jz 0.7.0 → 0.8.0

package/src/compile/loop-square.js

@@ -0,0 +1,102 @@
+// Bounded-square narrowing: carry `i*i` as i32 inside a loop guarded by `i*i < CONST`.
+//
+// A PRODUCT `i*i` is f64 in unhinted JS — the integer-overflow contract: a product can
+// exceed 2³¹, where JS keeps a Number, so jz can't blindly use i32.mul (it would wrap).
+// In a Sieve-of-Eratosthenes `for(i=2; i*i<LIMIT; i++) for(j=i*i; j<LIMIT; j+=i) …`, that
+// makes the outer bound, the inner counter `j`'s init, and the whole index chain f64 —
+// each typed-array access then pays an f64→i32 convert.
+//
+// But when the loop GUARD is `i*i < CONST` with CONST a compile-time constant ≤ 2³⁰, the
+// counter is i ≤ ⌈√CONST⌉ ≤ 2¹⁵ throughout the body (the loop is still running, and i is
+// only incremented by +1), so EVERY `i*i` there is < 2³⁰ < 2³¹ and `Math.imul(i,i) == i*i`
+// exactly. The exit overshoot (the first i with i*i ≥ CONST, evaluated in the condition)
+// is ≤ CONST + 2√CONST+1 < 2³¹ for CONST ≤ 2³⁰, so the condition narrows soundly too. The
+// hard cap is 2³⁰ — well under the 2³¹ overflow point, with margin for the overshoot.
+//
+// So we rewrite those `i*i` to `Math.imul(i,i)` (jz's i32 multiply): semantically identical
+// in the proven range, and it lets the EXISTING i32 machinery carry the index chain as i32
+// — the inner `j` (init now i32, step `j+i` i32, bound `j<CONST` i32) cascades on its own.
+//
+// Sound iff: the loop condition is `(i*i) </≤ CONST` (CONST ≤ 2³⁰), and the IV `i` is
+// incremented by +1 and NOT otherwise mutated (so within a body iteration i ∈ {entry, +1},
+// both squares < 2³¹). Mirrors strength-reduce-divmod's structure (post-prepare `while`).
+
+import { findMutations } from './analyze-scans.js'
+import { includeMods } from '../autoload.js'
+import { ctx } from '../ctx.js'
+import { litVal, unitIncVar, normalizeLoop, closureMutatedVars, rewriteBlocks } from './loop-model.js'
+
+const SQUARE_BOUND_MAX = 2 ** 30
+// The constant numeric value of a bound: a literal, OR a module const folded to an int
+// (`const LIMIT = 1<<20` → ctx.scope.constInts.get('LIMIT') = 1048576 — the bench form).
+const boundVal = (n) => {
+  const lit = litVal(n)
+  if (lit != null) return lit
+  if (typeof n === 'string') { const v = ctx.scope.constInts?.get(n); return typeof v === 'number' ? v : null }
+  return null
+}
+// `i * i` — the IV squared.
+const isSquare = (n, iv) => Array.isArray(n) && n[0] === '*' && n[1] === iv && n[2] === iv && typeof iv === 'string'
+// Math.imul(i, i) in CANONICAL post-prepare form: prepare resolves `Math.imul` → the string
+// ref `'math.imul'`, so the call is `['()', 'math.imul', [',', i, i]]`. math.imul emits a
+// primitive `i32.mul` (no stdlib helper / module include needed).
+const imulOf = (iv) => ['()', 'math.imul', [',', iv, iv]]
+
+// The IV of a `(i*i) </≤ CONST` (or mirrored `CONST >/≥ (i*i)`) guard, CONST ≤ 2³⁰, else null.
+function boundedSquareIV(cond) {
+  if (!Array.isArray(cond)) return null
+  let prod, bound
+  if (cond[0] === '<' || cond[0] === '<=') { prod = cond[1]; bound = cond[2] }
+  else if (cond[0] === '>' || cond[0] === '>=') { prod = cond[2]; bound = cond[1] }
+  else return null
+  if (!isSquare(prod, prod && prod[1])) return null
+  const b = boundVal(bound)
+  if (b == null || b < 0 || b > SQUARE_BOUND_MAX) return null
+  return prod[1]
+}
+
+// Narrow a `for`/`while` whose guard is `(i*i) </≤ CONST` (CONST ≤ 2³⁰) and whose IV `i` is
+// incremented by +1 and not otherwise mutated — then within any body iteration i ∈ {entry,
+// entry+1}, entry ≤ ⌈√CONST⌉ ≤ 2¹⁵, so every `i*i` (and the exit overshoot) is < 2³¹ and
+// Math.imul(i,i) == i*i. Rewrites those products; the dependent counter chain cascades to i32.
+// `cm` is the function's closure-mutated-vars set (an IV in it has an unprovable entry value).
+function tryNarrow(stmt, cm) {
+  const L = normalizeLoop(stmt)
+  if (!L) return null
+  const { kind, cond, step, body } = L, isFor = kind === 'for'
+
+  const iv = boundedSquareIV(cond)
+  if (!iv) return null
+  if (cm.has(iv)) return null   // mutable via a closure call — entry value unprovable
+
+  if (isFor) {
+    // The `for` update is the IV's sole, +1 mutation; the body must not reassign i.
+    if (unitIncVar(step) !== iv) return null
+    const ivMut = new Set(); findMutations(body, new Set([iv]), ivMut)
+    if (ivMut.has(iv)) return null
+  } else {
+    // `while`: the increment lives in the body (exactly one +1; nothing else mutates i).
+    if (!Array.isArray(body) || body[0] !== ';') return null
+    let ivIdx = -1
+    for (let k = 1; k < body.length; k++) if (unitIncVar(body[k]) === iv) { if (ivIdx >= 0) return null; ivIdx = k }
+    if (ivIdx < 0) return null
+    const ivMut = new Set()
+    findMutations([';', ...body.slice(1).filter((_, k) => k !== ivIdx - 1)], new Set([iv]), ivMut)
+    if (ivMut.has(iv)) return null
+  }
+
+  // We're injecting `math.imul` after prepare's auto-import step, so ensure the math module
+  // (which registers the `math.imul` → i32.mul primitive emitter) is included.
+  includeMods('math')
+  // Rewrite every `i*i` in the condition + body to Math.imul(i,i) (NOT init/update — they're
+  // `i=2` / `i++`). The inner counter whose init this feeds cascades to i32 on its own.
+  const rw = (n) => !Array.isArray(n) ? n : isSquare(n, iv) ? imulOf(iv) : n.map(rw)
+  return [isFor
+    ? ['for', L.init, rw(cond), step, rw(body)]
+    : ['while', rw(cond), rw(body)]]
+}
+
+export function narrowBoundedSquare(body) {
+  const cm = closureMutatedVars(body)
+  return rewriteBlocks(body, stmt => tryNarrow(stmt, cm))
+}

package/src/compile/narrow.js

@@ -28,6 +28,10 @@ import {
 } from './infer.js'
 
 const PTR_ABI_KINDS = new Set([VAL.OBJECT, VAL.SET, VAL.MAP, VAL.BUFFER])
+// Integer-preserving ops: an expr over integers stays integer (ToInt32-consistent) through these.
+// Excludes /, %, ** (fractional). Used to recognize a recursive arg whose i32-ness follows from
+// its inputs' i32-ness (`f(n - 1)`), so it carries no independent type evidence.
+const RECUR_INT_OPS = new Set(['+', '-', '*', 'u-', 'u+', '&', '|', '^', '<<', '>>', '>>>', '~'])
 
 
 function filterLiveCallSites(callSites, valueUsed) {
@@ -165,9 +169,10 @@ function refreshCallerValTypes(callerCtx) {
 // it is the same single typed-array ctor (scope.js invalidates on any conflict),
 // so it can't denote a different kind at the call site.
 function callerTypedElemsFor(func, globalTE) {
-  const local = analyzeBody(func.body).typedElems
+  const facts = analyzeBody(func.body)
+  const local = facts.typedElems
   if (!globalTE.size) return local
-  const shadowed = new Set(analyzeBody(func.body).locals.keys())
+  const shadowed = new Set(facts.locals.keys())
   for (const p of func.sig?.params || []) shadowed.add(p.name)
   const merged = new Map()
   for (const [k, v] of globalTE) if (!shadowed.has(k)) merged.set(k, v)
@@ -223,6 +228,7 @@ function enrichCallerValTypesFromPointerParams(callerCtx) {
 }
 
 function refreshCallerLocals(callerCtx) {
+  const prevTE = ctx.types.typedElem
   for (const func of ctx.func.list) {
     if (!func.body || func.raw) continue
     // Seed pointer-narrowed params' val-kind so analyzeBody recognises e.g.
@@ -232,13 +238,24 @@ function refreshCallerLocals(callerCtx) {
     // (heapsort→siftDown's `end`). analyzeFuncForEmit re-seeds + re-invalidates at
     // emit time, so this transient localReps doesn't leak past narrowing.
     ctx.func.localReps = new Map()
-    for (const p of func.sig.params) if (p.ptrKind != null) ctx.func.localReps.set(p.name, { val: p.ptrKind })
+    // Seed the typedElem overlay with this func's TYPED-pointer params (element ctor from
+    // ptrAux), exactly as analyzeFuncForEmit does at emit time. Without it, a local bound to
+    // an integer typed-array PARAM element — `aa = perm[perm[X]+Y]` (noise), perm an Int32
+    // pointer param — types f64 here, so a callee fed it (`grad(aa,…)`, used only as `aa&3`)
+    // never narrows its param to i32. Mirrors emit so narrow-time callerLocals agree with it.
+    const te = ctx.scope.globalTypedElem ? new Map(ctx.scope.globalTypedElem) : new Map()
+    for (const p of func.sig.params) {
+      if (p.ptrKind != null) ctx.func.localReps.set(p.name, { val: p.ptrKind })
+      if (p.ptrKind === VAL.TYPED && p.ptrAux != null) { const c = ctorFromElemAux(p.ptrAux); if (c != null) te.set(p.name, c) }
+    }
+    ctx.types.typedElem = te
     invalidateLocalsCache(func.body)
     const fresh = analyzeBody(func.body).locals
     for (const p of func.sig.params) if (!fresh.has(p.name)) fresh.set(p.name, p.type)
     callerCtx.get(func).callerLocals = fresh
   }
   ctx.func.localReps = null
+  ctx.types.typedElem = prevTE
 }
 
 function resetParamWasmFacts(paramReps) {
@@ -280,6 +297,35 @@ function narrowI32Results(funcs) {
     e[0] === '>>>' ||
     (e[0] === '()' && typeof e[1] === 'string' && ctx.func.map?.get(e[1])?.sig?.unsignedResult === true)
   )
+  const callsSelf = (n, name) => Array.isArray(n) && ((n[0] === '()' && n[1] === name) || n.some(c => callsSelf(c, name)))
+  // Classify a func's return tails as all-v128 / all-i32 (+ sign) under the CURRENT sig.results.
+  const evalTails = (func, body, exprs) => {
+    const savedCurrent = ctx.func.current
+    ctx.func.current = func.sig
+    const locals = isBlockBody(body) ? analyzeBody(body).locals : new Map()
+    for (const p of func.sig.params) if (!locals.has(p.name)) locals.set(p.name, p.type)
+    // Seed the typedElem overlay with this func's TYPED-pointer params so a return tail
+    // reading a typed-array element — `return vals[h]`, vals an Int32Array param (dict's
+    // `lookup`) — types as i32, not NaN-boxed f64. Without it the call site keeps the full
+    // __typed_idx/ToNumber unbox dispatch (491520× per dict kernel run). Mirrors
+    // refreshCallerLocals + analyzeFuncForEmit. Only meaningful once Phase G has tagged params
+    // ptrKind=TYPED (the I2 re-run below); harmless before (no typed params → overlay untouched).
+    const savedTE = ctx.types.typedElem
+    let te = null
+    for (const p of func.sig.params) {
+      if (p.ptrKind === VAL.TYPED && p.ptrAux != null) {
+        const c = ctorFromElemAux(p.ptrAux)
+        if (c != null) { if (!te) te = savedTE ? new Map(savedTE) : new Map(); te.set(p.name, c) }
+      }
+    }
+    if (te) ctx.types.typedElem = te
+    const allV128 = exprs.every(e => exprType(e, locals) === 'v128')
+    const allI32 = !allV128 && exprs.every(e => exprType(e, locals) === 'i32')
+    if (te) ctx.types.typedElem = savedTE
+    const r = { allV128, allI32, anyUnsigned: exprs.some(isUnsignedTail), allUnsigned: exprs.every(isUnsignedTail) }
+    ctx.func.current = savedCurrent
+    return r
+  }
   let changed = true
   while (changed) {
     changed = false
@@ -289,22 +335,40 @@ function narrowI32Results(funcs) {
       if (isBlockBody(body) && hasBareReturn(body)) continue
       const exprs = returnExprs(body)
       if (!exprs.length) continue
-      const savedCurrent = ctx.func.current
-      ctx.func.current = func.sig
-      const locals = isBlockBody(body) ? analyzeBody(body).locals : new Map()
-      for (const p of func.sig.params) if (!locals.has(p.name)) locals.set(p.name, p.type)
-      const allV128 = exprs.every(e => exprType(e, locals) === 'v128')
-      const allI32 = !allV128 && exprs.every(e => exprType(e, locals) === 'i32')
-      const anyUnsigned = exprs.some(isUnsignedTail)
-      const allUnsigned = exprs.every(isUnsignedTail)
-      ctx.func.current = savedCurrent
+      let r = evalTails(func, body, exprs)
+      // Recursive result cycle: a self-call in a return tail — or feeding a returned local
+      // (nqueens' `cnt = cnt + solve(…); return cnt`) — reads solve's own not-yet-narrowed
+      // f64 result, so `cnt` widens to f64 and the i32 narrowing never fires. Break the cycle
+      // optimistically: tentatively assume the i32 result, re-analyze, and keep it ONLY if every
+      // tail is then i32 (else revert). Sound — committed only when self-consistent.
+      if (!r.allI32 && !r.allV128 && callsSelf(body, func.name)) {
+        const saved = func.sig.results
+        func.sig.results = ['i32']
+        invalidateLocalsCache(body)
+        const opt = evalTails(func, body, exprs)
+        if (opt.allI32 && (!opt.anyUnsigned || opt.allUnsigned)) {
+          if (opt.allUnsigned) func.sig.unsignedResult = true
+          changed = true
+          continue
+        }
+        func.sig.results = saved
+        invalidateLocalsCache(body)
+        r = evalTails(func, body, exprs)
+      }
       // SIMD: every tail returns a lane vector → v128 result.
-      if (allV128) {
+      if (r.allV128) {
         func.sig.results = ['v128']
         changed = true
-      } else if (allI32 && (!anyUnsigned || allUnsigned)) {   // sign-consistent i32 tails
+      } else if (r.allI32 && (!r.anyUnsigned || r.allUnsigned)) {   // sign-consistent i32 tails
         func.sig.results = ['i32']
-        if (allUnsigned) func.sig.unsignedResult = true
+        if (r.allUnsigned) func.sig.unsignedResult = true
+        // A committed i32 result is a genuine NUMBER, so stamp valResult for the call-site
+        // VAL dispatch — E2 (narrowValResults) ran ABOVE the param lattice and so couldn't
+        // type a `return typedArrayParam[idx]` tail (hashjoin's `probe` → `vals[h]`), leaving
+        // valResult unset → the hot `sum + probe()` stayed the polymorphic string-or-number
+        // `+`. Only-if-unset: an UNBOXED-pointer i32 result already carries its ARRAY/OBJECT/
+        // TYPED valResult (the unboxing ABI needs it), so this never overwrites a pointer kind.
+        if (func.valResult == null) func.valResult = VAL.NUMBER
         changed = true
       }
     }
@@ -672,10 +736,20 @@ export default function narrowSignatures(programFacts, ast) {
       const state = siteState(callSites[s])
       if (!state) continue
       const { func, argList } = state
+      const recursive = state.callee === state.callerFunc?.name
       for (let k = 0; k < func.sig.params.length; k++) {
         const r = ensureParamRep(paramReps, state.callee, k)
         if (k >= argList.length) { for (const rule of rules) rule.missing(r, k, state); continue }
-        for (const rule of rules) rule.apply(r, argList[k], k, state)
+        const arg = argList[k]
+        // Recursive identity arg — `f(…, p, …)` calling itself with its own param p threaded
+        // through at the same position — is a fixpoint identity: it carries whatever type p
+        // settles to, so it constrains nothing. Skip it, else exprType(p) reads p's not-yet-
+        // narrowed f64 and the meet poisons the type the non-recursive call sites would prove
+        // (nqueens' `solve(all, …)` — `all` stuck f64 while cols/d1/d2, passed as i32 bitwise
+        // exprs, narrowed fine).
+        const pname = func.sig.params[k].name
+        if (recursive && (arg === pname || (Array.isArray(arg) && arg[0] === 'local.get' && arg[1] === pname))) continue
+        for (const rule of rules) rule.apply(r, arg, k, state)
       }
     }
   }
@@ -743,6 +817,46 @@ export default function narrowSignatures(programFacts, ast) {
       mergeParamFact(r, field, v)
     },
   })
+  // WASM type of a call arg. exprType resolves most shapes, but an INTEGER typed-array
+  // element read `intArr[idx]` (and arithmetic over it, `intArr[idx]+1`) types f64 here:
+  // exprType's `[]` rule reads the typedElem OVERLAY, which doesn't see a typedCtor-narrowed
+  // PARAM array at fixpoint time — yet the element is a 32-bit machine integer. Install the
+  // caller's resolved param-typedCtors (+ module globals) as that overlay for the duration
+  // of the type query, so a param fed only such integer elements (dict's key `k` ← src[i],
+  // threaded through Math.imul / === keys[h] / keys[h]=k) narrows to i32 instead of paying
+  // convert + f64-compare + trunc round-trips through its probe loop.
+  // A value built ONLY from the callee's own params + already-i32 locals + integer constants via
+  // integer-preserving ops. Its i32-ness follows from its inputs' — for a recursive self-call it
+  // carries no INDEPENDENT evidence about whether the params are i32. Used for the optimism below.
+  const isRecurIntExpr = (n, pnames, callerLocals) => {
+    if (typeof n === 'string') return pnames.has(n) || callerLocals?.get?.(n) === 'i32'
+    if (typeof n === 'number') return Number.isInteger(n)
+    if (!Array.isArray(n)) return false
+    if (n[0] == null) return typeof n[1] === 'number' && Number.isInteger(n[1])           // boxed int literal
+    if (n[0] === 'local.get') return pnames.has(n[1]) || callerLocals?.get?.(n[1]) === 'i32'
+    if (RECUR_INT_OPS.has(n[0])) return n.slice(1).every(c => isRecurIntExpr(c, pnames, callerLocals))
+    return false
+  }
+  const argWasmType = (arg, state) => {
+    // Recursive self-call: an arg built only from the callee's own params + already-i32 locals +
+    // int constants (`f(n - 1)`, `f(n - 1 - i)`) is i32 IFF those params are i32 — a fixpoint
+    // identity carrying no INDEPENDENT type evidence. Optimistically type it i32 so the NON-
+    // recursive call sites decide: all i32 ⇒ the param narrows; any f64 ⇒ the meet still poisons
+    // it. Lets a plain decreasing recursion narrow with no `|0` source crutch. (The bare-identity
+    // arg `f(n)` is already skipped wholesale in runCallsiteLattice.)
+    if (state.callee === state.callerFunc?.name &&
+        isRecurIntExpr(arg, new Set(state.func.sig.params.map(p => p.name)), state.callerLocals)) return 'i32'
+    if (!state._teOverlay) {
+      const m = new Map(ctx.scope.globalTypedElem || [])
+      const pf = state.callerParamFacts('typedCtor')
+      if (pf) for (const [name, ctor] of pf) if (ctor != null) m.set(name, ctor)
+      state._teOverlay = m
+    }
+    const prev = ctx.func.localTypedElemsOverlay
+    ctx.func.localTypedElemsOverlay = state._teOverlay
+    try { return exprType(arg, state.callerLocals) }
+    finally { ctx.func.localTypedElemsOverlay = prev }
+  }
   const runFixpoint = () => runCallsiteLattice([
     // val runs SOFT (monotone): a TYPED param's val only becomes inferable after the
     // typedCtor fixpoint + pointer-ABI enrichment, so an early hard merge would
@@ -754,7 +868,7 @@ export default function narrowSignatures(programFacts, ast) {
       missing: poison('wasm'),
       apply(r, arg, _k, state) {
         if (r.wasm === null) return
-        const wt = exprType(arg, state.callerLocals)
+        const wt = argWasmType(arg, state)
         if (r.wasm === undefined) r.wasm = wt
         else if (r.wasm !== wt) r.wasm = null
       },
@@ -919,6 +1033,16 @@ export default function narrowSignatures(programFacts, ast) {
   // (callback bench: mix is FNV — params and result all i32-shaped, but inferred
   // only after E phase narrowed mix's result).
   phase.refreshLocals()
+  // I2: Re-narrow i32 RESULTS now that Phase G (applyTypedPointerParamAbi) has tagged
+  // typed-array params ptrKind=TYPED. Phase E ran before G, so a function returning a
+  // typed-array element — dict's `lookup = (keys, vals, k) => { … return vals[h] }` with
+  // vals an Int32Array param — had its return tail type as NaN-boxed f64 (vals not yet a
+  // typed pointer), leaving sig.results f64 and the call site running the full
+  // __typed_idx/ToNumber unbox on every probe step (491520× per dict kernel run). Now that
+  // evalTails seeds the typed-param overlay and params carry ptrAux, the fixpoint catches
+  // `vals[h]` as i32, narrows the result, and the dispatch vanishes; the runFixpoint below
+  // then propagates the i32 result into `let v = lookup(...)` at the call sites.
+  narrowI32Results(funcsWithNarrowableResult)
   // Reset wasm field unconditionally — first pass populated it from stale callerLocals
   // (where `let h = mix(...)` widened h to f64 because mix's result wasn't narrowed
   // yet). clearStickyNull only resets null; here we need to reset f64-observed too
@@ -1334,25 +1458,37 @@ export function specializeBimorphicTyped(programFacts) {
 
     // Build one clone per distinct combo.
     const cloneByKey = new Map()
-    for (const [key, combo] of distinct) {
-      const suffix = combo.map(c => c.replace(/^new\./, '').replace(/\./g, '_')).join('$')
+    for (const [dkey, cmb] of distinct) {
+      // NB: this loop variable must NOT reuse the name `combo` (declared twice above, at the
+      // site loop and the distinct-building loop). The self-host miscompiles a for-of loop
+      // variable whose name collides with an earlier block-scoped declaration — it aliases the
+      // prior binding instead of rebinding per iteration, so `combo` would stay stuck at the
+      // last site's ctor and every clone would get the same (wrong) element type → silent
+      // garbage. A unique name gets a clean per-iteration binding.
+      const suffix = cmb.map(c => c.replace(/^new\./, '').replace(/\./g, '_')).join('$')
       let cloneName = `${func.name}$${suffix}`
       let n = 0
       while (ctx.func.names.has(cloneName)) cloneName = `${func.name}$${suffix}$${++n}`
 
+      // Build cloneSig with clean, fully-formed object literals — never by spreading a
+      // live object and then overriding/extending its keys. A MULTI-prop spread of a
+      // member-access source (`{ ...func.sig, params, results }`) takes the static
+      // allKnown OBJECT-merge path, which trusts func.sig's COMPILE-TIME schema; sig
+      // objects are polymorphic (some carry result/ptrKind/unsignedResult), so that
+      // schema can be a subset of the runtime shape and the slot-copy then faults a
+      // later `sig.params` read out of bounds in the self-host. (The single-unknown
+      // `{ ...x }` clone is fixed at the root — __obj_clone — but the allKnown merge
+      // path is a separate hazard.) Constructing each param with its pointer ABI baked
+      // in sidesteps it; output is unchanged on the host.
       const cloneSig = {
-        ...func.sig,
-        params: func.sig.params.map(p => ({ ...p })),
+        params: func.sig.params.map((p, idx) => {
+          const bi = bimorphic.indexOf(idx)
+          return bi < 0
+            ? { ...p }
+            : { name: p.name, type: 'i32', ptrKind: VAL.TYPED, ptrAux: typedElemAux(cmb[bi]) }
+        }),
         results: [...func.sig.results],
       }
-      for (let i = 0; i < bimorphic.length; i++) {
-        const k = bimorphic[i]
-        const aux = typedElemAux(combo[i])
-        const p = cloneSig.params[k]
-        p.type = 'i32'
-        p.ptrKind = VAL.TYPED
-        p.ptrAux = aux
-      }
       const clone = { ...func, name: cloneName, sig: cloneSig }
       ctx.func.list.push(clone)
       ctx.func.map.set(cloneName, clone)
@@ -1360,19 +1496,20 @@ export function specializeBimorphicTyped(programFacts) {
 
       // Mirror per-param reps under the clone's name with mono ctors at bimorphic
       // positions. emitFunc's preseed reads typedCtor → seeds typedElem map →
-      // `arr[i]` lowers to direct typed load.
+      // `arr[i]` lowers to direct typed load. Each `{ ...r }` is a true clone, so
+      // pinning typedCtor on it leaves the source rep untouched (__obj_clone).
       const cloneReps = new Map()
       for (const [k, r] of reps) cloneReps.set(k, { ...r })
       for (let i = 0; i < bimorphic.length; i++) {
         const k = bimorphic[i]
         const r = cloneReps.get(k) || {}
-        r.typedCtor = combo[i]
+        r.typedCtor = cmb[i]
         r.val = VAL.TYPED
         cloneReps.set(k, r)
       }
       paramReps.set(cloneName, cloneReps)
 
-      cloneByKey.set(key, clone)
+      cloneByKey.set(dkey, clone)
     }
 
     // Rewrite each site's call AST to point at the matching clone.

package/src/compile/peel-stencil.js

@@ -20,8 +20,9 @@
 // literal tests use `== null`; created literals are bare numbers.
 
 import { findMutations } from './analyze-scans.js'
+import { ASSIGN_OPS } from '../ast.js'
+import { litN, unitIncVar, normalizeLoop, closureMutatedVars, rewriteBlocks, freshLoopId } from './loop-model.js'
 
-const litN = (n, k) => Array.isArray(n) && n.length === 2 && n[0] == null && n[1] === k
 const isVar = (n) => typeof n === 'string'
 
 // `k = -r`: prepared as ['u-', r] (unary minus) or ['-', 0, r].
@@ -31,11 +32,10 @@ const negOf = (n) => Array.isArray(n) && n[0] === 'u-' ? n[1]
 // Every write to `iv` in `node` is a strictly-positive step (++iv / iv+=1 / iv=iv+1),
 // so iv advances monotonically — required so the three split loops partition [0,bound)
 // and the clamp-free interior never re-runs at an edge index. Any other write → false.
-const ASSIGN = new Set(['=', '+=', '-=', '*=', '/=', '%=', '&=', '|=', '^=', '<<=', '>>=', '>>>=', '**=', '&&=', '||=', '??='])
 function ivMonotonic(node, iv) {
   if (!Array.isArray(node)) return true
   if ((node[0] === '++' || node[0] === '--') && node[1] === iv) return node[0] === '++'
-  if (ASSIGN.has(node[0]) && node[1] === iv) {
+  if (ASSIGN_OPS.has(node[0]) && node[1] === iv) {
     if (node[0] === '+=' && litN(node[2], 1)) return true
     if (node[0] === '=' && Array.isArray(node[2]) && node[2][0] === '+'
       && ((node[2][1] === iv && litN(node[2][2], 1)) || (node[2][2] === iv && litN(node[2][1], 1)))) return true
@@ -44,22 +44,6 @@ function ivMonotonic(node, iv) {
   return node.every(c => ivMonotonic(c, iv))
 }
 
-// Vars assigned inside any closure in the function — a call in the loop can mutate
-// them even though findMutations (direct writes only) misses it. iv/bound/r in this
-// set must bail (same class as the loop-SR closure-mutation guard).
-const collectAssigns = (n, out) => {
-  if (!Array.isArray(n)) return
-  if (typeof n[1] === 'string' && (ASSIGN.has(n[0]) || n[0] === '++' || n[0] === '--')) out.add(n[1])
-  n.forEach(c => collectAssigns(c, out))
-}
-const closureMutated = (n, out) => {
-  if (!Array.isArray(n)) return out
-  if (n[0] === '=>') collectAssigns(n, out)
-  n.forEach(c => closureMutated(c, out))
-  return out
-}
-let _cm = new Set()
-
 // Find, anywhere in `node`, a clamp `if (ci < 0) ci = 0; else if (ci >= B) ci = B-1`
 // over a var `ci` and bound var `B`. Returns { ci, bound } or null (first match).
 function findClamp(node) {
@@ -121,7 +105,7 @@ function countWrites(node, v) {
   const visit = (x) => {
     if (!Array.isArray(x)) return
     if ((x[0] === '++' || x[0] === '--') && x[1] === v) n++
-    else if (ASSIGN.has(x[0]) && x[1] === v) n++
+    else if (ASSIGN_OPS.has(x[0]) && x[1] === v) n++
     x.forEach(visit)
   }
   visit(node)
@@ -151,7 +135,7 @@ function ivWrittenInNestedLoop(body, iv) {
   let found = false
   const visit = (n, inLoop) => {
     if (!Array.isArray(n)) return
-    if (inLoop && (((n[0] === '++' || n[0] === '--') && n[1] === iv) || (ASSIGN.has(n[0]) && n[1] === iv))) found = true
+    if (inLoop && (((n[0] === '++' || n[0] === '--') && n[1] === iv) || (ASSIGN_OPS.has(n[0]) && n[1] === iv))) found = true
     const deeper = inLoop || n[0] === 'while' || n[0] === 'for'
     n.forEach(c => visit(c, deeper))
   }
@@ -159,41 +143,24 @@ function ivWrittenInNestedLoop(body, iv) {
   return found
 }
 
-let _uniq = 0
-
 // Drop the clamp `if` node from a (cloned) body, leaving the bare `ci = iv + k`.
 const dropClamp = (node, clampNode) =>
   !Array.isArray(node) ? node
     : node === clampNode ? ['{}', [';']]   // empty block (the if is a statement)
     : node.map(c => dropClamp(c, clampNode))
 
-// A strictly-positive +1 step on `iv` (the for-loop increment): i++, ++i, i+=1, i=i+1.
-const stepIsPosInc = (s, iv) => {
-  if (!Array.isArray(s)) return false
-  let inc = s
-  if (s[0] === '-' && litN(s[2], 1) && Array.isArray(s[1]) && s[1][0] === '++') inc = s[1]
-  if (inc[0] === '++' && inc[1] === iv) return true
-  if (s[0] === '+=' && s[1] === iv && litN(s[2], 1)) return true
-  return s[0] === '=' && s[1] === iv && Array.isArray(s[2]) && s[2][0] === '+'
-    && ((s[2][1] === iv && litN(s[2][2], 1)) || (s[2][2] === iv && litN(s[2][1], 1)))
-}
-
-function tryPeel(stmt) {
-  if (!Array.isArray(stmt)) return null
+function tryPeel(stmt, cm) {
   // Normalize while / for into (iv, bound, body, init, step). For a `while`, the
   // increment is inside the body; for a `for` it is the separate step clause, which
   // we re-append to each split loop's body (converting the for into init + whiles).
-  let iv, bound, body, init = null, step = null
-  if (stmt[0] === 'while') {
-    const cond = stmt[1]
-    if (!Array.isArray(cond) || cond[0] !== '<' || !isVar(cond[1])) return null
-    iv = cond[1]; bound = cond[2]; body = stmt[2]
-  } else if (stmt[0] === 'for') {
-    init = stmt[1]; const cond = stmt[2]; step = stmt[3]; body = stmt[4]
-    if (!Array.isArray(cond) || cond[0] !== '<' || !isVar(cond[1])) return null
-    iv = cond[1]; bound = cond[2]
-    if (!stepIsPosInc(step, iv)) return null
-  } else return null
+  const L = normalizeLoop(stmt)
+  if (!L) return null
+  let { init, cond, step, body } = L
+  if (!Array.isArray(cond) || cond[0] !== '<' || !isVar(cond[1])) return null
+  const iv = cond[1], bound = cond[2]
+  // The `for` step must be the IV's strictly-positive +1 increment; a `while` increments in
+  // its body (validated below by ivMonotonic / the exactly-one-+1 checks).
+  if (L.kind === 'for' && unitIncVar(step) !== iv) return null
   if (!isVar(bound) || !Array.isArray(body)) return null
   // A loop whose body is a single statement (e.g. an outer row loop wrapping one
   // inner loop — the vertical blur pass) isn't a `;` sequence; normalize it.
@@ -227,9 +194,9 @@ function tryPeel(stmt) {
   if (!ivMonotonic(body, iv)) return null
   const mut = new Set(); findMutations(body, new Set([bound, r]), mut)
   if (mut.has(bound) || mut.has(r)) return null
-  if (_cm.has(iv) || _cm.has(bound) || _cm.has(r)) return null  // closure-mutable → unsafe
+  if (cm.has(iv) || cm.has(bound) || cm.has(r)) return null  // closure-mutable → unsafe
 
-  const id = _uniq++
+  const id = freshLoopId()
   const xs = `__pks${id}`, xe = `__pke${id}`
   // xs = r < bound ? r : bound ;  xe = (bound - r) > xs ? bound - r : xs
   const seed = ['let',
@@ -242,20 +209,7 @@ function tryPeel(stmt) {
   return init ? [init, seed, ...loops] : [seed, ...loops]
 }
 
-function walk(node) {
-  if (!Array.isArray(node)) return node
-  const n = node.map(walk)
-  if (n[0] !== ';') return n
-  const out = [';']
-  for (let k = 1; k < n.length; k++) {
-    const r = tryPeel(n[k])
-    if (r) out.push(...r)
-    else out.push(n[k])
-  }
-  return out
-}
-
 export function peelClampedStencil(body) {
-  _cm = closureMutated(body, new Set())
-  return walk(body)
+  const cm = closureMutatedVars(body)
+  return rewriteBlocks(body, stmt => tryPeel(stmt, cm))
 }

package/src/compile/plan/common.js

@@ -129,6 +129,35 @@ export const fixedScalarTypedArray = (expr) => {
     ? { len, coerce: SCALAR_TYPED_COERCE[ctor] } : null
 }
 
+/** Does `expr` allocate a FRESH typed-array buffer of static numeric length —
+ *  `new Float64Array(N)` with N a compile-time integer? Excludes view ctors
+ *  (`new Float64Array(someBuffer)` — the arg is a buffer ref, not an int), so the
+ *  result provably aliases no other buffer. Used by param-distinctness. */
+export const isFreshTypedArrayAlloc = (expr) => {
+  if (typedElemCtor(expr) == null) return false
+  const args = callArgs(expr)
+  return !!args && args.length === 1 && constIntExpr(args[0]) != null
+}
+
+/** Local names const-bound to a fresh typed-array allocation (each a unique buffer, distinct from
+ *  every other such binding and from any pre-existing value). `const` only — an immutable binding
+ *  always holds that fresh buffer. Element writes (`a[i]=…`) don't reassign `a`, so they're fine. */
+export const freshTypedArrayLocals = (body) => {
+  const fresh = new Set()
+  const walk = node => {
+    if (!Array.isArray(node) || node[0] === '=>') return
+    if (node[0] === 'const') {
+      for (let i = 1; i < node.length; i++) {
+        const d = node[i]
+        if (Array.isArray(d) && d[0] === '=' && typeof d[1] === 'string' && isFreshTypedArrayAlloc(d[2])) fresh.add(d[1])
+      }
+    }
+    for (let i = 1; i < node.length; i++) walk(node[i])
+  }
+  walk(body)
+  return fresh
+}
+
 /** Map of name → {len, coerce} for every fixed-size typed-array binding declared
  *  via `let`/`const` directly in `body` (no descent into nested arrows). */
 export const fixedTypedArraysInBody = (body) => {

package/src/compile/plan/index.js

@@ -43,7 +43,7 @@ import { inlineHotInternalCalls, inlineLocalLambdas, specializeFixedRestCalls }
 import { bindNestedRowLengths, unrollRowLenPadLoops, splitCharScanLoops } from './loops.js'
 import {
   scalarizeFunctionTypedArrays, scalarizeFunctionArrayLiterals,
-  promoteIntArrayLiterals, scalarizeFunctionObjectLiterals,
+  promoteIntArrayLiterals, scalarizeFunctionObjectLiterals, analyzeParamDistinctness,
 } from './literals.js'
 
 export default function plan(ast, profiler) {
@@ -113,6 +113,9 @@ export default function plan(ast, profiler) {
   }
 
   t('narrowSignatures', () => narrowSignatures(programFacts, ast))
+  // After narrowSignatures (params now carry ptrKind): mark typed-array params that every call
+  // site passes a distinct fresh buffer for → enables alias-aware LICM in the optimizer.
+  if (optimizing()) t('analyzeParamDistinctness', () => analyzeParamDistinctness(programFacts))
   t('specializeBimorphicTyped', () => specializeBimorphicTyped(programFacts))
   t('refineDynKeys', () => refineDynKeys(programFacts))
   strictBoundaryTypeCheck(programFacts)