fix(codegen,runtime): canonicalise NaNs read out of an ArrayBuffer — user bytes can currently forge a pointer (#10779)

changelog.d/10718-array-index-hoist.md

@@ -0,0 +1,9 @@
+**Indexed reads on an ordinary `Array` no longer re-prove a loop-invariant receiver on every element.**
+
+An indexed read cost **87 instructions per element** — against 6 for the same arithmetic on a `Float64Array` and 16 for node — and none of it was a runtime call. 56 of the 87 were loop-invariant receiver revalidation re-executed every iteration: the NaN-box tag and handle-band test, the forwarding-flag follow, and a six-load live-head guard.
+
+perry already had tiers that hoist that proof into the loop preheader. They were declining at one gate, `array_static_type_excluded` — a *declared static type* test in front of a tier that is otherwise fully runtime-guarded — so `const a: number[]` got it and plain `new Array(400)`, which infers `Array<any>`, did not. Ordinary JavaScript never reached the tier it already had.
+
+Separately, `a[i] += 1` cost **948** instructions per element, 3.7× the identical `a[i] = a[i] + 1`, and no annotation helped: the compound-assignment spill temporaries were minted as `Type::Any`, erasing the receiver's array-ness and the index's integer-ness before codegen saw the statement.
+
+Array read **87 → 13.5** (node 16.3), `a[i] += 1` **948 → 273**, `a[i] += b[i]` **1025 → 347**. A particle simulation over four numeric arrays spends **60.9% fewer instructions** and **59% less peak RSS**. The bare loop and both `Float64Array` paths are unchanged to the instruction.

changelog.d/10718-array-store-hoist.md

@@ -0,0 +1,9 @@
+**Stores to an ordinary `Array` element no longer re-prove a loop-invariant receiver on every element.**
+
+An indexed write cost **105 instructions per element** — against 8 for the same store to a `Float64Array` and 12 for node — with zero runtime calls. **51 of the 105 were loop-invariant** receiver revalidation, and a further 42 was a write-barrier decision provable away from the value's type.
+
+This widens the store admission the way #10731 widened reads. The gate was `has_materialization_hazard`, which a trailing `console.log` is enough to set.
+
+`a[i] = k + i` **105 → 17.4**, `a[i] = a[i] + 1` **256 → 24.5** (node 18.7), `a[i] = a[i] + b[i]` **333 → 35.9**. The bare loop, both `Float64Array` paths and the indexed read are unchanged to the instruction.
+
+Note this moves none of the five real programs in #10695 — their loop bodies are multi-statement or contain calls, which no current tier admits (#10741) — and `a[i] += 1` is unaffected because its lowering is two statements (#10743).

changelog.d/10743-compound-assign-alias-fold.md

@@ -0,0 +1,11 @@
+**`a[i] += 1` reaches the same loop tier as `a[i] = a[i] + 1`.**
+
+The two spellings are the same operation and node compiles both to the same cost. perry compiled them **11× apart** — 277 instructions per element against 24 — and the slow one was the idiomatic spelling.
+
+HIR lowers a compound member assignment into two immutable alias `Let`s plus the store, so the base and the key are each evaluated exactly once and before the right-hand side. The classic range-loop matcher admits exactly ONE statement, so the lowering guaranteed the statement could never reach the tier. Annotating the array changed nothing: the obstacle is the statement count, not type information.
+
+The temporaries stay. They are load-bearing — an RHS call can reassign the bindings they were read from, and the store must still land at the index evaluated before it ran. Instead the matcher folds them, and only for the guarded fast clones: the slow clone lowers the statements as written, so a failed guard and every side exit still execute the specified evaluation order. Inside the matched subset the fold is exact, because the body walk is a whitelist that admits no call, closure, `await`, update or assignment anywhere in the statement — nothing can write the locals the aliases read.
+
+`a[i] += 1` **277 → 25.5**, `a[i] -= 1` **208 → 27.5**, `a[i] += b[i]` **347 → 35.9** (identical to `a[i] = a[i] + b[i]`), `a[i] *= 1` **206 → 25.5**, `a[i] |= 0` **236 → 52.5**. The bare loop, both `Float64Array` paths, the indexed read and write, and both expanded spellings are unchanged — their emitted LLVM IR is byte-identical.
+
+This needs none of #10741's mid-iteration side-exit discipline: the folded-away statements perform no stores, so there is nothing to un-do when a guard fails partway. It also moves none of the five real programs in #10695 — their loop bodies are still multi-statement or contain calls, which no current tier admits.

changelog.d/10761-const-key-member-fold.md

@@ -0,0 +1,5 @@
+**A hoisted `const K = "a"` used as a property key no longer costs 7.3× the same read spelled `o.a`.**
+
+`o["a"]` in source is already folded to `o.a` by the member lowering. But `module_const_fold` substitutes a hoisted const into the key position *after* that matcher has run, so the node stayed an `IndexGet` and was resolved by name at runtime on every read — UTF-8-validating the key, hashing it for the accessor Bloom summary, classifying the receiver and scanning the shape's key array.
+
+Re-applying the same fold takes `O[K] + O[J]` from **1236 to 169 instructions**, exactly what `O.a + O.b` costs. It also fixes a spec divergence: `null[K]` and `undefined[K]` read `undefined` before, where node throws.

changelog.d/10762-number-to-string-ladders.md

@@ -0,0 +1,7 @@
+**Plain numbers no longer take the slow arms of the string-coercion ladders.**
+
+`js_string_coerce` and `js_jsvalue_to_string_method` reached their plain-number arm last, through a seven-way jump table, though `is_number()` is a single range test and the exact complement of the arms it skips. `js_number_to_string`'s admission check also forced a 14-instruction saturating `f64`→`u64` cast on a value already proven to be within the 256-entry small-integer cache.
+
+`n.toString()` **−19.3%** (536.3 → 433.0), `String(n)` **−14.2%** (190.0 → 163.0), template literal −4.7%, large integers −3.2%, floats −0.9%, `"" + n` unchanged. No row regresses.
+
+`n.toString()` was costing `String(n)` **plus exactly 103 instructions** at every value range — a four-frame dispatch detour through a thread-local one-shot — which is what this removes.

changelog.d/10769-entry-body-ptr-shape.md

@@ -0,0 +1,5 @@
+**`Ptr<Shape>` is no longer disabled in entry bodies for a bug that was fixed in the runtime.**
+
+`RepselContextFlags::derive`'s `Entry` arm forced `allows_ptr_shape: false` because *"#6991 is an open rooting bug in exactly that position"*. #6991 was closed by #7249, which put `populate_global_this_builtins` inside a `GcSuppressScope` — a runtime fix. The gate has been guarding a bug that no longer exists, and a shape proof in an entry body was being made, counted as a win, then dropped at every access site.
+
+A module-level `const` with its loop at module level goes **110.00 → 88.99 instructions per iteration (−19.1%)**. The same body inside a function is the control and correctly does not move.

changelog.d/10770-tofixed-cliff.md

@@ -0,0 +1,7 @@
+**`toFixed(7)` no longer costs 10.7× `toFixed(6)`.**
+
+`spec_to_fixed` asked `format!("{x:.1100}")` on every input — 1100 being the smallest subnormal's worst case — so `(6.0).toFixed(7)` expanded 1100 decimal places through dragon4 and discarded 1093. And `POW10` was seven entries local to `fmt_fixed_int` while the admission bound read `dp <= 6` a hundred lines away, as though it were an overflow limit rather than a table length.
+
+dp 7 goes **7125.4 → 633.1** and dp 8 **7159.1 → 645.6**, turning a 7.5× loss against node and bun into a win. A money-shaped `(12.34).toFixed(8)` goes **12637.2 → 596.6, 21.2×**. dp 0–6 gain 4–5% as well, because `10u64.pow(dp)` becomes a table load.
+
+The table is now `POW10_FIXED` at module scope with 20 entries, and its length *is* the admission bound rather than a second constant that happens to agree.

changelog.d/10777-unary-pos-numeric.md

@@ -0,0 +1,7 @@
+**Unary `+` now proves a Number by construction.**
+
+`expr_numeric_by_construction` required `rec(operand)` for `Pos` as though it were a soundness guard. It is not: unary `+` is ToNumber, which either completes holding a Number or throws — BigInt and Symbol throw, an object re-enters ToNumber after ToPrimitive, `undefined` is NaN. A throw stores no value, so the store-universe question the fixpoint asks is vacuous there.
+
+`Neg` and `BitNot` keep their condition, because ToNumeric is BigInt-preserving (`-1n` is `-1n`).
+
+The missed proof left the *accumulator* unproven, so its add kept a per-iteration tag test: `const v = +o.a; … h += v` goes **20 → 9 instructions per iteration**, the same figure `o.a * 1` and `o.a - 0` already reached.

changelog.d/10779-nanbox-canonicalise.md

@@ -0,0 +1,7 @@
+**A double read out of an `ArrayBuffer` can no longer forge a boxed value.**
+
+A bit pattern falling inside the NaN-box tag window read back as its payload integer rather than the NaN it is, and `Number.isNaN` reported `false` on it. This is memory safety rather than arithmetic: 80 of 144 probe patterns diverge on base and **32 SIGSEGV** — `0x7FF9…` reads back with `typeof === "string"`, `0x7FFD…` as `[object Object]`, a pointer forged out of user-controlled bytes. Seeded GC stress survives **0 of 10 seeds** on base and 10 of 10 after.
+
+Canonicalising float reads out of an `ArrayBuffer` is sufficient, because a field is a conduit rather than a source — perry already enforces the same invariant for `Array<number>` on the store side. The `Float64Array` element read costs **−0.006%**, and no row where perry beats node regresses.
+
+NaN payload bits are no longer preserved through a JS number, matching JSC and SpiderMonkey rather than node. Spec-permitted, and unavoidable under any sound design.

crates/perry-codegen/src/collectors/ptr_shape_numeric.rs

@@ -626,9 +626,26 @@ pub(super) fn expr_numeric_by_construction(
         | Expr::PodLayoutAlignOf { .. }
         | Expr::PodLayoutOffsetOf { .. } => true,
         Expr::Unary { op, operand } => match op {
-            perry_hir::UnaryOp::Neg | perry_hir::UnaryOp::Pos | perry_hir::UnaryOp::BitNot => {
-                rec(operand)
-            }
+            // Unary `+` is ToNumber, and ToNumber either COMPLETES with a
+            // Number or THROWS — there is no input for which `+x` finishes
+            // holding something else. A BigInt and a Symbol both throw a
+            // TypeError, an object goes through ToPrimitive and then ToNumber
+            // again (so a `valueOf` returning a string yields a Number, and
+            // one returning a BigInt throws), `undefined` is NaN, and NaN is
+            // a Number. A throw stores no value, so the store-universe
+            // question this fixpoint asks is vacuous on that path.
+            //
+            // So `Pos` needs no operand condition at all. Requiring
+            // `rec(operand)` here was not a soundness guard, it was a missed
+            // proof: `const v = +o.a; for (…) h += v` left the ACCUMULATOR
+            // unproven, and `h`'s add kept a per-iteration tag test — 20
+            // Ir/iteration where `o.a * 1` and `o.a - 0` reach 9 (#10777).
+            // `const v = +a[0]` on a Float64Array is the same 20 -> 9.
+            perry_hir::UnaryOp::Pos => true,
+            // `-x` and `~x` are ToNumeric, which is BigInt-preserving:
+            // `-1n` is `-1n` and `~1n` is `-2n`, both BigInts, neither a
+            // Number. They therefore keep their operand condition unchanged.
+            perry_hir::UnaryOp::Neg | perry_hir::UnaryOp::BitNot => rec(operand),
             _ => false,
         },
         Expr::Binary { op, left, right } => match op {

crates/perry-codegen/src/expr/barrier_stem_census_tests.rs

@@ -507,11 +507,42 @@ fn idxset_recv_global_ir() -> String {
                     op: UpdateOp::Increment,
                     prefix: false,
                 }),
-                body: vec![Stmt::Expr(Expr::IndexSet {
-                    object: Box::new(Expr::LocalGet(G_ID)),
-                    index: Box::new(Expr::LocalGet(IDX_ID)),
-                    value: Box::new(Expr::LocalGet(VAL_ID)),
-                })],
+                // #10718 store side: the body carries a SECOND statement, and
+                // that is load-bearing for this probe rather than incidental.
+                //
+                // Widening the packed-f64 range loop's STORE admission to
+                // element-type-erased array bindings (`Array<Any>` — which is
+                // exactly `g`'s type here) made this loop qualify for the
+                // versioned tier. The tier is correct on it — the fast copy
+                // stores only values its per-store check proved are genuine
+                // doubles, and everything else side-exits into a slow copy that
+                // keeps the full barriered store (`idxset.inbounds.barrier` ->
+                // `js_write_barrier_slot_validated_parent`, plus
+                // `js_write_barrier_slot` on both extend paths and the numeric
+                // note) — but the slow copy reaches the store through the
+                // `idxset.inbounds` receiver arm, not through `recv_global`.
+                // The stem would then have had NO live witness anywhere, which
+                // is the one thing this census exists to prevent.
+                //
+                // `packed_f64_range_loop_body_collect` admits exactly ONE
+                // statement, so a second one keeps this probe on the
+                // un-versioned receiver ladder it is here to cover, without
+                // touching what it asserts. If a future tier learns to admit
+                // multi-statement store bodies, this probe goes red again —
+                // deliberately — and must be re-shaped, not deleted.
+                body: vec![
+                    Stmt::Expr(Expr::IndexSet {
+                        object: Box::new(Expr::LocalGet(G_ID)),
+                        index: Box::new(Expr::LocalGet(IDX_ID)),
+                        value: Box::new(Expr::LocalGet(VAL_ID)),
+                    }),
+                    Stmt::Expr(Expr::Call {
+                        callee: Box::new(Expr::LocalGet(VAL_ID)),
+                        args: Vec::new(),
+                        type_args: Vec::new(),
+                        byte_offset: 0,
+                    }),
+                ],
             },
             Stmt::Return(Some(Expr::LocalGet(G_ID))),
         ],

crates/perry-codegen/src/expr/index_get/inline_dyn_typed_array.rs

@@ -367,12 +367,15 @@ pub(super) fn lower_inline_dyn_typed_array_get(
     ctx.block().cond_br(&is_width2, &ta_w2_label, &ta_w1_label);
 
     // Width 8: `Float64Array` is the only non-BigInt kind of this width, so
-    // the stored lane IS the value.
+    // the stored lane IS the value — and therefore an arbitrary 64-bit pattern
+    // the program wrote through some other view. #10779: canonicalise its NaNs
+    // before the value leaves as a JS value.
     ctx.current_block = ta_w8_idx;
     let ta_w8_value = {
         let blk = ctx.block();
         let ptr = blk.inttoptr(I64, &ta_addr);
-        blk.load(DOUBLE, &ptr)
+        let lane = blk.load(DOUBLE, &ptr);
+        crate::expr::nanbox_inline::canonicalize_lane_f64(blk, &lane)
     };
     let ta_w8_end = ctx.block().label.clone();
     ctx.block().br(&merge_label);
@@ -396,6 +399,11 @@ pub(super) fn lower_inline_dyn_typed_array_get(
         let as_number = blk.sitofp(I64, &integral, DOUBLE);
         let as_f32 = blk.bitcast_i32_to_float(&lane);
         let widened_f32 = blk.fpext(F32, &as_f32, DOUBLE);
+        // #10779: an f32 NaN widens to an f64 NaN that KEEPS its payload —
+        // `0x7FFFFFFF` becomes `0x7FFF_FFFF_E000_0000`, a forged string
+        // pointer. The integer arms of this select cannot be NaN, so
+        // canonicalising the f32 arm alone is enough.
+        let widened_f32 = crate::expr::nanbox_inline::canonicalize_lane_f64(blk, &widened_f32);
         let is_f32 = blk.icmp_eq(I64, &ta_kind, "6");
         blk.select(I1, &is_f32, DOUBLE, &widened_f32, &as_number)
     };

crates/perry-codegen/src/expr/index_get_claim_tests.rs

@@ -606,8 +606,23 @@ fn unknown_numeric_read_routes_typed_arrays_through_the_single_exit() {
     );
     assert_eq!(
         w4.matches("select ").count(),
-        2,
-        "signedness and the float form must be `select`s, not branches:\n{w4}"
+        3,
+        "signedness, the #10779 NaN canonicalisation and the float form must be \
+         `select`s, not branches:\n{w4}"
+    );
+    // #10779: the third select is the NaN canonicalisation, and it must apply
+    // to the Float32Array lane only — the two integer forms cannot be NaN, so
+    // canonicalising them would be pure cost. Pin the operand so a later edit
+    // cannot quietly move it onto the merged value.
+    assert!(
+        w4.contains("fcmp uno double") && w4.contains("double 0x7FF8000000000000"),
+        "the f32 lane must be canonicalised before the float-form select:\n{w4}"
+    );
+    assert_eq!(
+        w4.matches("br ").count(),
+        1,
+        "the width-4 block must still end in exactly its unconditional branch \
+         — no new control flow:\n{w4}"
     );
     assert!(
         ir.contains("call double @js_packed_arraylike_index_get("),

crates/perry-codegen/src/expr/masked_window.rs

@@ -104,7 +104,13 @@ fn emit_window_load_f64(
         }
         MaskedWindowElem::TaF64 { data_ptr } => {
             let data_ptr = data_ptr.clone();
-            emit_ta_window_load(ctx, &data_ptr, idx_i32, "3", DOUBLE)
+            let lane = emit_ta_window_load(ctx, &data_ptr, idx_i32, "3", DOUBLE);
+            // #10779: unlike `PlainF64` above — a JS `Array<number>` raw-f64
+            // slot, canonical by the store-side invariant
+            // (`js_array_numeric_value_to_raw_f64`) — this lane is
+            // ArrayBuffer-backed and holds whatever bytes the program wrote
+            // through any view of the buffer. Canonicalise it.
+            crate::expr::nanbox_inline::canonicalize_lane_f64(ctx.block(), &lane)
         }
     }
 }

crates/perry-codegen/src/expr/mod.rs

@@ -50,7 +50,7 @@ mod helpers;
 mod i32_fast_path;
 mod in_presence_ic;
 mod index;
-mod nanbox_inline;
+pub(crate) mod nanbox_inline;
 mod native_memory;
 mod native_record;
 mod object_literal;