jz 0.7.0 → 0.8.0

package/src/compile/plan/inline.js

@@ -39,12 +39,25 @@ import {
 // expression — null if void or no trailing return value.
 const inlinedBody = (func, args) => {
   const params = func.sig.params
-  if (args.length !== params.length || !args.every(isSimpleArg)) return null
+  if (args.length !== params.length) return null
   const paramNames = new Set(params.map(p => p.name))
   if (mutatesAny(func.body, paramNames)) return null
 
+  // A simple arg (ident / literal / arithmetic) is cheap to substitute directly, even when its
+  // param is used several times. A NON-simple arg (a call, `?:`, indexed load) is bound to a fresh
+  // temp evaluated ONCE in call order — preserving evaluation count + left-to-right order, and
+  // never duplicating the expression. This lets nested calls inline: `lerp(grad(a), grad(b), u)`
+  // binds `t0 = grad(a); t1 = grad(b)` and substitutes the body with t0/t1; a later inliner pass
+  // then folds grad into those temp decls (the fixpoint in inlineHotInternalCalls).
   const subst = new Map()
-  for (let i = 0; i < params.length; i++) subst.set(params[i].name, args[i])
+  const argPrefix = []
+  for (let i = 0; i < params.length; i++) {
+    const arg = args[i]
+    if (isSimpleArg(arg)) { subst.set(params[i].name, arg); continue }
+    const tmp = `${T}inarg${ctx.func.uniq++}`
+    argPrefix.push(['const', ['=', tmp, arg]])
+    subst.set(params[i].name, tmp)
+  }
 
   const locals = new Set()
   collectBindings(func.body, locals)
@@ -56,13 +69,13 @@ const inlinedBody = (func, args) => {
   const stmts = blockStmts(func.body)
   // Expression-bodied arrow `(c) => expr`: no statement block; the whole body
   // *is* the return value. Treat as zero-prefix + value.
-  if (!stmts) return { prefix: [], value: cloneWithSubst(func.body, subst, rename) }
+  if (!stmts) return { prefix: argPrefix, value: cloneWithSubst(func.body, subst, rename) }
   const last = stmts.length ? stmts[stmts.length - 1] : null
   const isTrailingReturn = Array.isArray(last) && last[0] === 'return'
   const prefixSrc = isTrailingReturn ? stmts.slice(0, -1) : stmts
   const prefix = prefixSrc.map(stmt => cloneWithSubst(stmt, subst, rename))
   const value = isTrailingReturn && last.length > 1 ? cloneWithSubst(last[1], subst, rename) : null
-  return { prefix, value }
+  return { prefix: argPrefix.length ? [...argPrefix, ...prefix] : prefix, value }
 }
 
 const stmtDeclName = (stmt) => {
@@ -109,7 +122,14 @@ const isCandidateCall = (node, candidates) =>
 // arithmetic>`, substituting the decls into the return value turns it into a
 // zero-prefix expression. Duplicated subtrees (`dx` used twice → `x1-x2`
 // twice) are pure, and the watr-layer CSE collapses the copies.
-const PURE_FLATTEN_OPS = new Set(['+', '-', '*', '/', '%', 'u-', 'u+', '&', '|', '^', '<<', '>>', '>>>'])
+const PURE_FLATTEN_OPS = new Set([
+  '+', '-', '*', '/', '%', 'u-', 'u+', '&', '|', '^', '<<', '>>', '>>>',
+  // pure value-producing ops with no side effects — safe to duplicate (CSE collapses copies):
+  // comparisons, logical, bit-not, and the conditional. Lets a branchy leaf like noise's
+  // `grad(h,x,y) => { …; u = (h&1)===0 ? x : -x; … }` flatten to an expression so it inlines
+  // into its multi-call caller `perlin` — `lerp(grad(a), grad(b), u)` then collapses end to end.
+  '<', '<=', '>', '>=', '==', '!=', '===', '!==', '&&', '||', '!', '~', '?:',
+])
 const pureFlattenExpr = (n) => {
   if (typeof n === 'number' || typeof n === 'string') return true  // literal or ident
   if (!Array.isArray(n)) return false
@@ -163,13 +183,19 @@ const inlineInExpr = (node, candidates) => {
 
 const inlineInStmt = (stmt, candidates, loopVariantNames = null) => {
   if (!Array.isArray(stmt)) return { node: stmt, changed: false }
-  // Statement-position call: discard return value, splice prefix in place.
+  // Statement-position call: the result is unused, but the callee's return
+  // EXPRESSION may still carry side effects — an expression-bodied arrow whose body
+  // is itself effectful (`seek = n => idx = n` inlines to the assignment `idx = i`;
+  // a one-liner that calls another fn) puts the effect in `value`, not `prefix`.
+  // Emit it as a trailing statement so the effect runs; a pure value is dropped
+  // later by vacuum/DCE. (Dropping it lost the parser's seek() idx-advance → ∞ loop.)
   if (isCandidateCall(stmt, candidates)) {
     const args = callArgs(stmt)
     const shape = args && inlinedBody(candidates.get(stmt[1]), args)
     if (shape) {
       const { hoisted, rest } = partitionInvariantPrefix(shape.prefix, loopVariantNames)
-      return { node: ['{}', [';', ...rest]], changed: true, splice: rest, hoisted }
+      const splice = shape.value !== null ? [...rest, shape.value] : rest
+      return { node: ['{}', [';', ...splice]], changed: true, splice, hoisted }
     }
   }
   // `let/const X = call(...)` with single decl: inline as prefix + decl(value).
@@ -259,9 +285,99 @@ const inlineInStmt = (stmt, candidates, loopVariantNames = null) => {
   return { node: stmt, changed: false }
 }
 
+// Short-circuit operators: only the FIRST operand is unconditionally evaluated; a call in
+// a later operand might not run, so it can't be hoisted.
+const SHORT_CIRCUIT = new Set(['?:', '?', '&&', '||', '??'])
+// Optional chaining: jz's own desugaring already tees the base to evaluate it once, and
+// the key/args run conditionally — so the hoist treats the WHOLE expression as opaque (no
+// operand, not even the base, is hoisted out) to avoid colliding with that desugaring.
+const OPTIONAL_CHAIN = new Set(['?.', '?.[]', '?.()'])
+// Mutating expression operators — evaluating one is an observable side effect.
+const ASSIGN_OPS = new Set(['=', '+=', '-=', '*=', '/=', '%=', '&=', '|=', '^=', '<<=', '>>=', '>>>=', '**=', '&&=', '||=', '??=', '++', '--'])
+// Does evaluating this expression have an observable side effect (a call or assignment)?
+const containsEffect = (n) => Array.isArray(n) && n[0] !== '=>' &&
+  (n[0] === '()' || n[0] === '?.()' || ASSIGN_OPS.has(n[0]) || n.slice(1).some(containsEffect))
+
+// Hoist an unconditionally-evaluated NESTED call to a block-body candidate out to a
+// preceding `const __h = call(...)` temp. inlineInStmt folds block-body candidates only at
+// a DIRECT `const X = call` / `X = call`; a call buried in an expression (noise's
+// `sum = sum + amp * perlin(x)`) is reached by neither that path nor inlineInExpr (which
+// only substitutes zero-prefix expr-bodies). Hoisting normalizes it to the direct form.
+// Only block-body candidates and only unconditional positions — preserving evaluation order
+// + count. Statement HEADERS that are expression positions (for-init/update, while/if test)
+// are left untouched: there's no sound place for a hoisted decl there, so those calls just
+// stay outlined. Conservatively leaves unrecognized statement shapes alone.
+const hoistNestedCalls = (body, blockNames) => {
+  if (!blockNames.size || !Array.isArray(body)) return { node: body, changed: false }
+  let changed = false
+  const seq = (stmts) => stmts.length === 1 ? stmts[0] : [';', ...stmts]
+  // Lifting a call to the pre-decl block moves its evaluation to the TOP of the statement.
+  // Sound only if no observable side effect is evaluated BEFORE it — else its effect jumps
+  // ahead of that one (`a() + helper(x)` must keep a()'s effect first). `eff.seen` threads
+  // left-to-right through evaluation order: a call or assignment LEFT IN PLACE marks every
+  // later position. A hoisted call moves as a unit — its args run in a fresh inner eff, and
+  // it does NOT advance the outer eff (the whole unit relocates together, order intact).
+  const hExpr = (n, pre, cond, eff) => {
+    if (!Array.isArray(n) || n[0] === '=>') return n
+    if (!cond && !eff.seen && n[0] === '()' && typeof n[1] === 'string' && blockNames.has(n[1])) {
+      const call = [n[0], n[1], ...n.slice(2).map(a => hExpr(a, pre, false, { seen: false }))]
+      const tmp = `${T}inl${ctx.func.uniq++}_h`
+      pre.push(['const', ['=', tmp, call]])
+      changed = true
+      return [null, tmp]
+    }
+    if (OPTIONAL_CHAIN.has(n[0])) {
+      const out = [n[0], ...n.slice(1).map(c => hExpr(c, pre, true, eff))]
+      if (n[0] === '?.()') eff.seen = true  // optional CALL may run
+      return out
+    }
+    if (SHORT_CIRCUIT.has(n[0]))
+      return [n[0], hExpr(n[1], pre, cond, eff), ...n.slice(2).map(c => hExpr(c, pre, true, eff))]
+    const out = [n[0], ...n.slice(1).map(c => hExpr(c, pre, cond, eff))]
+    if (n[0] === '()' || ASSIGN_OPS.has(n[0])) eff.seen = true  // a call/assign left in place is an effect
+    return out
+  }
+  // A RHS that is DIRECTLY a candidate call is already folded by inlineInStmt's
+  // `const X = call` / `X = call` paths — hoisting it would be redundant and (for an
+  // object/array-literal `{}`-bodied factory) would break the post-inline alias chain.
+  // Only hoist NESTED calls; leave a top-level direct call to those paths.
+  const directCall = (e) => Array.isArray(e) && e[0] === '()' && typeof e[1] === 'string' && blockNames.has(e[1])
+  const hStmt = (s) => {  // → array of statements (hoisted decls prepended)
+    if (!Array.isArray(s)) return [s]
+    switch (s[0]) {
+      case ';': return [[';', ...s.slice(1).flatMap(hStmt)]]
+      case '{}': return [['{}', seq(hStmt(s[1]))]]
+      case 'if': return [s.length > 3
+        ? ['if', s[1], seq(hStmt(s[2])), seq(hStmt(s[3]))]
+        : ['if', s[1], seq(hStmt(s[2]))]]
+      case 'for': { const i = forLoopBodyIndex(s); return [withForLoopBody(s, seq(hStmt(s[i])))] }
+      case 'while': return [['while', s[1], seq(hStmt(s[2]))]]
+      case 'let': case 'const': {
+        if (s.length === 2 && Array.isArray(s[1]) && s[1][0] === '=' && typeof s[1][1] === 'string' && !directCall(s[1][2])) {
+          const pre = []; const rhs = hExpr(s[1][2], pre, false, { seen: false })
+          return pre.length ? [...pre, [s[0], ['=', s[1][1], rhs]]] : [s]
+        }
+        return [s]
+      }
+      // A computed assign target (`a[i]=…`) evaluates its index BEFORE the RHS, so an effect
+      // there (`a[j++]=…`) must block hoisting too — seed eff.seen from the LHS.
+      case '=': { if (directCall(s[2])) return [s]; const pre = []; const rhs = hExpr(s[2], pre, false, { seen: containsEffect(s[1]) }); return pre.length ? [...pre, ['=', s[1], rhs]] : [s] }
+      case 'return': { if (s.length < 2 || directCall(s[1])) return [s]; const pre = []; const v = hExpr(s[1], pre, false, { seen: false }); return pre.length ? [...pre, ['return', v]] : [s] }
+      default: return [s]  // unrecognized shape (break/continue/throw/try/switch): leave alone
+    }
+  }
+  const out = hStmt(body)
+  return { node: changed ? seq(out) : body, changed }
+}
+
 export const inlineHotInternalCalls = (programFacts, ast) => {
   const cfg = ctx.transform.optimize
   if (cfg && cfg.sourceInline === false) return false
+  // Transitive candidacy + expression-position hoisting are a size↔speed trade (they
+  // pull a large multi-call leaf like noise's perlin fully into its hot caller, where
+  // the lower tiers prefer to keep multi-caller helpers outlined for V8 tier-up). Gate
+  // both on the speed tier so levels ≤2 keep their conservative inlining policy.
+  const speedTier = !!(cfg && cfg.inlineFns)
 
   const fixedByFunc = new Map(ctx.func.list.map(func => [func, fixedTypedArraysInBody(func.body)]))
   const typedByFunc = new Map(ctx.func.list.map(func => [func, analyzeBody(func.body).typedElems]))
@@ -315,7 +431,14 @@ export const inlineHotInternalCalls = (programFacts, ast) => {
   // entry points, not pulling a leaf INTO an export's hot loop (game-of-life's
   // step calls rot per cell; pre-Turboshaft wasm tiers never inline calls).
   const leaves = new Set()
+  // Transitive candidacy via fixpoint: a function whose only user-callees are THEMSELVES
+  // candidates (so they inline away) can be inlined too. noise's `perlin` calls grad/fade/
+  // lerp (loop-free leaves) — once those are candidates, perlin clears the call-bearing-body
+  // gate and becomes a leaf candidate. Each pass adds ≥1 or stops, so it's bounded.
+  for (let recollect = true; recollect;) {
+  recollect = false
   for (const func of ctx.func.list) {
+    if (candidates.has(func.name)) continue
     const sites = sitesByCallee.get(func.name)
     // Exported leaf/kernel with exactly one internal caller (e.g. fill→beat in
     // floatbeat): inline into the caller's loop but keep the export for external
@@ -336,7 +459,13 @@ export const inlineHotInternalCalls = (programFacts, ast) => {
     const fullyFixedTypedArraySite = hasFullyFixedTypedArraySites(func, sites)
     const hasLoop = some(func.body, n => LOOP_OPS.has(n[0]))
     const isTinyLeaf = !hasLoop && nodeSize(func.body) <= 15
-    if (!sites || sites.length < 1 || (!isTinyLeaf && !fixedTypedArraySite && sites.length > 2) || sites.length > 8) continue
+    // A small leaf (no loop, ≤40 nodes) is cheap to splice even when called several times — its
+    // per-call overhead + lost cross-call fusion dwarfs the ≤8× duplication, and temp-binding +
+    // flattenPrefix keep the spliced body bounded (no arg re-evaluation, CSE collapses copies).
+    // The 2-site non-tiny-leaf cap would otherwise outline a hot helper like noise's `grad`
+    // (~30 nodes, called 4× from perlin) and freeze the call overhead per pixel.
+    const isSmallLeaf = !hasLoop && nodeSize(func.body) <= 48
+    if (!sites || sites.length < 1 || (!isTinyLeaf && !isSmallLeaf && !fixedTypedArraySite && sites.length > 2) || sites.length > 8) continue
     const stmts = blockStmts(func.body)
     // Expression-bodied arrow funcs (`(c) => expr`) have no block — body IS the
     // return value. Treat as a "tiny leaf" branch handled below; force hasLoop=false.
@@ -356,7 +485,10 @@ export const inlineHotInternalCalls = (programFacts, ast) => {
     // that get hammered from a hot caller's loop — replacing the call with its
     // body saves the per-iteration call+reinterpret overhead (tokenizer hot path).
     if (!hasLoop) {
-      if (some(func.body, n => n[0] === '()' && typeof n[1] === 'string' && ctx.func.names.has(n[1]))) continue
+      // Calls to functions that are THEMSELVES candidates are fine — they inline away;
+      // only a call to a non-candidate user function blocks (a later fixpoint pass re-checks).
+      // Speed-tier only; lower tiers keep the strict "any user call ⇒ outline" rule.
+      if (some(func.body, n => n[0] === '()' && typeof n[1] === 'string' && ctx.func.names.has(n[1]) && !(speedTier && candidates.has(n[1])))) continue
       // Per-iteration call overhead dwarfs body-size bloat when EVERY site sits
       // inside a caller's loop (game-of-life's rot: ~40 nodes × 2 sites, fired
       // for most of 260k cells/frame; cloth's relax: ~160 nodes × 2 sites, fired
@@ -367,7 +499,10 @@ export const inlineHotInternalCalls = (programFacts, ast) => {
       // to ≤2 sites, so the spliced duplication is at most ~2× a bounded body.
       const allSitesInLoop = sites.every(site =>
         site.callerFunc?.body && containsNode(site.callerFunc.body, site.node, false))
-      if (nodeSize(func.body) > (allSitesInLoop ? 200 : 30)) continue
+      // Non-in-loop cap is 40 (not 30) so a small leaf called from a straight-line but
+      // transitively-hot caller still inlines (noise's grad is called from perlin, which has
+      // no loop of its own but is itself the per-pixel kernel). Still tightly bounded.
+      if (nodeSize(func.body) > (allSitesInLoop ? 200 : 48)) continue
     }
     if (some(func.body, n => n[0] === '()' && n[1] === func.name)) continue
     // Kernels with nested loops (depth ≥ 2) are typically large and the inner
@@ -386,6 +521,8 @@ export const inlineHotInternalCalls = (programFacts, ast) => {
       forwarders.add(func.name)
     if (!hasLoop) leaves.add(func.name)
     candidates.set(func.name, func)
+    if (speedTier) recollect = true  // only the speed-tier transitive relaxation needs a re-pass
+  }
   }
   if (!candidates.size) return false
 
@@ -436,20 +573,38 @@ export const inlineHotInternalCalls = (programFacts, ast) => {
     // Route those through inlineInExpr so the call is replaced by the inlined
     // value expression instead.
     const isExprBody = !Array.isArray(func.body) || func.body[0] !== '{}'
-    const r = isExprBody
-      ? inlineInExpr(func.body, activeCandidates)
-      : inlineInStmt(func.body, activeCandidates)
-    let body = r.changed ? r.node : func.body
-    let bodyChanged = r.changed
-    // Expression-position pass. Exported callers take the leaf-safe subset —
-    // the same tier-up rationale as the statement path (leaves into exports
-    // are fine; relocated kernels are not).
+    // Expression-position pass takes the leaf-safe subset for exports — the same tier-up
+    // rationale as the statement path (leaves into exports are fine; relocated kernels are not).
     const exprActive = func.exported
       ? new Map([...exprOnlyCandidates].filter(([n]) => exportedCandidates.has(n)))
       : exprOnlyCandidates
-    if (exprActive.size) {
-      const e = inlineInExpr(body, exprActive)
-      if (e.changed) { body = e.node; bodyChanged = true }
+    // Iterate to a (bounded) fixpoint: inlining a call whose args are themselves candidate calls
+    // binds those args to temps (`t0 = grad(a)`); the next pass folds the candidate into the temp
+    // decl. Depth is bounded by call nesting (a small constant), capped here so a pathological
+    // chain can't loop unbounded.
+    // Loop-free block-body LEAVES: the stmt path folds them only at a DIRECT `const X =
+    // call`, never nested in an expression. Hoisting such a call to a temp (in the iter
+    // fixpoint below) lets inlineInStmt then fold it — the noise `sum + amp*perlin(x)`
+    // shape. Restricted to LEAVES (no own loop): a loop kernel called in expression
+    // position (e.g. a 2-site `reduce`) was deliberately staying outlined for V8 tier-up,
+    // and hoisting it would pull the loop into a cold caller.
+    const blockNames = new Set()
+    for (const n of activeCandidates.keys()) if (leaves.has(n) && !exprActive.has(n)) blockNames.add(n)
+    let body = func.body, bodyChanged = false
+    for (let iter = 0; iter < 4; iter++) {
+      let iterChanged = false
+      if (speedTier && !isExprBody && blockNames.size) {
+        const h = hoistNestedCalls(body, blockNames)
+        if (h.changed) { body = h.node; iterChanged = true }
+      }
+      const r = isExprBody ? inlineInExpr(body, activeCandidates) : inlineInStmt(body, activeCandidates)
+      if (r.changed) { body = r.node; iterChanged = true }
+      if (exprActive.size) {
+        const e = inlineInExpr(body, exprActive)
+        if (e.changed) { body = e.node; iterChanged = true }
+      }
+      if (!iterChanged) break
+      bodyChanged = true
     }
     if (bodyChanged) { func.body = body; changed = true }
   }

package/src/compile/plan/literals.js

@@ -28,7 +28,7 @@ import {
   some, T, stmtList, refsName, REFS_IN_EXPR, ASSIGN_OPS, isReassigned, hasControlTransfer,
 } from '../../ast.js'
 import {
-  intLiteralValue, constIntExpr, staticObjectProps, staticPropertyKey,
+  intLiteralValue, nonNegIntLiteral, constIntExpr, staticObjectProps, staticPropertyKey,
 } from '../../static.js'
 import {
   smallConstForTripCount, containsDeclOf, cloneWithSubst,
@@ -37,7 +37,7 @@ import { VAL } from '../../reps.js'
 import { includeModule } from '../../autoload.js'
 import { analyzeBody, invalidateLocalsCache } from '../analyze.js'
 import {
-  isSimpleArg, fixedScalarTypedArray, fixedTypedArraysInBody, maxScalarTypedArrayLen,
+  isSimpleArg, fixedScalarTypedArray, fixedTypedArraysInBody, maxScalarTypedArrayLen, freshTypedArrayLocals,
 } from './common.js'
 
 // === Loop unrolling & scalarization ===
@@ -526,6 +526,44 @@ export const scalarizeFunctionTypedArrays = (programFacts) => {
   return changed
 }
 
+// Param-distinctness (alias analysis). Marks a function's typed-array params MUTUALLY DISTINCT
+// (provably different buffers) when EVERY call site passes a distinct fresh `new TypedArray` local
+// for each of them. This is what lets the optimizer's LICM hoist a load from one such param across
+// a store to another (the load can't be clobbered) — the alias-analysis-enabled LICM that
+// rust/clang get for free (raytrace's sphere loads vs the framebuffer store). Sound because:
+//   • a fresh `new TypedArray(N)` is a unique buffer (the allocator returns fresh memory);
+//   • requiring ALL typed-array-param args to be fresh-new excludes views/subarrays (not fresh)
+//     and forwarded params (not fresh), the only ways two args could alias;
+//   • pairwise-distinct arg names rule out the same buffer passed twice;
+//   • scalar (non-TYPED) params are ignored — they can't alias a buffer.
+// Conservatively all-or-nothing per function: any non-fresh/duplicate typed arg ⇒ no fact.
+export const analyzeParamDistinctness = (programFacts) => {
+  const freshByFunc = new Map(ctx.func.list.map(func => [func, freshTypedArrayLocals(func.body)]))
+  const sitesByCallee = new Map()
+  for (const site of programFacts.callSites) {
+    if (!site.callerFunc) continue
+    const l = sitesByCallee.get(site.callee); l ? l.push(site) : sitesByCallee.set(site.callee, [site])
+  }
+  for (const func of ctx.func.list) {
+    const params = func.sig?.params, sites = sitesByCallee.get(func.name)
+    if (!params || !sites?.length) continue
+    const typedIdx = []
+    for (let i = 0; i < params.length; i++) if (params[i].ptrKind === VAL.TYPED) typedIdx.push(i)
+    if (typedIdx.length < 2) continue   // distinctness only matters with ≥2 typed-array params
+    let ok = true
+    for (const site of sites) {
+      const seen = new Set()
+      for (const i of typedIdx) {
+        const arg = site.argList?.[i]
+        if (typeof arg !== 'string' || !freshByFunc.get(site.callerFunc)?.has(arg) || seen.has(arg)) { ok = false; break }
+        seen.add(arg)
+      }
+      if (!ok) break
+    }
+    if (ok) func.distinctParams = new Set(typedIdx.map(i => params[i].name))
+  }
+}
+
 const scalarizeArrayLiteralSeq = (seq) => {
   if (!Array.isArray(seq) || seq[0] !== ';') return { node: seq, changed: false }
   let changed = false
@@ -940,13 +978,41 @@ const _intArrayLitElems = (expr) => {
   return out
 }
 
+// Arithmetic and bitwise operators that always produce a numeric result —
+// regardless of operand types — so `name[expr]` is index-safe after promotion.
+// Bitwise ops (`&`, `|`, etc.) ToInt32 their operands; pure-arithmetic ops with
+// numeric leaves stay numeric. `+` is excluded: `"a" + "b"` is a string.
+const _NUMERIC_INDEX_OPS = new Set(['-', '*', '/', '%', '&', '|', '^', '<<', '>>', '>>>', 'u-', 'u+'])
+
+// Returns true when `key` is provably a numeric index at plan time: an integer
+// literal, a local name whose val-type is VAL.NUMBER in `valTypes`, or a
+// compound expression that always produces a number (arithmetic/bitwise ops).
+// Mirrors the `idxNumericName` / `intIndexIR` guard in emit so that the same
+// index shapes that skip `__is_str_key` at emit-time also pass here. Used by
+// `_disqualifyPromotion` to gate index reads: a non-numeric key on a promoted
+// Int32Array NaN-coerces to 0 (trunc_sat_f64_s(NaN) = 0) instead of returning
+// undefined — the correct JS behaviour for an out-of-range or string index.
+const _isNumericKey = (key, valTypes) => {
+  if (key == null) return false
+  if (nonNegIntLiteral(key) != null) return true           // literal integer
+  if (typeof key === 'string') return valTypes?.get(key) === VAL.NUMBER
+  if (!Array.isArray(key)) return false
+  const op = key[0]
+  if (op == null) return typeof key[1] === 'number'        // [null, n] literal
+  if (_NUMERIC_INDEX_OPS.has(op)) return true              // always produces Number
+  // `+` is numeric only when both operands are proven numeric.
+  if (op === '+' && key.length === 3)
+    return _isNumericKey(key[1], valTypes) && _isNumericKey(key[2], valTypes)
+  return false
+}
+
 // Walks `node` and disqualifies every candidate name that appears in an
 // unsafe context. `initSet` holds the candidate's own init-decl AST nodes
 // (their LHS reference is the binding being defined, not an escape).
-const _disqualifyPromotion = (node, candidates, disqualified, initSet) => {
+const _disqualifyPromotion = (node, candidates, disqualified, initSet, valTypes) => {
   if (initSet.has(node)) {
     // The init decl itself: only walk the RHS (skip the LHS `name`).
-    return _disqualifyPromotion(node[2], candidates, disqualified, initSet)
+    return _disqualifyPromotion(node[2], candidates, disqualified, initSet, valTypes)
   }
   if (typeof node === 'string') {
     // Bare identifier outside any handled parent context — escape.
@@ -972,7 +1038,7 @@ const _disqualifyPromotion = (node, candidates, disqualified, initSet) => {
       Array.isArray(node[1]) && (node[1][0] === '.' || node[1][0] === '?.') &&
       typeof node[1][1] === 'string' && candidates.has(node[1][1])) {
     disqualified.add(node[1][1])
-    for (let i = 2; i < node.length; i++) _disqualifyPromotion(node[i], candidates, disqualified, initSet)
+    for (let i = 2; i < node.length; i++) _disqualifyPromotion(node[i], candidates, disqualified, initSet, valTypes)
     return
   }
 
@@ -994,7 +1060,7 @@ const _disqualifyPromotion = (node, candidates, disqualified, initSet) => {
         typeof callee[1] === 'string' && candidates.has(callee[1])) {
       if (!_TYPED_SAFE_METHODS.has(callee[2])) disqualified.add(callee[1])
       // Walk method args (skip the receiver — already validated above).
-      for (let i = 2; i < node.length; i++) _disqualifyPromotion(node[i], candidates, disqualified, initSet)
+      for (let i = 2; i < node.length; i++) _disqualifyPromotion(node[i], candidates, disqualified, initSet, valTypes)
       return
     }
     // Array.isArray flips true→false under promotion.
@@ -1003,7 +1069,7 @@ const _disqualifyPromotion = (node, candidates, disqualified, initSet) => {
       const list = raw == null ? [] : (Array.isArray(raw) && raw[0] === ',') ? raw.slice(1) : [raw]
       for (const a of list) {
         if (typeof a === 'string' && candidates.has(a)) disqualified.add(a)
-        else _disqualifyPromotion(a, candidates, disqualified, initSet)
+        else _disqualifyPromotion(a, candidates, disqualified, initSet, valTypes)
       }
       return
     }
@@ -1011,10 +1077,15 @@ const _disqualifyPromotion = (node, candidates, disqualified, initSet) => {
     // bare-name leaf above and disqualify.
   }
 
-  // Index read `name[k]` — read access is TYPED-safe. Walk the key in case
-  // it contains references to other candidate names.
+  // Index read `name[k]` — TYPED-safe only when the key is provably numeric.
+  // A string or unknown key on a promoted Int32Array would NaN-coerce to 0
+  // (i32.trunc_sat_f64_s(NaN) = 0) instead of returning undefined — silently
+  // wrong. Mirror the `idxNumericName` / `intIndexIR` guard in emit: disqualify
+  // the candidate unless `k` is an integer literal, a VAL.NUMBER local, or an
+  // expression that always produces a Number (bitwise/arithmetic ops).
   if (op === '[]' && typeof node[1] === 'string' && candidates.has(node[1])) {
-    _disqualifyPromotion(node[2], candidates, disqualified, initSet)
+    _disqualifyPromotion(node[2], candidates, disqualified, initSet, valTypes)
+    if (!_isNumericKey(node[2], valTypes)) disqualified.add(node[1])
     return
   }
 
@@ -1023,15 +1094,15 @@ const _disqualifyPromotion = (node, candidates, disqualified, initSet) => {
   if (ASSIGN_OPS.has(op) && Array.isArray(node[1]) && node[1][0] === '[]' &&
       typeof node[1][1] === 'string' && candidates.has(node[1][1])) {
     disqualified.add(node[1][1])
-    _disqualifyPromotion(node[1][2], candidates, disqualified, initSet)
-    _disqualifyPromotion(node[2], candidates, disqualified, initSet)
+    _disqualifyPromotion(node[1][2], candidates, disqualified, initSet, valTypes)
+    _disqualifyPromotion(node[2], candidates, disqualified, initSet, valTypes)
     return
   }
 
   // Whole-binding reassign: `name = …` / `name += …` / etc.
   if (ASSIGN_OPS.has(op) && typeof node[1] === 'string' && candidates.has(node[1])) {
     disqualified.add(node[1])
-    _disqualifyPromotion(node[2], candidates, disqualified, initSet)
+    _disqualifyPromotion(node[2], candidates, disqualified, initSet, valTypes)
     return
   }
 
@@ -1041,7 +1112,7 @@ const _disqualifyPromotion = (node, candidates, disqualified, initSet) => {
     if (typeof t === 'string' && candidates.has(t)) { disqualified.add(t); return }
     if (Array.isArray(t) && t[0] === '[]' && typeof t[1] === 'string' && candidates.has(t[1])) {
       disqualified.add(t[1])
-      _disqualifyPromotion(t[2], candidates, disqualified, initSet)
+      _disqualifyPromotion(t[2], candidates, disqualified, initSet, valTypes)
       return
     }
   }
@@ -1056,9 +1127,9 @@ const _disqualifyPromotion = (node, candidates, disqualified, initSet) => {
       else if (Array.isArray(d) && d[0] === '=' && typeof d[1] === 'string' &&
                candidates.has(d[1]) && !initSet.has(d)) {
         disqualified.add(d[1])
-        _disqualifyPromotion(d[2], candidates, disqualified, initSet)
+        _disqualifyPromotion(d[2], candidates, disqualified, initSet, valTypes)
       } else {
-        _disqualifyPromotion(d, candidates, disqualified, initSet)
+        _disqualifyPromotion(d, candidates, disqualified, initSet, valTypes)
       }
     }
     return
@@ -1080,14 +1151,14 @@ const _disqualifyPromotion = (node, candidates, disqualified, initSet) => {
     for (let i = 1; i < node.length; i++) {
       const child = node[i]
       if (i === 2 && typeof child === 'string' && candidates.has(child)) continue
-      _disqualifyPromotion(child, candidates, disqualified, initSet)
+      _disqualifyPromotion(child, candidates, disqualified, initSet, valTypes)
     }
     return
   }
 
   // Generic — recurse into children. Bare-name refs at unhandled positions
   // hit the string-leaf branch above and disqualify on contact.
-  for (let i = 1; i < node.length; i++) _disqualifyPromotion(node[i], candidates, disqualified, initSet)
+  for (let i = 1; i < node.length; i++) _disqualifyPromotion(node[i], candidates, disqualified, initSet, valTypes)
 }
 
 // Walk `body` to collect every `let X = [intLit, …]` candidate. Each entry
@@ -1155,8 +1226,11 @@ const promoteIntArrayLiteralsInBody = (body) => {
   if (!candidates.size) return { node: body, changed: false }
   const initSet = new Set()
   for (const { initDecl } of candidates.values()) initSet.add(initDecl)
+  // valTypes from analyzeBody gives per-local VAL.* kinds, used by
+  // _disqualifyPromotion to prove index keys are numeric (see _isNumericKey).
+  const { valTypes } = analyzeBody(body)
   const disqualified = new Set()
-  _disqualifyPromotion(body, candidates, disqualified, initSet)
+  _disqualifyPromotion(body, candidates, disqualified, initSet, valTypes)
   const validated = new Set()
   for (const name of candidates.keys()) if (!disqualified.has(name)) validated.add(name)
   if (!validated.size) return { node: body, changed: false }

package/src/ctx.js

@@ -38,11 +38,11 @@ export { HEAP, LAYOUT, PTR, ATOM, FORWARDING_MASK, nanPrefixHex, atomNanHex, sso
 // |-----------|----------|---------------------------------|---------------------------|
 // | core      | compile  | reset, modules, inc(), emit*    | emit, compile, modules    |
 // | module    | compile  | prepare, index.js               | prepare, compile, emit    |
-// | scope     | compile  | analyze, compile, plan, modules | compile, emit             |
-// | func      | function | compile, narrow                 | emit, modules             |
+// | scope     | compile  | analyze, compile, plan, modules, assemble | compile, emit   |
+// | func      | function | compile, narrow, assemble       | emit, modules             |
 // | types     | function | analyze, plan                   | emit, modules             |
 // | schema    | compile  | prepare, analyze, compile       | prepare, analyze, emit    |
-// | closure   | init     | modules (fn plugin)             | emit, compile             |
+// | closure   | init     | modules (fn plugin), plan, emit | emit, compile             |
 // | runtime   | compile  | emit, modules                   | emit, compile             |
 // | memory    | compile  | index.js                        | compile                   |
 // | error     | compile  | prepare, compile, emit          | err()                     |
@@ -63,6 +63,11 @@ export { HEAP, LAYOUT, PTR, ATOM, FORWARDING_MASK, nanPrefixHex, atomNanHex, sso
 // narrow-phase writers: narrowSignatures (under plan) temporarily swaps
 //   ctx.func.{localReps, locals, current} per-function with save/restore
 //   so per-call-site signature inference sees the right scope.
+// assemble-phase writers: buildStartFn (wat/assemble.js) re-owns the ctx.func frame
+//   (locals/stack/refinements/…) to emit the module-init `start` fn, save/restoring
+//   around it; the data pass also const-folds ctx.scope.globals (mut→false) and
+//   declares the __heap* globals. emit seeds ctx.closure.{paramTypes,paramTypedCtors}
+//   at direct-call sites (read by emitClosureBody); plan sets ctx.closure.{floor,width}.
 export const ctx = {
   core: {},       // emitter table + stdlib registry (seeded by reset + modules)
   module: {},     // module graph: imports, resolved sources, module-init blocks
@@ -92,9 +97,14 @@ export const ctx = {
                   // the defaults; see reset() for the field list and who flips each.
 }
 
-/** Create a child scope via shallow flat copy (metacircular-safe: no prototype chain).
+/** Create a child scope via shallow flat copy with NO prototype chain. Critical:
+ *  `{ ...parent }` would inherit Object.prototype in V8 (jz.js), so a name-keyed lookup
+ *  like `chain['valueOf']`/`emit['toString']` returns the inherited method instead of
+ *  undefined — corrupting resolution of any identifier named like an Object method. The
+ *  kernel's jz objects are already prototype-less, so this was a jz.js-ONLY footgun. A
+ *  prototype-less dict (Object.create(null) + assign) is correct in both engines.
  *  Mutations to the child do not affect the parent; lookups work via direct property access. */
-export const derive = (parent) => ({ ...parent })
+export const derive = (parent) => Object.assign(Object.create(null), parent)
 
 /** Include stdlib names for emission. */
 export const inc = (...names) => names.forEach(n => ctx.core.includes.add(n))
@@ -133,12 +143,19 @@ export const emitter = (deps, fn) => {
  *  carry it as `.argc`; bare ones expose it as the function's own `.length`. */
 export const emitArity = (h) => h?.argc ?? h?.length
 
-/** Tag an emit handler as a property getter — it yields a value when the
- *  property is *read* (`re.source`, `m.size`), so the `.`-read path may fire it.
- *  Untagged handlers are methods: a bare read of `m.values` must not invoke them
- *  (that would materialize a view instead of reading the `"values"` property);
- *  they fire only from the method-call path. Apply outermost: `getter(emitter(…))`. */
-export const getter = (fn) => (fn.getter = true, fn)
+/** Register `fn` as a property-GETTER emitter for `key` — it yields a value when
+ *  the property is *read* (`re.source`, `m.size`, `a.byteOffset`), so the `.`-read
+ *  path fires it. (Untagged `ctx.core.emit` handlers are methods: a bare read of
+ *  `m.values` must NOT invoke them — that would materialize a view — they fire only
+ *  from the method-call path.) Getter-ness lives in `ctx.core.getters` (a plain Set),
+ *  NOT as a flag on the emitter closure: the self-host kernel can't reliably read a
+ *  dynamic property off a closure returned via a dynamic-key lookup, so a closure tag
+ *  silently read `undefined` and every getter fell through to `__dyn_get`. A Set
+ *  key-lookup is kernel-safe. Dispatch (module/core.js) checks `ctx.core.getters.has(key)`. */
+export const registerGetter = (key, fn) => {
+  ctx.core.emit[key] = fn
+  ctx.core.getters.add(key)
+}
 
 /** Expand ctx.core.includes transitively via ctx.core.stdlibDeps. Call before WASM assembly.
  *  Each module co-locates its own deps with its stdlib registrations at init time. */
@@ -207,6 +224,13 @@ export function reset(proto, globals, bridge) {
                             // `(import "env" "name" (global $name i64))` at assembly. Same
                             // usage-gated pattern as jsstring — emit records, assembly owns
                             // the ctx.module.imports write.
+    getters: new Set(), // keys of emit entries that are property getters — the
+                        // kernel-safe authority for getter dispatch (a closure-attached
+                        // flag was unreadable in the self-host kernel after a dynamic-key
+                        // lookup, so every getter silently fell through to __dyn_get).
+                        // MUST remain last: adding fields before stdlib/stdlibDeps/… shifts
+                        // their slot indices and breaks the self-host compiled kernel's reads.
+                        // Populated by registerGetter(); checked by module/core.js dispatch.
   }
 
 
@@ -234,6 +258,10 @@ export function reset(proto, globals, bridge) {
     globalTypedElem: null,
     globalReps: null, // Map<name, ValueRep> — module-level pointer reps (TYPED const globals stored as raw i32 offset, etc.)
     consts: null,
+    constInts: null,      // Map<name, int> — module const folded to an integer literal (prepare/plan seed; static/ir read)
+    constStrs: null,      // Map<name, string> — module const folded to a string literal
+    shapeStrs: null,      // Map<expr, string> / shapeStrArrays: Map<name, string[]> — schema-shape string folds
+    shapeStrArrays: null,
   }
 
   ctx.func = {
@@ -241,7 +269,7 @@ export function reset(proto, globals, bridge) {
     names: new Set(),  // Set<string> — known func names (list + imported funcs); populated at compile() start
     map: new Map(),    // Map<string, func> — name → func entry; populated at compile() start
     multiProp: new Set(),  // Set<"obj.prop"> — function-properties assigned >1× (wrapper composition); suppresses the static fn.prop() direct call
-    exports: {},
+    exports: Object.create(null),  // name-keyed: prototype-less (see derive) — `export let valueOf` must not hit Object.prototype
     current: null,
     locals: new Map(),
     localReps: null,
@@ -324,6 +352,8 @@ export function reset(proto, globals, bridge) {
     minArgc: null,        // Map<closureBodyName, number> — fewest args any direct call passed.
                           // A slot at index ≥ minArgc is omitted by some call (→ may be undefined),
                           // so it must NOT be typed NUMBER, else `x === undefined` mis-folds to false.
+    floor: null,          // min closure-table arity (modules: fn/timer/typedarray/array; read in plan). null ⇒ 0.
+    width: null,          // closure call/make signature width (plan/scope sets; emit/assemble read). null ⇒ MAX_CLOSURE_ARITY.
   }
 
   ctx.runtime = {
@@ -370,6 +400,15 @@ export function reset(proto, globals, bridge) {
     inspect: false,     // when true, compile() additionally populates ctx.inspect with the inferred
                         // per-function signatures, locals, and JSON shapes — readable by editor
                         // hosts for inlay hints / hover types without re-running the analyzer.
+    helperCounters: false, // internal profiling mode: export mutable i64 counters for selected
+                           // runtime helpers and instrument their entry blocks. Build-time opt-in
+                           // only; normal output is byte-identical and pays no counter cost.
+    helperCallsites: false, // profiling-only: export mutable i64 counters for selected runtime
+                            // helper callsites after optimization, so hot helpers can be traced
+                            // back to the compiled function that calls them.
+    loopXformId: 0,     // monotonic id for the per-function loop transforms' generated locals
+                        // (loop-model freshLoopId). Per-compile (reset here), not a module-global —
+                        // so compile(P) is deterministic regardless of prior compiles in the process.
   }
 
   // Inspection sink. Populated by compile() only when transform.inspect is true.