    finally { ctx.func.localTypedElemsOverlay = prev }
+  }
   const runFixpoint = () => runCallsiteLattice([
     // val runs SOFT (monotone): a TYPED param's val only becomes inferable after the
     // typedCtor fixpoint + pointer-ABI enrichment, so an early hard merge would
@@ -734,7 +868,7 @@ export default function narrowSignatures(programFacts, ast) {
       missing: poison('wasm'),
       apply(r, arg, _k, state) {
         if (r.wasm === null) return
-        const wt = exprType(arg, state.callerLocals)
+        const wt = argWasmType(arg, state)
         if (r.wasm === undefined) r.wasm = wt
         else if (r.wasm !== wt) r.wasm = null
       },
@@ -899,6 +1033,16 @@ export default function narrowSignatures(programFacts, ast) {
   // (callback bench: mix is FNV — params and result all i32-shaped, but inferred
   // only after E phase narrowed mix's result).
   phase.refreshLocals()
+  // I2: Re-narrow i32 RESULTS now that Phase G (applyTypedPointerParamAbi) has tagged
+  // typed-array params ptrKind=TYPED. Phase E ran before G, so a function returning a
+  // typed-array element — dict's `lookup = (keys, vals, k) => { … return vals[h] }` with
+  // vals an Int32Array param — had its return tail type as NaN-boxed f64 (vals not yet a
+  // typed pointer), leaving sig.results f64 and the call site running the full
+  // __typed_idx/ToNumber unbox on every probe step (491520× per dict kernel run). Now that
+  // evalTails seeds the typed-param overlay and params carry ptrAux, the fixpoint catches
+  // `vals[h]` as i32, narrows the result, and the dispatch vanishes; the runFixpoint below
+  // then propagates the i32 result into `let v = lookup(...)` at the call sites.
+  narrowI32Results(funcsWithNarrowableResult)
   // Reset wasm field unconditionally — first pass populated it from stale callerLocals
   // (where `let h = mix(...)` widened h to f64 because mix's result wasn't narrowed
   // yet). clearStickyNull only resets null; here we need to reset f64-observed too
@@ -1127,6 +1271,87 @@ export function adviseJsstringCarrier(paramReps, valueUsed) {
   }
 }
 
+// Two value-kinds CONFLICT when passing one where the other is expected would
+// rely on a JS boundary coercion jz does not implement (so the result diverges).
+// NUMBER↔STRING is the canonical pair: `"5" * 2` is 10 in JS but NaN in jz, and a
+// STRING passed to a numeric param reads its NaN-boxed bits as an f64. ARRAY/OBJECT
+// vs NUMBER/STRING likewise. We treat the four primitive-ish kinds as mutually
+// exclusive; BOOL is omitted (it nanboxes to 0/1 and numeric code tolerates it).
+const STRICT_CONFLICT = {
+  [VAL.NUMBER]: new Set([VAL.STRING, VAL.ARRAY, VAL.OBJECT]),
+  [VAL.STRING]: new Set([VAL.NUMBER, VAL.ARRAY, VAL.OBJECT]),
+  [VAL.ARRAY]: new Set([VAL.NUMBER, VAL.STRING]),
+  [VAL.OBJECT]: new Set([VAL.NUMBER, VAL.STRING]),
+}
+const kindName = (v) => ({ [VAL.NUMBER]: 'number', [VAL.STRING]: 'string', [VAL.ARRAY]: 'array', [VAL.OBJECT]: 'object' }[v] || 'value')
+
+/**
+ * Strict-mode boundary type check (standalone; runs in both the full-narrow and
+ * skip-narrow plan paths).
+ *
+ * jz infers a param's type from how it's used (`x * 2` → number, `s.charCodeAt`
+ * → string) or from an explicit default (`x = 0` → number). In permissive mode a
+ * caller may pass any type and jz silently computes a divergent result (`"5"*2`
+ * is 10 in JS, NaN here). Strict mode is the canonical subset where that misuse
+ * is a compile error instead — consistent with strict already rejecting `==`,
+ * dynamic dispatch, and `void`.
+ *
+ * Fires ONLY when BOTH sides are statically certain and conflict:
+ *   - the callee param has a known kind (its default-value type, or a settled
+ *     `val` rep from body-usage / call-site inference), AND
+ *   - the argument expression has a known, conflicting kind (a literal or a
+ *     locally-typed binding).
+ * An untyped param or untyped arg is never flagged — no false positives on
+ * genuinely polymorphic code.
+ */
+export function strictBoundaryTypeCheck(programFacts) {
+  if (!ctx.transform.strict) return
+  const { callSites, paramReps } = programFacts
+
+  // Per-callee body-evidence cache: methodEvidence (.charCodeAt→STRING, .push→
+  // ARRAY) keyed by param name. Computed lazily, once per callee.
+  const bodyEvidence = new Map()
+  const evidenceOf = (func) => {
+    if (!bodyEvidence.has(func.name)) {
+      const names = func.sig.params.map(p => p.name).filter(Boolean)
+      bodyEvidence.set(func.name, func.body ? inferParams(func.body, names) : new Map())
+    }
+    return bodyEvidence.get(func.name)
+  }
+
+  // Expected kind of callee param k, from any statically-certain source:
+  //   1. explicit default value type — the source's own declaration (x = 0 → number)
+  //   2. settled call-site/usage rep `val` (paramReps; present after full narrow)
+  //   3. type-exclusive body evidence (methodEvidence; works in skip-narrow path too)
+  // First certain source wins; null when the param is genuinely polymorphic.
+  const paramKind = (func, k) => {
+    const p = func.sig.params[k]
+    if (!p) return null
+    const def = func.defaults?.[p.name]
+    if (def != null) { const dv = valTypeOf(def); if (dv) return dv }
+    const repVal = paramReps?.get(func.name)?.get(k)?.val
+    if (repVal != null) return repVal
+    return evidenceOf(func).get(p.name)?.val ?? null
+  }
+
+  for (const cs of callSites) {
+    const func = ctx.func.map.get(cs.callee)
+    if (!func || func.raw || !func.sig) continue
+    if (func.rest) continue                       // rest packs args into an array
+    for (let k = 0; k < cs.argList.length && k < func.sig.params.length; k++) {
+      const want = paramKind(func, k)
+      if (want == null) continue
+      const conflicts = STRICT_CONFLICT[want]
+      if (!conflicts) continue
+      const got = valTypeOf(cs.argList[k])
+      if (got != null && conflicts.has(got)) {
+        const pname = func.sig.params[k].name
+        err(`strict mode: ${kindName(want)} parameter '${pname}' of '${cs.callee}' received a ${kindName(got)} argument — jz does not coerce ${kindName(got)}→${kindName(want)} at the call boundary (the result would diverge from JS). Pass a ${kindName(want)}, or { strict: false }.`)
+      }
+    }
+  }
+}
+
 /**
  * Phase: bimorphic typed-array param specialization.
  *
@@ -1161,13 +1386,9 @@ export function specializeBimorphicTyped(programFacts) {
     if (list) list.push(cs); else sitesByCallee.set(cs.callee, [cs])
   }
 
-  // Per-caller typedElem map (literal `new TypedArray(N)` bindings inside body).
-  const callerTypedCtx = new Map()
-  callerTypedCtx.set(null, ctx.scope.globalTypedElem || new Map())
-  for (const func of ctx.func.list) {
-    if (!func.body || func.raw) continue
-    callerTypedCtx.set(func, analyzeBody(func.body).typedElems)
-  }
+  // Per-caller typedElem map: body-local `new TypedArray(N)` bindings layered
+  // over the module's typed globals (shared with buildCallerTypedCtx).
+  const callerTypedCtx = buildCallerTypedCtx()
   // Per-caller typed-param map: caller's own params that F/G already narrowed
   // (so transitive `sum(arr)` inside a func that took `arr` from above resolves).
   const callerTypedParamsCtx = new Map()
@@ -1237,25 +1458,37 @@ export function specializeBimorphicTyped(programFacts) {
 
     // Build one clone per distinct combo.
     const cloneByKey = new Map()
-    for (const [key, combo] of distinct) {
-      const suffix = combo.map(c => c.replace(/^new\./, '').replace(/\./g, '_')).join('$')
+    for (const [dkey, cmb] of distinct) {
+      // NB: this loop variable must NOT reuse the name `combo` (declared twice above, at the
+      // site loop and the distinct-building loop). The self-host miscompiles a for-of loop
+      // variable whose name collides with an earlier block-scoped declaration — it aliases the
+      // prior binding instead of rebinding per iteration, so `combo` would stay stuck at the
+      // last site's ctor and every clone would get the same (wrong) element type → silent
+      // garbage. A unique name gets a clean per-iteration binding.
+      const suffix = cmb.map(c => c.replace(/^new\./, '').replace(/\./g, '_')).join('$')
       let cloneName = `${func.name}$${suffix}`
       let n = 0
       while (ctx.func.names.has(cloneName)) cloneName = `${func.name}$${suffix}$${++n}`
 
+      // Build cloneSig with clean, fully-formed object literals — never by spreading a
+      // live object and then overriding/extending its keys. A MULTI-prop spread of a
+      // member-access source (`{ ...func.sig, params, results }`) takes the static
+      // allKnown OBJECT-merge path, which trusts func.sig's COMPILE-TIME schema; sig
+      // objects are polymorphic (some carry result/ptrKind/unsignedResult), so that
+      // schema can be a subset of the runtime shape and the slot-copy then faults a
+      // later `sig.params` read out of bounds in the self-host. (The single-unknown
+      // `{ ...x }` clone is fixed at the root — __obj_clone — but the allKnown merge
+      // path is a separate hazard.) Constructing each param with its pointer ABI baked
+      // in sidesteps it; output is unchanged on the host.
       const cloneSig = {
-        ...func.sig,
-        params: func.sig.params.map(p => ({ ...p })),
+        params: func.sig.params.map((p, idx) => {
+          const bi = bimorphic.indexOf(idx)
+          return bi < 0
+            ? { ...p }
+            : { name: p.name, type: 'i32', ptrKind: VAL.TYPED, ptrAux: typedElemAux(cmb[bi]) }
+        }),
         results: [...func.sig.results],
       }
-      for (let i = 0; i < bimorphic.length; i++) {
-        const k = bimorphic[i]
-        const aux = typedElemAux(combo[i])
-        const p = cloneSig.params[k]
-        p.type = 'i32'
-        p.ptrKind = VAL.TYPED
-        p.ptrAux = aux
-      }
       const clone = { ...func, name: cloneName, sig: cloneSig }
       ctx.func.list.push(clone)
       ctx.func.map.set(cloneName, clone)
@@ -1263,19 +1496,20 @@ export function specializeBimorphicTyped(programFacts) {
 
       // Mirror per-param reps under the clone's name with mono ctors at bimorphic
       // positions. emitFunc's preseed reads typedCtor → seeds typedElem map →
-      // `arr[i]` lowers to direct typed load.
+      // `arr[i]` lowers to direct typed load. Each `{ ...r }` is a true clone, so
+      // pinning typedCtor on it leaves the source rep untouched (__obj_clone).
       const cloneReps = new Map()
       for (const [k, r] of reps) cloneReps.set(k, { ...r })
       for (let i = 0; i < bimorphic.length; i++) {
         const k = bimorphic[i]
         const r = cloneReps.get(k) || {}
-        r.typedCtor = combo[i]
+        r.typedCtor = cmb[i]
         r.val = VAL.TYPED
         cloneReps.set(k, r)
       }
       paramReps.set(cloneName, cloneReps)
 
-      cloneByKey.set(key, clone)
+      cloneByKey.set(dkey, clone)
     }
 
     // Rewrite each site's call AST to point at the matching clone.