jz 0.7.0 → 0.8.0

package/src/compile/analyze.js

@@ -118,6 +118,11 @@ const makeTypedTracker = (get, set, del) => {
     if (poison.has(name)) return
     const setOrInvalidate = (c) => {
       if (c === MIXED_CTORS) return invalidate(name)
+      // Module-level alias fact: a `.view` ctor (subarray / buffer-backed) is the ONLY
+      // way two typed-array bindings can overlap. Recording that the program creates
+      // ANY view lets memory-reordering passes (SLP) stay sound by bailing when set —
+      // with no view, distinct typed bases own disjoint allocations.
+      if (typeof c === 'string' && c.endsWith('.view')) ctx.features.typedView = true
       const prev = get(name)
       if (prev && prev !== c) invalidate(name)
       else set(name, c)
@@ -168,7 +173,7 @@ export function analyzeBody(body) {
   // for any slice and can't be WeakMap-keyed. Return empty maps without caching.
   if (body === null || typeof body !== 'object') return {
     locals: new Map(), valTypes: new Map(), arrElemSchemas: new Map(),
-    arrElemValTypes: new Map(), typedElems: new Map(), escapes: new Map(),
+    arrElemValTypes: new Map(), arrElemTypedCtors: new Map(), typedElems: new Map(), escapes: new Map(),
     flatObjects: new Map(),
   }
   const hit = _bodyFactsCache.get(body)
@@ -184,6 +189,10 @@ export function analyzeBody(body) {
   // so `chord[j]` is a Number and skips __to_num. Single-level only — enough for the
   // 2-D table pattern without a general nested-type lattice.
   const arrElemElemValTypes = new Map()
+  // `name`'s elements are all typed arrays of one ctor ('new.Float32Array'), e.g.
+  // `Array.from(nCh, () => new Float32Array(n))` (codec channelData). Lets `arr[i]`
+  // resolve as that typed array so `arr[i][j]` / `let o = arr[i]; o[j]` inline.
+  const arrElemTypedCtors = new Map()
   const typedElems = new Map()
   const escapes = new Map() // name → bool: local holds allocation, true if it escapes
 
@@ -224,6 +233,22 @@ export function analyzeBody(body) {
     return arrElemValTypes.get(name) || null
   }
 
+  // Disagreement → null poison, like observeArrValType. Records the common
+  // TypedArray ctor of an array's elements.
+  const observeArrTypedCtor = (arr, ctor) => {
+    if (typeof arr !== 'string') return
+    if (arrElemTypedCtors.get(arr) === null) return
+    if (!ctor) { arrElemTypedCtors.set(arr, null); return }
+    if (!arrElemTypedCtors.has(arr)) arrElemTypedCtors.set(arr, ctor)
+    else if (arrElemTypedCtors.get(arr) !== ctor) arrElemTypedCtors.set(arr, null)
+  }
+  // The ctor a `new XxxArray(...)` element expr produces ('new.Float32Array'), if any.
+  const elemTypedCtorOf = (expr) => {
+    const c = typedElemCtor(expr)
+    // typed-array views/buffers only — exclude ArrayBuffer/DataView (no element index).
+    return c && !c.includes('ArrayBuffer') && !c.includes('DataView') ? c : null
+  }
+
   const exprElemSourceVal = (expr) => {
     if (typeof expr === 'string') {
       const repVt = ctx.func.localReps?.get(expr)?.val
@@ -315,6 +340,14 @@ export function analyzeBody(body) {
             if (exprElemSourceVal(elems[k]) !== common) common = null
           }
           if (common != null) observeArrValType(name, common)
+          // Array-of-typed-arrays literal (`[new Float32Array(n), …]`): record the
+          // common element ctor so `name[i]` is a known typed array.
+          if (common === VAL.TYPED) {
+            let ctor = elemTypedCtorOf(elems[0])
+            for (let k = 1; k < elems.length && ctor != null; k++)
+              if (elemTypedCtorOf(elems[k]) !== ctor) ctor = null
+            observeArrTypedCtor(name, ctor)
+          }
           // Array-of-arrays literal: record the common element-of-element kind so a
           // later `x = name[i]` binds `x`'s element type one level down.
           if (common === VAL.ARRAY) {
@@ -341,6 +374,18 @@ export function analyzeBody(body) {
       const f = ctx.func.map?.get(rhs[1])
       if (f?.arrayElemValType) observeArrValType(name, f.arrayElemValType)
     }
+    // `Array.from(arg, () => new XxxArray(...))` — codec channelData and per-row
+    // typed-array tables. The map-callback's returned ctor is every element's type.
+    // Post-prepare AST: `['()', 'Array.from', [',', arg, callback]]` (args in a comma node).
+    if (Array.isArray(rhs) && rhs[0] === '()' && rhs[1] === 'Array.from' && Array.isArray(rhs[2])) {
+      const args = rhs[2][0] === ',' ? rhs[2].slice(1) : [rhs[2]]
+      const fn = args[1]
+      const body = Array.isArray(fn) && fn[0] === '=>' ? fn[2] : null
+      const ret = Array.isArray(body) && body[0] === '{}' && Array.isArray(body[1]) && body[1][0] === 'return'
+        ? body[1][1] : body
+      const ctor = ret && elemTypedCtorOf(ret)
+      if (ctor) { observeArrValType(name, VAL.TYPED); observeArrTypedCtor(name, ctor) }
+    }
     if (typeof rhs === 'string') {
       const v = elemValOf(rhs)
       if (v) observeArrValType(name, v)
@@ -469,9 +514,20 @@ export function analyzeBody(body) {
         }
         observeArrSchema(arr, exprSchemaId(a, localSchemaMap))
         observeArrValType(arr, exprElemSourceVal(a))
+        // `ch.push(new Float32Array(m))` — track the element ctor so `ch[c][i]`
+        // inlines, same as the Array.from / array-literal forms.
+        if (exprElemSourceVal(a) === VAL.TYPED) observeArrTypedCtor(arr, elemTypedCtorOf(a))
       }
     }
 
+    // `ch[c] = new Float32Array(m)` — index-fill construction of a typed-array-of-
+    // arrays (`let ch = new Array(n); for(c) ch[c] = new T(m)`). Mirror push.
+    if (op === '=' && Array.isArray(node[1]) && node[1][0] === '[]' && node[1].length === 3
+        && typeof node[1][1] === 'string' && valTypeOf(node[2]) === VAL.TYPED) {
+      observeArrValType(node[1][1], VAL.TYPED)
+      observeArrTypedCtor(node[1][1], elemTypedCtorOf(node[2]))
+    }
+
     // `=` reassignment — locals widen, valTypes/typedElems track,
     // arrElemSchemas/ValTypes invalidate when rhs isn't array-producing.
     if (op === '=' && typeof node[1] === 'string') {
@@ -485,6 +541,7 @@ export function analyzeBody(body) {
       trackTyped(name, rhs)
       if (arrElemSchemas.has(name) && !isArrayProducingRhs(rhs)) observeArrSchema(name, null)
       if (arrElemValTypes.has(name) && !isArrayProducingRhs(rhs)) observeArrValType(name, null)
+      if (arrElemTypedCtors.has(name) && !isArrayProducingRhs(rhs)) observeArrTypedCtor(name, null)
       return
     }
 
@@ -573,7 +630,7 @@ export function analyzeBody(body) {
   // Never-relocated array bindings — reads may skip the realloc-forwarding follow.
   const neverGrown = doSchemas ? scanNeverGrown(body) : new Set()
 
-  const result = { locals, valTypes, arrElemSchemas, arrElemValTypes, typedElems, escapes, flatObjects, sliceViews, unsignedLocals, neverGrown, numericFill }
+  const result = { locals, valTypes, arrElemSchemas, arrElemValTypes, arrElemTypedCtors, typedElems, escapes, flatObjects, sliceViews, unsignedLocals, neverGrown, numericFill }
   _bodyFactsCache.set(body, result)
   return result
 }
@@ -705,6 +762,11 @@ export function analyzeValTypes(body) {
   for (const [name, vt] of facts.arrElemValTypes) {
     if (vt != null) updateRep(name, { arrayElemValType: vt })
   }
+  // Array-of-typed-arrays element ctor → rep, so `arr[i]` resolves as a typed array
+  // and `arr[i][j]` / `let o = arr[i]; o[j]` inline (codec channelData scatter).
+  for (const [name, ctor] of facts.arrElemTypedCtors) {
+    if (ctor != null) updateRep(name, { arrayElemTypedCtor: ctor })
+  }
   // Construct-then-fill numeric arrays (`let a = Array(n); a[i] = expr`) carry no
   // element evidence at their decl, so the walk above leaves them untyped. scanNumericFill
   // proved every write Numeric and every other use a pure read — record NUMBER so `arr[i]`

package/src/compile/cse-load.js

@@ -0,0 +1,200 @@
+/**
+ * Sound CSE of repeated pure typed-array element loads within a straight-line region.
+ *
+ * `re[b] = re[a] - tr;  …;  re[a] = re[a] + tr`  — the fft butterfly loads `re[a]` twice.
+ * Cache the first load in a temp and reuse it (eliminating the redundant load) when every
+ * intervening store writes a provably-DIFFERENT element, so it cannot clobber the cached value.
+ *
+ * Soundness (no array-distinctness / non-aliasing assumption):
+ *   A cached `arr[idx]` survives a store `any[idx2]` iff `idx2 ≠ idx` is PROVABLE. If the indices
+ *   differ, the store hits a different element even if `any` aliases `arr`. If `idx2` might equal
+ *   `idx` (incl. a different array at the same index — could alias), invalidate. Array-name-
+ *   agnostic; never assumes non-aliasing. Reassigning `arr` / any var in `idx`, an impure call, or
+ *   a control-flow edge also flushes. So `re[a]` (intervening stores all at index `b = a+half ≠ a`)
+ *   is CSE'd, while `im[a]` (the `re[a]` store is at the same index `a`) correctly is NOT.
+ *
+ *   provablyDiffer: distinct int constants, or `idx2 = idx ± P` with P provably > 0 — the canonical
+ *   P is a loop bound: inside `for (j = C≥0; j < B; …)` the body runs only when `0 ≤ j < B`, so
+ *   `B ≥ 1`, hence `a + B ≠ a`. A name index resolves through its single `let X = a + b` def.
+ *
+ * Runs post-analyze (purity known) and pre-emit, mutating the body. Purely conservative.
+ */
+
+import { ASSIGN_OPS } from '../ast.js'
+
+const isArr = (x) => Array.isArray(x)   // arrow, not a bare builtin alias — jz can't self-host a builtin as a first-class value
+const isName = (x) => typeof x === 'string'
+
+const stableIdx = (e) => {
+  if (isName(e) || typeof e === 'number') return true
+  if (!isArr(e)) return false
+  const op = e[0]
+  if (op == null) return typeof e[1] === 'number'
+  if ((op === '+' || op === '-' || op === '*') && e.length === 3) return stableIdx(e[1]) && stableIdx(e[2])
+  return false
+}
+
+const idxKey = (e) => {
+  if (isName(e)) return e
+  if (typeof e === 'number') return `#${e}`
+  if (isArr(e) && e[0] == null) return `#${e[1]}`
+  if (isArr(e)) return `(${e[0]} ${idxKey(e[1])} ${e[2] !== undefined ? idxKey(e[2]) : ''})`
+  return '?'
+}
+
+const idxVars = (e, out) => {
+  if (isName(e)) out.add(e)
+  else if (isArr(e)) for (let i = 1; i < e.length; i++) idxVars(e[i], out)
+}
+
+const CONTROL = new Set(['for', 'while', 'do', 'if', 'loop', 'block', 'switch', 'try', '=>',
+  'br', 'br_if', 'br_table', 'return', 'continue', 'break', 'throw', 'unreachable'])
+const ASSIGN = new Set([...ASSIGN_OPS, '++', '--'])
+
+function buildFacts(body) {
+  const def = new Map(), declCount = new Map(), positive = new Set()
+  const scan = (n) => {
+    if (!isArr(n)) return
+    const op = n[0]
+    if (op === 'let' || op === 'const') {
+      for (let i = 1; i < n.length; i++) {
+        const d = n[i]
+        if (isName(d)) declCount.set(d, (declCount.get(d) || 0) + 1)
+        else if (isArr(d) && d[0] === '=' && isName(d[1])) {
+          declCount.set(d[1], (declCount.get(d[1]) || 0) + 1)
+          def.set(d[1], d[2])
+        }
+      }
+    }
+    if (op === 'for') {
+      // parse shape ['for', [';', init, cond, step], body]; post-prepare ['for', init, cond, step, body].
+      const hdr2 = isArr(n[1]) && n[1][0] === ';'
+      const init = hdr2 ? n[1][1] : n[1]
+      const cond = hdr2 ? n[1][2] : n[2]
+      const lo = isArr(init) && (init[0] === 'let' || init[0] === 'const') && isArr(init[1]) && init[1][0] === '=' ? init[1][2]
+        : (isArr(init) && init[0] === '=' ? init[2] : null)
+      const loZero = (typeof lo === 'number' && lo >= 0) || (isArr(lo) && lo[0] == null && lo[1] >= 0)
+      // `for (j = 0; j < BOUND; …)` ⇒ inside the body BOUND ≥ 1 (j ≥ 0 ∧ j < BOUND). Mark BOUND positive.
+      if (loZero && isArr(cond) && (cond[0] === '<' || cond[0] === '<=') && isName(cond[2])) positive.add(cond[2])
+    }
+    for (let i = 1; i < n.length; i++) scan(n[i])
+  }
+  scan(body)
+  for (const [n, c] of declCount) if (c > 1) def.delete(n)   // reassigned ⇒ not a stable def
+  return { def, positive }
+}
+
+const cval = (e) => typeof e === 'number' ? e : (isArr(e) && e[0] == null ? e[1] : null)
+
+const isPositive = (e, F) => {
+  const c = cval(e); if (c != null) return c > 0
+  if (isName(e)) return F.positive.has(e)
+  if (isArr(e) && (e[0] === '+' || e[0] === '*') && e.length === 3) return isPositive(e[1], F) && isPositive(e[2], F)
+  return false
+}
+
+const asBasePlus = (e, F) => {
+  if (isName(e) && F.def.has(e)) e = F.def.get(e)
+  if (isArr(e) && e[0] === '+' && e.length === 3) return { base: e[1], off: e[2] }
+  return null
+}
+
+function provablyDiffer(idx, idx2, F) {
+  const ka = idxKey(idx), kb = idxKey(idx2)
+  if (ka === kb) return false
+  const va = cval(idx), vb = cval(idx2)
+  if (va != null && vb != null) return va !== vb
+  const bp2 = asBasePlus(idx2, F); if (bp2 && idxKey(bp2.base) === ka && isPositive(bp2.off, F)) return true
+  const bp1 = asBasePlus(idx, F);  if (bp1 && idxKey(bp1.base) === kb && isPositive(bp1.off, F)) return true
+  return false
+}
+
+/**
+ * @param body        function-body AST (mutated in place)
+ * @param isTypedArray (name) => boolean — receiver is a pure typed-array load
+ * @param freshName   () => string — unique temp local name
+ * @returns number of loads eliminated
+ */
+export function cseLoads(body, isTypedArray, freshName) {
+  if (!isArr(body)) return 0
+  const F = buildFacts(body)
+  let eliminated = 0
+
+  // Process the statement list of a `[';', …]` node (children [1..]).
+  const runSeq = (seq) => {
+    // key → { arr, idxNode, idxVars, temp, firstParent, firstIdx, firstStmt }
+    const avail = new Map()
+    const inserts = []   // { at: stmtIdx, binding }
+
+    const flush = () => avail.clear()
+    const invalidateVar = (name) => { for (const [k, e] of avail) if (e.arr === name || e.idxVars.has(name)) avail.delete(k) }
+
+    const reads = (node, parent, pi, si) => {
+      if (!isArr(node) || node[0] === 'str') return
+      // Element/member assignment targets must stay targets. Plain `=` does not
+      // read the slot; compound/update ops do, but rewriting the LHS node itself
+      // turns the eventual store into a temp assignment. Only inspect receiver /
+      // index subexpressions here, then let the RHS participate in load CSE.
+      if (ASSIGN.has(node[0]) && isArr(node[1]) && (node[1][0] === '[]' || node[1][0] === '.' || node[1][0] === '?.')) {
+        const lhs = node[1]
+        reads(lhs[0] === '[]' ? lhs[2] : lhs[1], lhs, lhs[0] === '[]' ? 2 : 1, si)   // index / receiver
+        for (let i = 2; i < node.length; i++) reads(node[i], node, i, si)            // rhs value
+        return
+      }
+      if (node[0] === '[]' && isName(node[1]) && isTypedArray(node[1]) && stableIdx(node[2])) {
+        const arr = node[1], key = `${arr}|${idxKey(node[2])}`
+        const e = avail.get(key)
+        if (e) {
+          if (e.temp === null) {
+            e.temp = freshName()
+            inserts.push({ at: e.firstStmt, binding: ['let', ['=', e.temp, ['[]', arr, e.idxNode]]] })
+            e.firstParent[e.firstIdx] = e.temp           // rewrite the 1st occurrence to read the temp
+          }
+          parent[pi] = e.temp                            // rewrite this (2nd+) occurrence
+          eliminated++
+          return
+        }
+        const vars = new Set(); idxVars(node[2], vars)
+        avail.set(key, { arr, idxNode: node[2], idxVars: vars, temp: null, firstParent: parent, firstIdx: pi, firstStmt: si })
+        return                                            // don't descend into a stable index
+      }
+      if (node[0] === '()' || node[0] === 'call') { flush(); for (let i = 1; i < node.length; i++) reads(node[i], node, i, si); return }
+      for (let i = 1; i < node.length; i++) reads(node[i], node, i, si)
+    }
+
+    const writes = (node) => {
+      if (!isArr(node)) return
+      const op = node[0]
+      if (ASSIGN.has(op)) {
+        const lhs = node[1]
+        if (isName(lhs)) invalidateVar(lhs)
+        else if (isArr(lhs) && lhs[0] === '[]') {
+          const idx2 = lhs[2]
+          for (const [k, e] of [...avail]) if (!provablyDiffer(e.idxNode, idx2, F)) avail.delete(k)
+        }
+        for (let i = 2; i < node.length; i++) writes(node[i])
+        return
+      }
+      for (let i = 1; i < node.length; i++) writes(node[i])
+    }
+
+    for (let si = 1; si < seq.length; si++) {
+      const s = seq[si]
+      if (!isArr(s)) continue
+      if (CONTROL.has(s[0])) { flush(); continue }   // nesting handled by the outer `descend`
+      reads(s, seq, si, si)
+      writes(s)
+    }
+    inserts.sort((a, b) => b.at - a.at)
+    for (const ins of inserts) seq.splice(ins.at, 0, ins.binding)
+  }
+
+  // Walk to every `[';', …]` sequence; run CSE on each, then recurse into its (now-rewritten) stmts.
+  const descend = (node) => {
+    if (!isArr(node)) return
+    if (node[0] === ';') runSeq(node)
+    for (let i = 1; i < node.length; i++) descend(node[i])
+  }
+  descend(body)
+  return eliminated
+}

package/src/compile/emit-assign.js

@@ -99,26 +99,54 @@ function dispatchByKeyKind(arr, keyExpr, valueExpr, numericIR) {
       ['else', numericIR(['local.get', `$${keyTmp}`])]])
 }
 
+/** Raw indexed f64.store at `ptrOffset(o)+idx*8` — the lean fallback for a receiver
+ *  proven to be ARRAY/TYPED at runtime (the ARRAY/TYPED forks are taken first).
+ *  Operands are pre-set locals: `$obj` f64, `$idx` i32, `$val` f64. */
+const rawIndexedStore = (obj, idx, val, arrVT) => ['block', ['result', 'f64'],
+  ['f64.store', ['i32.add', ptrOffsetIR(['local.get', `$${obj}`], arrVT), ['i32.shl', ['local.get', `$${idx}`], ['i32.const', 3]]], ['local.get', `$${val}`]],
+  ['local.get', `$${val}`]]
+
+/** Numeric element store for a receiver that may be OBJECT/HASH at runtime: those
+ *  keep dynamic indexed props in the propsPtr HASH sidecar at off-16 (paired with
+ *  __dyn_get); a raw store at ptrOffset(o)+i*8 lands in the schema-slot region —
+ *  silent corruption at small i, an OOB trap at large i (the self-host `blur`
+ *  crash). The propsPtr hash is STRING-keyed (object keys are strings: `o[3]` ≡
+ *  `o["3"]`), so the index is rendered to its string form — the same string the
+ *  __dyn_get read produces, content-compared by the hash. ARRAY/TYPED fall to the
+ *  raw store. Caller must `inc('__dyn_set','__i32_to_str')`. Gated by `mayBeObject`
+ *  so pure typed-array programs (an f64 param indexed in a hot loop) keep the lean
+ *  raw store and never drag in __dyn_set / __i32_to_str. */
+const objHashOrRawStore = (obj, idx, val, arrVT) => ['if', ['result', 'f64'],
+  ['i32.or', ptrTypeEq(['local.get', `$${obj}`], PTR.OBJECT), ptrTypeEq(['local.get', `$${obj}`], PTR.HASH)],
+  ['then', ['block', ['result', 'f64'],
+    ['drop', ['call', '$__dyn_set',
+      ['i64.reinterpret_f64', ['local.get', `$${obj}`]],
+      ['i64.reinterpret_f64', ['call', '$__i32_to_str', ['local.get', `$${idx}`]]],
+      ['i64.reinterpret_f64', ['local.get', `$${val}`]]]],
+    ['local.get', `$${val}`]]],
+  ['else', rawIndexedStore(obj, idx, val, arrVT)]]
+
 /** Build a `__ptr_type`-fork IR for `arr[idx] = val` when receiver is opaque
  *  (non-string expr, or string-named binding of unknown VAL). Forks on
  *  ARRAY → `__arr_set_idx_ptr` (+ optional persist), TYPED → `__typed_set_idx`,
- *  else → raw f64.store at the OBJECT/HASH payload offset. */
-function emitPolymorphicElementStore(arrExpr, idxI32, valueExpr, arrVT, persist) {
+ *  OBJECT/HASH → `__dyn_set` (only when `mayBeObject`), else → raw f64.store. */
+function emitPolymorphicElementStore(arrExpr, idxI32, valueExpr, arrVT, persist, mayBeObject) {
   const objTmp = temp('asu')
   const idxTmp = tempI32('asi')
   const ptrTmp = temp('asp')
   const valTmp = temp()
   const hasTypedSet = !!ctx.core.stdlib['__typed_set_idx']
   inc('__ptr_type', '__arr_set_idx_ptr')
+  if (mayBeObject) inc('__dyn_set', '__i32_to_str')
   if (hasTypedSet) inc('__typed_set_idx')
   const arrSetCall = ['call', '$__arr_set_idx_ptr', ['i64.reinterpret_f64', ['local.get', `$${objTmp}`]], ['local.get', `$${idxTmp}`], ['local.get', `$${valTmp}`]]
   const arrayBranch = ['block', ['result', 'f64'],
     ['local.set', `$${ptrTmp}`, arrSetCall],
     ...(persist ? [persist(['local.get', `$${ptrTmp}`])] : []),
     ['local.get', `$${valTmp}`]]
-  const fallbackStore = ['block', ['result', 'f64'],
-    ['f64.store', ['i32.add', ptrOffsetIR(['local.get', `$${objTmp}`], arrVT), ['i32.shl', ['local.get', `$${idxTmp}`], ['i32.const', 3]]], ['local.get', `$${valTmp}`]],
-    ['local.get', `$${valTmp}`]]
+  const fallbackStore = mayBeObject
+    ? objHashOrRawStore(objTmp, idxTmp, valTmp, arrVT)
+    : rawIndexedStore(objTmp, idxTmp, valTmp, arrVT)
   const elseBranch = hasTypedSet
     ? ['if', ['result', 'f64'],
         ptrTypeEq(['local.get', `$${objTmp}`], PTR.TYPED),
@@ -186,8 +214,13 @@ export function emitElementAssign(arr, idx, val) {
   if (keyType === VAL.STRING) return dynSetCall(arr, keyExpr, valueExpr)
 
   // 5. Typed-array receiver → __typed_set_idx (or per-ctor element write).
-  if (typeof arr === 'string' && ctx.core.emit['.typed:[]='] &&
-      lookupValType(arr) === 'typed') {
+  //    Also fires for a nested `arr[c]` receiver whose array's elements are typed
+  //    arrays of a known ctor (codec `ch[c][i] = …` channelData scatter) — the
+  //    `.typed:[]=` emitter resolves the element ctor and inlines the store.
+  const nestedElemTypedCtor = Array.isArray(arr) && arr[0] === '[]' && arr.length === 3 &&
+    typeof arr[1] === 'string' ? repOf(arr[1])?.arrayElemTypedCtor : null
+  if (ctx.core.emit['.typed:[]='] &&
+      ((typeof arr === 'string' && lookupValType(arr) === 'typed') || nestedElemTypedCtor)) {
     const r = ctx.core.emit['.typed:[]=']?.(arr, idx, val, void_)
     if (r) return r
     // Element ctor unknown — runtime aux-byte dispatch. __typed_set_idx
@@ -224,6 +257,28 @@ export function emitElementAssign(arr, idx, val) {
   const knownArrVT = typeof arr === 'string' ? lookupValType(arr) : null
   const arrVT = knownArrVT || VAL.OBJECT
 
+  // 7b. Known-OBJECT receiver with a non-static key. The schema-slot (step 2) and
+  //     string-key (step 4) fast paths already returned, so the key here is a numeric
+  //     or runtime-unknown expression. A raw indexed f64.store (steps 8–9 / the default
+  //     below) would compute `ptrOffset(o) + i*8` into an allocation sized for schema
+  //     slots only — silent slot corruption at small i, an out-of-bounds memory trap at
+  //     large i. Route to __dyn_set (the per-OBJECT propsPtr hash sidecar), mirroring
+  //     emitPropertyAssign's OBJECT dot-write path; __dyn_get reads it back. This closes
+  //     the `o.prop=v` vs `o[expr]=v` asymmetry that faulted the self-host.
+  if (knownArrVT === VAL.OBJECT) return dynSetCall(arr, keyExpr, valueExpr)
+
+  // A receiver "may be an OBJECT/HASH at runtime" unless the analyzer has proven it
+  // is an indexable array/typed candidate (`rep.notString`, set by infer.js for
+  // bindings used as `x[i]` array/typed receivers — e.g. a Float64Array param `buf`).
+  // Those keep the lean raw-store path and never drag in __dyn_set / __i32_to_str
+  // (which carry their own rehash/itoa loops — a real size + hot-loop-ratchet cost).
+  // Everything else (an object-literal local `let o = {}` — the Root A′ case — or a
+  // fully-opaque expression) gets the OBJECT-safe fork that routes to the propsPtr
+  // sidecar instead of an out-of-bounds raw f64.store.
+  const mayBeObject = typeof arr !== 'string' || repOf(arr)?.notString !== true
+  // OBJECT-safe numeric store when the receiver may be an object, else the lean raw store.
+  const numStore = (o, i, v) => mayBeObject ? objHashOrRawStore(o, i, v, arrVT) : rawIndexedStore(o, i, v, arrVT)
+
   // 8. Polymorphic + runtime key dispatch — key kind unknown AND receiver shape
   //    possibly TypedArray (or fully opaque). Numeric branch forks on __ptr_type.
   //    Deliberately a 2-fork (TYPED vs else) rather than reusing
@@ -238,6 +293,7 @@ export function emitElementAssign(arr, idx, val) {
       const idxTmp = tempI32('asi')
       const valTmp = temp()
       inc('__ptr_type', '__typed_set_idx')
+      if (mayBeObject) inc('__i32_to_str')
       // When arr type is unknown (could be TypedArray) and __typed_set_idx is
       // available, dispatch the numeric branch through __ptr_type so TypedArray
       // writes go by element type. Without this, ternary-typed arrays (e.g.
@@ -250,23 +306,26 @@ export function emitElementAssign(arr, idx, val) {
         ['if', ['result', 'f64'],
           ptrTypeEq(['local.get', `$${objTmp}`], PTR.TYPED),
           ['then', ['call', '$__typed_set_idx', ['i64.reinterpret_f64', ['local.get', `$${objTmp}`]], ['local.get', `$${idxTmp}`], ['local.get', `$${valTmp}`]]],
-          ['else', ['block', ['result', 'f64'],
-            ['f64.store', ['i32.add', ptrOffsetIR(['local.get', `$${objTmp}`], arrVT), ['i32.shl', ['local.get', `$${idxTmp}`], ['i32.const', 3]]], ['local.get', `$${valTmp}`]],
-            ['local.get', `$${valTmp}`]]]]])
+          ['else', numStore(objTmp, idxTmp, valTmp)]]])
     }
+    const objTmpB = temp('asu')
+    const idxTmpB = tempI32('asi')
     const valTmp = temp()
+    inc('__ptr_type')
+    if (mayBeObject) inc('__i32_to_str')
     return dispatchByKeyKind(arr, keyExpr, valueExpr, keyNode => ['block', ['result', 'f64'],
+      ['local.set', `$${objTmpB}`, asF64(emit(arr))],
+      ['local.set', `$${idxTmpB}`, asI32(typed(keyNode, 'f64'))],
       ['local.set', `$${valTmp}`, valueExpr],
-      ['f64.store', ['i32.add', ptrOffsetIR(asF64(emit(arr)), arrVT), ['i32.shl', asI32(typed(keyNode, 'f64')), ['i32.const', 3]]], ['local.get', `$${valTmp}`]],
-      ['local.get', `$${valTmp}`]])
+      numStore(objTmpB, idxTmpB, valTmp)])
   }
 
   // 9. Opaque receiver (non-string expr) or string-named with unknown VT — pure
   //    __ptr_type dispatch (no key-kind fork: key is provably numeric here).
   if (typeof arr !== 'string')
-    return emitPolymorphicElementStore(emit(arr), asI32(emit(idx)), valueExpr, arrVT, null)
+    return emitPolymorphicElementStore(emit(arr), asI32(emit(idx)), valueExpr, arrVT, null, mayBeObject)
   if (knownArrVT == null)
-    return emitPolymorphicElementStore(emit(arr), asI32(emit(idx)), valueExpr, arrVT, persistBinding(arr))
+    return emitPolymorphicElementStore(emit(arr), asI32(emit(idx)), valueExpr, arrVT, persistBinding(arr), mayBeObject)
 
   // Default: known-VT receiver that isn't ARRAY/TYPED/OBJECT special — raw f64.store.
   return withTemp(valueExpr, t => [