jz 0.8.1 → 0.9.0

package/src/compile/peel-stencil.js

@@ -206,6 +206,11 @@ function tryPeel(stmt, cm) {
   // for: append the step to each split loop's body; while: body already increments.
   const mk = (B, bod) => ['while', ['<', iv, B], step ? [';', ...bod.slice(1), step] : bod]
   const loops = [mk(xs, body), mk(xe, interiorBody), mk(bound, body)]
+  // Range theorem for the interval proof (typedIdxProven class 5): the peel's own
+  // bit-exactness argument — for interior iv, `ci = iv + k ∈ [0, bound-1]` WITHOUT
+  // the clamp. Stamped on the interior loop's FINAL body node (mk may rebuild it);
+  // the interval walk intersects ci's env writes with it while inside the subtree.
+  loops[1][2]._rangeFacts = [[clamp.ci, bound]]
   return init ? [init, seed, ...loops] : [seed, ...loops]
 }
 

package/src/compile/plan/index.js

@@ -25,17 +25,19 @@
  */
 
 import { ctx } from '../../ctx.js'
-import { collectProgramFacts, refreshProgramFacts } from '../program-facts.js'
+import { invalidateLocalsCache } from '../analyze.js'
+import { collectProgramFacts, refreshProgramFacts, analyzeSchemaSlotIntCertain, observeProgramSlots, analyzeParamNeverGrown } from '../program-facts.js'
 import narrowSignatures, {
-  specializeBimorphicTyped, refineDynKeys,
+  specializeBimorphicTyped, speculateTypedParams, refineDynKeys,
   applyJsstringBoundaryCarrierStandalone, narrowBoolResults,
   strictBoundaryTypeCheck,
 } from '../narrow.js'
 
 import { optimizing } from './common.js'
 import { adviseProgram } from './advise.js'
+import { scanInplaceStores } from '../inplace-store.js'
 import {
-  inferModuleLetTypes, unboxConstTypedGlobals, inferModuleIntGlobals,
+  inferModuleLetTypes, inferModuleGlobalValTypes, unboxConstTypedGlobals, inferModuleIntGlobals, refineFieldProvenance,
   flattenFuncNamespaces, devirtGlobalCalls,
   materializeAutoBoxSchemas, resolveClosureWidth, canSkipWholeProgramNarrowing,
 } from './scope.js'
@@ -59,6 +61,10 @@ export default function plan(ast, profiler) {
   }
 
   t('inferModuleLetTypes', () => inferModuleLetTypes(ast))
+  // Pass 1 (no call-site param facts yet): literal/alias/global-to-global
+  // evidence only. Early enough that a freshly-proven NUMBER global still
+  // reaches inferModuleIntGlobals's candidacy check below.
+  t('inferModuleGlobalValTypes', () => inferModuleGlobalValTypes(ast))
   t('unboxConstTypedGlobals', unboxConstTypedGlobals)
   t('inferModuleIntGlobals', () => inferModuleIntGlobals(ast))
 
@@ -97,6 +103,10 @@ export default function plan(ast, profiler) {
   ctx.types.dynKeyVars = programFacts.dynVars
   ctx.types.dynWriteVars = programFacts.dynWriteVars
   ctx.types.anyDynKey = programFacts.anyDyn
+  ctx.types.literalWriteKeys = programFacts.literalWriteKeys
+  ctx.types.writtenProps = programFacts.writtenProps
+  ctx.types.arrResized = programFacts.arrResized
+  ctx.types.nameEscapes = programFacts.nameEscapes
 
   t('materializeAutoBoxSchemas', () => materializeAutoBoxSchemas(programFacts))
   t('resolveClosureWidth', () => resolveClosureWidth(programFacts))
@@ -113,11 +123,43 @@ export default function plan(ast, profiler) {
   }
 
   t('narrowSignatures', () => narrowSignatures(programFacts, ast))
+  // Pass 2: narrowSignatures has now settled `programFacts.paramReps`, so a
+  // global written from a bare parameter alias (`cur = s`, subscript's parse-
+  // state shape) resolves — pass 1 saw only an untyped param and poisoned it.
+  // Idempotent: names pass 1 already claimed are skipped.
+  t('inferModuleGlobalValTypes2', () => inferModuleGlobalValTypes(ast, programFacts.paramReps))
   // After narrowSignatures (params now carry ptrKind): mark typed-array params that every call
   // site passes a distinct fresh buffer for → enables alias-aware LICM in the optimizer.
   if (optimizing()) t('analyzeParamDistinctness', () => analyzeParamDistinctness(programFacts))
+  // Slot-kind census REBUILD with post-narrowing receiver resolution: the early
+  // hazard scan can't type params (`re[j] = tr` on a then-unnarrowed TYPED param
+  // read as a world-poisoning keyed write), so recompute hazards with paramReps
+  // and rebuild slotTypes/slotTypedCtors fresh BEFORE their consumers below
+  // (inplace sweep, bimorphic split, typed-param speculation) and at emit.
+  t('refineSlotKindCensus', () => observeProgramSlots(ast, { fresh: true, paramReps: programFacts.paramReps }))
+  // Cross-function neverGrown for read-only array PARAMS (growth-free callee
+  // closure + safeReads) — the raw-base element read skips __ptr_offset.
+  if (optimizing()) t('analyzeParamNeverGrown', () => analyzeParamNeverGrown(programFacts.paramReps))
+  // Whole-program alias sweep for in-place replace-stores (`arr[i] = {lit}` →
+  // overwrite the old element's slots) — needs the settled arrayElemSchema
+  // facts, so it runs after the signature fixpoint.
+  if (optimizing()) t('scanInplaceStores', () => scanInplaceStores(programFacts))
   t('specializeBimorphicTyped', () => specializeBimorphicTyped(programFacts))
+  if (optimizing()) t('speculateTypedParams', () => speculateTypedParams(programFacts, ast))
   t('refineDynKeys', () => refineDynKeys(programFacts))
+  // Late: return sids (narrowSignatures) + the slot/write censuses are complete —
+  // bind module consts' schemas from returned objects, then re-run the module-let
+  // ctor fixpoint whose FIELD evidence (slotTypedCtorAt, write-gated) resolves
+  // only now. Upgrade-only: strictly more evidence than the early run.
+  t('refineFieldProvenance', () => refineFieldProvenance(ast))
+  t('refineModuleLetTypes', () => inferModuleLetTypes(ast))
+  // Late slot-int census: rebuild FRESH with body-local element-alias sids
+  // (`const p = ps[i]` through the param's arrayElemSchema — knowledge that
+  // exists only after narrowing). Consumers read at emit, after this.
+  t('refineSlotIntCensus', () => analyzeSchemaSlotIntCertain(ast, { paramReps: programFacts.paramReps }))
+  // The late upgrades land through analyzeBody's trackers — drop the cached
+  // walks so emit-time re-analysis sees the new field kinds.
+  for (const f of ctx.func.list) if (f.body && !f.raw) invalidateLocalsCache(f.body)
   strictBoundaryTypeCheck(programFacts)
 
   adviseProgram(programFacts)

package/src/compile/plan/inline.js

@@ -465,7 +465,14 @@ export const inlineHotInternalCalls = (programFacts, ast) => {
     // The 2-site non-tiny-leaf cap would otherwise outline a hot helper like noise's `grad`
     // (~30 nodes, called 4× from perlin) and freeze the call overhead per pixel.
     const isSmallLeaf = !hasLoop && nodeSize(func.body) <= 48
-    if (!sites || sites.length < 1 || (!isTinyLeaf && !isSmallLeaf && !fixedTypedArraySite && sites.length > 2) || sites.length > 8) continue
+    // Leaf site cap scales with body size — the cost of inlining N sites is
+    // N·size nodes, not N: a 30-node pure leaf hammered from 9 sites (colorpq's
+    // spow) is 270 spliced nodes, cheaper than 9 call frames per pixel, while a
+    // 48-node body keeps the old 8-site bound (360/48 → 8). Full inlining also
+    // restores shape identity for downstream CSE — a PARTIAL split (some sites
+    // inlined, some calls) makes duplicate pure subtrees structurally unequal.
+    const leafSiteCap = (isTinyLeaf || isSmallLeaf) ? Math.max(8, Math.floor(360 / Math.max(1, nodeSize(func.body)))) : 8
+    if (!sites || sites.length < 1 || (!isTinyLeaf && !isSmallLeaf && !fixedTypedArraySite && sites.length > 2) || sites.length > leafSiteCap) continue
     const stmts = blockStmts(func.body)
     // Expression-bodied arrow funcs (`(c) => expr`) have no block — body IS the
     // return value. Treat as a "tiny leaf" branch handled below; force hasLoop=false.

package/src/compile/plan/literals.js

@@ -947,6 +947,33 @@ export const scalarizeFunctionArrayLiterals = () => {
 // re-dispatch via emit.js:2211's `.typed:<m>` lookup (VAL.TYPED ⇒ typed
 // emitter). Methods missing here (.join, .sort, .reverse, .subarray, .fill,
 // .toString, .copyWithin, …) lack a typed emitter — disqualify the candidate.
+// Does an inline arrow callback provably yield a NUMBER for every element?
+// Conservative: only shapes whose result is structurally numeric qualify —
+// arithmetic/bitwise/compare ops, numeric literals, the element param itself,
+// Math.* calls. A call to a user fn, an object/array/string literal, or any
+// unknown shape returns false (the caller then keeps the plain-array rep).
+const _NUM_OPS = new Set(['+', '-', '*', '/', '%', '**', '|', '&', '^', '<<', '>>', '>>>',
+  '<', '<=', '>', '>=', '==', '!=', '===', '!==', '!', '~', 'u+', 'u-'])
+const _numericCallbackBody = (fn) => {
+  if (!Array.isArray(fn) || fn[0] !== '=>') return false
+  const params = new Set()
+  const raw = fn[1]
+  for (const p of Array.isArray(raw) && raw[0] === ',' ? raw.slice(1) : raw != null ? [raw] : [])
+    if (typeof p === 'string') params.add(p)
+  const numeric = (n) => {
+    if (typeof n === 'number') return true
+    if (typeof n === 'string') return params.has(n)   // element/index param — numeric under a promoted receiver
+    if (!Array.isArray(n)) return false
+    if (n[0] == null) return typeof n[1] === 'number' // number node — wrapper is null OR undefined in the live AST
+    if (_NUM_OPS.has(n[0])) return n.slice(1).every(a => a == null || numeric(a))
+    if (n[0] === '()' && typeof n[1] === 'string' && n[1].startsWith('Math.')) return true
+    if (n[0] === '?' && n.length === 4) return numeric(n[2]) && numeric(n[3])
+    return false
+  }
+  // expression body only; block bodies ({…return…}) stay conservative
+  return numeric(fn[2])
+}
+
 const _TYPED_SAFE_METHODS = new Set([
   'set',
   'map', 'filter', 'slice',
@@ -1059,11 +1086,23 @@ const _disqualifyPromotion = (node, candidates, disqualified, initSet, valTypes)
     if (Array.isArray(callee) && (callee[0] === '.' || callee[0] === '?.') &&
         typeof callee[1] === 'string' && candidates.has(callee[1])) {
       if (!_TYPED_SAFE_METHODS.has(callee[2])) disqualified.add(callee[1])
+      // `.map` is the one whitelisted method that writes CALLBACK RESULTS into the
+      // typed output: `.typed:map` ToNumber-coerces them (spec for a REAL typed
+      // receiver), but a plain array's map must return the callback's values
+      // verbatim — `[10,20].map(s => mk(s))` yields objects. Promote across map
+      // only when the callback provably yields numbers; anything else (object/
+      // string/unknown call results) keeps the plain-array representation.
+      else if (callee[2] === 'map' && !_numericCallbackBody(node[2])) disqualified.add(callee[1])
       // Walk method args (skip the receiver — already validated above).
       for (let i = 2; i < node.length; i++) _disqualifyPromotion(node[i], candidates, disqualified, initSet, valTypes)
       return
     }
     // Array.isArray flips true→false under promotion.
+    // KNOWN GAP (recorded in .work/todo.md, extension-surface archive): a DERIVED value of a
+    // promoted array (`s = a.slice(0); Array.isArray(s)`) is not tracked here,
+    // so promotion survives and isArray answers false at O2+. Fixing it needs
+    // derived-name flow, not a blanket disqualifier (a blanket one regressed
+    // the __to_num elision pin) — a focused optimizer-session item.
     if (callee === 'Array.isArray') {
       const raw = node[2]
       const list = raw == null ? [] : (Array.isArray(raw) && raw[0] === ',') ? raw.slice(1) : [raw]