jz 0.9.1 → 0.9.2

package/src/ctx.js

@@ -385,6 +385,20 @@ export function reset(proto, globals, bridge) {
                                 //   Populated whole-program by `analyzeStructInline`
                                 //   (default-disqualify); read by the array
                                 //   push/index/length codegen.
+    inlineCellI32: new Set(),   // inlineArray subset — every slot strict-int32
+                                //   (slotI32Certain) and K ≥ 2, so the element
+                                //   packs K raw i32 cells (⌈K/2⌉ physical 8-byte
+                                //   cells, C's exact record layout): raw i32
+                                //   loads/stores, no trunc_sat/convert per field.
+                                //   Standalone `{S}` objects of the same sid keep
+                                //   f64 slots — the packed decision rides the
+                                //   CURSOR (inlineCellCursors → node.cellI32),
+                                //   never the bare sid.
+    inlineCellCursors: new Map(), // sig → Set<name>: `const p = a[i]` cursor
+                                //   locals of packed (inlineCellI32) arrays in
+                                //   that function — readVar tags their reads
+                                //   with `.cellI32` so slot access picks the
+                                //   packed i32 ops instead of f64 cells.
   }
 
   ctx.closure = {

package/src/ir.js

@@ -835,7 +835,7 @@ export const cloneIR = (n) => Array.isArray(n) ? n.map(cloneIR) : n
  *  anything else → itself. `valIR` must be side-effect-free (a local read) — it is duplicated,
  *  so each occurrence gets a fresh clone. Used for bindings flagged in ctx.func.maybeNullish;
  *  a real number isn't either sentinel, so it falls through the `else` unchanged. */
-const coerceNullishToNum = (valIR) => typed(
+export const coerceNullishToNum = (valIR) => typed(
   ['if', ['result', 'f64'],
     ['i64.eq', ['i64.reinterpret_f64', cloneIR(valIR)], ['i64.const', NULL_NAN]],
     ['then', ['f64.const', 0]],
@@ -857,6 +857,26 @@ export function toNumF64(node, v) {
   // not a number — skipping coercion would reinterpret pointer bits as an f64.
   // Only a plain i32 (loop counter, `x|0`) is genuinely already-numeric.
   if ((v.type === 'i32' && v.ptrKind == null) || isLit(v)) return asF64(v)
+  // Checked typed-array read (`.typed:[]` tags checkedNumRead): number|undefined
+  // with the undefined confined to a CONSTANT miss arm. ToNumber of that arm
+  // folds statically (undefined → canonical NaN) — the hit arm is already a
+  // plain-number load. Without the fold the UNDEF sentinel enters f64 arithmetic
+  // as a "number" (valTypeOf claims NUMBER from the ELEMENT type, blind to the
+  // OOB path — checked BEFORE the vt fast-outs below for exactly that reason),
+  // and hardware NaN propagation carries its PAYLOAD to the escape, where the
+  // boundary decodes it back as `undefined` (JS: NaN).
+  if (v.checkedNumRead && Array.isArray(v)) {
+    const foldArm = (n) => Array.isArray(n) && n[0] === 'f64.const' && n[1] === `nan:${UNDEF_NAN}`
+      ? ['f64.const', 'nan'] : n
+    if (v[0] === 'if')   // (if (result f64) cond (then load) (else UNDEF))
+      return typed(v.map(c => Array.isArray(c) && c[0] === 'else' && c.length === 2
+        ? ['else', foldArm(c[1])] : c), 'f64')
+    if (v[0] === 'block') {   // (block (result f64) …sets (select load UNDEF in))
+      const tail = v[v.length - 1]
+      if (Array.isArray(tail) && tail[0] === 'select')
+        return typed([...v.slice(0, -1), ['select', tail[1], foldArm(tail[2]), tail[3]]], 'f64')
+    }
+  }
   // A binding assigned a nullish literal may hold null/undefined here — coerce per ToNumber
   // (null→+0, undefined→NaN); a real number falls through unchanged. Only flagged bindings pay
   // this, so the numeric kernels jz optimizes for (which never assign null) stay untouched.
@@ -1240,6 +1260,11 @@ export function readVar(name) {
     node.ptrKind = rep.ptrKind
     const aux = rep.ptrAux ?? ctx.schema.idOf?.(name)
     if (aux != null) node.ptrAux = aux
+    // structInline cursor into a PACKED (i32-cell) array: slot access must
+    // pick the packedI32 ops, not the f64 slot layout — the flag rides the
+    // node because a standalone object of the same sid keeps f64 slots.
+    if (rep.ptrKind === VAL.OBJECT && ctx.schema.inlineCellCursors?.get(ctx.func.current)?.has(name))
+      node.cellI32 = true
   }
   return node
 }

package/src/optimize/index.js

@@ -166,6 +166,7 @@ const LEVEL_PRESETS = Object.freeze({
     unrollRecurrence: false,  // ×2 body duplication is a size regression — speed-only
     clampPeel: false,         // edge-clamp peel triples a stencil loop (clamp-free interior + 2 edges) to vectorize — speed-only
     versionTypedBounds: false,// typed-bounds loop versioning duplicates every proven nest (guarded fast arm + checked twin, ×1.5-3 on small kernels) — the branchless checked reads alone are the size-tier lowering; speed-only trade
+    leanCheckedIdx: true,     // unproven typed reads emit the if-form (guard → direct load, else undefined) — ~6 ops/site smaller than the select-clamp form, which exists only so SPEED-tier kernel bodies stay branch-free for the SIMD lift (off here)
 
     boolConvertToSelect: false,  // adds a const + op per site — speed-only latency trade
     devirtIndirect: false,    // guards + duplicated args grow bytes — speed-only trade

package/src/optimize/vectorize.js

@@ -978,6 +978,32 @@ function matchLaneOffset(off, ind, offsetTees, allowAos, aosPix, idxTees) {
   return null
 }
 
+/**
+ * Mirror lane address: `base + ((INV − iv) << K)` — the DESCENDING twin of the
+ * canonical lane address (symmetric fills: `inp[N−k] = lm`). INV is an i32
+ * const or a bare local; the CALLER must verify a named INV is body-invariant
+ * (not in the body writes set). f64 store sites only (2 lanes): the vector for
+ * (iv, iv+1) mirrors to (INV−iv, INV−iv−1) — contiguous descending, stored as
+ * one v128 at INV−iv−1 with the lanes swapped.
+ */
+function matchMirrorAddr(addr, ind) {
+  if (!isArr(addr) || addr[0] !== 'i32.add' || addr.length !== 3) return null
+  for (const k of [1, 2]) {
+    const off = addr[k]
+    if (!isArr(off) || off[0] !== 'i32.shl' || off.length !== 3) continue
+    const K = constNum(off[2])
+    if (K == null || K < 0 || K > 3) continue
+    const sub = off[1]
+    if (!isArr(sub) || sub[0] !== 'i32.sub' || sub.length !== 3) continue
+    if (!isLocalGet(sub[2], ind)) continue
+    const inv = sub[1]
+    const invName = isArr(inv) && inv[0] === 'local.get' && typeof inv[1] === 'string' ? inv[1] : null
+    if (!invName && constNum(inv) == null) continue
+    return { base: addr[k === 1 ? 2 : 1], invExpr: inv, invName, strideLog2: K }
+  }
+  return null
+}
+
 /**
  * Match an address expression `(i32.add base OFFSET)`, with optional outer
  * `(local.tee $A ...)`. OFFSET is matched by matchLaneOffset (which also
@@ -1267,6 +1293,7 @@ function tryVectorize(bl, fnLocals, freshIdRef, pureFuncMap, constLocals) {
   const allowAos = true
   const aosPix = new Map()
   let aosPixelStride = 1
+  const mirrorSites = []   // mirror stores a[INV−iv] — invariance of INV checked post-scan
   // Pixel-INDEX locals: `$J = P*i` (the `const j = 3*i` of an AoS loop, kept as its own local
   // pre-watr). A channel address is then `base + ((local.get $J) << K)`; idxTees lets
   // matchLaneOffset resolve $J → pixel-stride P. Value -1 marks an inconsistent local (bail).
@@ -1357,8 +1384,20 @@ function tryVectorize(bl, fnLocals, freshIdRef, pureFuncMap, constLocals) {
       if (laneType != null && sty !== laneType && !narrowing) return false
       if (laneType == null) { laneType = sty; stride = LANE_INFO[laneType].stride }
       const memarg = typeof node[1] === 'string' && node[1].startsWith('offset=')
-      const m = matchLaneAddr(memAddr(node), incVar, addrLocals, offsetTees, allowAos, aosPix, idxTees)
-      if (!m) return false
+      let m = matchLaneAddr(memAddr(node), incVar, addrLocals, offsetTees, allowAos, aosPix, idxTees)
+      if (!m) {
+        // mirror store `a[INV − iv] = lane` (f64, full-width, no memarg): the
+        // descending twin — accepted as its own site class; INV invariance is
+        // verified post-scan against the body writes set.
+        const mm = !memarg && sty === 'f64' && laneType === 'f64' && matchMirrorAddr(memAddr(node), incVar)
+        if (mm && (1 << mm.strideLog2) === stride) {
+          mirrorSites.push(mm)
+          siteStrides.push(1)
+          loadStoreSites.push({ parent, idx: pi, kind: 'store' })
+          return scanForLoadsStores(node[2], node, 2)
+        }
+        return false
+      }
       if ((1 << m.strideLog2) !== (narrowing ? LANE_INFO[sty].stride : stride)) return false
       if (!recordAos(m)) return false
       if (m.teeName) addrLocals.set(m.teeName, { strideLog2: m.strideLog2, pixelStride: m.pixelStride, base: m.base })
@@ -1410,6 +1449,10 @@ function tryVectorize(bl, fnLocals, freshIdRef, pureFuncMap, constLocals) {
   const writes = new Set()
   for (const s of body) collectWrites(s, writes)
   if (boundLocal && writes.has(boundLocal)) return null  // bound varies in body → bail
+  // a mirror INV written in the body is not invariant — the descending window would drift
+  for (const mm of mirrorSites) if (mm.invName && writes.has(mm.invName)) return null
+  // AoS gather/scatter and mirror windows don't compose (distinct per-step deltas)
+  if (mirrorSites.length && aosPixelStride > 1) return null
 
   const localKind = new Map()  // name → 'lane' | 'invariant' | 'addr'
   // Walk to collect ALL referenced names
@@ -1542,9 +1585,14 @@ function tryVectorize(bl, fnLocals, freshIdRef, pureFuncMap, constLocals) {
     ]
   ]
 
-  // Bound setup: simdBoundName = bound & ~(lanes-1)
+  // Bound setup: align the SPAN, not the bound — simdBound = iv + ((bound − iv)
+  // & ~(lanes−1)). `bound & mask` assumed a 0 entry: a loop entering at k=1
+  // (symmetric fills start past the DC bin) would run its last vector step at
+  // k = bound−1 and overrun one lane past the bound. iv holds the entry value
+  // here (the setup precedes the SIMD block).
   const boundSetup = ['local.set', simdBoundName,
-    ['i32.and', boundExpr, ['i32.const', mask]]]
+    ['i32.add', ['local.get', incVar],
+      ['i32.and', ['i32.sub', boundExpr, ['local.get', incVar]], ['i32.const', mask]]]]
 
   // Synthetic outer wrapper — has no result, no label, just sequences.
   // A clone of any LICM-hoisted preamble runs first (so the SIMD block sees the
@@ -2359,7 +2407,10 @@ function tryMapReduceVectorize(bl, fnLocals, freshIdRef) {
       ...lifted,
       ['local.set', incVar, ['i32.add', ['local.get', incVar], ['i32.const', 2]]],
       ['br', simdLoop]]]
-  const boundSetup = ['local.set', simdBoundName, ['i32.and', boundExpr, ['i32.const', -2]]]
+  // span-aligned (same entry≠0 hazard as tryVectorize's bound — see there)
+  const boundSetup = ['local.set', simdBoundName,
+    ['i32.add', ['local.get', incVar],
+      ['i32.and', ['i32.sub', boundExpr, ['local.get', incVar]], ['i32.const', -2]]]]
   const wrapper = ['block', boundSetup, simdBlock, bl.blockNode]
   return { wrapper, newLocalDecls: [['local', simdBoundName, 'i32'], ...newLocalDecls] }
 }
@@ -2807,6 +2858,26 @@ function liftStmt(stmt, ctx) {
     // Handle memarg if present (last positional after addr/val): unlikely in
     // pre-watr IR for this shape; bail if more than 3 children.
     if (stmt.length !== 3) return liftFail(ctx, `${op} with memarg`)
+    // Mirror store `a[INV − iv] = lane` (f64, 2 lanes): the vector's lanes
+    // (iv, iv+1) mirror to (INV−iv, INV−iv−1) — one v128 store at INV−iv−1
+    // with the f64 lanes SWAPPED. The scalar remainder keeps the plain form.
+    if (ctx.laneType === 'f64' && sty === 'f64') {
+      const mm = matchMirrorAddr(addr, ctx.incVar)
+      if (mm) {
+        const v = liftExprV(stmt[2], ctx)
+        if (ctx.fail) return null
+        const vt = `$__mirv${ctx.freshIdRef.next++}`
+        ctx.extraLocals.push(['local', vt, 'v128'])
+        const mAddr = ['i32.add', mm.base,
+          ['i32.shl', ['i32.sub', ['i32.sub', mm.invExpr, ['local.get', ctx.incVar]], ['i32.const', 1]],
+            ['i32.const', mm.strideLog2]]]
+        return ['__seq__',
+          ['local.set', vt, v],
+          ['v128.store', mAddr,
+            ['i8x16.shuffle', '8', '9', '10', '11', '12', '13', '14', '15', '0', '1', '2', '3', '4', '5', '6', '7',
+              ['local.get', vt], ['local.get', vt]]]]
+      }
+    }
     // Narrowing store: a narrower element written from a wider float lane (`o[i] =
     // narrow(f(x))` — codec encode / downsample). The scalar store value carries a
     // conversion (f32.demote_f64, or the float→int ToInt32 idiom); peel it, lift the
@@ -3992,7 +4063,10 @@ function tryRampMap(blockNode, fnLocals, freshIdRef) {
       ...lifted,
       ...scaledIncs,
       ['br', simdLoopLabel]]]
-  const boundSetup = ['local.set', simdBoundName, ['i32.and', boundExpr, ['i32.const', -LANES]]]
+  // span-aligned (same entry≠0 hazard as tryVectorize's bound — see there)
+  const boundSetup = ['local.set', simdBoundName,
+    ['i32.add', ['local.get', ivName],
+      ['i32.and', ['i32.sub', boundExpr, ['local.get', ivName]], ['i32.const', -LANES]]]]
   const wrapper = ['block', boundSetup, simdBlock, blockNode]
   const newLocalDecls = [
     ['local', simdBoundName, 'i32'],

package/src/prepare/index.js

@@ -1051,6 +1051,12 @@ export const GLOBALS = Object.assign(Object.create(null), {
   parseFloat: 'number',
   encodeURIComponent: 'encodeURIComponent',
   decodeURIComponent: 'decodeURIComponent',
+  encodeURI: 'encodeURI',
+  decodeURI: 'decodeURI',
+  atob: 'atob',
+  btoa: 'btoa',
+  crypto: 'crypto',
+  navigator: 'navigator',
   Error: 'Error',
   // Error subclasses: distinct names in JS, but jz doesn't carry typed error
   // info — `throw` accepts any value and stringification goes through the

package/src/static.js

@@ -163,6 +163,37 @@ export function objLiteralSchemaId(expr) {
   return parsed ? ctx.schema.register(parsed.names) : null
 }
 
+/** Canonical content key for an inplace/structInline replace-store site —
+ *  the ','-wrapper around literal props is normalized away between plan and
+ *  emit, so flatten before serializing. Shared by scanInplaceStores (plan),
+ *  analyzeStructInline (eligibility), and the emit arms; lives here so the
+ *  three importers stay acyclic (the self-host resolver rejects cycles). */
+export const inplaceKey = (arrName, lit) => {
+  const props = lit.slice(1)
+  const flat = props.length === 1 && Array.isArray(props[0]) && props[0][0] === ',' ? props[0].slice(1) : props
+  return `${arrName}|${JSON.stringify(flat)}`
+}
+
+/** K schema-ordered field-value AST nodes of an object literal `{S}` — the
+ *  cell-store order for a structInline `.push({S})` / `a[i] = {S}` — or null if
+ *  `lit` is not a plain static-key `{}` literal carrying exactly schema `sid`'s
+ *  fields. Mapped by name into schema order so sites with differing key order
+ *  flatten to the same cell run. */
+export function structLiteralFields(lit, sid) {
+  if (!Array.isArray(lit) || lit[0] !== '{}') return null
+  const parsed = staticObjectProps(lit.slice(1))
+  const schema = ctx.schema.list[sid]
+  if (!parsed || parsed.names.length !== schema.length) return null
+  const byName = new Map()
+  for (let i = 0; i < parsed.names.length; i++) byName.set(parsed.names[i], parsed.values[i])
+  const out = []
+  for (const name of schema) {
+    if (!byName.has(name)) return null
+    out.push(byName.get(name))
+  }
+  return out
+}
+
 /** Resolve schemaId of an expression, given a per-function schemaId map for locals.
  *  Used for both intra-function arr elem-schema observation and func.arrayElemSchema
  *  return inference. Recognizes: object literals, var names with bound schemaId,