perf(codegen): version stable packed array loops

[proggeramlug]

Lands #8719 with its soundness blocker fixed.

The bug was not where the IR first suggested

The symptom I reported was an unguarded fptosi + xor i32 consuming a phi that merged a proven number (the string arm of a guarded charCodeAt) with an arbitrary user method's result (the generic arm) — so an any receiver returning a BigInt yields garbage where the spec requires BigInt xor or a TypeError. I attributed that to binary.rs mishandling the join. That was wrong, and worth recording because the correct diagnosis is more useful:

The cause is one lever in expr/literals_vars.rs. The PR's new explicit_numeric_toint32 disjunct bypasses can_lower_expr_as_i32_in_current_region — which correctly answers false for (h ^ recv.charCodeAt(i)) | 0, since a Call with a PropertyGet callee is not an i32-chain leaf. It then calls into the lower_expr_as_i32 family without its documented precondition ("Must be called only after can_lower_expr_as_i32 returned true for the same expression"). lower_expr_native_i32's i32-chain arm recurses structurally and fptosis every operand it cannot lower natively.

So binary.rs — which already applies is_provably_not_bigint per operand — was bypassed entirely rather than getting the join wrong.

The predicate itself is fine and stays: expr_produces_canonical_raw_f64 is a claim about the value the ordinary lowering produces, not a licence to re-evaluate its operands natively. The bug was consuming a value-level claim as an evaluation-strategy licence.

The fix, and why not the alternative

let v_i32 = if structurally_i32 {
    lower_expr_as_i32(ctx, value)?
} else {
    let d = lower_expr(ctx, value)?;
    ctx.block().toint32_fast(&d)
};

An unproven tree keeps js_dynamic_bitxor; a proven one still gets the inline xor i32. The conversion is free — x | 0 always lowers to sitofp i32 → double, so the round trip folds — and the i32-slot store the lever exists for is preserved, making this a strict improvement over main, which took neither branch here.

House precedent settles the alternative of sinking arithmetic into the arms: lower_guarded_numeric_add's doc block (the #7773 fix) records that it was already tried and is worse — per-node diamonds make the outer add consume a phi LLVM cannot prove canonical, so the cold arm stays live in the loop; that shape went 86 ms → 119 ms.

Emitted IR after the fix

anystr.merge.7:
  %r29 = phi double [ %r22, %anystr.string.5 ], [ %r28, %anystr.generic.6 ]
  %r30 = call double @js_dynamic_bitxor(double %r12, double %r29)   ; BigInt-aware
  %r31 = call i32 @llvm.aarch64.fjcvtzs(double %r30)                ; ToInt32 of `| 0`
  store i32 %r37, ptr %r2                                           ; i32 slot preserved

A proven receiver still gets cca.fast, the inline load i8, and xor i32 with no dynamic helper.

Validation (on the merged result, against current main e2eee4048)

• All 30 lint-job checkers pass
• Negative control unmodified — type_analysis/numeric/tests.rs blob hash is byte-identical to main (86b697d489c8), and all three char_code_at_* tests pass, so the fast path still fires for proven receivers rather than the optimization being disabled
• perry-codegen --lib: 1229 passed, 0 failed (+3 = the PR's new tests)
• perry-runtime --lib (RUST_TEST_THREADS=1): 2671 passed, 0 failed (+2)
• perry-transform --lib 93/0, perry-hir --lib 334/0
• Squashed tree verified identical to the validated tree

Two caveats, stated rather than smoothed over

1. One intermittent suite failure I could not reproduce. An early --tests sweep showed typed_array_rmw_8692 at 8/9. It then passed 9/9 six times standalone, once single-threaded, and the full sweep passed three consecutive times with zero failing suites — and it passes 9/9 on clean main. I believe it is flaky (that suite manipulates a process-global artifact env), not a regression here, but I am recording it rather than dropping it.
2. The end-to-end acceptance test was not run. crates/perry/tests/issue_8690_loop_versioned_arraylike.rs needs the full compiler plus the -static wrappers; disk was contended for much of this session. The IR-level evidence above is what backs the fix.

Summary by CodeRabbit

• Performance

  • Improved counted-loop performance for packed arrays and eligible array subclasses through optimized fast paths.
  • Added faster indexed reads and checked-reader method execution while preserving safe fallback behavior.

• Bug Fixes

  • Preserved correct TypeError behavior when applying integer coercion to BigInt values.
  • Improved invalidation of numeric optimizations after array mutations, prototype changes, descriptor updates, exceptions, or proxy activity.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0e92edf6-8bf6-42c0-b553-7bebdf5203e0

📥 Commits

Reviewing files that changed from the base of the PR and between e2eee40 and 05602bd.

📒 Files selected for processing (48)

• changelog.d/8690-loop-versioned-packed-arraylike.md
• crates/perry-codegen/src/codegen/artifacts.rs
• crates/perry-codegen/src/codegen/closure.rs
• crates/perry-codegen/src/codegen/entry.rs
• crates/perry-codegen/src/codegen/function.rs
• crates/perry-codegen/src/codegen/helpers.rs
• crates/perry-codegen/src/codegen/index_method_clone_tests.rs
• crates/perry-codegen/src/codegen/indexed_method_artifacts.rs
• crates/perry-codegen/src/codegen/method.rs
• crates/perry-codegen/src/codegen/mod.rs
• crates/perry-codegen/src/codegen/typed_abi.rs
• crates/perry-codegen/src/collectors/proven_this_routing_tests.rs
• crates/perry-codegen/src/expr/binary.rs
• crates/perry-codegen/src/expr/class_field_barrier_tests.rs
• crates/perry-codegen/src/expr/class_field_inline_guard.rs
• crates/perry-codegen/src/expr/i32_fast_path.rs
• crates/perry-codegen/src/expr/index_get.rs
• crates/perry-codegen/src/expr/index_get/guarded_array.rs
• crates/perry-codegen/src/expr/literals_vars.rs
• crates/perry-codegen/src/expr/mod.rs
• crates/perry-codegen/src/expr/proxy_reflect.rs
• crates/perry-codegen/src/lower_call/method_override.rs
• crates/perry-codegen/src/lower_call/mod.rs
• crates/perry-codegen/src/lower_call/property_get/dynamic_dispatch.rs
• crates/perry-codegen/src/runtime_decls/strings.rs
• crates/perry-codegen/src/stmt/if_stmt.rs
• crates/perry-codegen/src/stmt/let_stmt.rs
• crates/perry-codegen/src/stmt/let_stmt_facts.rs
• crates/perry-codegen/src/stmt/loops.rs
• crates/perry-codegen/src/stmt/mod.rs
• crates/perry-codegen/src/stmt/stable_packed_loop.rs
• crates/perry-codegen/src/stmt/versioned_indexed_loop.rs
• crates/perry-codegen/src/type_analysis/numeric.rs
• crates/perry-codegen/src/type_analysis/pod.rs
• crates/perry-runtime/src/array/mod.rs
• crates/perry-runtime/src/array/subclass.rs
• crates/perry-runtime/src/array/subclass_tests.rs
• crates/perry-runtime/src/gc/layout.rs
• crates/perry-runtime/src/gc/types.rs
• crates/perry-runtime/src/object/mod.rs
• crates/perry-runtime/src/object/polymorphic_index.rs
• crates/perry-runtime/src/object/spill.rs
• crates/perry-runtime/src/proxy.rs
• crates/perry-runtime/src/typed_feedback/guards.rs
• crates/perry-runtime/src/typed_feedback/tests.rs
• crates/perry/tests/issue_8655_array_subclass_indexing.rs
• crates/perry/tests/issue_8690_loop_versioned_arraylike.rs
• scripts/shape_descriptor_census_baseline.json

---

📝 Walkthrough

Walkthrough

This PR adds versioned lowering for indexed and stable packed arraylike loops, emits fast indexed-method clones, adds runtime packed-arraylike guards and numeric-proof invalidation, updates related guard masks and tests, and fixes x | 0 i32 lowering to preserve BigInt TypeError behavior.

Changes

Loop versioning and packed arraylike support

Layer / File(s)	Summary
Loop facts and lowering pipeline crates/perry-codegen/src/expr/mod.rs, crates/perry-codegen/src/codegen/{closure.rs,entry.rs,function.rs,method.rs}, crates/perry-codegen/src/stmt/{mod.rs,let_stmt.rs,let_stmt_facts.rs,loops.rs,if_stmt.rs}, crates/perry-codegen/src/stmt/versioned_indexed_loop.rs	FnCtx now tracks array-length snapshots, trusted array handles, and loop facts. for lowering now tries versioned indexed loops, emits per-iteration guards, and adjusts bound and safepoint handling for fast clones.
Fast indexed method clone generation crates/perry-codegen/src/codegen/{artifacts.rs,indexed_method_artifacts.rs,method.rs,mod.rs,typed_abi.rs,helpers.rs}, crates/perry-codegen/src/lower_call/property_get/dynamic_dispatch.rs, crates/perry-codegen/src/codegen/index_method_clone_tests.rs	Code generation now emits guarded indexed-method clones and optional fast-array-handle clones for eligible checked readers. Dynamic dispatch uses live loop handles to call those clones. Tests verify clone IR and fast/slow loop paths.
Stable packed loop lowering and numeric reads crates/perry-codegen/src/stmt/stable_packed_loop.rs, crates/perry-codegen/src/expr/{index_get.rs,index_get/guarded_array.rs,binary.rs,i32_fast_path.rs}, crates/perry-codegen/src/type_analysis/{numeric.rs,pod.rs}, crates/perry-codegen/src/runtime_decls/strings.rs, crates/perry/tests/{issue_8655_array_subclass_indexing.rs,issue_8690_loop_versioned_arraylike.rs}, changelog.d/8690-loop-versioned-packed-arraylike.md, scripts/shape_descriptor_census_baseline.json	Adds stable packed counted-loop admission, fast and generic paths, direct indexed loads, and numeric index facts for expression lowering and type analysis. Regression tests check IR structure, runtime behavior, and native-region metadata.
Runtime proof guard and invalidation crates/perry-runtime/src/array/{mod.rs,subclass.rs,subclass_tests.rs}, crates/perry-runtime/src/{gc/layout.rs,gc/types.rs,object/mod.rs,object/polymorphic_index.rs,object/spill.rs,proxy.rs,typed_feedback/{guards.rs,tests.rs}}, crates/perry-codegen/src/{expr/class_field_inline_guard.rs,expr/class_field_barrier_tests.rs,expr/proxy_reflect.rs,lower_call/method_override.rs,lower_call/mod.rs,collectors/proven_this_routing_tests.rs}	The runtime adds packed numeric-proof metadata and js_packed_arraylike_loop_guard, clears proof state on indexed, spill, and field writes, and rejects proof-marked receivers in write and method guards. Tests update masks and proof-retirement behavior.
BitOr-toint32 lowering fix crates/perry-codegen/src/expr/literals_vars.rs, changelog.d/8690-loop-versioned-packed-arraylike.md	Canonical BitOr(..., 0) now lowers through the general expression path before toint32_fast. This keeps operand-level BigInt checks and preserves runtime TypeError behavior.

Estimated code review effort: 5 (Critical) | ~120 minutes

Sequence Diagram(s)

sequenceDiagram
  participant lower_for
  participant stable_packed_loop
  participant js_packed_arraylike_loop_guard
  participant generic_loop
  lower_for->>stable_packed_loop: try lower(...)
  stable_packed_loop->>js_packed_arraylike_loop_guard: validate receiver and bound
  js_packed_arraylike_loop_guard-->>stable_packed_loop: metadata or reject
  stable_packed_loop->>stable_packed_loop: emit fast clone when admitted
  stable_packed_loop->>generic_loop: enter generic path on reject or side exit

Loading

Possibly related PRs

• PerryTS/perry#6061: Both PRs add loop-versioning lowering with fast and slow paths and extend loop-fact tracking in code generation.

Suggested reviewers: thehypnoo, jdalton

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch merge/b35

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}