jz 0.7.0 → 0.8.0

package/module/typedarray.js

@@ -12,7 +12,7 @@ import { emit, idx, deps, call } from '../src/bridge.js'
 import { valTypeOf } from '../src/kind.js'
 import { VAL, lookupValType } from '../src/reps.js'
 import { nanPrefixHex, TYPED_ELEM_NAMES, TYPED_ELEM_CODE, TYPED_ELEM_BIGINT_FLAG, encodeTypedElemAux } from '../layout.js'
-import { inc, PTR, LAYOUT, getter } from '../src/ctx.js'
+import { inc, PTR, LAYOUT, registerGetter } from '../src/ctx.js'
 
 const _NAN_BITS = nanPrefixHex()
 
@@ -28,6 +28,12 @@ const STORE = [
   'i32.store8', 'i32.store8', 'i32.store16', 'i32.store16',
   'i32.store', 'i32.store', 'f32.store', 'f64.store',
 ]
+// f64 value → this element's stored representation (paired with STORE). Signed
+// kinds trunc_s, unsigned trunc_u, f32 demotes, f64 stores as-is (null = identity).
+const FROM_F64 = [
+  'i32.trunc_f64_s', 'i32.trunc_f64_u', 'i32.trunc_f64_s', 'i32.trunc_f64_u',
+  'i32.trunc_f64_s', 'i32.trunc_f64_u', 'f32.demote_f64', null,
+]
 
 // SIMD: vector width per element type (elements per v128)
 const VEC_WIDTH = [16, 16, 8, 8, 4, 4, 4, 2] // 128 bits / element bits
@@ -202,10 +208,17 @@ export default (ctx) => {
     __to_buffer: ['__ptr_type', '__ptr_offset', '__ptr_aux', '__mkptr'],
     __typed_set_idx: ['__ptr_aux', '__ptr_offset'],
     __typed_get_idx: ['__ptr_aux', '__ptr_offset'],
-    __typed_fill: ['__len', '__typed_set_idx'],
+    // __clamp_idx is body-called by every range op (fill/copyWithin/subarray/slice). It has NO
+    // other manual-dep edge in the whole stdlib, so it's reachable ONLY via resolveIncludes'
+    // auto-scan — which diverges under self-host (jz.wasm), dropping it ("Unknown func
+    // $__clamp_idx" on typed .fill/.subarray in the kernel). Declare it manually here so the
+    // reliable dep path includes it. Pinned by test/selfhost-includes.js.
+    __typed_fill: ['__len', '__typed_set_idx', '__clamp_idx'],
     __typed_reverse: ['__len', '__typed_get_idx', '__typed_set_idx'],
-    __typed_copyWithin: ['__len', '__typed_get_idx', '__typed_set_idx'],
+    __typed_copyWithin: ['__len', '__typed_get_idx', '__typed_set_idx', '__clamp_idx'],
     __typed_sort: ['__len', '__typed_get_idx', '__typed_set_idx'],
+    __subarray: ['__ptr_aux', '__ptr_offset', '__typed_shift', '__typed_data', '__len', '__mkptr', '__alloc', '__clamp_idx'],
+    __typed_slice_rt: ['__ptr_aux', '__typed_shift', '__typed_data', '__len', '__mkptr', '__alloc_hdr_n', '__clamp_idx'],
     // __str_join uses __typed_idx when typedarray is loaded (plain arrays promoted to
     // Int32Array by promoteIntArrayLiterals can produce PTR.TYPED results via .map()).
     __str_join: [...(ctx.core.stdlibDeps.__str_join ?? []), '__typed_idx'],
@@ -266,6 +279,60 @@ export default (ctx) => {
                   (i32.load (i32.add (local.get $off) (i32.const 8)))))
           (else (call $__mkptr (i32.const ${PTR.BUFFER}) (i32.const 0) (local.get $off)))))))`
 
+  // __subarray(ptr, begin, end, useEnd) — runtime-dispatched `.subarray(...)` for
+  // when the receiver's elem type / view-ness isn't statically known (a binding
+  // reassigned owned→view: `let c = new T(d); c = c.subarray(n)`). Reads elem type
+  // and the view bit off the aux byte, so it is correct whether `ptr` is an owned
+  // typed array or an existing view. Mirrors the static `.typed:subarray` emitter:
+  // builds the 16-byte descriptor [byteLen][dataOff][rootOff] and tags TYPED|view.
+  // Cold path (slicing, not per-element) — correctness over speed.
+  ctx.core.stdlib['__subarray'] = `(func $__subarray (param $ptr i64) (param $begin i32) (param $end i32) (param $useEnd i32) (result f64)
+    (local $aux i32) (local $shift i32) (local $off i32) (local $data i32) (local $root i32)
+    (local $len i32) (local $lo i32) (local $hi i32) (local $n i32) (local $desc i32)
+    (local.set $aux (call $__ptr_aux (local.get $ptr)))
+    (local.set $shift (call $__typed_shift (i32.and (local.get $aux) (i32.const 7))))
+    (local.set $off (call $__ptr_offset (local.get $ptr)))
+    (local.set $data (call $__typed_data (local.get $ptr)))
+    (local.set $root
+      (if (result i32) (i32.and (local.get $aux) (i32.const 8))
+        (then (i32.load (i32.add (local.get $off) (i32.const 8))))
+        (else (local.get $off))))
+    (local.set $len (call $__len (local.get $ptr)))
+    (local.set $lo (call $__clamp_idx (local.get $begin) (local.get $len)))
+    (if (local.get $useEnd)
+      (then
+        (local.set $hi (call $__clamp_idx (local.get $end) (local.get $len))))
+      (else (local.set $hi (local.get $len))))
+    (local.set $n (select (i32.sub (local.get $hi) (local.get $lo)) (i32.const 0) (i32.gt_s (local.get $hi) (local.get $lo))))
+    (local.set $desc (call $__alloc (i32.const 16)))
+    (i32.store (local.get $desc) (i32.shl (local.get $n) (local.get $shift)))
+    (i32.store (i32.add (local.get $desc) (i32.const 4)) (i32.add (local.get $data) (i32.shl (local.get $lo) (local.get $shift))))
+    (i32.store (i32.add (local.get $desc) (i32.const 8)) (local.get $root))
+    (call $__mkptr (i32.const ${PTR.TYPED}) (i32.or (local.get $aux) (i32.const 8)) (local.get $desc)))`
+
+  // __typed_slice_rt(ptr, begin, end, useEnd) — runtime-dispatched `.slice(...)` for
+  // a receiver whose elem type / view-ness isn't statically known. Unlike subarray
+  // this returns a fresh OWNED copy (bit-exact memory.copy, so bigint-safe too). Reads
+  // elem type + data address off the aux byte. Cold path — correctness over speed.
+  ctx.core.stdlib['__typed_slice_rt'] = `(func $__typed_slice_rt (param $ptr i64) (param $begin i32) (param $end i32) (param $useEnd i32) (result f64)
+    (local $aux i32) (local $et i32) (local $shift i32) (local $src i32)
+    (local $len i32) (local $lo i32) (local $hi i32) (local $n i32) (local $byteLen i32) (local $dst i32)
+    (local.set $aux (call $__ptr_aux (local.get $ptr)))
+    (local.set $et (i32.and (local.get $aux) (i32.const 7)))
+    (local.set $shift (call $__typed_shift (local.get $et)))
+    (local.set $src (call $__typed_data (local.get $ptr)))
+    (local.set $len (call $__len (local.get $ptr)))
+    (local.set $lo (call $__clamp_idx (local.get $begin) (local.get $len)))
+    (if (local.get $useEnd)
+      (then
+        (local.set $hi (call $__clamp_idx (local.get $end) (local.get $len))))
+      (else (local.set $hi (local.get $len))))
+    (local.set $n (select (i32.sub (local.get $hi) (local.get $lo)) (i32.const 0) (i32.gt_s (local.get $hi) (local.get $lo))))
+    (local.set $byteLen (i32.shl (local.get $n) (local.get $shift)))
+    (local.set $dst (call $__alloc_hdr_n (local.get $byteLen) (local.get $byteLen) (i32.const 1)))
+    (memory.copy (local.get $dst) (i32.add (local.get $src) (i32.shl (local.get $lo) (local.get $shift))) (local.get $byteLen))
+    (call $__mkptr (i32.const ${PTR.TYPED}) (i32.and (local.get $aux) (i32.const 23)) (local.get $dst)))`
+
   // Constructor: new Float64Array(len) | new F64Array(arr) | new F64Array(buf) | new F64Array(buf, off, len)
   for (const [name, elemType] of Object.entries(TYPED_ELEM_CODE)) {
     const aux = typedAux(name)
@@ -278,6 +345,7 @@ export default (ctx) => {
       // and tags the TYPED ptr with aux=elemType|8. Reads/writes alias the parent,
       // .buffer reconstructs the root BUFFER, .byteOffset = dataOff - parentOff.
       if (offsetExpr != null && lenExpr2 != null) {
+        ctx.features.typedView = true  // subview aliases the parent buffer — SLP must not assume disjoint bases
         const src = temp('tvs')
         const parentOff = tempI32('tvp')
         const byteLen = tempI32('tvb')
@@ -303,9 +371,12 @@ export default (ctx) => {
       // TYPED retagged at the same offset — the byteLen header is shared with the parent.
       // __len(view) = byteLen >> shift computes elemCount for this view's elemType.
       if (srcType === VAL.BUFFER || srcType === VAL.TYPED) {
+        ctx.features.typedView = true  // zero-copy reinterpret aliases the source — SLP must not pack across it
         return mkPtrIR(PTR.TYPED, aux, ['call', '$__ptr_offset', ['i64.reinterpret_f64', asF64(emit(lenExpr))]])
       }
       if (srcType == null && ctx.core.emit[`${name}.from`]) {
+        ctx.features.typedView = true  // unknown arg: runtime may take the buffer/typed zero-copy-view branch
+
         // Runtime dispatch: number → allocate; array → copy elements; buffer/typed → zero-copy view.
         const src = temp('ts')
         const len = tempI32('tl')
@@ -410,7 +481,7 @@ export default (ctx) => {
   // .buffer — always aliased (zero-copy). BUFFER: passthrough.
   // Owned TYPED: retag as BUFFER at same offset — the byteLen header is shared.
   // TYPED view (incl. DataView): BUFFER at descriptor[8] (root parent data offset).
-  ctx.core.emit['.buffer'] = getter((obj) => {
+  registerGetter('.buffer', (obj) => {
     if (typeof obj === 'string') {
       const ctor = ctx.types.typedElem?.get(obj)
       if (ctor === 'new.ArrayBuffer') return asF64(emit(obj))
@@ -430,7 +501,7 @@ export default (ctx) => {
 
   // .byteLength — BUFFER: raw __len. Owned TYPED: elemCount * stride.
   // View TYPED (incl. DataView): descriptor[0], via the __byte_length fallback.
-  ctx.core.emit['.byteLength'] = getter((obj) => {
+  registerGetter('.byteLength', (obj) => {
     if (typeof obj === 'string') {
       const ctor = ctx.types.typedElem?.get(obj)
       if (ctor === 'new.ArrayBuffer') {
@@ -454,7 +525,7 @@ export default (ctx) => {
   })
 
   // .byteOffset — owned: 0. View: descriptor[4] - descriptor[8].
-  ctx.core.emit['.byteOffset'] = getter((obj) => {
+  registerGetter('.byteOffset', (obj) => {
     if (typeof obj === 'string') {
       const ctor = ctx.types.typedElem?.get(obj)
       if (ctor?.endsWith('.view')) {
@@ -543,6 +614,10 @@ export default (ctx) => {
   // We treat `undefined`/`null`/`0`/`''` as falsy (BE) per ToBoolean.
   const staticLE = (node) => {
     if (node === undefined) return false                              // arg omitted → BE
+    // Prepare lowers a literal `true`/`false` endianness flag to `['bool', 0|1]`;
+    // fold it so `dv.getInt16(p, true)` is one native load (no per-access LE branch
+    // + dead byte-swap arm — the dominant overhead in DataView codec loops).
+    if (Array.isArray(node) && node[0] === 'bool') return !!node[1]
     if (Array.isArray(node) && node[0] == null) {
       // [] → undefined, [null, x] → literal x
       if (node.length === 1) return false
@@ -603,7 +678,18 @@ export default (ctx) => {
       (f64.reinterpret_i64 (i64.const ${_NAN_BITS}))
       (local.get $v)
       (f64.ne (local.get $v) (local.get $v))))`
-  const canonNaN = (vIR) => { inc('__canon_nan'); return typed(['call', '$__canon_nan', vIR], 'f64') }
+  // Inline the NaN-canonicalization select rather than a call — a DataView float
+  // read runs this per sample in codec loops, and the inlined `(select nan v (v≠v))`
+  // is the exact idiom the auto-vectorizer recognizes (vs an opaque call).
+  const canonNaN = (vIR) => {
+    const t = temp('cn')
+    return typed(['block', ['result', 'f64'],
+      ['local.set', `$${t}`, vIR],
+      ['select',
+        ['f64.reinterpret_i64', ['i64.const', _NAN_BITS]],
+        ['local.get', `$${t}`],
+        ['f64.ne', ['local.get', `$${t}`], ['local.get', `$${t}`]]]], 'f64')
+  }
 
   // ToIndex for DataView byte offsets (spec 25.1.2.x getViewValue/setViewValue):
   // ToIntegerOrInfinity then reject negatives and >2^53-1 with a RangeError. The
@@ -644,8 +730,25 @@ export default (ctx) => {
   const dvIndexChecked = (offNode, size, viewSize) => {
     ctx.runtime.throws = true
     const idxT = tempI32('dvb')
+    const offIR = emit(offNode)
+    // Fast path: a proven-i32 byte offset (a loop-advanced `p`, `i*2`, a `|0` value)
+    // carries no fraction/NaN/negative-from-ToNumber surprise, so it skips the f64
+    // ToIndex round-trip and the `__dv_index` CALL — the dominant per-sample cost in
+    // DataView-based codec loops. An i32 range (`<0`) + bounds (`>viewSize-size`)
+    // check is all the spec needs here; this lowers `dv.getInt16(p,true)` to one
+    // `i32.load16_s`, matching the explicit-typed-view path.
+    if (offIR.type === 'i32') {
+      return typed(['block', ['result', 'i32'],
+        ['local.set', `$${idxT}`, offIR],
+        ['if', ['i32.or',
+            ['i32.lt_s', ['local.get', `$${idxT}`], ['i32.const', 0]],
+            ['i32.gt_s', ['local.get', `$${idxT}`], ['i32.sub', viewSize, ['i32.const', size]]]],
+          ['then', ['throw', '$__jz_err', ['f64.const', 0]]]],
+        ['local.get', `$${idxT}`]], 'i32')
+    }
+    inc('__dv_index')
     return typed(['block', ['result', 'i32'],
-      ['local.set', `$${idxT}`, dvIndex(offNode)],
+      ['local.set', `$${idxT}`, typed(['call', '$__dv_index', toNumF64(offNode, offIR)], 'i32')],
       ['if', ['i32.gt_s', ['local.get', `$${idxT}`], ['i32.sub', viewSize, ['i32.const', size]]],
         ['then', ['throw', '$__jz_err', ['f64.const', 0]]]],
       ['local.get', `$${idxT}`]], 'i32')
@@ -812,16 +915,11 @@ export default (ctx) => {
         len: ['i32.mul', ['local.get', `$${len}`], ['i32.const', stride]], stride: 1, tag: 'tf' })
       const t = out.local
       const id = ctx.func.uniq++
-      const storeExpr = elemType === 7 ? ['f64.store',
-          ['i32.add', ['local.get', `$${t}`], ['i32.mul', ['local.get', `$${i}`], ['i32.const', stride]]],
-          ['f64.load', ['i32.add', ['local.get', `$${off}`], ['i32.shl', ['local.get', `$${i}`], ['i32.const', 3]]]]]
-        : elemType === 6 ? ['f32.store',
-          ['i32.add', ['local.get', `$${t}`], ['i32.mul', ['local.get', `$${i}`], ['i32.const', stride]]],
-          ['f32.demote_f64', ['f64.load', ['i32.add', ['local.get', `$${off}`], ['i32.shl', ['local.get', `$${i}`], ['i32.const', 3]]]]]]
-        : [store,
-          ['i32.add', ['local.get', `$${t}`], ['i32.mul', ['local.get', `$${i}`], ['i32.const', stride]]],
-          [(elemType & 1) ? 'i32.trunc_f64_u' : 'i32.trunc_f64_s',
-            ['f64.load', ['i32.add', ['local.get', `$${off}`], ['i32.shl', ['local.get', `$${i}`], ['i32.const', 3]]]]]]
+      const conv = FROM_F64[elemType]
+      const srcF64 = ['f64.load', ['i32.add', ['local.get', `$${off}`], ['i32.shl', ['local.get', `$${i}`], ['i32.const', 3]]]]
+      const storeExpr = [store,
+        ['i32.add', ['local.get', `$${t}`], ['i32.mul', ['local.get', `$${i}`], ['i32.const', stride]]],
+        conv ? [conv, srcF64] : srcF64]
       return typed(['block', ['result', 'f64'],
         ['local.set', `$${srcL}`, asF64(emit(src))],
         ['local.set', `$${off}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${srcL}`]]]],
@@ -859,7 +957,14 @@ export default (ctx) => {
       receiver = receiver[1][1]
       chainOutput = true
     }
-    const ctor = typeof receiver === 'string' && ctx.types.typedElem?.get(receiver)
+    // Nested receiver `arr[i]` where `arr`'s elements are typed arrays of a known
+    // ctor (`Array.from(n, () => new Float32Array())` — codec channelData). The i-th
+    // element IS that owned typed array; emit(receiver) already loads its pointer, so
+    // the standard typedDataAddr path inlines `arr[i][j]` to a direct load/store.
+    const ctor = (Array.isArray(receiver) && receiver[0] === '[]' && receiver.length === 3 && typeof receiver[1] === 'string'
+        ? ctx.func.localReps?.get(receiver[1])?.arrayElemTypedCtor
+        : null)
+      || (typeof receiver === 'string' && ctx.types.typedElem?.get(receiver))
     if (!ctor) return null
     const isView = viewOutput || (!chainOutput && ctor.endsWith('.view'))
     const name = ctor.endsWith('.view') ? ctor.slice(4, -5) : ctor.slice(4)
@@ -887,65 +992,6 @@ export default (ctx) => {
 
   // Runtime-dispatch typed index: checks ptr_type + aux to load with correct stride.
   // For TYPED views (aux bit 3), $off indirects through descriptor[4] to real data.
-  // Factory — collapses to ARRAY-only f64 indexing when no TYPED pointer can reach here.
-  // Identical factory in array.js; whichever module loads last wins the registration.
-  ctx.core.stdlib['__typed_idx'] = () => {
-    if (!ctx.features.typedarray && !ctx.features.external) {
-      return `(func $__typed_idx (param $ptr i64) (param $i i32) (result f64)
-    (local $len i32)
-    (local.set $len (call $__len (local.get $ptr)))
-    (if (result f64)
-      (i32.or
-        (i32.lt_s (local.get $i) (i32.const 0))
-        (i32.ge_u (local.get $i) (local.get $len)))
-      (then (f64.const nan:${UNDEF_NAN}))
-      (else (f64.load (i32.add (call $__ptr_offset (local.get $ptr)) (i32.shl (local.get $i) (i32.const 3)))))))`
-    }
-    return `(func $__typed_idx (param $ptr i64) (param $i i32) (result f64)
-    (local $off i32) (local $et i32) (local $len i32) (local $aux i32)
-    (local.set $off (call $__ptr_offset (local.get $ptr)))
-    ;; ARRAY fast path: __ptr_offset already followed any forwarding — read header len + f64.load, no $__len call.
-    (if (i32.and (i32.eq (call $__ptr_type (local.get $ptr)) (i32.const ${PTR.ARRAY})) (i32.ge_u (local.get $off) (i32.const 8)))
-      (then (return (if (result f64)
-        (i32.and (i32.ge_s (local.get $i) (i32.const 0)) (i32.lt_u (local.get $i) (i32.load (i32.sub (local.get $off) (i32.const 8)))))
-        (then (f64.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 3)))))
-        (else (f64.const nan:${UNDEF_NAN}))))))
-    (local.set $aux (call $__ptr_aux (local.get $ptr)))
-    (if
-      (i32.and
-        (i32.eq (call $__ptr_type (local.get $ptr)) (i32.const ${PTR.TYPED}))
-        (i32.ne (i32.and (local.get $aux) (i32.const 8)) (i32.const 0)))
-      (then (local.set $off (i32.load (i32.add (local.get $off) (i32.const 4))))))
-    (local.set $len (call $__len (local.get $ptr)))
-    (if (result f64)
-      (i32.or
-        (i32.lt_s (local.get $i) (i32.const 0))
-        (i32.ge_u (local.get $i) (local.get $len)))
-      (then (f64.const nan:${UNDEF_NAN}))
-      (else
-        (if (result f64) (i32.eq (call $__ptr_type (local.get $ptr)) (i32.const ${PTR.TYPED}))
-          (then
-            (local.set $et (i32.and (local.get $aux) (i32.const 7)))
-            (if (result f64) (i32.ge_u (local.get $et) (i32.const 6))
-              (then (if (result f64) (i32.eq (local.get $et) (i32.const 7))
-                (then (if (result f64) (i32.and (local.get $aux) (i32.const ${TYPED_ELEM_BIGINT_FLAG}))
-                  (then (f64.reinterpret_i64 (i64.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 3))))))
-                  (else (f64.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 3)))))))
-                (else (f64.promote_f32 (f32.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 2))))))))
-              (else (if (result f64) (i32.ge_u (local.get $et) (i32.const 4))
-                (then (if (result f64) (i32.and (local.get $et) (i32.const 1))
-                  (then (f64.convert_i32_u (i32.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 2))))))
-                  (else (f64.convert_i32_s (i32.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 2))))))))
-                (else (if (result f64) (i32.ge_u (local.get $et) (i32.const 2))
-                  (then (if (result f64) (i32.and (local.get $et) (i32.const 1))
-                    (then (f64.convert_i32_u (i32.load16_u (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 1))))))
-                    (else (f64.convert_i32_s (i32.load16_s (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 1))))))))
-                  (else (if (result f64) (i32.and (local.get $et) (i32.const 1))
-                    (then (f64.convert_i32_u (i32.load8_u (i32.add (local.get $off) (local.get $i)))))
-                    (else (f64.convert_i32_s (i32.load8_s (i32.add (local.get $off) (local.get $i)))))))))))))
-          (else (f64.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 3)))))))))`
-  }
-
   ctx.core.stdlib['__typed_set_idx'] = `(func $__typed_set_idx (param $ptr i64) (param $i i32) (param $v f64) (result f64)
     (local $off i32) (local $aux i32) (local $et i32) (local $bits i32)
     (local.set $aux (call $__ptr_aux (local.get $ptr)))
@@ -982,12 +1028,8 @@ export default (ctx) => {
   ctx.core.stdlib['__typed_fill'] = `(func $__typed_fill (param $ptr i64) (param $val f64) (param $start i32) (param $end i32) (result f64)
     (local $len i32) (local $i i32)
     (local.set $len (call $__len (local.get $ptr)))
-    (if (i32.lt_s (local.get $start) (i32.const 0)) (then (local.set $start (i32.add (local.get $len) (local.get $start)))))
-    (if (i32.lt_s (local.get $start) (i32.const 0)) (then (local.set $start (i32.const 0))))
-    (if (i32.gt_s (local.get $start) (local.get $len)) (then (local.set $start (local.get $len))))
-    (if (i32.lt_s (local.get $end) (i32.const 0)) (then (local.set $end (i32.add (local.get $len) (local.get $end)))))
-    (if (i32.lt_s (local.get $end) (i32.const 0)) (then (local.set $end (i32.const 0))))
-    (if (i32.gt_s (local.get $end) (local.get $len)) (then (local.set $end (local.get $len))))
+    (local.set $start (call $__clamp_idx (local.get $start) (local.get $len)))
+    (local.set $end (call $__clamp_idx (local.get $end) (local.get $len)))
     (local.set $i (local.get $start))
     (block $done (loop $fill
       (br_if $done (i32.ge_s (local.get $i) (local.get $end)))
@@ -1047,15 +1089,9 @@ export default (ctx) => {
   ctx.core.stdlib['__typed_copyWithin'] = `(func $__typed_copyWithin (param $ptr i64) (param $target i32) (param $start i32) (param $end i32) (result f64)
     (local $len i32) (local $count i32) (local $k i32)
     (local.set $len (call $__len (local.get $ptr)))
-    (if (i32.lt_s (local.get $target) (i32.const 0)) (then (local.set $target (i32.add (local.get $len) (local.get $target)))))
-    (if (i32.lt_s (local.get $target) (i32.const 0)) (then (local.set $target (i32.const 0))))
-    (if (i32.gt_s (local.get $target) (local.get $len)) (then (local.set $target (local.get $len))))
-    (if (i32.lt_s (local.get $start) (i32.const 0)) (then (local.set $start (i32.add (local.get $len) (local.get $start)))))
-    (if (i32.lt_s (local.get $start) (i32.const 0)) (then (local.set $start (i32.const 0))))
-    (if (i32.gt_s (local.get $start) (local.get $len)) (then (local.set $start (local.get $len))))
-    (if (i32.lt_s (local.get $end) (i32.const 0)) (then (local.set $end (i32.add (local.get $len) (local.get $end)))))
-    (if (i32.lt_s (local.get $end) (i32.const 0)) (then (local.set $end (i32.const 0))))
-    (if (i32.gt_s (local.get $end) (local.get $len)) (then (local.set $end (local.get $len))))
+    (local.set $target (call $__clamp_idx (local.get $target) (local.get $len)))
+    (local.set $start (call $__clamp_idx (local.get $start) (local.get $len)))
+    (local.set $end (call $__clamp_idx (local.get $end) (local.get $len)))
     (local.set $count (i32.sub (local.get $end) (local.get $start)))
     (if (i32.gt_s (local.get $count) (i32.sub (local.get $len) (local.get $target)))
       (then (local.set $count (i32.sub (local.get $len) (local.get $target)))))
@@ -1238,20 +1274,28 @@ export default (ctx) => {
         ['f32.store', off, ['f32.demote_f64', ['local.get', `$${vt}`]]],
         ['local.get', `$${vt}`]], void_ ? 'void' : 'f64') // Float32Array
     }
-    // Integer store: when the source is already i32-typed (bitwise ops, |0,
-    // typed-array load, known-i32 var), store it directly — skip the f64
-    // detour that costs a sign branch + i64 trunc + i32 wrap on every write.
-    if (valIR.type === 'i32') {
-      const cheap = Array.isArray(valIR) &&
-        ((valIR[0] === 'local.get' && typeof valIR[1] === 'string') ||
-         (valIR[0] === 'i32.const' && (typeof valIR[1] === 'number' || typeof valIR[1] === 'string')))
-      if (void_ && cheap) return typed([STORE[et], off, valIR], 'void')
+    // Integer store: when the source is already i32-typed (bitwise ops, |0, known-i32 var) —
+    // OR an `f64.convert_i32_*` that peels back to i32 (an Int8/Uint8/Int16/… element READ
+    // materialized as f64 by the universal value model) — store the i32 low bits directly,
+    // skipping the f64 detour that costs a sign branch + i64 trunc + i32 wrap on every write.
+    // This eradicates the f64 round-trip on byte/typed-array TRANSFORMS — `out[i] = table[in[j]]`
+    // and `dst[i] = src[j]` (base64, qoi, wav, blur) — where both sides are integer elements.
+    // `store8/16` mask the low bits, so storing the convert's i32 source is bit-identical; the
+    // non-void result reboxes that i32 to f64 (the assignment's RHS value, in element range here).
+    const i32Backed = valIR.type === 'i32' ||
+      (Array.isArray(valIR) && (valIR[0] === 'f64.convert_i32_s' || valIR[0] === 'f64.convert_i32_u'))
+    if (i32Backed) {
+      const vi = asI32(valIR)
+      const cheap = Array.isArray(vi) &&
+        ((vi[0] === 'local.get' && typeof vi[1] === 'string') ||
+         (vi[0] === 'i32.const' && (typeof vi[1] === 'number' || typeof vi[1] === 'string')))
+      if (void_ && cheap) return typed([STORE[et], off, vi], 'void')
       const v32 = tempI32('tw')
       return typed(void_ ? ['block',
-        ['local.set', `$${v32}`, valIR],
+        ['local.set', `$${v32}`, vi],
         [STORE[et], off, ['local.get', `$${v32}`]]]
         : ['block', ['result', 'f64'],
-        ['local.set', `$${v32}`, valIR],
+        ['local.set', `$${v32}`, vi],
         [STORE[et], off, ['local.get', `$${v32}`]],
         [(et & 1) ? 'f64.convert_i32_u' : 'f64.convert_i32_s', ['local.get', `$${v32}`]]], void_ ? 'void' : 'f64')
     }
@@ -1714,7 +1758,17 @@ export default (ctx) => {
   // Bulk copy via `memory.copy`.
   ctx.core.emit['.typed:slice'] = (arr, start, end) => {
     const r = resolveElem(arr)
-    if (!r || r.isBigInt) return null
+    if (!r) {
+      // Elem type / view-ness not statically known (owned→view reassigned binding).
+      // Dispatch off the runtime aux byte instead of crashing on empty IR.
+      inc('__typed_slice_rt')
+      return typed(['call', '$__typed_slice_rt',
+        ['i64.reinterpret_f64', asF64(emit(arr))],
+        start == null ? ['i32.const', 0] : asI32(emit(start)),
+        end == null ? ['i32.const', 0] : asI32(emit(end)),
+        ['i32.const', end == null ? 0 : 1]], 'f64')
+    }
+    if (r.isBigInt) return null
     const { et, isView } = r
     const arrLoc = temp('tsa'), srcPtr = tempI32('tssp'), srcLen = tempI32('tssl')
     const lo = tempI32('tslo'), hi = tempI32('tshi'), n = tempI32('tsn')
@@ -1809,8 +1863,18 @@ export default (ctx) => {
   // NOT a copy). Builds the 16-byte descriptor [byteLen][dataOff][parentOff] and tags the
   // TYPED ptr with aux|view, exactly like new TypedArray(buffer, byteOffset, length).
   ctx.core.emit['.typed:subarray'] = (arr, begin, end) => {
+    ctx.features.typedView = true  // zero-copy view aliases the receiver — covers inline `a.subarray(1)[i]=…` the bound-decl path in analyze.js misses
     const r = resolveElem(arr)
-    if (!r) return null
+    if (!r) {
+      // Elem type / view-ness not statically known (owned→view reassigned binding).
+      // Dispatch off the runtime aux byte instead of crashing on empty IR.
+      inc('__subarray')
+      return typed(['call', '$__subarray',
+        ['i64.reinterpret_f64', asF64(emit(arr))],
+        begin == null ? ['i32.const', 0] : asI32(emit(begin)),
+        end == null ? ['i32.const', 0] : asI32(emit(end)),
+        ['i32.const', end == null ? 0 : 1]], 'f64')
+    }
     const { et, isView, isBigInt } = r
     const shift = SHIFT[et]
     const viewAux = et | 8 | (isBigInt ? 16 : 0)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jz",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Ahead-of-time compiler for the numeric core of JavaScript (DSP, audio, math, parsers) to lean GC-free WASM — valid jz is valid JS, no type annotations, no runtime.",
   "main": "index.js",
   "types": "index.d.ts",
@@ -55,10 +55,14 @@
     "bench:size": "node scripts/bench-size.mjs",
     "bench:compile": "node scripts/bench-compile.mjs",
     "bench:startup": "node scripts/bench-startup.mjs",
+    "bench:self": "node scripts/bench-selfhost.mjs",
     "bench:readme": "node scripts/bench-readme.mjs",
+    "audit:as": "node scripts/audit-assemblyscript.mjs",
     "build": "node scripts/build-dist.mjs",
     "build:examples": "node examples/build.mjs all",
-    "prepare": "npm run build"
+    "prepublishOnly": "npm test && npm run build && npm run test:self",
+    "prepare": "npm run build",
+    "audit:fixpoint": "node scripts/audit-fixpoint.mjs"
   },
   "repository": {
     "type": "git",
@@ -72,7 +76,7 @@
   "license": "MIT",
   "dependencies": {
     "subscript": "^10.4.17",
-    "watr": "^4.6.10"
+    "watr": "^4.7.1"
   },
   "keywords": [
     "javascript",

package/src/abi/string.js

@@ -56,7 +56,7 @@
 // take. Kept as a one-liner so each op reads as a single `call`.
 const ssoI64 = (sF64) => ['i64.reinterpret_f64', sF64]
 
-import { isReassigned } from '../ast.js'
+import { isReassigned, isLeaf } from '../ast.js'
 import { LAYOUT, oobNanIR, ssoBitI64Hex } from '../../layout.js'
 
 /** Pre-shifted SSO discriminator — layout.js is cycle-free; memoized at first use. */
@@ -79,10 +79,6 @@ const allocLocalI32 = (ctx, tag) => {
   return name
 }
 
-const _isLeaf = (n) => Array.isArray(n) &&
-  (n[0] === 'local.get' || n[0] === 'global.get' ||
-   n[0] === 'i32.const' || n[0] === 'i64.const' ||
-   n[0] === 'f64.const' || n[0] === 'f32.const')
 
 /** Per-use cheap form of `charCodeAt` against a pre-decomposed param receiver
  *  (shape 1): a bounds check plus a 2-arm SSO/heap byte select reading the four
@@ -90,22 +86,29 @@ const _isLeaf = (n) => Array.isArray(n) &&
  *  side-effecting `iI32` is spilled to a scratch local first — leaves are safe
  *  to duplicate. `oobNan` picks the OOB contract / result type exactly as in
  *  the generic path. */
-function emitDecompCharRead(dec, iI32, ctx, oobNan) {
+function emitDecompCharRead(dec, iI32, ctx, oobNan, inBounds = false) {
   const rt = oobNan ? 'f64' : 'i32'
   let idx = iI32, spill = null
-  if (!_isLeaf(iI32)) { spill = allocLocalI32(ctx, 'ci'); idx = ['local.get', `$${spill}`] }
-  const ssoByteExpr = ['i32.and',
-    ['i32.shr_u', ['local.get', `$${dec.base}`], ['i32.shl', idx, ['i32.const', 3]]],
-    ['i32.const', 0xFF]]
+  if (!isLeaf(iI32)) { spill = allocLocalI32(ctx, 'ci'); idx = ['local.get', `$${spill}`] }
+  const ssoByteExpr = ['i32.wrap_i64', ['i64.and',
+    ['i64.shr_u', ['local.get', `$${dec.ptr64}`], ['i64.mul', ['i64.extend_i32_u', idx], ['i64.const', 7]]],
+    ['i64.const', '0x7f']]]
   const heapByteExpr = ['i32.load8_u', ['i32.add', ['local.get', `$${dec.loadbase}`], idx]]
   const ccByte = ['if', ['result', 'i32'],
     ['local.get', `$${dec.sso}`],
     ['then', ssoByteExpr],
     ['else', heapByteExpr]]
-  const use = ['if', ['result', rt],
-    ['i32.ge_u', idx, ['local.get', `$${dec.len}`]],
-    ['then', oobNan ? oobNanIR() : ['i32.const', 0]],
-    ['else', oobNan ? ['f64.convert_i32_u', ccByte] : ccByte]]
+  // `inBounds`: the index is proven in [0, len) by an enclosing canonical scan
+  // (analyze.js inBoundsCharCodeAt / splitCharScanLoops' in-bounds main loop), so
+  // the OOB arm is dead — drop the per-char `i >= len` compare. This is what turns
+  // a split char-scan loop into a bare load (the `if(sso)` arm is loop-invariant and
+  // V8-folds), matching AS/native on tokenizer-shape scans. Otherwise keep the guard.
+  const use = inBounds
+    ? (oobNan ? ['f64.convert_i32_u', ccByte] : ccByte)
+    : ['if', ['result', rt],
+        ['i32.ge_u', idx, ['local.get', `$${dec.len}`]],
+        ['then', oobNan ? oobNanIR() : ['i32.const', 0]],
+        ['else', oobNan ? ['f64.convert_i32_u', ccByte] : ccByte]]
   return spill
     ? ['block', ['result', rt], ['local.set', `$${spill}`, iI32], use]
     : use
@@ -131,9 +134,8 @@ export function emitCharDecompPrologue(dec) {
     ['i64.const', 0]]
   const offMask = `0x${LAYOUT.OFFSET_MASK.toString(16).toUpperCase()}`
   const off = ['i32.wrap_i64', ['i64.and', ptr, ['i64.const', offMask]]]
-  const ssoLen = ['i32.and',
-    ['i32.wrap_i64', ['i64.shr_u', ptr, ['i64.const', LAYOUT.AUX_SHIFT]]],
-    ['i32.const', LAYOUT.SSO_BIT - 1]]
+  // SSO length lives at payload bits 42-44 (7-bit-codec layout; see module/string.js).
+  const ssoLen = ['i32.wrap_i64', ['i64.and', ['i64.shr_u', ptr, ['i64.const', 42]], ['i64.const', 7]]]
   // Heap length is `i32.load(off - 4)`; guard against off<4 (corrupt/non-string
   // payload) so the load doesn't trap on a wrapped-negative address.
   const heapLen = ['if', ['result', 'i32'],
@@ -146,6 +148,7 @@ export function emitCharDecompPrologue(dec) {
       ['then',
         ['local.set', `$${dec.sso}`, ['i32.const', 1]],
         ['local.set', `$${dec.base}`, off],
+        ['local.set', `$${dec.ptr64}`, ptr],   // full payload: SSO chars are 7-bit, span into aux
         ['local.set', `$${dec.len}`, ssoLen],
         // SSO: route every per-iter load to address 0 (always valid, byte
         // discarded by the outer select).
@@ -212,7 +215,7 @@ export const sso = {
      *  `src/compile.js#emitFunc` — it drains `ctx.func.charDecomp` after the
      *  body emit completes and splices an init block between the boxed-param
      *  inits and the user statements. */
-    charCodeAt: (sF64, iI32, ctx, oobNan = false) => {
+    charCodeAt: (sF64, iI32, ctx, oobNan = false, inBounds = false) => {
       // `oobNan` selects the out-of-bounds semantics and result type:
       //   - false (default): OOB → `i32.const 0`, result i32 — the raw-byte
       //     primitive used by the `buf += s[i]` append-byte fast path.
@@ -256,14 +259,16 @@ export const sso = {
             // discards it). Pre-computing it in the prologue removes a
             // per-iter `select` and lets V8 fold the add into the load.
             const loadbase = `${name}$ccldb`
+            const ptr64 = `${name}$ccp64`
             ctx.func.locals.set(base, 'i32')
             ctx.func.locals.set(len, 'i32')
             ctx.func.locals.set(sso, 'i32')
             ctx.func.locals.set(loadbase, 'i32')
-            dec = { base, len, sso, loadbase, param: name }
+            ctx.func.locals.set(ptr64, 'i64')   // full SSO payload for 7-bit char extraction
+            dec = { base, len, sso, loadbase, ptr64, param: name }
             ctx.func.charDecomp.set(name, dec)
           }
-          return emitDecompCharRead(dec, iI32, ctx, oobNan)
+          return emitDecompCharRead(dec, iI32, ctx, oobNan, inBounds)
         }
       }
 
@@ -277,9 +282,6 @@ export const sso = {
       // so we MUST spill anything that isn't side-effect-free to a local
       // before referencing it more than once. Leaves (`local.get`, `*.const`,
       // `global.get`) are safe to duplicate; everything else is spilled.
-      const isLeaf = (n) => Array.isArray(n) &&
-        (n[0] === 'local.get' || n[0] === 'global.get' ||
-         n[0] === 'i32.const' || n[0] === 'i64.const' || n[0] === 'f64.const' || n[0] === 'f32.const')
       const sLeaf = isLeaf(sF64)
       const iLeaf = isLeaf(iI32)
       const ptrI64Expr = ssoI64(sF64)
@@ -301,12 +303,10 @@ export const sso = {
       }
       const offMask = `0x${LAYOUT.OFFSET_MASK.toString(16).toUpperCase()}`
       const offExpr = () => ['i32.wrap_i64', ['i64.and', getPtr(), ['i64.const', offMask]]]
-      const ssoLen = ['i32.and',
-        ['i32.wrap_i64', ['i64.shr_u', getPtr(), ['i64.const', LAYOUT.AUX_SHIFT]]],
-        ['i32.const', LAYOUT.SSO_BIT - 1]]
-      const ssoByte = ['i32.and',
-        ['i32.shr_u', offExpr(), ['i32.mul', getIdx(), ['i32.const', 8]]],
-        ['i32.const', 0xFF]]
+      const ssoLen = ['i32.wrap_i64', ['i64.and', ['i64.shr_u', getPtr(), ['i64.const', 42]], ['i64.const', 7]]]
+      const ssoByte = ['i32.wrap_i64', ['i64.and',
+        ['i64.shr_u', getPtr(), ['i64.mul', ['i64.extend_i32_u', getIdx()], ['i64.const', 7]]],
+        ['i64.const', '0x7f']]]
       const ssoBranch = ['if', ['result', rt],
         ['i32.ge_u', getIdx(), ssoLen],
         ['then', mkOob()],

package/src/ast.js

@@ -66,6 +66,11 @@ export const isBlockBody = (body) =>
 export const isLiteralStr = idx => Array.isArray(idx) && idx[0] === 'str' && typeof idx[1] === 'string'
 export const isFuncRef = (node, funcNames) => typeof node === 'string' && funcNames.has(node)
 
+/** A value-leaf IR instruction — `local.get`/`global.get`/any `*.const`. Cheap and
+ *  side-effect-free, so safe to duplicate without spilling to a temp. The one
+ *  source of truth for "is this trivially duplicatable" across ir/abi/optimize. */
+export const isLeaf = n => Array.isArray(n) && (n[0] === 'local.get' || n[0] === 'global.get' || n[0].endsWith('.const'))
+
 // === Assignment / reassignment ===
 
 /** Assignment operators — shared across analyze, plan, emit, abi. */
@@ -385,9 +390,21 @@ export function cloneNode(node) {
 /** Structural equality via JSON. AST nodes are JSON-serializable except i64.const
  *  BigInt payloads (NaN-box prefixes — dcbb433 routes pointer offsets through boxed
  *  forms); the replacer stringifies those as `<n>n` (cf. formatErrorNode in ctx.js). */
-export const bigintSafeKey = (_k, v) => typeof v === 'bigint' ? `${v}n` : v
+// Replacer for structural node-equality / dedup keys. JSON.stringify is the fast
+// path, but it silently collapses values it can't round-trip: bigint throws, and —
+// the subtle one — Infinity / -Infinity / NaN ALL stringify to `null` while -0
+// stringifies to `0`. Two nodes differing ONLY in such a constant then serialize
+// identically and compare equal — an unsound merge (SLP packs `[Inf,-Inf]` as one
+// splat lane; CSE/LICM dedups distinct invariants). Tag each so it round-trips with
+// Object.is semantics.
+export const stableKey = (_k, v) => {
+  if (typeof v === 'bigint') return `${v}n`
+  if (typeof v === 'number' && (v !== v || v === Infinity || v === -Infinity || Object.is(v, -0)))
+    return v !== v ? '#NaN' : v === Infinity ? '#Inf' : v === -Infinity ? '#-Inf' : '#-0'
+  return v
+}
 export function nodeEqual(a, b) {
-  return JSON.stringify(a, bigintSafeKey) === JSON.stringify(b, bigintSafeKey)
+  return JSON.stringify(a, stableKey) === JSON.stringify(b, stableKey)
 }
 
 /** Property entries of an object-literal AST node (`['{}', …]`). */