jz 0.6.0 → 0.8.0

package/layout.js

@@ -41,6 +41,29 @@ export const PTR = {
 /** Reserved atom aux ids (PTR.ATOM). */
 export const ATOM = { NULL: 1, UNDEF: 2, FALSE: 4, TRUE: 5 }
 
+/** Tags whose heap block can relocate on growth (ARRAY/HASH/SET/MAP) — leaving a
+ *  forwarding header that `__ptr_offset` must follow. `(1 << tag) & FORWARDING_MASK`
+ *  tests membership in one shl+and, replacing a 4-way tag-equality OR. */
+export const FORWARDING_MASK = (1 << PTR.ARRAY) | (1 << PTR.HASH) | (1 << PTR.SET) | (1 << PTR.MAP)
+
+// BigInt views of the NaN-box fields — the carrier is 64-bit, JS bit-ops are 32-bit.
+const TAG_SHIFT = BigInt(LAYOUT.TAG_SHIFT), TAG_MASK = BigInt(LAYOUT.TAG_MASK)
+const AUX_SHIFT = BigInt(LAYOUT.AUX_SHIFT), AUX_MASK = BigInt(LAYOUT.AUX_MASK)
+const OFFSET_MASK = BigInt(LAYOUT.OFFSET_MASK)
+
+/** Format an i64 BigInt as a zero-padded `0x…` hex literal for WAT/IR templates. */
+export const i64Hex = bits => '0x' + bits.toString(16).toUpperCase().padStart(16, '0')
+
+/** Pack (type, aux, offset) into the i64 NaN-box carrier — the single source of
+ *  truth for pointer bit layout. Compiler IR (`packPtrBits`/`mkPtrIR`), the
+ *  `$__mkptr` inline specializer, and the interop high-word encoder all derive
+ *  from this. `offset` defaults to 0 to yield the box prefix (offset OR'd later). */
+export const ptrBits = (type, aux = 0, offset = 0) =>
+  LAYOUT.NAN_PREFIX_BITS
+  | ((BigInt(type) & TAG_MASK) << TAG_SHIFT)
+  | ((BigInt(aux) & AUX_MASK) << AUX_SHIFT)
+  | (BigInt(offset >>> 0) & OFFSET_MASK)
+
 // =============================================================================
 // PTR.TYPED element-type aux codec — which typed-array flavor lives in the aux
 // field of a PTR.TYPED box. Pure (no compiler state) → lives with the NaN-box
@@ -89,20 +112,19 @@ export function ctorFromElemAux(aux) {
   return isView ? `new.${name}.view` : `new.${name}`
 }
 
-/** Host-side high u32 word for NaN-boxed f64 pointer encoding (interop). */
+/** Host-side high u32 word for NaN-boxed f64 pointer encoding (interop) — the
+ *  top 32 bits of `ptrBits(type, aux)` (offset lives in the low word). */
 export const encodePtrHi = (type, aux) =>
-  (0x7FF80000 | ((type & 0xF) << 15) | (aux & 0x7FFF)) >>> 0
+  ((LAYOUT.NAN_PREFIX << 16) | ((type & LAYOUT.TAG_MASK) << (LAYOUT.TAG_SHIFT - 32)) | (aux & LAYOUT.AUX_MASK)) >>> 0
 
-export const decodePtrType = hi => (hi >>> 15) & 0xF
-export const decodePtrAux = hi => hi & 0x7FFF
+export const decodePtrType = hi => (hi >>> (LAYOUT.TAG_SHIFT - 32)) & LAYOUT.TAG_MASK
+export const decodePtrAux = hi => hi & LAYOUT.AUX_MASK
 
 /** i64 NaN-prefix OR-mask for WAT `(i64.const …)` templates. */
-export const nanPrefixHex = () =>
-  '0x' + LAYOUT.NAN_PREFIX_BITS.toString(16).toUpperCase().padStart(16, '0')
+export const nanPrefixHex = () => i64Hex(LAYOUT.NAN_PREFIX_BITS)
 
 /** Atom sentinel as i64 hex (compiler WAT templates). */
-export const atomNanHex = atomId =>
-  '0x' + (LAYOUT.NAN_PREFIX_BITS | (BigInt(atomId) << BigInt(LAYOUT.AUX_SHIFT))).toString(16).toUpperCase().padStart(16, '0')
+export const atomNanHex = atomId => i64Hex(LAYOUT.NAN_PREFIX_BITS | (BigInt(atomId) << AUX_SHIFT))
 
 /** STRING aux bit 0 on a PLAIN-HEAP string (SSO and SLICE clear): this is a
  *  CANONICAL interned string — the static-pool copy (or an intern-table hit
@@ -115,22 +137,16 @@ export const atomNanHex = atomId =>
 export const STR_INTERN_BIT = 0x1
 
 /** Pre-shifted STRING SSO aux bit as i64 hex. */
-export const ssoBitI64Hex = () =>
-  '0x' + (BigInt(LAYOUT.SSO_BIT) << BigInt(LAYOUT.AUX_SHIFT)).toString(16).toUpperCase().padStart(16, '0')
+export const ssoBitI64Hex = () => i64Hex(BigInt(LAYOUT.SSO_BIT) << AUX_SHIFT)
 
 /** Pre-shifted STRING slice/view aux bit as i64 hex. */
-export const sliceBitI64Hex = () =>
-  '0x' + (BigInt(LAYOUT.SLICE_BIT) << BigInt(LAYOUT.AUX_SHIFT)).toString(16).toUpperCase().padStart(16, '0')
+export const sliceBitI64Hex = () => i64Hex(BigInt(LAYOUT.SLICE_BIT) << AUX_SHIFT)
 
 /** Full i64 NaN-box hex for `(i64.const …)` — ptr type + aux, offset OR'd separately. */
-export const ptrNanHex = (ptrType, aux = 0) =>
-  '0x' + ptrBoxPrefixBigInt(ptrType, aux).toString(16).toUpperCase().padStart(16, '0')
+export const ptrNanHex = (ptrType, aux = 0) => i64Hex(ptrBits(ptrType, aux))
 
 /** Compile-time i64 prefix for mkPtrIR (before offset OR). */
-export const ptrBoxPrefixBigInt = (ptrType, aux = 0) =>
-  (0x7FF8n << 48n)
-  | ((BigInt(ptrType) & 0xFn) << 47n)
-  | ((BigInt(aux) & 0x7FFFn) << 32n)
+export const ptrBoxPrefixBigInt = (ptrType, aux = 0) => ptrBits(ptrType, aux)
 
 /** Host-side atom sentinel high-u32 values (interop f64 decode). */
 export const ATOM_HI = {

package/module/array.js

@@ -10,13 +10,13 @@
 
 import { typed, asF64, asI64, asI32, NULL_NAN, UNDEF_NAN, temp, tempI32, allocPtr, multiCount, arrayLoop, elemLoad, elemStore, truthyIR, extractF64Bits, appendStaticSlots, mkPtrIR, slotAddr, isLiteralStr, resolveValType, undefExpr, ptrTypeEq } from '../src/ir.js'
 import { inBoundsArrIdx } from '../src/type.js'
-import { emit, spread, deps } from '../src/bridge.js'
+import { emit, spread, deps, idx as emitIndex } from '../src/bridge.js'
 import { valTypeOf } from '../src/kind.js'
 import { extractParams, classifyParam, ASSIGN_OPS, refsName, REFS_IN_EXPR } from '../src/ast.js'
-import { staticPropertyKey, staticObjectProps, inlineArraySid } from '../src/static.js'
+import { staticPropertyKey, staticObjectProps, inlineArraySid, staticIndexKey, intLiteralValue } from '../src/static.js'
 import { VAL, lookupValType, lookupNotString, updateRep } from '../src/reps.js'
 import { structInline } from '../src/abi/index.js'
-import { ctx, inc, err, PTR, LAYOUT, followForwardingWat } from '../src/ctx.js'
+import { ctx, inc, err, warnDeopt, PTR, LAYOUT, followForwardingWat } from '../src/ctx.js'
 import { strHashLiteral } from './collection.js'
 
 
@@ -33,7 +33,7 @@ function allocArray(len, cap) {
  *  only an 8-byte header left off-16 pointing at adjacent data-segment bytes, so
  *  for-in / named-prop lookup (which read off-16 as the props-sidecar pointer)
  *  walked garbage → OOB (test262 built-ins/Object/keys sparse-array). */
-function staticArrayPtr(slots) {
+export function staticArrayPtr(slots) {
   if (!ctx.runtime.data) ctx.runtime.data = ''
   while (ctx.runtime.data.length % 8 !== 0) ctx.runtime.data += '\0'
   const headerOff = ctx.runtime.data.length
@@ -249,9 +249,9 @@ export default (ctx) => {
       '__ptr_offset',
       ...(needsArrayDynMove() ? ['__dyn_move', '__hash_new', '__ihash_set_local'] : []),
     ],
-    __arr_fill: ['__ptr_offset'],
+    __arr_fill: ['__ptr_offset', '__clamp_idx'],  // body-calls __clamp_idx; declare it (self-host auto-scan can't be relied on — see test/selfhost-includes.js)
     __arr_set_idx_ptr: ['__arr_grow', '__ptr_offset'],
-    __arr_push1: ['__arr_grow_known', '__ptr_offset'],
+    __arr_push1: ['__arr_grow_known', '__ptr_offset_fwd'],
     __arr_set_length: ['__arr_grow_known', '__ptr_offset', '__ptr_type'],
     __arr_unshift: ['__arr_grow', '__len', '__ptr_offset'],
     __arr_splice: ['__arr_grow', '__len', '__ptr_offset', '__alloc_hdr', '__mkptr'],
@@ -333,67 +333,6 @@ export default (ctx) => {
   // Full body handles TYPED element types and view indirection since external host can
   // pass typed arrays even when typedarray module isn't loaded. When features.typedarray
   // and features.external are both off, collapses to ARRAY-only f64 indexing.
-  ctx.core.stdlib['__typed_idx'] = () => {
-    if (!ctx.features.typedarray && !ctx.features.external) {
-      return `(func $__typed_idx (param $ptr i64) (param $i i32) (result f64)
-    (local $len i32)
-    (local.set $len (call $__len (local.get $ptr)))
-    (if (result f64)
-      (i32.or
-        (i32.lt_s (local.get $i) (i32.const 0))
-        (i32.ge_u (local.get $i) (local.get $len)))
-      (then (f64.const nan:${UNDEF_NAN}))
-      (else (f64.load (i32.add (call $__ptr_offset (local.get $ptr)) (i32.shl (local.get $i) (i32.const 3)))))))`
-    }
-    // Hot (~37M calls in watr self-host). Type/aux/offset extracted once from $ptr.
-    return `(func $__typed_idx (param $ptr i64) (param $i i32) (result f64)
-    (local $t i32) (local $off i32) (local $et i32) (local $len i32) (local $aux i32)
-    (local.set $t (i32.wrap_i64 (i64.and (i64.shr_u (local.get $ptr) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))))
-    (local.set $off (i32.wrap_i64 (i64.and (local.get $ptr) (i64.const ${LAYOUT.OFFSET_MASK}))))
-    ;; ARRAY fast path: follow forwarding inline, bounds-check against header len, f64.load — no $__len call.
-    (if (i32.and (i32.eq (local.get $t) (i32.const ${PTR.ARRAY})) (i32.ge_u (local.get $off) (i32.const 8)))
-      (then
-        ${followForwardingWat('$off', { lowGuard: false })}
-        (return (if (result f64)
-          (i32.and (i32.ge_s (local.get $i) (i32.const 0)) (i32.lt_u (local.get $i) (i32.load (i32.sub (local.get $off) (i32.const 8)))))
-          (then (f64.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 3)))))
-          (else (f64.const nan:${UNDEF_NAN}))))))
-    (local.set $aux (i32.wrap_i64 (i64.and (i64.shr_u (local.get $ptr) (i64.const ${LAYOUT.AUX_SHIFT})) (i64.const ${LAYOUT.AUX_MASK}))))
-    (if
-      (i32.and
-        (i32.eq (local.get $t) (i32.const ${PTR.TYPED}))
-        (i32.ne (i32.and (local.get $aux) (i32.const 8)) (i32.const 0)))
-      (then (local.set $off (i32.load (i32.add (local.get $off) (i32.const 4))))))
-    (local.set $len (call $__len (local.get $ptr)))
-    (if (result f64)
-      (i32.or
-        (i32.lt_s (local.get $i) (i32.const 0))
-        (i32.ge_u (local.get $i) (local.get $len)))
-      (then (f64.const nan:${UNDEF_NAN}))
-      (else
-        (if (result f64) (i32.eq (local.get $t) (i32.const ${PTR.TYPED}))
-          (then
-            (local.set $et (i32.and (local.get $aux) (i32.const 7)))
-            (if (result f64) (i32.ge_u (local.get $et) (i32.const 6))
-              (then (if (result f64) (i32.eq (local.get $et) (i32.const 7))
-                (then (if (result f64) (i32.and (local.get $aux) (i32.const 16))
-                  (then (f64.reinterpret_i64 (i64.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 3))))))
-                  (else (f64.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 3)))))))
-                (else (f64.promote_f32 (f32.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 2))))))))
-              (else (if (result f64) (i32.ge_u (local.get $et) (i32.const 4))
-                (then (if (result f64) (i32.and (local.get $et) (i32.const 1))
-                  (then (f64.convert_i32_u (i32.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 2))))))
-                  (else (f64.convert_i32_s (i32.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 2))))))))
-                (else (if (result f64) (i32.ge_u (local.get $et) (i32.const 2))
-                  (then (if (result f64) (i32.and (local.get $et) (i32.const 1))
-                    (then (f64.convert_i32_u (i32.load16_u (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 1))))))
-                    (else (f64.convert_i32_s (i32.load16_s (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 1))))))))
-                  (else (if (result f64) (i32.and (local.get $et) (i32.const 1))
-                    (then (f64.convert_i32_u (i32.load8_u (i32.add (local.get $off) (local.get $i)))))
-                    (else (f64.convert_i32_s (i32.load8_s (i32.add (local.get $off) (local.get $i)))))))))))))
-          (else (f64.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 3)))))))))`
-  }
-
   // Array.from(src) — shallow copy of array (memory.copy of f64 elements)
   ctx.core.stdlib['__arr_from'] = `(func $__arr_from (param $src i64) (result f64)
     (local $len i32) (local $dst i32)
@@ -576,12 +515,13 @@ export default (ctx) => {
   ctx.core.stdlib['__arr_push1'] = `(func $__arr_push1 (param $ptr i64) (param $val f64) (result f64)
     (local $p f64) (local $base i32) (local $len i32)
     (local.set $p (f64.reinterpret_i64 (local.get $ptr)))
-    (local.set $base (call $__ptr_offset (local.get $ptr)))
+    (local.set $base (i32.wrap_i64 (i64.and (local.get $ptr) (i64.const ${LAYOUT.OFFSET_MASK}))))
+    ${followForwardingWat('$base', { lowGuard: true })}
     (local.set $len (i32.load (i32.sub (local.get $base) (i32.const 8))))
     (if (i32.lt_s (i32.load (i32.sub (local.get $base) (i32.const 4))) (i32.add (local.get $len) (i32.const 1)))
       (then
         (local.set $p (call $__arr_grow_known (local.get $ptr) (i32.add (local.get $len) (i32.const 1))))
-        (local.set $base (call $__ptr_offset (i64.reinterpret_f64 (local.get $p))))))
+        (local.set $base (i32.wrap_i64 (i64.and (i64.reinterpret_f64 (local.get $p)) (i64.const ${LAYOUT.OFFSET_MASK}))))))
     (f64.store (i32.add (local.get $base) (i32.shl (local.get $len) (i32.const 3))) (local.get $val))
     (i32.store (i32.sub (local.get $base) (i32.const 8)) (i32.add (local.get $len) (i32.const 1)))
     (local.get $p))`
@@ -625,8 +565,14 @@ export default (ctx) => {
     if (!hasSpread) {
       const len = elems.length
       // R: Static data segment for arrays of pure-literal elements (own-memory only).
-      // Saves N×(alloc+store) instructions in __start; raw f64 bits embedded directly.
-      if (len >= 4 && !ctx.memory.shared) {
+      // Raw f64 bits embedded directly — a constant array becomes a const pointer with no
+      // alloc and no per-element store. A static array aliases ONE shared data-segment
+      // region, so this is sound only when no caller expects a fresh instance per
+      // evaluation: at module scope the literal runs exactly once. A function-local
+      // literal (which would leak in-place mutations across calls — a latent bug the old
+      // len≥4 gate also had) allocs fresh instead. Module scope lifts the size floor too,
+      // so `const x = [1, 2, 3]` is a data segment, not an alloc.
+      if (ctx.func.atModuleScope && len >= 1 && !ctx.memory.shared) {
         // asF64 folds i32.const → f64.const literally, so int-literal arrays also qualify.
         const slots = elems.map(e => extractF64Bits(asF64(emit(e))))
         if (slots.every(b => b !== null)) return staticArrayPtr(slots)
@@ -651,6 +597,14 @@ export default (ctx) => {
   // === Index read ===
 
   ctx.core.emit['[]'] = (arr, idx) => {
+    // A literal NEGATIVE index is always out of range → undefined (JS semantics), never a
+    // raw `payload + (-1)*8` load that reads heap before the allocation. A side-effecting
+    // receiver still evaluates. Mirrors VT['[]'] returning null for the same case.
+    { const li = intLiteralValue(idx)
+      if (li != null && li < 0)
+        return typeof arr === 'string'
+          ? undefExpr()
+          : typed(['block', ['result', 'f64'], ['drop', asF64(emit(arr))], undefExpr()], 'f64') }
     // Hoist non-identifier arr so side-effecting sources (e.g. `foo.shift()[i]`) execute once.
     // The rest of the handler inlines `emit(arr)` into multiple IR positions, which would
     // otherwise re-execute the source expression per use at runtime.
@@ -676,10 +630,13 @@ export default (ctx) => {
     const litKey = isLiteralStr(idx) ? idx[1]
       : typeof arr === 'string' && lookupValType(arr) === VAL.OBJECT ? staticPropertyKey(idx)
       : null
-    // SRoA flat object: `o['k']` → `local.get $o#i` (analyze.js scanFlatObjects).
-    if (litKey != null && typeof arr === 'string' && ctx.func.flatObjects?.has(arr)) {
+    // SRoA flat object/array: `o['k']` / `a[2]` → `local.get $o#i` (scanFlatObjects).
+    // A bare integer index resolves its slot key here (not via `litKey`, which stays
+    // null for arrays so the heap-array / schema paths below are untouched).
+    if (typeof arr === 'string' && ctx.func.flatObjects?.has(arr)) {
       const fo = ctx.func.flatObjects.get(arr)
-      const fi = fo.names.indexOf(litKey)
+      const flatKey = litKey != null ? litKey : staticIndexKey(idx)
+      const fi = flatKey != null ? fo.names.indexOf(flatKey) : -1
       if (fi >= 0) return typed(['local.get', `$${arr}#${fi}`], 'f64')
     }
     if (litKey != null && typeof arr === 'string' && ctx.schema.slotOf) {
@@ -700,14 +657,34 @@ export default (ctx) => {
     // Multi-value calls are materialized at call site (see '()' handler), so
     // func()[i] works naturally — func() returns a heap array pointer, [i] indexes it.
     const vt = typeof arr === 'string' ? lookupValType(arr) : valTypeOf(arr)
-    const va = emit(arr), vi = asI32(emit(idx))
+    // Literal string key on a receiver that isn't a known array/typed/string:
+    // `x['a']` IS `x.a` — delegate to the dot emitter so an untyped/OBJECT/external
+    // receiver gets the same polymorphic dispatch (__dyn_get_any_t_h, host-external
+    // aware). The local `dynLoad` fallback below calls __dyn_get, which only probes
+    // the internal HASH layout — so `x['a']` on a host object silently returned
+    // undefined while `x.a` worked. (Known ARRAY/TYPED/STRING fall through unchanged:
+    // their string-key semantics differ from a HASH/OBJECT property read.)
+    if (litKey != null && vt !== VAL.ARRAY && vt !== VAL.TYPED && vt !== VAL.STRING)
+      return emit(['.', arr, litKey])
+    // emitIndex (not bare asI32(emit)) narrows integer index arithmetic — incl. a
+    // literal term like the `+1` of `a[i*W + x + 1]` — to i32 ops instead of the
+    // f64 convert/trunc round-trip. Non-i32 keys (string dispatch) fall back to
+    // asI32(emit) inside emitIndex, so this is a strict improvement for every branch.
+    const va = emit(arr), vi = emitIndex(idx)
     const ptrExpr = asF64(va)
     const dynLoad = (objExpr, keyExpr) => {
       if (ctx.transform.strict) err(`strict mode: dynamic property access \`${typeof arr === 'string' ? arr : '<expr>'}[<expr>]\` falls back to __dyn_get. Use a literal key or known typed-array receiver, or pass { strict: false }.`)
+      warnDeopt('deopt-dyn-read', `dynamic property read \`${typeof arr === 'string' ? arr : '<expr>'}[…]\` couldn't resolve a static type — it falls back to a runtime hash lookup (~1.5–2× slower than a typed/slot read, far worse in a hot loop). Use a literal key, a typed-array receiver, or a Map for genuinely dynamic keys.`)
       inc('__dyn_get')
       return ['f64.reinterpret_i64', ['call', '$__dyn_get', ['i64.reinterpret_f64', objExpr], ['i64.reinterpret_f64', keyExpr]]]
     }
     const stringLoad = () => (inc('__str_idx'), ['call', '$__str_idx', ['i64.reinterpret_f64', ptrExpr], vi])
+    // A numeric index on an unknown receiver is array/typed access by design — kept
+    // lean (no OBJECT/HASH dyn-get fork): an object with numeric keys is a degenerate
+    // pattern not worth a per-access string-coercion + hash probe in every hot loop.
+    // The WRITE path still routes a numeric `o[i]=v` on an OBJECT to __dyn_set for
+    // SAFETY (no schema-slot corruption / OOB), so such a read returns undefined
+    // rather than corrupting — matching JS for an out-of-range typed/array index.
     const arrayLoad = (['call', '$__typed_idx', ['i64.reinterpret_f64', ptrExpr], vi])
     const emitDynamicKeyDispatch = (objExpr, numericLoad) => {
       const keyTmp = temp()
@@ -753,6 +730,16 @@ export default (ctx) => {
     if (keyType === VAL.STRING)
       return typed(dynLoad(ptrExpr, asF64(emit(idx))), 'f64')
     if (vt === 'array') {
+      // Base offset of the array's data region. A binding proven never relocated
+      // (scanNeverGrown — a fresh array literal whose every use is a pure read, so no
+      // grow op can ever run) skips the realloc-forwarding follow: its base is the raw
+      // post-header offset `wrap(reinterpret(ptr) & OFFSET_MASK)`, no __ptr_offset call.
+      // Memory-safe ONLY under that proof — a relocated array read through this stale
+      // base would corrupt memory (see scanNeverGrown's default-deny rationale).
+      const neverGrown = typeof arr === 'string' && ctx.func.localReps?.get(arr)?.neverGrown === true
+      const arrBase = () => neverGrown
+        ? ['i32.wrap_i64', ['i64.and', ['i64.reinterpret_f64', ptrExpr], ['i64.const', LAYOUT.OFFSET_MASK]]]
+        : (inc('__ptr_offset'), ['call', '$__ptr_offset', ['i64.reinterpret_f64', ptrExpr]])
       // structInline Array<S>: element i is K consecutive inline f64 schema
       // cells — no per-row heap object, no stored element pointer. `arr[i]` is
       // the byte address of the element's first cell, returned as a first-class
@@ -761,11 +748,10 @@ export default (ctx) => {
       // structInline handles (src/analyze.js analyzeStructInline).
       const inlSid = inlineArraySid(arr)
       if (inlSid != null) {
-        inc('__ptr_offset')
         const baseI32 = tempI32('ab')
         const K = ctx.schema.list[inlSid].length
         const cell = typed(structInline(K).ops.elemAddr(
-          ['local.tee', `$${baseI32}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ptrExpr]]],
+          ['local.tee', `$${baseI32}`, arrBase()],
           vi), 'i32')
         cell.ptrKind = VAL.OBJECT
         cell.ptrAux = inlSid
@@ -775,51 +761,51 @@ export default (ctx) => {
       // not __typed_idx (which does __len + __ptr_offset = two forwarding follows
       // plus type-dispatch overhead irrelevant for plain arrays).
       const keyIsNum = keyType === VAL.NUMBER
-      // Inline fast path: when arr has a known element schema and key is a
-      // known number, the type-tag check and bounds check inside __arr_idx are
-      // dead weight in hot kernels. Emit (f64.load (i32.add base (shl i 3)))
-      // directly. base goes through __ptr_offset (still does forwarding follow),
-      // and hoistAddrBase will CSE the (base, i) pair across the iteration body.
-      // Array<NUMBER>/<STRING>/<OBJECT> all use 8-byte f64 slot layout — direct
-      // f64.load is correct regardless of elem kind (returns raw f64 for NUMBER,
-      // NaN-boxed pointer for OBJECT/STRING; downstream typed() handles both).
-      // Fast path fires on schemaId (Array<{x,y,z}> shapes) OR plain elem-val
-      // (Array<NUMBER> from `.map(x => x*k)` etc.) — both are proven facts from
-      // the narrowing fixpoint (carried onto params via paramReps).
-      const rep = typeof arr === 'string' ? ctx.func.localReps?.get(arr) : null
-      const hasElemFact = rep?.arrayElemSchema != null || rep?.arrayElemValType != null
-      // Take the unchecked inline load ONLY when the index is proven in-bounds by an
-      // enclosing canonical loop `for (let i=C; i<arr.length; i++)`. Skipping the bounds
-      // check on an arbitrary numeric index is unsound: `a[1]` on a length-1 array would
-      // read the raw (uninitialized) cell instead of undefined. Constant / unproven
-      // indices fall through to __arr_idx(_known) below, which bounds-checks → UNDEF_NAN.
-      const idxProvenInBounds = hasElemFact && keyIsNum
+      // Inline fast path for any known plain ARRAY + numeric key: the type-tag
+      // dispatch and bounds check inside __arr_idx(_known) are dead weight in hot
+      // kernels — most visibly AST walkers doing `node[i]` over heterogeneous
+      // arrays, where no element schema/valType is ever inferred. Emit the
+      // f64.load directly. base goes through __ptr_offset (still the forwarding
+      // follow), and hoistAddrBase CSEs the (base, i) pair across the iteration
+      // body. taggedLinear stores every element as one 8-byte f64 cell —
+      // Array<NUMBER>/<STRING>/<OBJECT> alike — so a direct f64.load is correct
+      // regardless of elem kind (raw f64 for NUMBER, NaN-boxed pointer for
+      // OBJECT/STRING; downstream typed() handles both). The load shape is fixed
+      // by the carrier, not by any rep fact, so we do NOT gate on a known element
+      // schema/valType: a bare `let a = [...]` walked by index gets the same
+      // inline load as an Array<{x,y,z}>. (structInline arrays returned above via
+      // inlineArraySid; typed arrays are VAL.TYPED, handled below.)
+      //
+      // Take the UNCHECKED inline load only when the index is proven in-bounds by
+      // an enclosing canonical loop `for (let i=C; i<arr.length; i++)` — a pure
+      // index<length structural proof (scanBoundedArrIdx, src/type.js), itself
+      // element-kind-independent. Skipping the bounds check on an arbitrary numeric
+      // index is unsound: `a[1]` on a length-1 array would read the raw cell instead
+      // of undefined; those fall through to the inline bounds-checked load below.
+      const idxProvenInBounds = keyIsNum
         && typeof arr === 'string' && typeof idx === 'string'
         && inBoundsArrIdx(ctx).has(arr + '\x00' + idx)
       if (idxProvenInBounds) {
-        inc('__ptr_offset')
-        // __ptr_offset returns i32 — base local must be i32 (not the default
-        // f64 NaN-box temp). Flat tee form so downstream peepholes can fold
+        // base local must be i32. Flat tee form so downstream peepholes can fold
         // `i32.wrap_i64 (i64.reinterpret_f64 (f64.load …))` → `i32.load …`
         // when this load feeds a ptrUnboxed OBJECT field.
         const baseI32 = tempI32('ab')
         return typed(ctx.abi.array.ops.load(
-          ['local.tee', `$${baseI32}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ptrExpr]]],
+          ['local.tee', `$${baseI32}`, arrBase()],
           vi), 'f64')
       }
-      // Known-elem array, numeric key, NOT proven in-bounds → inline bounds-checked
+      // Known plain array, numeric key, NOT proven in-bounds → inline bounds-checked
       // load: `idx < len ? load : undefined`. Same semantics as __arr_idx_known but
       // inline, so watr hoists the loop-invariant len load and CSEs the base — the
       // residual cost is a single (predictable) compare per access, not a call. Skipping
       // the check would read raw memory for OOB indices (e.g. `a[1]` on a length-1 array).
-      if (hasElemFact && keyIsNum) {
-        inc('__ptr_offset')
+      if (keyIsNum) {
         const baseI32 = tempI32('ab'), idxI32 = tempI32('ai')
         return typed(['if', ['result', 'f64'],
           ['i32.lt_u',
             ['local.tee', `$${idxI32}`, vi],
             ['i32.load', ['i32.sub',
-              ['local.tee', `$${baseI32}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ptrExpr]]],
+              ['local.tee', `$${baseI32}`, arrBase()],
               ['i32.const', 8]]]],
           ['then', ctx.abi.array.ops.load(['local.get', `$${baseI32}`], ['local.get', `$${idxI32}`])],
           ['else', undefExpr()]], 'f64')
@@ -897,6 +883,10 @@ export default (ctx) => {
 
   // .push(val) → append, increment len, return array (possibly reallocated pointer)
   ctx.core.emit['.push'] = (arr, ...vals) => {
+    // `_expect` is overwritten by recursive emit() calls below. Capture the
+    // statement-position hint now so a dropped `xs.push(v)` can skip computing
+    // the JS return length while still performing the mutation/writeback.
+    const void_ = ctx.func._expect === 'void'
     // structInline Array<S>: `.push({S})` writes the K schema fields as K
     // consecutive f64 cells. Flatten the struct literal into K schema-ordered
     // field-value nodes and fall through to the general multi-value store path
@@ -924,8 +914,10 @@ export default (ctx) => {
       const readVar = box ? ['f64.load', ['local.get', `$${box}`]] : isGlobal ? ['global.get', `$${arr}`] : ['local.get', `$${arr}`]
       const writeVar = v => box ? ['f64.store', ['local.get', `$${box}`], v] : isGlobal ? ['global.set', `$${arr}`, v] : ['local.set', `$${arr}`, v]
       const vv = asF64(emit(vals[0]))
+      const pushed = ['call', '$__arr_push1', ['i64.reinterpret_f64', readVar], vv]
+      if (void_) return typed(['block', writeVar(pushed)], 'void')
       return typed(['block', ['result', 'f64'],
-        writeVar(['call', '$__arr_push1', ['i64.reinterpret_f64', readVar], vv]),
+        writeVar(pushed),
         ['f64.convert_i32_s', ['i32.load', ['i32.sub',
           ['call', '$__ptr_offset', ['i64.reinterpret_f64', readVar]], ['i32.const', 8]]]]], 'f64')
     }
@@ -1077,12 +1069,8 @@ export default (ctx) => {
         (if (i32.ge_u (local.get $off) (i32.const 8))
           (then
             (local.set $len (i32.load (i32.sub (local.get $off) (i32.const 8))))
-            (if (i32.lt_s (local.get $start) (i32.const 0)) (then (local.set $start (i32.add (local.get $len) (local.get $start)))))
-            (if (i32.lt_s (local.get $start) (i32.const 0)) (then (local.set $start (i32.const 0))))
-            (if (i32.gt_s (local.get $start) (local.get $len)) (then (local.set $start (local.get $len))))
-            (if (i32.lt_s (local.get $end) (i32.const 0)) (then (local.set $end (i32.add (local.get $len) (local.get $end)))))
-            (if (i32.lt_s (local.get $end) (i32.const 0)) (then (local.set $end (i32.const 0))))
-            (if (i32.gt_s (local.get $end) (local.get $len)) (then (local.set $end (local.get $len))))
+            (local.set $start (call $__clamp_idx (local.get $start) (local.get $len)))
+            (local.set $end (call $__clamp_idx (local.get $end) (local.get $len)))
             (local.set $i (local.get $start))
             (block $done (loop $fill
               (br_if $done (i32.ge_s (local.get $i) (local.get $end)))