jz 0.6.0 → 0.8.0

package/src/compile/plan/literals.js

@@ -25,10 +25,10 @@
 
 import { ctx } from '../../ctx.js'
 import {
-  some, T, stmtList, refsName, ASSIGN_OPS, isReassigned, hasControlTransfer,
+  some, T, stmtList, refsName, REFS_IN_EXPR, ASSIGN_OPS, isReassigned, hasControlTransfer,
 } from '../../ast.js'
 import {
-  intLiteralValue, constIntExpr, staticObjectProps, staticPropertyKey,
+  intLiteralValue, nonNegIntLiteral, constIntExpr, staticObjectProps, staticPropertyKey,
 } from '../../static.js'
 import {
   smallConstForTripCount, containsDeclOf, cloneWithSubst,
@@ -37,7 +37,7 @@ import { VAL } from '../../reps.js'
 import { includeModule } from '../../autoload.js'
 import { analyzeBody, invalidateLocalsCache } from '../analyze.js'
 import {
-  isSimpleArg, fixedScalarTypedArray, fixedTypedArraysInBody, maxScalarTypedArrayLen,
+  isSimpleArg, fixedScalarTypedArray, fixedTypedArraysInBody, maxScalarTypedArrayLen, freshTypedArrayLocals,
 } from './common.js'
 
 // === Loop unrolling & scalarization ===
@@ -90,7 +90,7 @@ const safeScalarArrayUse = (node, name, len, parentOp = null) => {
   const op = node[0]
   if (ASSIGN_TARGET_OPS.has(op) && node[1] === name) return false
   if (isMemberWriteTarget(op, node, name)) return false
-  if ((op === 'let' || op === 'const') && node.slice(1).some(d => d === name || (Array.isArray(d) && d[1] === name))) return false
+  if (isDeclOp(op) && node.slice(1).some(d => d === name || (Array.isArray(d) && d[1] === name))) return false
   if ((op === '.' || op === '?.') && node[1] === name) return node[2] === 'length'
   // Element write `name[idx] (op)= v` / `name[idx]++`: an out-of-bounds index
   // grows the array (sparse-array semantics), which the fixed scalar slot set
@@ -141,7 +141,7 @@ const safeScalarObjectUse = (node, name, keys) => {
   if (!Array.isArray(node)) return true
   const op = node[0]
   if (ASSIGN_TARGET_OPS.has(op) && node[1] === name) return false
-  if ((op === 'let' || op === 'const') && node.slice(1).some(d => d === name || (Array.isArray(d) && d[1] === name))) return false
+  if (isDeclOp(op) && node.slice(1).some(d => d === name || (Array.isArray(d) && d[1] === name))) return false
   if ((op === '.' || op === '?.') && node[1] === name) return keys.has(node[2])
   if (op === '[]' && node[1] === name) {
     const key = staticPropertyKey(node[2])
@@ -181,7 +181,7 @@ const safeScalarTypedArrayUse = (node, name, len, coerce = '') => {
   if (typeof node === 'string') return node !== name
   if (!Array.isArray(node)) return true
   const op = node[0]
-  if ((op === 'let' || op === 'const') && node.slice(1).some(d => d === name || (Array.isArray(d) && d[1] === name))) return false
+  if (isDeclOp(op) && node.slice(1).some(d => d === name || (Array.isArray(d) && d[1] === name))) return false
   if (isMemberWriteTarget(op, node, name)) return false
   if ((op === '.' || op === '?.') && node[1] === name) return node[2] === 'length'
   if (op === '[]' && node[1] === name) return typedArraySlotIndex(node[2], len) != null
@@ -200,6 +200,34 @@ const safeScalarTypedArrayUse = (node, name, len, coerce = '') => {
   for (let i = 1; i < node.length; i++) if (!safeScalarTypedArrayUse(node[i], name, len, coerce)) return false
   return true
 }
+
+// `name`'s reference used as a bare VALUE — anywhere except as the base of `name[i]`,
+// `name.prop`, or `name.method(...)`. That captures a second handle to its backing memory.
+const refsAsValue = (node, name) => {
+  if (node === name) return true
+  if (!Array.isArray(node)) return false
+  if (node[0] === '[]' && node[1] === name) return refsAsValue(node[2], name)   // name[i]: vet the index only
+  if ((node[0] === '.' || node[0] === '?.') && node[1] === name) return false    // name.prop / name.method()
+  if (node[0] === '()') return false                                             // a call RESULT, not name itself
+  return node.slice(1).some(e => refsAsValue(e, name))
+}
+
+// True when `name`'s backing memory ESCAPES into a persistent alias: bound to another
+// variable (`let b = name`), stored into a field or literal (`o.x = name`, `[name]`), or
+// captured as a `.subarray(...)` view. Mirrored scalarization syncs scalars↔memory only
+// AROUND each unsafe statement, so a write through the captured alias in a LATER statement
+// never reaches `name`'s scalar slots (and vice-versa) — the array must stay memory-backed.
+// A bare `name` passed only as a call ARGUMENT is transient (the callee touches it during
+// the call, already covered by the surrounding sync), so it is NOT a capture.
+const createsTypedArrayAlias = (node, name) => {
+  if (!Array.isArray(node)) return false
+  if (node[0] === '()' && Array.isArray(node[1]) && node[1][0] === '.'
+      && node[1][1] === name && node[1][2] === 'subarray') return true           // zero-copy view
+  if (node[0] === '=' && refsAsValue(node[2], name)) return true                  // let b = name / x = name
+  if ((node[0] === '[' || node[0] === '{}') && node.slice(1).some(e => refsAsValue(e, name))) return true  // [name] / {k:name}
+  for (let i = 1; i < node.length; i++) if (createsTypedArrayAlias(node[i], name)) return true
+  return false
+}
 const rewriteScalarTypedArrayUses = (node, arrays) => {
   if (!Array.isArray(node)) return node
   const op = node[0]
@@ -286,14 +314,16 @@ const scalarizeTypedArrayLiteralSeq = (seq) => {
     const fixed = fixedScalarTypedArray(decl[2])
     if (fixed == null) continue
     const { len, coerce } = fixed
-    let hasSafeUse = false, hasUnsafeUse = false
+    let hasSafeUse = false, hasUnsafeUse = false, hasAliasUse = false
     for (let j = 0; j < stmts.length; j++) {
       if (j === i) continue
       if (!refsName(stmts[j], decl[1])) continue
       const safe = safeScalarTypedArrayUse(stmts[j], decl[1], len, coerce)
       hasSafeUse ||= safe
       hasUnsafeUse ||= !safe
+      hasAliasUse ||= createsTypedArrayAlias(stmts[j], decl[1])
     }
+    if (hasAliasUse) continue   // persistent aliasing view (subarray) — keep memory-backed
     if (hasUnsafeUse && (!hasSafeUse || coerce)) continue
     if (!hasUnsafeUse) candidates.set(decl[1], { index: i, len, coerce, mirrored: false })
     else mirrored.set(decl[1], { index: i, len, coerce, mirrored: true })
@@ -496,6 +526,44 @@ export const scalarizeFunctionTypedArrays = (programFacts) => {
   return changed
 }
 
+// Param-distinctness (alias analysis). Marks a function's typed-array params MUTUALLY DISTINCT
+// (provably different buffers) when EVERY call site passes a distinct fresh `new TypedArray` local
+// for each of them. This is what lets the optimizer's LICM hoist a load from one such param across
+// a store to another (the load can't be clobbered) — the alias-analysis-enabled LICM that
+// rust/clang get for free (raytrace's sphere loads vs the framebuffer store). Sound because:
+//   • a fresh `new TypedArray(N)` is a unique buffer (the allocator returns fresh memory);
+//   • requiring ALL typed-array-param args to be fresh-new excludes views/subarrays (not fresh)
+//     and forwarded params (not fresh), the only ways two args could alias;
+//   • pairwise-distinct arg names rule out the same buffer passed twice;
+//   • scalar (non-TYPED) params are ignored — they can't alias a buffer.
+// Conservatively all-or-nothing per function: any non-fresh/duplicate typed arg ⇒ no fact.
+export const analyzeParamDistinctness = (programFacts) => {
+  const freshByFunc = new Map(ctx.func.list.map(func => [func, freshTypedArrayLocals(func.body)]))
+  const sitesByCallee = new Map()
+  for (const site of programFacts.callSites) {
+    if (!site.callerFunc) continue
+    const l = sitesByCallee.get(site.callee); l ? l.push(site) : sitesByCallee.set(site.callee, [site])
+  }
+  for (const func of ctx.func.list) {
+    const params = func.sig?.params, sites = sitesByCallee.get(func.name)
+    if (!params || !sites?.length) continue
+    const typedIdx = []
+    for (let i = 0; i < params.length; i++) if (params[i].ptrKind === VAL.TYPED) typedIdx.push(i)
+    if (typedIdx.length < 2) continue   // distinctness only matters with ≥2 typed-array params
+    let ok = true
+    for (const site of sites) {
+      const seen = new Set()
+      for (const i of typedIdx) {
+        const arg = site.argList?.[i]
+        if (typeof arg !== 'string' || !freshByFunc.get(site.callerFunc)?.has(arg) || seen.has(arg)) { ok = false; break }
+        seen.add(arg)
+      }
+      if (!ok) break
+    }
+    if (ok) func.distinctParams = new Set(typedIdx.map(i => params[i].name))
+  }
+}
+
 const scalarizeArrayLiteralSeq = (seq) => {
   if (!Array.isArray(seq) || seq[0] !== ';') return { node: seq, changed: false }
   let changed = false
@@ -621,6 +689,191 @@ function scalarizeObjectLiterals(node, escapes) {
   return changed ? { node: out, changed: true } : { node, changed: false }
 }
 
+// === Whole-program constant fold of module-scope aggregate literals ===
+//
+// `var x = [1,2,3]; export const y = x[0]` materializes a data-segment array and
+// indexes it through __arr_idx_known (bounds + grow-forwarding) — all dead weight
+// for a never-grown constant. When EVERY reference to a module-scope const aggregate
+// is a static READ, replace each `x[k]` / `x.length` / `o.key` by its literal value
+// program-wide; the now-unused decl is dropped, so no array is built (no data, no
+// memory, no index helper) and the global is never declared. The per-function
+// scalarizers can't do this: the decl lives at module scope and may be read from
+// several function bodies, so the check must span the whole program.
+
+const ASSIGN_OR_UPDATE = (op) => ASSIGN_TARGET_OPS.has(op) || op === '++' || op === '--'
+// Module-scope binding ops. `var` survives to compile at module scope (jzify only
+// lowers it to `let` inside functions), so fold it too — the reassignment guard
+// below keeps a re-bound `var` heap-backed.
+const isDeclOp = (op) => op === 'let' || op === 'const' || op === 'var'
+
+// Reject `delete x`, `delete x.k`, `delete x[k]` — a deletion mutates the aggregate.
+const isDeleteOf = (node, name) =>
+  node[0] === 'delete' && (node[1] === name || (Array.isArray(node[1]) && node[1][1] === name))
+
+// A reference is fold-safe only if it READS `name` via a static index/key (or
+// `.length` for arrays). Any write/update/delete, reassignment, second declaration,
+// bare value use (escape), spread, dynamic key, or non-own member (method / proto
+// chain) escapes the literal model and disqualifies the binding.
+const foldSafeArrayUse = (node, name, len) => {
+  if (typeof node === 'string') return node !== name
+  if (!Array.isArray(node)) return true
+  const op = node[0]
+  if (isDeclOp(op) && node.slice(1).some(d => d === name || (Array.isArray(d) && d[1] === name))) return false
+  if (isDeleteOf(node, name)) return false
+  if (ASSIGN_OR_UPDATE(op)) {
+    const t = node[1]
+    if (t === name) return false
+    if (Array.isArray(t) && (t[0] === '[]' || t[0] === '.' || t[0] === '?.') && t[1] === name) return false
+  }
+  if ((op === '.' || op === '?.') && node[1] === name) return node[2] === 'length'
+  if (op === '[]' && node[1] === name) return constIntExpr(node[2]) != null
+  if (op === '...' && node[1] === name) return false
+  for (let i = 1; i < node.length; i++) if (!foldSafeArrayUse(node[i], name, len)) return false
+  return true
+}
+
+const foldSafeObjectUse = (node, name, keys) => {
+  if (typeof node === 'string') return node !== name
+  if (!Array.isArray(node)) return true
+  const op = node[0]
+  if (isDeclOp(op) && node.slice(1).some(d => d === name || (Array.isArray(d) && d[1] === name))) return false
+  if (isDeleteOf(node, name)) return false
+  if (ASSIGN_OR_UPDATE(op)) {
+    const t = node[1]
+    if (t === name) return false
+    if (Array.isArray(t) && (t[0] === '[]' || t[0] === '.' || t[0] === '?.') && t[1] === name) return false
+  }
+  if ((op === '.' || op === '?.') && node[1] === name) return keys.has(node[2])   // own key only — proto-safe
+  if (op === '[]' && node[1] === name) { const k = staticPropertyKey(node[2]); return k != null && keys.has(k) }
+  if (op === '...' && node[1] === name) return false
+  for (let i = 1; i < node.length; i++) if (!foldSafeObjectUse(node[i], name, keys)) return false
+  return true
+}
+
+const moduleStmtsOf = (seq) =>
+  Array.isArray(seq) && seq[0] === ';' ? seq.slice(1)
+  : Array.isArray(seq) && isDeclOp(seq[0]) ? [seq]
+  : []
+
+export function foldStaticConstAggregates(ast) {
+  // Span the main module AST and every bundled sub-module init — a const declared in
+  // one can be read from another or from a function body (mirrors the constInts fold).
+  const seqs = [ast, ...(ctx.module.moduleInits || [])]
+  const moduleStmts = seqs.flatMap(moduleStmtsOf)
+  const funcs = ctx.func.list.filter(f => f.body && !f.raw)
+  // A function parameter named `x` rebinds `x` for the whole body — its `x[…]` reads
+  // the param, not the module binding (params live on `f.sig`, separate from `.body`,
+  // so the body scan can't see them). Such a function is skipped (scan) / excluded
+  // (rewrite) for that name.
+  const paramNames = (f) => (f.sig?.params || []).map(p => p.name)
+  // Every AST a function can reference an outer binding from: its body PLUS each
+  // default-parameter expression (`(v = x[0]) => …`), which prepare extracts to
+  // `f.defaults` — separate from the body, so the body scan/rewrite would miss it.
+  const funcNodes = (f) => f.defaults ? [f.body, ...Object.values(f.defaults)] : [f.body]
+
+  // Classify module statements. A binding's value comes from an inline decl
+  // (`const x = […]`) OR — for `var`, which jzify lowers to `let x; x = […]` — a
+  // lone module-scope assignment after an uninitialized decl. The init statement(s)
+  // are excluded from the read-only scan and dropped on fold.
+  const inlineInit = new Map()    // name -> {value, stmt} | null (poisoned: >1 decl)
+  const assigns = new Map()       // name -> [assignStmt…]
+  const uninitDecl = new Map()    // name -> declStmt  (`let x` / `var x`, string declarator)
+  for (const stmt of moduleStmts) {
+    if (!Array.isArray(stmt)) continue
+    const op = stmt[0]
+    if (isDeclOp(op) && stmt.length === 2 && Array.isArray(stmt[1]) && stmt[1][0] === '=' && typeof stmt[1][1] === 'string') {
+      const name = stmt[1][1]
+      inlineInit.set(name, inlineInit.has(name) ? null : { value: stmt[1][2], stmt })
+    } else if (isDeclOp(op) && stmt.length === 2 && typeof stmt[1] === 'string') {
+      uninitDecl.set(stmt[1], stmt)
+    } else if (op === '=' && typeof stmt[1] === 'string') {
+      (assigns.get(stmt[1]) ?? assigns.set(stmt[1], []).get(stmt[1])).push(stmt)
+    }
+  }
+
+  // index of each statement in module-execution order — used to prove a `var`'s
+  // assignment dominates its reads.
+  const pos = new Map()
+  moduleStmts.forEach((s, i) => pos.set(s, i))
+
+  const arr = new Map(), obj = new Map(), initStmts = new Map()
+  const consider = (name, value, init) => {
+    if (ctx.func.exports?.[name]) return                 // exported → escapes to JS
+    const elems = scalarArrayElems(value)
+    if (elems) { arr.set(name, elems); initStmts.set(name, init); return }
+    const props = scalarObjectProps(value)
+    if (props) { obj.set(name, props); initStmts.set(name, init) }
+  }
+  for (const [name, info] of inlineInit) {
+    // a decl-initialized binding that is ALSO assigned is reassigned → not constant.
+    if (info && !assigns.has(name)) consider(name, info.value, new Set([info.stmt]))
+  }
+  for (const [name, list] of assigns) {
+    // `var` lowering: exactly one assignment, a matching uninit decl, and no
+    // competing inline decl. The assignment must dominate every read — conservatively,
+    // it precedes all other module references and the name is unused in any function
+    // body (a function could run before the assignment). `let`/`const` need no such
+    // guard (TDZ forbids use-before-init).
+    if (inlineInit.has(name) || list.length !== 1 || !uninitDecl.has(name)) continue
+    const assign = list[0], at = pos.get(assign)
+    const refsBefore = moduleStmts.some((s, i) => i < at && s !== uninitDecl.get(name) && refsName(s, name, REFS_IN_EXPR))
+    const refsInFn = funcs.some(f => !paramNames(f).includes(name) && funcNodes(f).some(n => refsName(n, name, REFS_IN_EXPR)))
+    if (refsBefore || refsInFn) continue
+    consider(name, assign[2], new Set([assign, uninitDecl.get(name)]))
+  }
+  if (!arr.size && !obj.size) return false
+
+  // Every mention outside the binding's init statement(s) — across all module
+  // statements and all function bodies — must be a fold-safe static read.
+  const checkAll = (name, pred) => {
+    const skip = initStmts.get(name)
+    return moduleStmts.every(s => skip.has(s) || pred(s))
+      && funcs.every(f => paramNames(f).includes(name) || funcNodes(f).every(pred))
+  }
+  for (const [name, elems] of [...arr]) if (!checkAll(name, n => foldSafeArrayUse(n, name, elems.length))) arr.delete(name)
+  for (const [name, props] of [...obj]) {
+    const keys = new Set(props.names)
+    if (!checkAll(name, n => foldSafeObjectUse(n, name, keys))) obj.delete(name)
+  }
+  if (!arr.size && !obj.size) return false
+
+  const objects = new Map()
+  for (const [name, props] of obj) {
+    const fields = new Map()
+    props.names.forEach((k, i) => fields.set(k, props.values[i]))
+    objects.set(name, fields)
+  }
+  const rewrite = (n) => rewriteScalarObjectUses(rewriteScalarArrayUses(n, arr), objects)
+  // Every init statement (the decl and, for `var`, its lone assignment) is dropped —
+  // nothing reads the binding anymore, so no aggregate is built.
+  const dropped = new Set()
+  for (const name of [...arr.keys(), ...obj.keys()]) for (const s of initStmts.get(name)) dropped.add(s)
+
+  // Rewrite + drop init statements in each module sequence (mutate in place so
+  // callers holding `ast`/moduleInits references see the result).
+  for (const seq of seqs) {
+    if (!Array.isArray(seq) || seq[0] !== ';') continue
+    const kept = []
+    for (const stmt of seq.slice(1)) {
+      if (dropped.has(stmt)) continue
+      kept.push(rewrite(stmt))
+    }
+    seq.splice(1, seq.length - 1, ...kept)
+  }
+  // Rewrite each function body AND its default-parameter expressions, excluding the
+  // folded names its params shadow.
+  for (const f of funcs) {
+    const pn = paramNames(f)
+    const shadows = pn.some(p => arr.has(p) || objects.has(p))
+    const rw = shadows
+      ? (n) => rewriteScalarObjectUses(rewriteScalarArrayUses(n, new Map([...arr].filter(([k]) => !pn.includes(k)))), new Map([...objects].filter(([k]) => !pn.includes(k))))
+      : rewrite
+    f.body = rw(f.body)
+    if (f.defaults) for (const k of Object.keys(f.defaults)) f.defaults[k] = rw(f.defaults[k])
+  }
+  return true
+}
+
 function scalarizeArrayLiterals(node) {
   if (!Array.isArray(node)) return { node, changed: false }
   if (node[0] === '=>') {
@@ -725,13 +978,41 @@ const _intArrayLitElems = (expr) => {
   return out
 }
 
+// Arithmetic and bitwise operators that always produce a numeric result —
+// regardless of operand types — so `name[expr]` is index-safe after promotion.
+// Bitwise ops (`&`, `|`, etc.) ToInt32 their operands; pure-arithmetic ops with
+// numeric leaves stay numeric. `+` is excluded: `"a" + "b"` is a string.
+const _NUMERIC_INDEX_OPS = new Set(['-', '*', '/', '%', '&', '|', '^', '<<', '>>', '>>>', 'u-', 'u+'])
+
+// Returns true when `key` is provably a numeric index at plan time: an integer
+// literal, a local name whose val-type is VAL.NUMBER in `valTypes`, or a
+// compound expression that always produces a number (arithmetic/bitwise ops).
+// Mirrors the `idxNumericName` / `intIndexIR` guard in emit so that the same
+// index shapes that skip `__is_str_key` at emit-time also pass here. Used by
+// `_disqualifyPromotion` to gate index reads: a non-numeric key on a promoted
+// Int32Array NaN-coerces to 0 (trunc_sat_f64_s(NaN) = 0) instead of returning
+// undefined — the correct JS behaviour for an out-of-range or string index.
+const _isNumericKey = (key, valTypes) => {
+  if (key == null) return false
+  if (nonNegIntLiteral(key) != null) return true           // literal integer
+  if (typeof key === 'string') return valTypes?.get(key) === VAL.NUMBER
+  if (!Array.isArray(key)) return false
+  const op = key[0]
+  if (op == null) return typeof key[1] === 'number'        // [null, n] literal
+  if (_NUMERIC_INDEX_OPS.has(op)) return true              // always produces Number
+  // `+` is numeric only when both operands are proven numeric.
+  if (op === '+' && key.length === 3)
+    return _isNumericKey(key[1], valTypes) && _isNumericKey(key[2], valTypes)
+  return false
+}
+
 // Walks `node` and disqualifies every candidate name that appears in an
 // unsafe context. `initSet` holds the candidate's own init-decl AST nodes
 // (their LHS reference is the binding being defined, not an escape).
-const _disqualifyPromotion = (node, candidates, disqualified, initSet) => {
+const _disqualifyPromotion = (node, candidates, disqualified, initSet, valTypes) => {
   if (initSet.has(node)) {
     // The init decl itself: only walk the RHS (skip the LHS `name`).
-    return _disqualifyPromotion(node[2], candidates, disqualified, initSet)
+    return _disqualifyPromotion(node[2], candidates, disqualified, initSet, valTypes)
   }
   if (typeof node === 'string') {
     // Bare identifier outside any handled parent context — escape.
@@ -757,7 +1038,7 @@ const _disqualifyPromotion = (node, candidates, disqualified, initSet) => {
       Array.isArray(node[1]) && (node[1][0] === '.' || node[1][0] === '?.') &&
       typeof node[1][1] === 'string' && candidates.has(node[1][1])) {
     disqualified.add(node[1][1])
-    for (let i = 2; i < node.length; i++) _disqualifyPromotion(node[i], candidates, disqualified, initSet)
+    for (let i = 2; i < node.length; i++) _disqualifyPromotion(node[i], candidates, disqualified, initSet, valTypes)
     return
   }
 
@@ -779,7 +1060,7 @@ const _disqualifyPromotion = (node, candidates, disqualified, initSet) => {
         typeof callee[1] === 'string' && candidates.has(callee[1])) {
       if (!_TYPED_SAFE_METHODS.has(callee[2])) disqualified.add(callee[1])
       // Walk method args (skip the receiver — already validated above).
-      for (let i = 2; i < node.length; i++) _disqualifyPromotion(node[i], candidates, disqualified, initSet)
+      for (let i = 2; i < node.length; i++) _disqualifyPromotion(node[i], candidates, disqualified, initSet, valTypes)
       return
     }
     // Array.isArray flips true→false under promotion.
@@ -788,7 +1069,7 @@ const _disqualifyPromotion = (node, candidates, disqualified, initSet) => {
       const list = raw == null ? [] : (Array.isArray(raw) && raw[0] === ',') ? raw.slice(1) : [raw]
       for (const a of list) {
         if (typeof a === 'string' && candidates.has(a)) disqualified.add(a)
-        else _disqualifyPromotion(a, candidates, disqualified, initSet)
+        else _disqualifyPromotion(a, candidates, disqualified, initSet, valTypes)
       }
       return
     }
@@ -796,10 +1077,15 @@ const _disqualifyPromotion = (node, candidates, disqualified, initSet) => {
     // bare-name leaf above and disqualify.
   }
 
-  // Index read `name[k]` — read access is TYPED-safe. Walk the key in case
-  // it contains references to other candidate names.
+  // Index read `name[k]` — TYPED-safe only when the key is provably numeric.
+  // A string or unknown key on a promoted Int32Array would NaN-coerce to 0
+  // (i32.trunc_sat_f64_s(NaN) = 0) instead of returning undefined — silently
+  // wrong. Mirror the `idxNumericName` / `intIndexIR` guard in emit: disqualify
+  // the candidate unless `k` is an integer literal, a VAL.NUMBER local, or an
+  // expression that always produces a Number (bitwise/arithmetic ops).
   if (op === '[]' && typeof node[1] === 'string' && candidates.has(node[1])) {
-    _disqualifyPromotion(node[2], candidates, disqualified, initSet)
+    _disqualifyPromotion(node[2], candidates, disqualified, initSet, valTypes)
+    if (!_isNumericKey(node[2], valTypes)) disqualified.add(node[1])
     return
   }
 
@@ -808,15 +1094,15 @@ const _disqualifyPromotion = (node, candidates, disqualified, initSet) => {
   if (ASSIGN_OPS.has(op) && Array.isArray(node[1]) && node[1][0] === '[]' &&
       typeof node[1][1] === 'string' && candidates.has(node[1][1])) {
     disqualified.add(node[1][1])
-    _disqualifyPromotion(node[1][2], candidates, disqualified, initSet)
-    _disqualifyPromotion(node[2], candidates, disqualified, initSet)
+    _disqualifyPromotion(node[1][2], candidates, disqualified, initSet, valTypes)
+    _disqualifyPromotion(node[2], candidates, disqualified, initSet, valTypes)
     return
   }
 
   // Whole-binding reassign: `name = …` / `name += …` / etc.
   if (ASSIGN_OPS.has(op) && typeof node[1] === 'string' && candidates.has(node[1])) {
     disqualified.add(node[1])
-    _disqualifyPromotion(node[2], candidates, disqualified, initSet)
+    _disqualifyPromotion(node[2], candidates, disqualified, initSet, valTypes)
     return
   }
 
@@ -826,7 +1112,7 @@ const _disqualifyPromotion = (node, candidates, disqualified, initSet) => {
     if (typeof t === 'string' && candidates.has(t)) { disqualified.add(t); return }
     if (Array.isArray(t) && t[0] === '[]' && typeof t[1] === 'string' && candidates.has(t[1])) {
       disqualified.add(t[1])
-      _disqualifyPromotion(t[2], candidates, disqualified, initSet)
+      _disqualifyPromotion(t[2], candidates, disqualified, initSet, valTypes)
       return
     }
   }
@@ -841,9 +1127,9 @@ const _disqualifyPromotion = (node, candidates, disqualified, initSet) => {
       else if (Array.isArray(d) && d[0] === '=' && typeof d[1] === 'string' &&
                candidates.has(d[1]) && !initSet.has(d)) {
         disqualified.add(d[1])
-        _disqualifyPromotion(d[2], candidates, disqualified, initSet)
+        _disqualifyPromotion(d[2], candidates, disqualified, initSet, valTypes)
       } else {
-        _disqualifyPromotion(d, candidates, disqualified, initSet)
+        _disqualifyPromotion(d, candidates, disqualified, initSet, valTypes)
       }
     }
     return
@@ -865,14 +1151,14 @@ const _disqualifyPromotion = (node, candidates, disqualified, initSet) => {
     for (let i = 1; i < node.length; i++) {
       const child = node[i]
       if (i === 2 && typeof child === 'string' && candidates.has(child)) continue
-      _disqualifyPromotion(child, candidates, disqualified, initSet)
+      _disqualifyPromotion(child, candidates, disqualified, initSet, valTypes)
     }
     return
   }
 
   // Generic — recurse into children. Bare-name refs at unhandled positions
   // hit the string-leaf branch above and disqualify on contact.
-  for (let i = 1; i < node.length; i++) _disqualifyPromotion(node[i], candidates, disqualified, initSet)
+  for (let i = 1; i < node.length; i++) _disqualifyPromotion(node[i], candidates, disqualified, initSet, valTypes)
 }
 
 // Walk `body` to collect every `let X = [intLit, …]` candidate. Each entry
@@ -940,8 +1226,11 @@ const promoteIntArrayLiteralsInBody = (body) => {
   if (!candidates.size) return { node: body, changed: false }
   const initSet = new Set()
   for (const { initDecl } of candidates.values()) initSet.add(initDecl)
+  // valTypes from analyzeBody gives per-local VAL.* kinds, used by
+  // _disqualifyPromotion to prove index keys are numeric (see _isNumericKey).
+  const { valTypes } = analyzeBody(body)
   const disqualified = new Set()
-  _disqualifyPromotion(body, candidates, disqualified, initSet)
+  _disqualifyPromotion(body, candidates, disqualified, initSet, valTypes)
   const validated = new Set()
   for (const name of candidates.keys()) if (!disqualified.has(name)) validated.add(name)
   if (!validated.size) return { node: body, changed: false }