perf(codegen): hoist the loop-invariant receiver proof for array element stores — 105 to 17.4 instructions (#10718)

changelog.d/10718-array-index-hoist.md

@@ -0,0 +1,9 @@
+**Indexed reads on an ordinary `Array` no longer re-prove a loop-invariant receiver on every element.**
+
+An indexed read cost **87 instructions per element** — against 6 for the same arithmetic on a `Float64Array` and 16 for node — and none of it was a runtime call. 56 of the 87 were loop-invariant receiver revalidation re-executed every iteration: the NaN-box tag and handle-band test, the forwarding-flag follow, and a six-load live-head guard.
+
+perry already had tiers that hoist that proof into the loop preheader. They were declining at one gate, `array_static_type_excluded` — a *declared static type* test in front of a tier that is otherwise fully runtime-guarded — so `const a: number[]` got it and plain `new Array(400)`, which infers `Array<any>`, did not. Ordinary JavaScript never reached the tier it already had.
+
+Separately, `a[i] += 1` cost **948** instructions per element, 3.7× the identical `a[i] = a[i] + 1`, and no annotation helped: the compound-assignment spill temporaries were minted as `Type::Any`, erasing the receiver's array-ness and the index's integer-ness before codegen saw the statement.
+
+Array read **87 → 13.5** (node 16.3), `a[i] += 1` **948 → 273**, `a[i] += b[i]` **1025 → 347**. A particle simulation over four numeric arrays spends **60.9% fewer instructions** and **59% less peak RSS**. The bare loop and both `Float64Array` paths are unchanged to the instruction.

changelog.d/10718-array-store-hoist.md

@@ -0,0 +1,9 @@
+**Stores to an ordinary `Array` element no longer re-prove a loop-invariant receiver on every element.**
+
+An indexed write cost **105 instructions per element** — against 8 for the same store to a `Float64Array` and 12 for node — with zero runtime calls. **51 of the 105 were loop-invariant** receiver revalidation, and a further 42 was a write-barrier decision provable away from the value's type.
+
+This widens the store admission the way #10731 widened reads. The gate was `has_materialization_hazard`, which a trailing `console.log` is enough to set.
+
+`a[i] = k + i` **105 → 17.4**, `a[i] = a[i] + 1` **256 → 24.5** (node 18.7), `a[i] = a[i] + b[i]` **333 → 35.9**. The bare loop, both `Float64Array` paths and the indexed read are unchanged to the instruction.
+
+Note this moves none of the five real programs in #10695 — their loop bodies are multi-statement or contain calls, which no current tier admits (#10741) — and `a[i] += 1` is unaffected because its lowering is two statements (#10743).

crates/perry-codegen/src/expr/barrier_stem_census_tests.rs

@@ -507,11 +507,42 @@ fn idxset_recv_global_ir() -> String {
                     op: UpdateOp::Increment,
                     prefix: false,
                 }),
-                body: vec![Stmt::Expr(Expr::IndexSet {
-                    object: Box::new(Expr::LocalGet(G_ID)),
-                    index: Box::new(Expr::LocalGet(IDX_ID)),
-                    value: Box::new(Expr::LocalGet(VAL_ID)),
-                })],
+                // #10718 store side: the body carries a SECOND statement, and
+                // that is load-bearing for this probe rather than incidental.
+                //
+                // Widening the packed-f64 range loop's STORE admission to
+                // element-type-erased array bindings (`Array<Any>` — which is
+                // exactly `g`'s type here) made this loop qualify for the
+                // versioned tier. The tier is correct on it — the fast copy
+                // stores only values its per-store check proved are genuine
+                // doubles, and everything else side-exits into a slow copy that
+                // keeps the full barriered store (`idxset.inbounds.barrier` ->
+                // `js_write_barrier_slot_validated_parent`, plus
+                // `js_write_barrier_slot` on both extend paths and the numeric
+                // note) — but the slow copy reaches the store through the
+                // `idxset.inbounds` receiver arm, not through `recv_global`.
+                // The stem would then have had NO live witness anywhere, which
+                // is the one thing this census exists to prevent.
+                //
+                // `packed_f64_range_loop_body_collect` admits exactly ONE
+                // statement, so a second one keeps this probe on the
+                // un-versioned receiver ladder it is here to cover, without
+                // touching what it asserts. If a future tier learns to admit
+                // multi-statement store bodies, this probe goes red again —
+                // deliberately — and must be re-shaped, not deleted.
+                body: vec![
+                    Stmt::Expr(Expr::IndexSet {
+                        object: Box::new(Expr::LocalGet(G_ID)),
+                        index: Box::new(Expr::LocalGet(IDX_ID)),
+                        value: Box::new(Expr::LocalGet(VAL_ID)),
+                    }),
+                    Stmt::Expr(Expr::Call {
+                        callee: Box::new(Expr::LocalGet(VAL_ID)),
+                        args: Vec::new(),
+                        type_args: Vec::new(),
+                        byte_offset: 0,
+                    }),
+                ],
             },
             Stmt::Return(Some(Expr::LocalGet(G_ID))),
         ],

crates/perry-codegen/src/stmt/loops.rs

@@ -1823,7 +1823,9 @@ fn match_packed_f64_range_loop(
                 {
                     return range_loop_reject("dense_written_not_addressable");
                 }
-            } else if !packed_loop_array_binding_is_eligible(ctx, arr_id) {
+            } else if !packed_loop_array_binding_is_eligible(ctx, arr_id)
+                && !written_untyped_binding_is_guardable(ctx, arr_id)
+            {
                 return range_loop_reject("written_binding_not_eligible");
             }
         } else if !packed_loop_array_binding_storage_is_addressable(ctx, arr_id)
@@ -1878,26 +1880,38 @@ fn match_packed_f64_range_loop(
             // every loop entry, so those static facts are not load-bearing
             // here; a wrong hint is one failed guard -> slow loop. Classic
             // (side-exiting, hole-tolerant) written arrays keep the full set.
-            if !local_allows_packed_f64_loop_store(ctx, arr_id) {
+            // #10718 store side: the two remaining tests below are DECLARED
+            // STATIC TYPE / static fact-graph tests standing in front of a
+            // tier whose every correctness obligation is discharged at
+            // runtime. `written_untyped_binding_is_guardable` admits the
+            // ordinary untyped-JavaScript array binding alongside them — see
+            // that function for why the guard, not the hint, is what holds.
+            let untyped_guardable = written_untyped_binding_is_guardable(ctx, arr_id);
+            if !local_allows_packed_f64_loop_store(ctx, arr_id) && !untyped_guardable {
                 return range_loop_reject("store_local_not_allowed");
             }
             if !dense
                 && !ctx
                     .native_facts
                     .packed_f64_eligible_for_guarded_store(arr_id)
+                && !untyped_guardable
             {
                 return range_loop_reject("store_not_fact_eligible");
             }
         } else if !local_is_number_array(ctx, arr_id)
-            && !(dense && local_is_untyped_candidate(ctx, arr_id))
+            && !local_is_guardable_untyped_array(ctx, arr_id)
         {
-            // #6750 follow-up: read-only DENSE accesses also admit bindings
-            // with no usable static type (`any` function parameters — the
-            // bcryptjs S-box shape). The entry guards/probes re-validate the
-            // ACTUAL runtime value, so a wrong hint costs one failed guard →
-            // slow loop, never correctness. Known non-array static types stay
-            // excluded so ordinary object/string index loops don't grow dead
-            // guard chains.
+            // #6750 follow-up: read-only accesses also admit bindings with no
+            // usable static ELEMENT type — an `any` parameter (the bcryptjs
+            // S-box shape) and, since #10718, the ordinary untyped-JavaScript
+            // `const a = new Array(n)` / `const a = []` binding, whose element
+            // type erases to `any`. The entry guards/probes re-validate the
+            // ACTUAL runtime value — plain-array shape, descriptors, prototype
+            // pollution, frozen/sealed, the whole index window, and raw-f64
+            // (hole-tolerant) packedness — so a wrong hint costs one failed
+            // guard → slow loop, never correctness. Known non-array and
+            // known-non-numeric static types stay excluded so ordinary
+            // object/string index loops don't grow dead guard chains.
             return range_loop_reject("array_static_type_excluded");
         }
     }
@@ -5968,6 +5982,126 @@ pub(super) fn local_is_untyped_candidate(ctx: &FnCtx<'_>, local_id: u32) -> bool
     )
 }
 
+/// #10718: a READ-only range-loop receiver whose static type carries no usable
+/// element proof, but which is not known to be a non-array or a non-numeric
+/// array.
+///
+/// Two shapes qualify, and the difference matters:
+///
+/// * [`local_is_untyped_candidate`] — no stable type proof at all, or
+///   `any`/`unknown`. This is #6750's population (an `any` parameter).
+/// * an ARRAY binding whose element type erases to `any`/`unknown`. This is
+///   what `const a = new Array(n)`, `const a = []` and every untyped
+///   JavaScript array infer, and it was the gate that kept ordinary JS off
+///   every hoisted element tier: annotating the identical program
+///   `const a: number[] = new Array(n)` cost 13.4 instructions per element
+///   against 87 for the same source without the annotation (#10718).
+///
+/// Admitting these is a hint, never a claim: `packed_f64_array_loop_range_guard`
+/// re-proves plain-array shape, forwarding, index descriptors, `Array.prototype`
+/// / `Object.prototype` index pollution, a recorded custom array prototype,
+/// frozen / sealed / non-extensible flags, the capacity/length sanity bounds,
+/// the whole index window against the LIVE length, and raw-f64-or-holes
+/// packedness of every slot, at every loop entry — and the matched body admits
+/// no call, closure or await, so nothing can invalidate that between the guard
+/// and the last iteration. A receiver that is not what the hint suggested fails
+/// the guard and runs the unchanged slow loop.
+///
+/// A declared non-numeric array (`string[]`, `Foo[]`) and every known non-array
+/// type stay excluded: their guard would be dead weight on every loop entry.
+fn local_is_guardable_untyped_array(ctx: &FnCtx<'_>, local_id: u32) -> bool {
+    local_is_untyped_candidate(ctx, local_id)
+        || local_array_binding_element_type_is_erased(ctx, local_id)
+}
+
+/// True when the binding's type says "an Array" but says nothing usable about
+/// its ELEMENT type.
+///
+/// `const a = new Array(n)` records `Generic { base: "Array", type_args: [] }`
+/// — an `Array` with no type argument, i.e. `Array<any>`. `[]`, `any[]`,
+/// `unknown[]`, `Array<any>` and `Array<unknown>` land here too. These are the
+/// ordinary untyped-JavaScript array bindings; before #10718 every one of them
+/// missed the hoisted element tiers, which is why `const a = new Array(400)`
+/// cost 87 instructions per element and `const a: number[] = new Array(400)`
+/// cost 13.4 on the identical program.
+///
+/// This reads `local_type_hint` rather than `stable_local_type_proof` on
+/// purpose, and the read is a DISPATCH HINT ONLY: it selects which loops are
+/// offered to the range tier, and every offered loop is admitted by
+/// `js_typed_feedback_packed_f64_range_loop_guard`, which re-proves the live
+/// receiver at loop entry (see [`local_is_guardable_untyped_array`]). A stale
+/// or reassigned binding therefore fails the guard and runs the unchanged slow
+/// loop; it can never produce a wrong element value.
+fn element_type_is_erased(ty: &perry_hir::types::Type) -> bool {
+    matches!(
+        ty,
+        perry_hir::types::Type::Any | perry_hir::types::Type::Unknown
+    )
+}
+
+fn local_array_binding_element_type_is_erased(ctx: &FnCtx<'_>, local_id: u32) -> bool {
+    match ctx.local_type_hint(&local_id) {
+        Some(perry_hir::types::Type::Array(elem)) => element_type_is_erased(elem.as_ref()),
+        Some(perry_hir::types::Type::Generic { base, type_args }) if base == "Array" => {
+            type_args.is_empty() || (type_args.len() == 1 && element_type_is_erased(&type_args[0]))
+        }
+        _ => false,
+    }
+}
+
+/// #10718 store side: may a WRITTEN range-loop receiver be admitted on the
+/// strength of the loop-entry guard alone, with no declared element type and
+/// no static fact-graph claim?
+///
+/// #10731 widened the READ admission to ordinary untyped JavaScript arrays and
+/// took `Array` element reads from 87 instructions to 13.5. It deliberately
+/// left the STORE side alone, because a raw slot store on an unproven element
+/// type pulls in frozen/sealed, the write barrier and the pointer-free layout
+/// note. Every one of those is discharged, and none of them by a static hint:
+///
+/// * **frozen / sealed / non-extensible** — `packed_f64_array_loop_range_guard`
+///   reads `OBJ_FLAG_FROZEN | OBJ_FLAG_SEALED | OBJ_FLAG_NO_EXTEND` off the GC
+///   header at every loop entry and declines. A store that must be ignored in
+///   sloppy mode or throw in strict mode therefore never reaches the fast copy
+///   at all; it runs the unchanged generic store in the slow loop.
+/// * **index accessors / `defineProperty` descriptors** — the same guard
+///   declines on `OBJ_FLAG_ARRAY_DESCRIPTORS`.
+/// * **a setter on `Array.prototype` / `Object.prototype`, or a recorded custom
+///   array prototype** — declined by the three prototype-pollution flags in
+///   `plain_array_index_guard`. This is what makes a store INTO A HOLE safe:
+///   with no inherited index property, defining the element on an in-bounds
+///   index is exactly what `[[Set]]` does.
+/// * **the write barrier** — the fast store writes a value the per-store check
+///   proved is a genuine double. A double carries no heap edge, so there is no
+///   edge for the barrier to record. A NaN-boxed non-double side-exits to the
+///   slow loop BEFORE the store, where the generic path runs barrier and all.
+/// * **the pointer-free layout note** — the guard proved every slot in the
+///   window is raw f64 or `TAG_HOLE`, and the fast store only ever writes a
+///   double, so the array's numeric layout is an invariant of the fast copy
+///   rather than something a note must maintain.
+/// * **growing through the store, and out-of-bounds** — the guard proves the
+///   loop's whole static index window against the LIVE `length`, so no admitted
+///   index is `>= length` and the fast copy can never need to extend.
+/// * **a proxied / subclassed / `arguments`-like receiver** — `GC_TYPE_ARRAY`
+///   plus the forwarding-flag test in `plain_array_index_guard`; a Proxy is not
+///   a `GC_TYPE_ARRAY` head.
+/// * **anything changing mid-loop** — the matched body admits no call, closure
+///   or await, so no user code can run between the guard and the last
+///   iteration to freeze, seal, `defineProperty` or pollute a prototype.
+///
+/// So the binding test that remains is a DISPATCH HINT: which loops are worth
+/// offering the guard. Being wrong costs one failed guard and the unchanged
+/// slow loop, never a wrong store. What it must still enforce is the two
+/// STORAGE facts the guard cannot see — the binding is read by a plain load
+/// (not a closure cell or box) and has not been scalar-replaced — because
+/// those decide whether the emitted code is looking at the array the guard
+/// validated.
+fn written_untyped_binding_is_guardable(ctx: &FnCtx<'_>, local_id: u32) -> bool {
+    local_is_guardable_untyped_array(ctx, local_id)
+        && packed_loop_array_binding_storage_is_addressable(ctx, local_id)
+        && !ctx.scalar_replaced_arrays.contains_key(&local_id)
+}
+
 fn local_allows_packed_f64_loop_store(ctx: &FnCtx<'_>, local_id: u32) -> bool {
     matches!(
         local_array_element_type(ctx, local_id),